CSSer

As someone on the development side who just cares a lot about security, I've already witnessed the strict safety bite in the wrong direction too. IT staff are predictably terrified of the blast radius of these tools, so they're inclined to lock down internal enterprise agent subscription permissions so tightly that the tool is not only neutered but also incapable of doing pre-product release, staging testing or even responsible disclosure of vulnerabilities to adjacent teams at the speed at which threat actors will be able to move once it's in production. That's pretty bad. It's not like we don't wonder about the implications of architectural decisions we're making as we do them. We just often lack the bandwidth or resources to fully explore them. And there's a huge difference between "Let's see if I can DDoS this service" and "I wonder if that token is single use or not". If you're going to be tying your system to theirs, it seems like it's a good idea to question the latter and report that to them if it's not prior to shipping it. Forcing the engineer to do that manually helps no one good. I've always thought zero-trust was a little broken in this way, but now it feels really shattered.

Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.

It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.

Trueee, I just rephrased. Marketing is powerful!

Hey, anyone who has YouTube Premium can watch this! I hope this doesn't come across as an ad or anything. I just got excited by your clip and noticed, so I thought I'd share: https://www.youtube.com/watch?v=hBRQ-jBqk8I

Nolan Bushnell (Atari co-founder) famously declined to invest in Apple early on too.

I mean, at least the way I imagine it, yeah. It instantly made me think of one of those spiky seed pods in my mouth.

I run a (web and native) app that integrates with Apple calendar and the like with per-user feed configuration. Due to the way Apple polls my servers, I am essentially hit with rolling 5 minute requests for every individual (non-negligibly sized) feed. The amount of bandwidth used at scale is not something I can just look at and shrug, and there are plenty of ways it could probably be made more efficient with levels of caching on near vs long-term items. I have to pass that cost on to my customer somehow. I wonder if this is something like that but at grander scale. There’s a lot of HIPAA compliance involved as well. Granted, I’m not charging a line item for that feature like they are here. I just roll it into the cost of the subscription and everyone shrugs because the price is justifiable to them.

I noticed that too. This also seems like a bit of an insult to the intelligence level of the average person. It’s precisely because attestation is a nuclear weapon that I doubt one of the big three will try it outside of their own specialized credentials. If someone tries to change ecosystems and finds that they’re going to have to reset all their passkeys it’s not going to take long for them to tell all their friends that passkeys suck and not to use them. This instantly kills adoption.

Furthermore, the rest of us are the people at the companies implementing passkeys. I did an implementation recently, didn’t require attestation, and can’t imagine why I ever would.

If we’re at this level of trust for all of FIDO, why aren’t we at legislative centers doing something much more dramatic about it instead of navel gazing about how we’re the smart ones who have recognized FIDO’s next big trick? How is attestation the problem here?

Yes, and we’ve told people this for two whole decades now only for them to shrug.

I think a better way to put this is that success with LLMs is guaranteed by defining what success looks like without LLMs first.

It looks nice. I wouldn’t roast it as much as admit that I can tell from some of the content phrasing that an LLM was used. The h1 feels cliche, for example. That comma doesn’t really need to be there.

I think they just meant that it's so many other people that they don't reasonably fit in the UI

But if you don't only surround yourself with people who think exactly like you, how will you ever recruit an army of yes men and women?

Weirdly when I first got my California DL I thought it felt fake compared to my home state because it was so much thinner. Maybe it’s better for the environment.

Do you really need flock cameras to catch low rank criminals in skid row or kids sneaking into the pool after hours? This seems like a massively imbalanced transaction. Moreover, who really cares about these kids doing that? Our justice system is completely overloaded, and the tools it has to deal with one of those kids in the wrong jurisdiction runs an extremely high risk of ruining their life rather than scaring them straight. One of those old people could probably accomplish the same thing by spending a couple of late evenings at the pool with a very bright flashlight if it’s that big of a deal.

Finally, I’m really worried about the parental surveillance we’re sticking everywhere. You are absolutely training your children to never take risks and wondering why they’re an anxious mess. There is a wide gulf between cutting through private property and vandalizing it, and I’m not convinced our current system is properly equipped to handle the nuances of that.

It’s fascinating to me how polished these things can look now. Years ago I recall reading a story of some consultant or new team member remarking how strange it is to start at a company, be given a tour of the codebases, and eventually find some awkward aspect of the architecture no one could really explain the reason for that had slipped under the radar for years. This feels like that but multiplied by a thousand.

I have spent the better part of the last decade of my career being approached by executives asking me how to optimize or automate away services that I felt had reached a local optimum. Each time this was the case I would gently express that our options were to commodify, by offering a kind of template, the service or optimize the process and way we gathered information from clients. Without fail, they hated the latter option. It was hard to do, and it implied that any number of people needed to do a lot better at their job in seemingly abstract ways. No, they’d always go for the template, then be dissatisfied by the fact that it’s, well, a template! Finally, they’d go back to begging me for alternatives.

This feels like them doubling down yet again. It’s like looking at your personal finances and trying to optimize it by canceling Netflix instead of acknowledging that you eat out 7 days a week.

The thing about this is that in a different codebase, even just that search for the trumpet guy could either burn a ton of tokens and come back with nothing or find it but light the ocean on fire in the process. This is because trumpet guy would be named "asset-ds1f23nbiq35421fsda.jpg", and it would be located in an images folder with thousands of other similar assets. So the agent starts by grepping for reasonable names, discovers nothing but finds an image directory, and then searches inside. In the worst case, I guess it starts analyzing each image. Or maybe it checks the article like he mentions, but the codebase uses a component library and the filename thing is still true, so it analyzes every image in the page. This is a bit of hyperbole, of course. Please allow it for the sake of comedic example.

Many of his other prompt examples also illustrate this. The author is massively leveraging the architecture of the organization through familiarity. It could well be the case that even an LLM was used to set that up, but I doubt it happened in one prompt or without critical thought. To be fair, I guess he's sort of trying to point that out, but by saying "Look how lazy I am while it still works" or something like that in order to look cool, I think all he's conveying is "Look how easy this is", when it's potentially not and could increasingly cost him/his company wildly varying amounts of money based on how he goes about it. When tokens were virtually free, no one cared. This is increasingly not true. Many are drawing comparisons to early cloud architecture.

I find this is sort of similar to the problematic idea that in theory anyone can clone your repo and get a local dev environment running in a few seconds. So then you try it with a non-technical staff member and quickly realize how unrealistic that is as you run into abstraction after abstraction that is completely foreign to them.

Makes me consider it just by thinking about enduring that

I can’t teach someone design in a day, but I can elaborate on the reference and point out some of the worst habits. A lot of these designs feature ornamentation without purpose. Look critically at the content in a design it produces. Ask yourself if each piece of information is serving a purpose for the end-user. This used to be, at least a little, harder to get wrong when adding noise came at the cost of more effort. The other thing is most often just typography. For a number of reasons, text below 16px should be treated very seriously. Claude throws it around everywhere.

Actually if I must be literal it’s a pretty big part of the culture out there. The playa is rife is with inside jokes that lately revolve around people telling you to have a terrible time, or saying there’s absolutely nothing at some place with a wink. Discovery and resilience is the point.

And sure, there’s a bit of old guard/new guard here, where the new guard is a bit softer about it. Personally, it was never my favorite aspect, but dismissing it says more about you than me.

I really dislike how the dribbble/envato style somehow escaped containment into Claude and now I’m seeing it everywhere mixed with mediocre design layouts. I think to myself that maybe stuff like this will help counteract that but then I see it in use with 12px typography (the kubernetes 3D dashboard thing) and I recoil in horror. Please consider this a PSA: Claude doesn’t understand UX or good design principles out of the box. Please go hug a designer.

I feel like there’s a non-zero chance you’re getting downvoted because HN doesn’t understand sarcastic burner humor.

> The apparent facts bear out that Luigi is guilty of killing that executive

And he pleaded guilty. There’s nothing “alleged” about this conversation, despite feelings about any other aspects of it.

Despite partial agreement, you’ve only reinforced my point as far as I’m concerned ¯\_(ツ)_/¯

“Not the same kind of mess” breaks the comparison, so… no.

Whenever I point out (in agreement with your statement) that the idea that the left and the right are somehow equally bad is a kind of fantasy on HN I usually get downvoted. People seem very committed to "shades of gray", moderate thinking to the point that it's viewed as always correct, which is well, just wrong. Yeah, often things are more complicated than they appear, but I find it almost hilarious how often you can't do that in American politics. And for the record I'm definitely not saying the left is somehow perfect. Obviously the left is a bit of a mess too. It's just that they're not the same kinds of messes across party lines.

A consumer watch dog that meticulously tracks equivalents to combat this would be an interesting project.

This is true. Here’s a cautionary tale to that end. My org’s IT recently introduced, without input, an ai filtering tool to automatically filter junk email. It apparently worked too well. In an ironic twist of fate, it filtered a raft of emails (across multiple domains, including tickets and account reps!) to IT from an important vendor about contract renewal into junk that ultimately resulted in leaving the vendor no choice but to suspend service until the bill was paid (they waited until the very large bill was over two months past due to do this, to their credit).

When I learned about this during the post-mortem I was incensed, to say the least. Email mgmt is part of a professional’s job, for better or worse. Accountability for that doesn’t suddenly evaporate because of a scenario like this. I don’t practice zero inbox for fun. I do it for my sanity and effectiveness. Technology can’t magically solve every problem.