threecheese

This is a problem that autonomous vehicles created. Why should we not complain that its solution is worse than non-autonomous travel, given it carries risk that doesn't exist today? Does Waymo benefit society enough to carry the tradeoffs?

And what surveillance or other risks does this introduce outside of the cabin, and why should society allow that? What is the definition of modicum of detection, and who is drawing that line?

In one dimension, I'd also consider a compliment! "Purist" approach. However, given you are marketing Rune now, ... ... <--- insert unsolicited advice here lol

Good luck, I mean it.

The files the agents were trying to retrieve were all part of "Modern.Gov", a "proprietary agenda, committee-meeting, and governance-management product" made by Civica.

*Is it possible they were trying to use RubyGems to pivot to attacking government sites? * One of the diffs shows they were broadly scraping pages hosted by this .NET component.

I was unable to find any modern CVE for Civica.

This is where I think the value of Fable/Astra-class models shows, and maybe why some call these "AGI" (this transcript shows Fable as the target model, and I don't think this prompting strategy would work without it).

With Opus 4.x/GPT <=5.5, I was orchestrating "by hand", and everything required multiple individually-instructed and context'd steps. I saw real value in the Dark Factory/attractor/workflow graph-of-agent-roles pattern as a way to automate this .

With 5/5.6, prompts could be much larger, but needed to be very deep and wide - high level of detail, lots of context added, lots of examples. They could pull code practices and structure from what's present, -ish, but require lots of hand-holding, and subagent teams were just OK. The Dark Factory yielded to the Software Factory, where the graph didn't need to be pre-constructed - the agent could drive the workflow. Looked like the future to me.

With the newer class of models, I find that they are able to infer/derive much better and orchestrate and prompt subagents themselves. They are Driving. My prompts are still large, but only because they're doing more - the individual prompt-parts are much like what the transcript showed, the workflow has collapsed into just instructions.

I'm still dipping my toes in here, trying not to blow my token allocation too quickly, and even though astra and fable have major gaps I am seeing through the fog a bit. The Factory is kinda falling away into the bitter lesson I guess.

You mentioned “it’s like driving a new car” in another thread; I tried Rune in an earlier incarnation, and it was more drastic than a new car. I’m a vim user, and so enabled the Vim option in onboarding - that was a big mistake, because I literally could not do anything without using vim motions. I felt like a helpless noob on my first unix, how-do-I-exit-this-dam-text-editor.

I realized that your onboarding was also training, and that I could not do anything with Rune without going through that training, and so I immediately exited and uninstalled. The friction was much too much.

I’m not sure if the onboarding is still like that :) If it is, my feedback would be have much much lower friction to try (or warnings for those who claim to use vim :).

Don’t forget General Tso!

I’m operating a terabyte-scale Clickhouse - but only because I left Langfuse running for a few months on a MacBook :)

But seriously Clickhouse does love disk space.

Fascinating; thank you.

I saw `ads_mcp` in the skills list; I wonder what this does? Are skill files readable? Not to jump to conclusions, but a LUKS volume aint gonna keep your data private when the back door is wide open.

TBH no way any sane person is putting an auth key in there, I see you have an issue open though. Great idea, very useful , I’ll watch for that PR!

Following Cal’s worries, for giggles - a threat modeling exercise:

Anthropic starts sending malicious instructions out to agent harness clients in inference responses. The auto-mode permission classifier is modified to allow it. An update is pushed to the Claude harness to bypass the sandbox. Millions of coding sessions are harnessed to $Do Something Else.

How much damage might be done? How long would it take for us to notice? `/model fable; /effort xhigh; /permissions unrestricted; spawn 100 subagents to hack the gibson `

They control the guard rails, the permission classifier, the client source code, and the inference; I’d guess that a very small % of us have our agents locked down in a way that would even mitigate this, much less prevent it.

—-

Further, what if a government forced them to do this? Could an emergency order classify the fleet of Claude Code users as a weapon to be commandeered?

Stealing and spamming? Sounds right :) jk

Your personal computer? Eh. This afternoon Claude code diagnosed an issue I’ve had with my 4K displays since Tahoe, it would have taken me a week just to learn enough to try to figure it out. Now I have a cli tool which fixes it. I get a weekly report of Chezmoi drift across all my machines, including what I changed. This took me 30 minutes to set up. There are so many things it can simplify.

A production server with user data on it? I wouldn’t dare. My backed up MacBook? Truly valuable.

Same. If asked to create an account, I suspect a lot of us will decline and move on.

The reason Herdr is novel, IMO, is its runtime owns the PTYs and builds a bidirectional messaging system on top of that. It’s like Pi’s RPC - a very limited version of it - which allows one to hook into agent i/o without needing to invoke “$agentcli -p”. There’s a lot they could build on that, and so I wonder why a managed cloud play was first on their list.

:applause: :)

Codex and Claude Code support plugin symlinks for local development; if you don’t mind keeping a local clone of your skills repo they can just use it. Claude needs a shim, as it wants to cache plugins; it’ll run a shell command (!) locally to get the plugin path. Codex supports this natively.

Here’s the spec I used for my skills repo:

https://claude.ai/public/artifacts/d37077a6-2cdd-4961-b504-b...

Tell us about your process and discipline; I see `engineering-quality` in the repo, which seems to be some sort of QA harness. Makes this a bit more interesting than just-another-yt-dlp-ui. Do you follow some similar design process, like speckit?

Does “The final decision is made by a judge” mean “workers rights can ultimately be arbitrated by a judge when escalated”, or “judges arbitrate all workers rights complaints”? If the former, i believe that’s reasonable; if the latter, thats nuts - and I might not balk at a statement like yours (“abolishes…”).

You are right, they are only really useful for charging (though 240w - beasts) or keyboards. I’ve given up on trying to find silicone cables for data transfer and just buy thunderbolt which are typically rubber (Apple ones are braided these days, but it’s a very tight braid).

It’s chubbycables. You’re welcome.

Looks like a userland cron/launchd, with jobs committed in a local repo. It’s designed to launch agent clis, for which it provisions a workspace and manages process state, and to be used by agents (and so provisions an api and mcp for each task).

Might seem silly (no disrespect meant), but I have this use case; I’ve tried to give agents access to launchd, but it has not gone well. Nothing has b0rked my system, but it has been annoying to version control plist files with my project repositories. And so i find this interesting, having written a shell script to convert repo config file + plist to safe launchd commands - and much shittier version of this thing.

Are we collectively OK with agent swarms on the public internet, hacking whatever they feel like? It’s kinda cute and interesting - this is the second time that we know of - what’s the hundredth time going to look like? Are they going to knock Cloudflare down to avoid captchas? Reserve AWS free tier resources by the billions and bring down east-1? Hack a hospital?

Do Chinese AI agents need to bring down a US power grid for funsies for somebody to take this seriously? I’m not an alarmist, or an anti-AI guy, but clearly this is capable of affecting public infrastructure and we’re just like “heh”.

If you need customer support to access customer support, something is wrong; no?

I did something just like this at my first post-college job in the 90s. I found some weird backup files on the NT LAN, had similar observations as you, but wrote my extractor in C (casting records into structs - my first C program) using a “bcc” floppy disk. Turned out to be the entire insurance company Btrieve database, which I could dump into csv to load into MS Access.

This “database” allowed me to automate nearly my entire job - finding and exercising test cases for policy bug reports with a calculator - which gave me time to experiment with software development. I’d gone to college to be a writer, but this was waaaay cooler.

I didn’t get a bonus - heck I’d have been fired for sure - but that time spent learning made my entire career possible. Hoping to get another ten years before AI eats it all.

Did you need to iterate on the prompt, or did you have a model help you author it? I frequently have problems with orchestration instructions in-prompt, and your is huge. Maybe this is just better with Fable? I honestly haven’t used it much.

Realistically, what are the risks? I get not wanting info you provide to AI being used against you in the future, like if you are gay and move to a country where that’s illegal (or live in one where it becomes illegal), but is “training” an actual risk here? I would assume that PII is redacted, and so beyond redaction failure, the real risk here seems to be to intellectual property and not to personal privacy.

Edit: Does “use for training” include “we store all your chat logs forever tied to your identity”?

I have memory disabled in all my Chat UIs (even though it tends to creep in, looking at you ChatGPT). It’s very helpful until it scales with time, at which point it becomes useless due to staleness or mis-application across contexts.

That being said, in coding over a longer time horizon, having the agent continually re-derive decisions/laws/facts/etc from your code is wasteful of tokens and time, and if your code doesn’t consistently apply them you can’t know the agent will make the correct choices.

You need memory of these important facts to avoid this expense or potential incorrectness. Memory does not itself scale though, without maintenance and pruning, and that has its own impacts on cost and correctness like the Chat memory.

“Damned if you do, damned if you don’t” at least until the agent can itself maintain its memory accurately - or some other non-human effort can achieve that.

I love that you know this, thank you!

I think you are referring to GitHub Copilot, which is fine (even though their context windows are artificially truncated and their dev tooling leaves a lot to be desired). I was making fun of the Copilot that’s shipped with MS stack. “Hey summarize my Teams meetings and try not to fuck that up too badly” - that one.

The LLMs I use know what an ADR is; try asking for one the next time you and the agent come up with a significant one. What I will do is in Claude/agents.md specify where decisions live (usually docs/decisions), and then during inference I’ll ask them to produce one. I am using Claude mostly, and I find that it proactively reads most docs (too many lol), but something like the Pi harness may need explicit cues or a skill.

The “how” is less important though ime; keeping it from getting out of hand is the real trick. Agents will happily file ADRs all day and align their decisions with all of them, and this will cost you $tokens. Yegge’s recent article resonated with me for precisely this reason - I am in no way using these tools at his scale, but am seeing the same behavior. Its sunday, and an agent has asked me to “ratify” an adr twice already :)

Knowing a little about the maintainers and their model, this isn’t a private-equity cash grab or Mr Monopoly twirling his moustache; it’s a business trying to stay sustainable in open source. There are no billionaires here: they staff developers who contribute to projects like OpenZFS, and developers who build enterprise features that fund all of it. Their business is being challenged by “global” shops taking advantage of the platforms openness - and this isn’t the virtuous or even legally tenable type of competition. It’s “violating terms and not legally accessible” competition, and they are taking measures. It sucks for everyone.

If TrueNAS/iX whatever turns around and sells to Bending Spoons, then I’ll of course owe you a beer. Until then, their leadership is just trying keep the project alive - and funding other open source efforts at the same time.

Maybe AI fucks all of this up, who knows ….