c-linkage

That's crazy to me. At this point, I don't even know if the git commit log would be useful to me as a human.

Maybe it's just me, but I like to be able to do both incremental testing and integration testing as I develop. This means I would start with the lexer and parser and get them tested (separately and together) before moving on to generating and validating IR.

It looks like the AI is dumping an entire compiler in one commit. I'm not even sure where I would begin to look if I were doing a bug hunt.

YMMV. I've been a solo developer for too many years. Not that I avoided working on a team, but my teams have been so small that everything gets siloed pretty quickly. Maybe life is different when more than one person works on the same application.

The problem is that convenience trumps everything.

  - It is convenient to use Facebook to chat with family
  - It is convenient to use credit cards to pay the local shop
  - It is convenient to use Netflix to watch movies
  - It is convenient to pay a (lower) monthly fee than a (higher) purchase price for MS products
  - It is convenient to have Apple / Google take care of email
  - It is convenient to use Uber instead of a taxi

The golden cage of convenience is why nothing will change in the US -- we prize convenience above all else.

It's pretty clear that the security models designed into operating systems never considered networked systems. Given that most operating systems were designed and deployed before the internet, this should not be a surprise.

Although one might consider it surprising that OS developers have not updated security models for this new reality, I would argue that no one wants to throw away their models due to 1) backward compatibility; and 2) the amount of work it would take to develop and market an entirely new operating system that is fully network aware.

Yes we have containers and VMs, but these are just kludges on top of existing systems to handle networks and tainted (in the Perl sense) data.

Some more testing reveals that it's uBlock Origin causing the problem. Disabling the plug-in for the site means Firefox no longer displays an error.

We focus on negative outcomes because that relates directly to survival. Our brains are wired for it. Talking about negative outcomes means we learn about them and have a better chance of avoiding them. Plus, the fear response is much stronger and lasts longer than the happy / joy response.

Note that for humans and other social animals "survival" doesn't always mean life or death -- it can mean being included or excluded from a social group which indirectly affects survival chances.

English for Speakers of other Languages

OT: Is Cloudflare breaking the internet again?

This is the third link off the HN Front Page that yields the following error in Firefox:

Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for philippdubach.com. The certificate is only valid for the following names: cloudflare-ech.com, *.cloudflare-ech.com

Error code: SSL_ERROR_BAD_CERT_DOMAIN

This seems like a tragedy of the commons -- GitHub is free after all, and it has all of these great properties, so why not? -- but this kind of decision making occurs whenever externalities are present.

My favorite hill to die on (externality) is user time. Most software houses spend so much time focusing on how expensive engineering time is that they neglect user time. Software houses optimize for feature delivery and not user interaction time. Yet if I spent one hour making my app one second faster for my million users, I can save 277 user hour per year. But since user hours are an externality, such optimization never gets done.

Externalities lead to users downloading extra gigabytes of data (wasted time) and waiting for software, all of which is waste that the developer isn't responsible for and doesn't care about.

Too late. Its those with money versus those without money. And those without don't count.

And if you work for a living, you don't have money.

Yeah, but where are the performance numbers? :D

Usually a root-cause analysis asks for five why's so your analysis seems a bit short.

One should ask why it is that housing / land is more profitable than those investments in which banks and private equity previously invested. And then when you follow that line of reasoning (too much capital and credit -- thanks quantitative easing! -- poor performance on bonds due to low interest rates and restrictions on the quality of investment vehicles) and you'll see that the root cause is probably more financial rather than _just_ too little housing.

Debts need to be cleared, losses need to be accepted, and leverage unwound. Building more housing just gives banks and private equity more stuff to buy.

Only the right kind of people can hear that dog whistle.

The Mythical Man-Month calls for a single person to be responsible for the design of a system. Steve Jobs was that guy for Apple. But once he left, there was no one strong enough to define the system across the whole company.

Always has been.

I was going to say that this is how genetic algorithms work, but there is still too much human in the loop.

Maybe code husbandry?

Engineering practices are written in blood. No one bleeds from software bugs (excluding things like Therac 25 which is classified as a medical device) so programmers will never be engineers.

I've often said security doesn't matter anymore. There are no consequences for a security breach. With companies claiming "hey, we followed best practices!" and transferring liability to third parties like Crowdstrike I'm not even sure how one could even prosecute (in the US).

That would make leasing the better option because at the end of the lease the leaser has to take them card back....no worry about selling something on one wants to buy.

Facebook could also pay a subsidiary to fraudulently click on the ads.

While this might sound extreme and paranoid, this is exactly the kind of thing corporations do to transfer risk and create plausible deniability.

Credit spends exactly the same as cash. All outstanding credit card debt is essentially an increase in the money supply.

Because they already own those assets and don't want anyone else to have them. The perception of wealth is always relative so if I can't make any more to maintain my status I must ensure that others can't get what I have.

I'll say it again: no one cares about security.

First, no one is ever punished for having security breaches: companies outsource security specifically to avoid responsibility (using contract law to transfer risk). Second, the MBA mentality has infected software development such that first to market and feature velocity trumps all: if I can download a package or have an LLM write my code so much the faster than me writing it.

Security is fucked because shareholders want it that way. Change the incentives to make security matter if you want something different.

Check for no-script or ad-blockers. I could read in Chrome but not Firefox.

Process efficiency is about doing less to achieve an objective than you used to. This is the idea behind LEAN. If companies keep adding tasks then this is the exact opposite of LEAN. The only way doing more tasks makes sense is if said company is expanding into different markets, but that can be challenging and distracting from the core business (a reason why many non-core tasks are now outsourced.)

Software automates processes. Processes are currently designed with human decision makers in the loop. If you want software-enabled process to achieve maximum productivity then humans must be removed from the loop. This is the true objective of AI as it is being deployed and hyped today.

That is why I do not like the American traffic signaling system. When the light turns red cross traffic has a two to three second delay. My feeling is that if people knew the cross traffic would go immediately when the light turned red they would certainly stop. But right now they know there's a buffer so they just run the red light.

In my experience if it doesn't happen in a meeting it doesn't happen.

Most people don't want actual security. They want "good enough" security which provides the illusion of security. Because even when "good enough" security fails there are no consequences so "good enough" security is all we will ever get.

Data breaches are now as common as air disasters and school shootings, so no one except the victims cares anymore. And there aren't enough victims to matter in the financial sense.

It's always about risk, and business and the consumer have made a devil's bargain that the consumer will now take on more risk. LLMs will continue to be developed and used and MCP will worm its way into more and more things because software is accepted to be insecure by default and we all just live with it.

Ted? Is that you?

Ah yes, the old ray tracer in PostScript.

Holy cow was that forecast bad!

It reminds me of a meeting long ago where the marketing team reported that oil was going to hit $400/bbl and that this would be great for business. I literally laughed out loud. At that price, gasoline would be about $18/gal and no one could afford to move anything except by ox cart.