everforward

Seems like everyone skipped over this part, but optical controls for motorized wheelchairs is a cool idea (at least to me, maybe that's an old idea).

Full VR hasn't done well, but it does continue to make me wonder if there's a market for a stripped and slimmed device. I'd maybe be interested in a device that does optical controls if it fit in regular-sized glasses. I'd be super interested if it had a HUD system (even a super basic one that can only show a handful of symbols). Better still if it had some basic audio, but maintaining the "regular glasses" form factor is more important to me than the HUD or audio.

I dislike it here because I like Mullvad, but yes, I think it’s fair to go straight to public disclosure.

Someone with likely substantial qualifications put in time to find this. The company is in it for profit (at least partially). What’s fair for the company is fair for the individual. The company can either offer to pay for bugs under the terms they want, hire more security folks to find the bugs themselves, or just accept that researches get to do whatever they want with their findings.

I’d tell Mullvad, but there are companies I don’t respect enough to feel compelled to give them a heads up. Perhaps the author feels that way about Mullvad, it’s entirely within their right to use this to publicly shame Mullvad.

It’s a distributed transaction, which is what makes it complicated. You need to atomically remove money from an account in one database and add money to an account in a totally separate database.

There’s a bunch of weird corner cases that come with that. What if the receiving account ID doesn’t exist, or the recipients bank flags the transaction, or the sender closes their account before the recipients bank has applied their end of the transaction.

I think some of these transfer systems are simpler because they’re global so both records are in the same database. Transactions can be technically atomic rather than organizationally atomic (ie atomicity is present in the technology, rather than approximated by processes).

Totally agree. I also think Clojures relative lack of support for custom types leads to elegant APIs.

It’s a breath of fresh air that practically every DSL takes either lists or maps so I can use very similar patterns to build their input rather than “every API wants me to method chain their custom types so every API needs its own special helpers library for common patterns”.

I never realized how much I hate classes until Clojure.

Have you tried typed Clojure? Curious about opinions on that vs having Malli do runtime validation. I tried it when I was a total noob and got overwhelmed. I feel like I have just enough context now to try again, and not sure if it’s nice or the overhead is so high it’s a boondoggle

The incarceration rate is much lower. The US has an incarceration rate of 541 per 100k, Singapore is 178 per 100k. Singapore is just much more likely to execute convicts; in part because SG has a mandatory death penalty for some crimes, and in part because much of the US doesn’t have the death penalty in all.

It does not appear to be an effective deterrent. https://www.academia.sg/extra/death-penalty-research-appendi... This article has a criticism of the SG government report (Study 6 header) on the deterrent effect when they added the mandatory death penalty in the 90s. The big takeaway is that convictions didn’t drop notably (cannabis convictions dropped a single percentage point, opium convictions went up 2%. Average opium weight seized dropped a ton, but is still like 13 times the mandatory death penalty limit so hard to call it there).

Sure, but that’s not deterrence anymore. The question there is less “will it work” and more “is this morally justifiable?” especially given the concerning proximity to eugenics (which started off as eliminating crime by eliminating people with “crime genes”).

“The throughline is that nearly every structure that gave boys meaning, community, accountability, and identity has either collapsed or is being actively dismantled by buildings full of PhDs.”

I think this is under appreciated, in part because it’s incredibly hard to fix. There’s a void where the US cultural image of masculinity used to be. As an adult man, I couldn’t really describe what a prototypically masculine person looks like or does or thinks anymore.

There’s a loss of identity there that we haven’t really rebuilt.

I wouldn’t point entirely at the PhDs, though. There were some real issues that were called out (inability to communicate, over reliance on anger as an emotional outlet, etc), but the identity could have stayed largely intact.

The killing blows were from segments of men who doubled down on the most negative aspects of masculinity, and made the rest of the men flee from that image of masculinity to avoid any association. I would rather drop masculinity from my self-perception than be associated with Andrew Tate or Logan Paul or whoever else.

I don’t think I know any men that have “modern masculinity” (whatever that would mean) as part of their core identity. They’re either clinging onto a Chuck Norris kind of masculinity, or just don’t have a strong gender component of their self-identity. They’re not feminine, they just don’t do anything to be “manly”. Being “manly” matters to them about as much as whether they’re a Coke or Pepsi person.

Are you worried because it’s not a mainstream language and coworkers may not know it, or are you worried about the language itself getting abandoned or being bad or such?

I’ve not used it in production, but I’ve shipped a few side projects and stuff for family members in it. ClojureScripts React wrapper, Reagent, honestly makes more sense to me than React does. I used Hiccup to generate HTML, and your components are just functions within Hiccups DSL (which is really just lists) and it ends up looking incredibly clean. Static things look static, dynamic things are obviously so, and it felt much less magic than regular React.

The only things I found that felt bad were trying to use non-functional components I found on NPM. It’s not a deal breaker, but the code was ugly. Nothing I couldn’t fix with a wrapper, but some JS libraries are heinously ugly in cljs by default.

I’ve been using LLMs (the new Deepseek) on Clojure and it works well. The only major pain point is that it sucks at getting the last paren on. There are hooks that will fix that automatically, but I’ve been lazy.

I haven’t tried on anything completely blank, though. My projects have been sort of skeletons where I’m figuring out what I want it to look like, and it’s pretty good at imitating the patterns. Like I write functions to query a particular SQL table, and it can pick up how to use the SQL generation library from that.

It works pretty well. I also have it generating good docstrings though, which might help. Every function gets a “what does it do, why would you use it, what does it expect as args, what does it return” comment. If the function expects a map, the comments specify the keys it needs and so on.

You can also get typing (sort of) by using Malli or similar which does both runtime checking of schemas and serves as documentation of what the expected shape of the arg is. The LLM has been pretty good at falling back to looking at the schema if tests fail because of validation issues.

Got a link to a study or meta-study? I tried searching, but the results I can find from Singapore match Western research.

A notable divergence here is that Singapore leverages the death penalty _much, much_ more heavily than even the US does. Per capita death penalties were 20.3x higher in Singapore than the US. Deterrence means a lot less when you don't have to worry about recidivism because the person is dead. That's certainly a strategy, but it's going to make deterrent effects look a lot better because a lot more of the recidivist population is going to end up dead and no longer contributing to crime stats. I.e. it may not be that deterrence works differently there, but that they're more willing to just execute people who aren't deterred.

It won’t work, we have literal piles of research showing that severity of punishment is not an effective deterrent, and to an incredible degree for children. They tend to either not think of consequences, or have youthful hubris and be certain they won’t get caught (even when they have in the past, I got spanked numerous times for the same exact things).

I would go so far as to bet it will have the opposite effect. Nothing legitimizes using violence to affect the behavior of others like the state doing it to you. I doubt they have the introspection to recognize the difference between state and personal violence, the message they’ll get is “might makes right”.

Those countries have structurally different cultures, economies and governments. Eg Singapore has a median household income that rivals or exceeds the US, in a part of the world where that makes them fabulously wealthy compared to their neighbors. That alone is a huge crime deterrent; why steal stuff you could just buy off whatever their Amazon is? They’re also a fairly small island, so it’s way easier to control drugs getting in.

TLDR Singapore and Japan have low crime rates that likely have nothing to do with severe punishments.

Mens rea. Typing that into a word processor is obviously not using the false pretext to gain anything. Doing it to Claude could be construed as an attempt to gain information, which checks some boxes for fraud and impersonation of government officials.

For reference, I think this is one of the relevant sections of the USC (18 USC 912):

Whoever falsely assumes or pretends to be an officer or employee acting under the authority of the United States or any department, agency or officer thereof, and acts as such, or in such pretended character demands or obtains any money, paper, document, or thing of value, shall be fined under this title or imprisoned not more than three years, or both.

IANAL but I can see interpretations where telling Claude you’re the FBI would qualify. It’s probably unlikely anyone is prosecuted for it, but there’s a chance

It really depends on how you define a software engineer. If you mean software engineers doing what we do today, the market probably won’t.

If you just mean “people who make software in any capacity”, it will probably grow (or has already grown) via product, marketing, etc folks making internal tools with AI (which may not work out, we’ll see).

Presuming we keep seeing LLM improvements, SWE will move up the stack like they did in the past. They used to work directly with hardware and software. Ops folks sprung up to do the hardware, and SWEs do basically all software using abstractions over hardware. This will be another step up where SWEs no longer work directly on software, but rather on the tooling that writes software which they hand over to marketing, HR, etc.

Again, presuming this all works out the way the AI folks plan.

It would also be nice to include a shaded area for the first standard deviation over a relevant period of time to get an idea of how far outside normal it is.

In my unhinged pipedreams, we’d have some sort of standard for conveying the data directly so users could use browser settings to decide how to display the data. There like a dozen people in the world that would use it, but they’d really really enjoy it I bet.

Yeah, that's part of why I said I'm not entirely convinced. 1 hours vs 2 hours is an unrealistic example. I do still think it can make sense, but the extra actual productivity is probably more in the vein of "getting an extra hour on a 10 or 20 hour project".

Does the computer running the agent have production DB credentials on it anywhere? If it does, the AI has access to the production DB.

This is part of why I'm bearish on the new hotness of "don't write tools, just write a Markdown skill and let the LLM write its own bash commands". It does work, for the most part, at the cost of it being entirely capable of changing its environment and executing arbitrary commands. Approvals exist, sure, but I've never seen anyone manually approve a command past like the 3rd permission dialog.

SWE's are expensive; median salary is $133k (not counting health insurance, payroll taxes, etc). If you can shave off an hour of dev time with $40 in LLM credits, that's $26.50 cheaper than having them do it without.

I'm not entirely convinced it works out that way so far, but that's the theory.

Trying to bring down LLM costs is sort of a double-edged sword, because the dev needs to be cutting LLM costs by more than what you're paying them. If it takes them a day to bring costs down by $1 an invocation, then it takes almost 2 years to recoup the salary costs. It's worse because LLMs currently change so much I wouldn't be confident that their solution won't be broken before the 2 year period. Will we still be tool calling in 2 years, or will that be something new? Will thinking still be a thing, or will it be superceded by something else? I don't think anyone knows, even the frontier providers.

Being the reserve currency props up our currency conversions because everyone wants USD to trade with. If we lose that, the value of the USD falls relative to other currencies (and especially relative to the new reserve currency). Our GDP would presumably be measured in whatever the new reserve currency is, and that alone would cause a GDP drop just due to unfavorable currency conversions.

Being the reserve currency also makes imports cheap but exports unappealingly expensive. Losing that means the inverse; imports are expensive and exports are more appealing internationally, but our economy is set up for cheap imports and not exporting much. It would take a while to realign to doing manufacturing for domestic supply and GDP via exports.

Possibly; I'm not going to hazard a guess on what the Supreme Court will decide the exact bar is. I just don't think it will be either extreme. "Nothing is copyrighted" is too damaging to the economy, "everything is copyrighted" has weird impacts on non-LLM copyrights that conflict with precedent.

We desperately need some sort of anti-retaliation provision added to chargebacks and CFPB complaints. They get off saying they won't give it back because how willing are you to get banned from Anthropic? You're like 3 legitimate chargebacks with vibe-coded companies to be banned from all the frontier models.

The risk/reward tradeoff of helmets is potentially dying, and we still had to make laws requiring people to wear them.

Glasses also have a pretty compelling reason to wear them.

I don't think VR has as compelling of a reason, at least so far. Even if it does, you need people to get far enough in to see that reason which is a hurdle when it involves a device they don't want to wear.

Specifications are not necessarily creative input. Eg if I write a prompt that just says “write a rate limiter in Python”, there’s really no creative input. I didn’t decide on the API, or the algorithm to bucket requests, or where to store counters, or etc. I just gave it statements of fact, which are inherently not creative.

Compilers are different in that the resulting binaries are not separately copyrighted. They are the same object to the Copyright Office because one produces the other, in the same way that converting an image to a PDF is still the same copyright.

LLMs don’t do that. The stuff coming in may not be copyrighted, and may not be copyrightable. The stuff that comes out is not a rote series of transformations, there are decisions being made. In common use, running a prompt 10 times might yield 10 meaningfully different results.

I’m dubious the outcome will be “any level of prompting is enough creativity”.

> we discovered because of some internal methods we figured out how to invoke with some clever indirection.

Apple trying to block Facebook is different than Apple trying to prevent Facebook from violating App Store standards. There was a time where the Facebook app was practically malware with all the tricks it tried to pull to Hoover up data.

I don’t know in what world I would describe Metas VR as anything but a failure. There was a brief period where I knew a few people with Quests. Most used them for the novelty and dropped them, a few played games on them, and I don’t know anyone that still owns one. I’m deep in the gaming community and haven’t heard anyone mention a Quest in years. Steam VR is almost equally quiet other than occasional nostalgia.

I don’t mean that VR failed entirely, just that the metaverse as a concept is basically dead. VR will live on in the niches where it makes sense.

If you’re talking about the Meta Ray Ban glasses, I wouldn’t really call that a successor. There’s no AR or VR to them that I can tell; just glasses with speakers, a mic and a camera. It’s a neat product, but not a platform in the way VR was meant to be. They also have real competition. I do actually own a pair of the Bose headphone sunglasses, which are practically the same product without a camera (which I’m sure they could add if they wanted). Unless people suddenly care about the Meta AI integration, and again; Bose or someone else could add a phone companion app.

Interaction feels like the issue with headsets. You either need a fair bit of space for gesture controls, or you have to talk to yourself for voice control.

I think VR has more niche uses than the craze implied. It’s got some cool games, virtual screens for a desktop could be cool someday, but I don’t see a near future where they replace phones.

I think this is sane washing their idea in the modern context of it having failed. I think at the time, they thought VR would be the next big thing and wanted to become the dominant player via first mover advantage.

The headsets don’t really make sense to me in the way you’re describing. Phones are omnipresent because it’s a thing you always just have on you. Headsets are large enough that it’s a conscious choice to bring it; they’re closer to a laptop than a phone.

Also, the web interface is like right there staring at them. Any device with a browser can access Facebook like that. Google/Apple/Microsoft can’t mess with that much without causing a huge scene and probably massive antitrust backlash.

I think it’s reasonably easy to design a system that’s documentable and documented. It’s very, very hard to maintain and iterate on a system while maintaining those properties.

Hacky things will make their way in because it takes a month to do the documentable thing and a week to ship the hacky thing.

It takes a lot of skilled people from varying disciplines to figure out what things are going to survive long enough and be important enough to spend the resources doing the right thing instead of the hacks.

It bites both ways. I’ve seen core business products crippled by years of digital duct tape, but I’ve also seen internal tooling that never really becomes useful because they insist on doing the “correct” thing and it’s constantly a year behind what we need it to do.

There are legit reasons, at least for two nested sessions. A production network that’s airgapped except for a bastion host that acts as a gateway. It’s better than port forwarding because you have to auth to the bastion host before the RDP chaining, and it often takes separate credentials for the second RDP session.

It’s a semi-common setup for higher security environments, and when you have a network of stuff that has known vulnerabilities you can’t patch for whatever reason. Traffic in and out is super carefully firewalled. It’s not great, but it’s better than a 25 year old MySQL with a direct public IP.

This is not the first time I’ve seen this, and it’s misleading. Your brain needs glucose, as does the rest of your body. You do not need to eat glucose, your body can synthesize it from non-glucose sources. You can absolutely survive on a diet with 0 glucose.

I don’t have an issue with people eating sugar, but it is not a necessary nutrient.

I think you could work around send(). Not a Ruby person, but in most languages you could store functions in a hashmap, and write an implementation of send that does a lookup and invokes the method (passing the instance pointer through if need be).

Won’t work with actual class methods, but if you know ahead of time all the functions it will call are dynamic then it’s not a big deal.