mpeg

I think there are unknowns in the calculation:

- What are the margins of Anthropic over their API pricing? Without this, all we're saying is the API is more expensive for heavy usage

- How have their price margins changed over time? I imagine built into their commercial model is the expectation for inference to get cheaper over time

- They have tighter usage windows than they used to, now having both 5-hour and weekly limits, they also seem to experiment with their usage quite often, this probably affects user's average utilisation, do they have any other levers they can pull here? eg how does changing to an 8-hour window affect it, or limiting certain models to API-only usage based on capacity like Fable

I know there is a certain level of subsidised usage built into their subscriptions, the VC-funded company playbook, but I don't think anyone from the outside knows for sure how much it is and I imagine it's lower than most people think, and reducing over time.

This is true for a lot of subscriptions though: some people use 100% of their mobile plan data, some people use 10% – the price accounts for this.

I get that, but the drawbacks outweigh the benefits imho and the b64 overhead is not solved, just deferred.

Say I want to distribute an hmml file as a single file, I'd have to create an html with the embedded js runtime, and then embed the hmml file... as b64, therefore negating any benefits.

I don't understand the advantage of this vs an html file with embedded images, except the latter would work with no runtime.

I like orbstack in theory, but I find it hard to justify a $96/yr license fee for something that has so many open source, free alternatives. As it is, I’d rather use podman or colima

Back in the day I wrote a PoC exploit for my employers app that abused an image upload api by embedding a jar file inside an svg as XXE which then got me RCE. Fun times.

It is, it asks you if you want to continue as opus 4.8… but I was trying precisely to evaluate fable

It's not even very usable... I tried 2 different chats and both eventually got stopped due to the safeguards

One was a piece of code I gave it to improve, it did so and then started writing tests, some of which tested security so the safeguards triggered

Another was one of the cryptography puzzles I use as new model tests, which are hard to oneshot and there's no public solution anywhere, it completely refused to even try to solve it

I figured, I just had a visceral reaction to that specific template as I get so many of them

Random but... please do not use this template on real emails

"Hi [FirstName],

I came across [Company] and was impressed by the work you're doing — especially [specific detail]."

It's a terrible cold email, I get so many of these every week... There's better ways to get someone's attention

I find it quite dishonest as github stars used to be (and maybe still are?) the measure of an open source project popularity, and these big, flashy LLM generated repos seem to always get a bit of attention

Have seen it from jobseekers trying to boost their profile with fake projects, founders trying to make their product more attractive to VCs, consultants trying to advertise their services...

I don't always have time for OSS, but every PR I've ever sent has always been hand written, and tested, and has taken into consideration the project coding style and architecture choices – I don't like this new world where developers can't even be bothered to write the docs.

How does this compare to the classic css-native parallax effect? Before the scroll timeline APIs you'd use the "perspective" css property to create a container where the z plane is n pixels away from the screen, and then position each layer within it at a different z distance using transform: translateZ

That method is GPU accelerated too, so it is performant compared to some js solutions, and has worked well in every browser for around a decade

I like the idea of the scroll-timeline though, just keen to understand what the advantage is for this

This is cool, I have SVT and usually am able to stop an episode if I do slow breathing like that; although sometimes if that doesn’t work the modified reverse valsalva manoeuvre does it every time.

I wouldn't be surprised if all the large AI labs already had an FTP account for Anna's

At the very least the chinese ones definitely would regardless of the legality, the western labs would keep it under wraps but they also probably do.

At their scale, he cost of scraping or getting it directly from Anna's sources is way higher than just donating $50k and getting easy, fast access

Or KSA

Yes but you can't compare some ollydbg script that would maybe be useful in a super specific challenge to LLMs which trivialise absolutely every challenge in a ctf and are de facto necessary to compete now

On the tooling I've made? Feel free to ask here or via email, the Salesforce one was for a fairly large (50k+ employees) company that uses it very extensively but as it often happens they're stuck with a ton of legacy crap. They have some of the AI tooling from SFDC but barely use it (lack of training, or interest) so this solves their immediate problem.

I'm very keen to use their new dynamic workflows (cf's durable execution engine) which would let agents write workflow steps, that way my users can ask an agent to do stuff like "run this report daily and email it to me" and it can work with minimal setup (very basic example, but you get the idea)

Huh? Haha I swear I’m not a sockpuppet or getting paid by cloudflare (I wish!) I just like their products

I think this post needs to be put in context, for months now Cloudflare has been releasing products that allow their whole platform to be usable by agents with the main objective of enabling their customers to dynamically write code using Cloudflare, this is just another step.

For example, you can now with Artifacts and Dynamic Workers make a lovable-style SaaS where your customers ask the AI agent to write software for them, the agent can run it in sandboxes with no build step, it can version it with a git-compatible API, and now you can even have it buy a domain for the end customer or set up their own cloudflare account when they want to move to production.

I personally have no use case for creating domains via agents, but some of the other features they're releasing around this area are extremely useful and I've started to ship internal tools for my clients where they are used, like giving them their own mini claude code that only does one thing – one I shipped last week was an agentic interface for Salesforce reports that understands their domain better (and all the undocumented tech debt) than the built-in Salesforce AI does and therefore manages the context better

If you look at the last 5 challenges (the ones Kimi was in) both Claude and Kimi have 1 DNF, chatgpt has 2

I'm not sure this is enough data to form an opinion, but going by what we have Kimi would be as reliable as Claude

If you look at the ranking breakdown though, Kimi K2.6 has only participated in the last 5 challenges (claude dominated before then) and if you only count those it would be in first place

You learn the most random ways to abuse program features, one I still remember because of how long it took to figure it out was an htb box that (after a long exploitation path) used NTFS ADS to hide the flag within the alternate stream in a decoy file; and of course the normal way to extract the stream was disabled so had to do some black magic with other binaries to get it

I was surprised at the low bounty too, considering the resources of openai

Last year I won a similar prompt injection challenge ran by a crypto startup against the latest claude and gpt (at the time) and it was considerably more money, from an org with maybe $5-10m in funding.

That and the restrictive NDA kinda tells me they're not looking for serious bounty hunters, who would either want a lot more money or, alternatively, to be able to publish their work; seems like a marketing stunt.

This one would be a fun challenge in a ctf, or maybe more appropriate for a puzzle hunt – most people would look at the dissassembly and not at the actual bytes and completely miss the binary encoding

Depends of what you prompt it... if you tell it to use react and shadcn, it will use that.

It's generated, when you try it you can see this is mostly a harness around claude opus 4.7 that helps it create a good design plan, it also supports asking you questions as it goes along, letting you review and feedback on mockups, etc, but ultimately if you look at what it's generating as it does it – it's just code

It's rolling out progressively, it works for me – it actually seems very polished, the examples are really good; and it lets you create your design system from your codebase

I don't have a horse in this race, but this seems the right way to me. As a developer, I do already inject custom scripts to provide extra functionality / automation on SaaS I use where APIs are not available or limited.

However, the thought of the non-technical users I work with doing that is scary, they have no idea if the code the LLM writes is correct, is it going to have a bug that causes a massive issue down the line?

I've seen fat finger errors cause financial loss, but at least in those cases the user always had a chance to realise their error and fix it, with something like this how would you even know?

lots of admin credentials too, which have probably never been changed

Sorry I'm blind! I completely missed the live demo. I think because it's on the top right corner I instinctively ignored it.

Maybe could have a "Try live" button that sort of nudges you to it (could open the sidebar with the page structure or something to make it obvious you're in "edit mode") if other people struggle to find it

Re. diff view, yes, I think it's the kind of thing that would give reassurance to users that they can play around with it without breaking anything, otherwise I feel I'd be a bit scared of accidentally touching something that shouldn't be changed (especially as you might experiment a bit before you land on the right style to change)