Ciantic
Ciantic on Hacker News
Only responsible thing in this case would have been for OpenCode people to invalidate all keys. But I guess it is not that straightforward if Anthropic/OpenAI etc don't have endpoint for it.
I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.
Article refers to Hugo Duminil-Copin, who also did a podcast with Brady Haran [1] about this subject, for him it isn't case of bruised ego, or gatekeeping. He realized that the way things were done were going to change, and it made him emotional, he is not pessimistic or against AI.
[1]: https://www.youtube.com/watch?v=omuJpoV-Ko4
GPT-6 Astra with computer use has gotten some of architects and 3d modelers wondering what their future is. Astra does such a good work with SketchUp 2026 and computer use, here is video, but it is well worth it because the author actually knows his stuff:
https://www.youtube.com/watch?v=E-ECbD14g_8
> Openrouter is not ideal, because you don't know who they send your traffic to and there are rumours of vendors cheating by providing quantized models.
OpenRouter allows to make an API key locked to certain provider, I do that myself.
This sounds a lot like Spotify's XIRP. They managed to vibe something useful for their own engineers, were super hyped, and decided to release it in public. However what are the odds this harness will stand the test of time against actual harness makers like OpenAI or Anthropic? Neither Spotify or IBM are focused on making models or harnesses, these are just side-products.
Very cool. I'm cloning the repo, just in case it gets taken down. I've been using EGUI, but its biggest problem is that LLMs really struggle with it. There isn't enough good examples of it. This codebase seems to have a lot of good examples, so given this as a reference, one might make a lot of progress much faster.
One thing would be shipping interfaces without implementations. Rust could try to ship more traits without implementations, I do see it could be problematic with Rust as they don't try to be opinionated on what you will build.
There is another alternative too, releasing interface only packages, then hoping everyone agrees to use those. JavaScript/TypeScript people actually did this already for one very tricky one, validation, see Standard Schema [1], which was great success. But I would hope to see more, for instance interfaces around typical building blocks like job queues, email sending etc.
[1]: https://standardschema.dev/schema
Intelligence and size of the model might not be that correlated after all. I for one feel like human level intelligence can be replicated with multiple small models, such as vision, language, logical reasoning, spatial understanding etc. It would be odd if this 1.2 l between my shoulders gets obsoleted with even old hardware and not by latest Nvidia supercomputer.
Did you look at 1X's artificial tendon driven hands?
That is what I also wonder, who added that tootbrush statement there? Given that Oral-B has done replacable batteries for years, and they have dominant position, I'm thinkin that statement didn't come from lobbies. Maybe someone who are making the law is reasoning with itself or small group and didn't know that replacable batteries in toothbrushes are already a thing.
I also have Kobo Clara BW, and don't like swipe gestures, or any gestures whatsoever.
I (now) know why I don't like that, because regular book and magazines, you don't have to think about how you hold it. Your thumb isn't going to magically flick a page by accident if you take a firm grip on it. With gestures only e-ink books, I have to take extra caution how I hold it so that it doesn't trigger something.
I also discovered that these days motherboards come with a payload in their chipset, which gets installed automatically in background unless you figure out to turn it off from BIOS before installing Windows. In my case it was bunch of ASUS useless stuff, not just drivers, some "Armoury Crate" etc. Which just keeps running in background. I've switched to KDE, that kind of solved itself.
SQLite has no date data type. Also SQLite has no way to call EXPLAIN on query and get the dummy type name either for arbitrary SELECT query, so you can't even infer it, if you were to use the dummy type name "DATE" or "DATETIME".
Yeah, "?." as safe navigation operator even in JS where it already exists is eye-sore. They could use some other single character instead of two characters. Question mark is already doing a lot with ternaries etc.
Instead of obj?.:method?.(…) it would be like obj#:method#(…)
Replace # with your favorite extra character instead of questionmark.
Node refuses to support TypeScript within node_modules, see
https://github.com/nodejs/node/issues/58429 this means you can't do "Typescript-only npm packages".
They made that intentionally at the beginning:
> Currently there is consensus that Node.js should NOT run TypeScript files inside `node_modules. It is not supported to avoid package maintainers to release TS only package.
If I saw this in my CI script:
curl -X POST $GITHUB_CACHE_URL < wololo.exe
It would make me pause, but now that it is a misfeature in YAML configuration it is more widely used. Point of bash scripts they are auditable, and understandable.
I didn't prescribe what the bash script would be, because it would differ on use case. If I wanted to share artifacts from other runs I would probably use podman and make sure I start new runs from known good condition, but because I understand that. Some other would use nix or whatever else.
What I want to focus on is mental model of your CI pipeline, and problem with too much YAML, consider this quote:
> Cache scope is per-repo, shared across pull_request_target runs (which use the base repo's cache scope) and pushes to main. A PR running in the base repo's cache scope can poison entries that production workflows on main will later restore.
This is very difficult to understand, and teach to new people, because everything is configured as YAML, yet everything is layed out in the background to directories and files.
What if your CI pipeline was old-school bash script instead? This would be far more obvious to greater amount of people how it works, and what is left behind by other runs. We know how directories and files work in bash scripts.
Could we go back to basics and manage pipelines as scripts and maybe even run small server?
Wow, amazing work.
Pretty impressive that it is faster than the Go version already.
`android docs` is the superpower we need for everything. NPM / pnpm should have similar `npm docs` that would allow humans and agents to search for type-signatures and JSDocs.
It is so annoying that each agent has its own ideas where it tries to get the docs, usually by blindly grepping.
What is the reason they don't use the WebView2? Microsoft Teams uses WebView2, surely it should be enough for Copilot. This defeats the whole point of having WebView builtin and shipped with the Windows 11.
I happen to be just now experimenting with app states. Out of interest, you mean something like this?
https://gist.github.com/Ciantic/63526ebfe65570b669eca33bf340...What would be disadvanatages of this approach? I don't like Arc's myself either, I would like to see what is best alternative for those in multi threaded apps.
Let me present you my favorite, how do you figure out dirname, basename and filename in batch script?
set filepath="C:\some path\having spaces.txt"
for /F "delims=" %%i in (%filepath%) do set dirname="%%~dpi"
for /F "delims=" %%i in (%filepath%) do set filename="%%~nxi"
for /F "delims=" %%i in (%filepath%) do set basename="%%~ni"
echo %dirname%
echo %filename%
echo %basename%
It is just as intuitive as one would expect.
I know not all, but Debian/Ubuntu/Fedora does, and while the intended purpose of multi-stage releases is not necessarily security but stability, it still does help up with security too. Because third parties can look and scan the dependencies while they are still not in stable.
Most of the supply chain vulnerabilities that ended up in the NPM would have been mitigated with having mandatory testing / stable branches, of course there needs to be some sort of way to skip the testing but that would be rather rare and cumbersome and audited, like it is in Linux distributions too.
NPM should learn from Linux distribution package managers.
Have a branch called testing, and packages stay in testing for few weeks, after which they go to stable. That is how many Linux distributions handle packages. It would have prevented many of these.
Advising every user of npm/pnpm to change their settings and set their own cooldown periods is not a real choice.
ChatGPT has style settings, you probably should set it to something else than the default. Go to your personalization settings and change base style and tone. I have set it as 'efficient' which is less cheery. I can see why attention economy would lead setting the defaults towards more 'affirming' as it keep people more engaged and coming back.
I've been using podman, and for me it is good enough. The way I use it I mount current working directory, /usr/bin, /bin, /usr/lib, /usr/lib64, /usr/share, then few specific ~/.aspnet, ~/.dotnet, ~/.npm-global etc. I use same image as my operating system (Fedora 43).
It works pretty well, agent which I choose to run can only write and see the current working directory (and subdirectories) as well as those pnpm/npm etc software development files. It cannot access other than the mounted directories in my home directory.
Now some evil command could in theory write to those shared ~/.npm-global directories some commands, that I then inadvertently run without the container but that is pretty unlikely.
I wish they support Linux wholeheartedly, a lot of toolkits and GUI frameworks do it by half-assing things, mostly because Wayland is difficult to understand.
In Wayland you have multiple ways to render windows, not just the XDG top level window. It works via surfaces, and here is a list I've discovered so far:
- XDG Top Level Window
- Child Window
- Popup Surface
- Layer surface (like task-bars, shell overlays)
- Subsurface (region in another surface)
- IME Panel Surface (surface that follows text cursor)
There probably is others too.
It is diffifcult to find high-level toolkits that support all of the above.