jcgrillo

> Every time I see an anecdote like this, A it reaffirms my belief that FAANG devs are fairly mediocre on the whole

I think another (partially causal?) problem is how they're managed. The whole perf circus is just ridiculous, especially the stuff recently reported about facebook. But they're all more or less like that. Steeped in that cocktail of incentives, who even knows what might happen to an otherwise excellent engineer.

But also just numerically, they can't be much above average, on average, because there are so many.

From another angle that's maybe just a welcome excuse? Or it's some kind of more symbiotic malfeasance? Any way you slice it, it stinks. If it is actually about some misguided attempt at public safety or national security, what could possibly be the actual goal?

Yeah, emacs is very competitive with "modern" IDEs. Even in JVM languages, which for a long time wasn't true. And I don't know of anything, anywhere that can rival magit.

I've been using it for far less time than you have, began ca. 2011 or 2012 here[0], but over that time it has been my constant benchmark for what an editor should feel like, and every other IDE I've used has fallen short. With LSP especially, in the past 6-7yr I have actually been predominantly using emacs. Part of that was being fortunate enough to no longer have to work on much JVM stuff since ca. 2019, but it's also due largely to large advancements in emacs' capabilities.

[0] https://groups.csail.mit.edu/mac/users/gjs/6946/mechanics-sy...

EDIT: In particular, this is exactly where I fell down the rabbit hole:

> If you are not familiar with Emacs you SHOULD run the tutorial, which can be accessed in edwin by holding down the control key and typing h, then, releasing the control key, type t. (C-h t)

I don't know if there's anything else on the entire internet I can specifically point to that has had a greater impact on my professional life... strange.

It smells an awful lot like the government is trying to pick a winner. Or, at least, a loser.

Before, when working on my car I would google bolt torque specs and usually the first result was authoritative--generally a forum post from a reliable, professional mechanic quoting the factory shop manual. Now the first result is an AI summary, which is wrong roughly 25-50% of the time in my experience. Often it does incredibly stupid things like mix up ft•lbs and N•m. If I were to trust this, it could kill me (or worse, someone else).

Now I don't google at all anymore, instead I spend 10min flipping through the manual to find the spec. One might argue that I should have been doing this all along, but it sure was convenient to have basically a 100% reliable, fast alternative. Now that's gone.

Yes, I agree there are areas where it's undeniably useful[0]. But that's not going to satisfy market expectations. Devtools is not a large addressable market. It's hard to find examples of real-world applications, which don't totally suck and users don't hate, outside of devtools. I can't think of a single one off the top of my head.

[0] I'm willing to concede this point, but I still maintain nobody has really shown it to be true in any rigorous sense. Maybe that doesn't matter. If people feel it makes them more productive, that's good enough for me.

Just wait. It's becoming clearer by the day that tech has become a monoculture. It's basically to a first approximation just a crowd of frauds plagiarizing each other (with a few, rare exceptions). Monocultures collapse. To date, the "promise" of AI is still imaginary. It's not living up to the transformative, abundant expectations that are being set. I personally think it's a safe bet it never will--that is, to be economically viable on the scale that the market expects, it needs to actually become AGI. And I'm betting that won't happen.

It's so refreshing to see emacs just sticking to its guns and getting solidly, steadily better over the years. Inspirational, even. This is how software should be. Can't wait for all the tree-sitter improvements!

This works especially well on an IBM Model M because there's nothing in the vicinity of either the left or right ctrl, you just chop your palm down and can't go wrong. I could also pretty reliably M-x in one hit by flipping my left hand over, curling my pinkie finger, and hitting the keys with the knuckles. On more crowded keyboards I remap ctrl:nocaps and use thumb and forefinger for M-x. I actually deliberately got rid of my Model M to teach myself to do it this objectively worse way, because context switching between my docked workstation setup and laptop keyboard on the go was difficult. If only someone would make a laptop with a proper keyboard...

> I don't believe you.[0]

[0] https://c.tenor.com/wuKJbik2LcEAAAAM/anchorman-ron-burgundy....

That's a good point!

And there are just tons of free engines sitting around that are basically almost as good as the newest ones...

I'm just here for Ed's victory lap.

I can't imagine there's a large variation in costs per token for inference and training costs between companies, and since they're all basically doing exactly the same thing, and competing on price... yeah.

Conceptually that makes sense, but has there been a supply chain problem lately? It's been a few years since I worked on a large rust project with tons of deps, but I don't recall there being a big problem. Especially with cargo vendor.

If fully auditing a collection of deps is the goal, it seems that could be accomplished by maintaining a list of repos and trusted commit hashes?

I guess I'm wondering whether there's some incremental solution that fits better with how the rest of the ecosystem works?

EDIT: just saw reference to cargo-vet, very cool! Thanks Colin.

I don't get it, maybe my brain isn't wrinkly enough. Two things:

1. What problem does stdx actually solve?

2. Ok, it's a git dep, seems fine? Why is the choice to publish or not publish in crates.io a big deal either way?

I don't think the government is trying to protect anyone here, they're trying to punish a company for failing to toe the line. Antirez put it well in a comment here[0].

My point was more that there is no direct intervention that can possibly give an asymmetric advantage to defenders. Given that it's trivial to jailbreak a model ("fix this code", "hypothetically how might I...", etc), if the model contains the information necessary to fix a vulnerability it also contains the information to exploit that vulnerability. And therefore anyone with access to the model can do either.

Of course if you remove the model from the equation the same circumstances are true. Attackers and defenders, mostly, have the same information available to them. We can try to tip the scales one way or the other by building tools that make their jobs easier, but there's no amount of "artificially" restricting information or taking things away that will actually deter a motivated, resourceful attacker. And doing so simultaneously disadvantages defenders.

Ultimately, if you know how to fix a bug you also know how to exploit it. If you want security, you have to build systems that are actually secure. There's no way to fake it.

[0] https://news.ycombinator.com/item?id=48556177

It seems at this rate to avoid a large tech crash in the near future we need to start seeing real, transformative value being delivered by AI. Like, the promises are coming due. From where I sit, I don't see that happening. That's bad news.

If it goes as bad as it might, it will affect many more people than just technologists. Most people's one and only experience with AI will be when it fails to deliver and wipes out their 401(k). That scenario, I think, would leave a pretty bad smell around AI.

If otoh the industry does find a way to make it print, or if I'm just totally wrong, this won't happen. I hope that's the case.

But then we wouldn't have had the metaverse, that was a barrel of laughs.

> this kind of AI psychosis might be the new normal for our industry, or at least one of the new normals

That's possible, but don't underestimate the cleansing power of a huge market crash. I don't know how it'll shake out, nobody does, but I'd bet in a few years hardly anyone will be looking back on the gung-ho AI thoughtleadering of 2026 as anything other than a stain on history.

Yes, and it's effective marketing. The war fighter vibes are thrilling. There's a tribal sense of us-vs-them, there's danger, there's the prospect of victory or defeat. Security products marketing is full of these ideas, because security is about preventing arbitrarily bad things from happening. So evoking your worst imaginable nightmare scenario is a great way to get you excited about buying something that might help prevent it.

You can't really have one without the other..

Question to folks building user-facing products on LLMs:

How do you protect yourself against this kind of misuse/jailbreak? Is it just a bunch of prompts? It seems like the fact that LLMs are so trivially jailbroken really limits how you can actually use them in products. How do you navigate these limitations?

Best state in the country, jobs or no.

Yeah it's a fractal of wtf all the way down..

...but why?

Seriously, this needs some more justification:

> Only big and well-funded organization are able to build the internal tooling and libraries requireed to securely ship large Rust projects.

Leaving aside the (real!) problems other commenters have highlighted, before even getting to those issues I have a small foundational question:

Is this actually a real problem?

As a kid, that's what I loved about computers. They were fair in ways society wasn't. The rules were clear, and breaking the rules resulted in badness. Unlike grade school, for example, where the rules were always changing and badness would just occur randomly and capriciously.

yes... ha ha ha... yes!

> a live, running process that does useful things

That is one of the things code does. It also communicates the developer's thoughts about how that process should work to others. If the latter is neglected, the code becomes very difficult to collaborate on. Very few lines of code that are written are "write once". Mostly they're changed, repeatedly, over time by many people. The live, running process is a very temporary entity by comparison. Yes, it needs to exist and do useful work. No, it is absolutely not the only thing that matters.