Silhouette

Copied directly from the page you linked as seen from here one minute ago.

It seems odd that this apparently leaves anyone working solo on a commercial project without a good option. There must be a lot of freelancers or people working at agencies who get software set up for each client or project that would be excluded by all of these options. Although API pricing appears to be so expensive at present relative to the subscription plans that it's probably still worth buying a "team" subscription with two seats and only using one of them in that kind of situation.

My personal observation was that when we looked into setting up those monthly subscriptions for some users at a small business in the UK we stopped at the point where they appeared to be offered only under Anthropic's Consumer Terms of Service because those terms clearly state:

"Non-commercial use only. You agree not to use our Services for any commercial or business purposes and we (and our Providers) have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity."

I can see this wording right now at https://www.anthropic.com/legal/consumer-terms but maybe if you're not in the UK you will see different content at that location.

In contrast the API key route appeared to be specifically offered under Anthropic's Commercial Terms of Service and those obviously don't contain the same restriction.

I would be very happy to find that there's some misunderstanding here and Anthropic do actually allow the use of their (very much cheaper) monthly subscriptions instead of API keys for small businesses like ours. But they aren't exactly known for their transparency in either their legal agreements or their billing policies and pricing plans and so until we know better we've chosen to err on the side of caution.

I've seen reports that say any organisation over 150 people needs to be paying API billing with Anthropic but here in the UK the terms seemed to be very clear when we looked that any sort of professional/commercial use is not permitted on the monthly plans like Pro and Max and you need something like API tokens or maybe some enterprise plan on their commercial terms for that kind work.

The page above still includes similar changes to the terms but now says they come into effect on 20 November 2026.

Does anyone know what's going on here? We were about to delete our business account today because we can't risk the potential consequences of the new terms but maybe we have a few more days? Has there been more push back from the big players than has been widely reported?

I saw an interesting observation the other day that Jensen Huang has played this game the best because his company is the one actually selling real products and making real money in return. If all the AI giants are buying up huge amounts of hardware speculatively because they assume they will need those data centres in the future and then the bottom falls out of the market then it's the AI companies left holding the baby. And if we do get to a point where local models are competitive then the OpenAIs and Anthropics of the industry might face real difficulties but it would just be a different market for Nvidia to also be selling real hardware and still in exchange for real money.

If progress with frontier models doesn't continue at the same pace then the investments and funny money deals might start to look very fragile.

If progress does continue then that progress might be towards smaller models more than quantum steps up in quality or capability that would increase the risk of the scenario above.

All of this is set against a backdrop of public hostility and political problems that I can only imagine increasing in the near term as well.

This feels like an unusually high stakes game of poker. I don't think I'd want to bet on Big AI right now if I had a few billion lying around. Then again - maybe that's why I don't have a few billion lying around!

I would say that a system with some sort of binary evaluation that indicates whether it succeeded or not is receiving feedback. It could also be some kind of sliding scale - how close did it get?

Either of those might be useful for determining a good future direction to iterate in but that would surely depend on the nature of the problem and how it's possible to search for solutions. I'd still call it a feedback loop even if the evaluation wasn't enough to point in a specific direction for a further iteration though. YMMV.

A recurring problem with politics is that even a lot of decent and reasonably intelligent people still aren't interested enough to spend a lot of their time looking into political issues in detail. And that's understandable! Most adults have enough to worry about with jobs and families and their own hobbies and interests. The point of representative democracy as commonly used in Western nations is to have representatives who can devote their time to getting involved and understanding the issues on behalf of those they represent. But then how do voters know that the people they vote to represent them will take a good position on the issues that matter to them? A lot of it comes down to rhetoric and trust - and that's how folksy populist politicians manage to win votes and get elected even if better informed voters can see straight through the sales pitch.

The kind of public information campaigns I'm talking about here are the ones that try to raise awareness of the most important points about the most important political issues among the general population who can't or won't do enough research to find out for themselves. It's about getting the core message and basic facts to enough people who would then support doing sensible things as long as they have that essential information. But of course there can be a fine line between public information based on facts and logical reasoning from one party and mere political propaganda from another. The same tools of government and taxpayer funding can support either in exactly the same way - depending on who is already in power at the time.

The only way this changes is if there is real political/government leadership on the issue. That leadership can direct national resources. It can legislate. It can even tax - if necessarily to a very high degree - less useful ways of spending available resources in the private sector to deter waste.

We can't get that kind of leadership in many countries at the moment because too many people will just vote for whichever party they always have or whichever populist nutter has the most convincing sound bites. So before the political problem can be resolved there needs to be much more public education on the realities of the issue.

This is unfortunately a circular argument because the public information campaigns that are needed to fix the education problem are only going to be run by political/government leadership of the required calibre. If anything the populist lightweights will push the other way because dumbing down the voting population helps to sustain their own control and importance.

My hope is that before it's too late there will be enough politicians who are both capable of dealing with the real issues here and capable of taking on the populists convincingly enough to get elected to start moving the needle. Unfortunately I don't really see any other way this gets fixed instead of spiralling downwards.

In particular I don't see why we should assume that the capabilities of AI programming tools will continue to improve at the same pace. There is no obvious source of new and high quality data for anyone to slurp up to train the next generation of models. Much of the change over the past year hasn't come from the incremental improvements in the models anyway. In fact I've even seen a few comments online arguing that some of the newer models had regressed in some respects. It has been the shift towards using agents and automating the incremental refinement of work in progress instead of waiting for human intervention that has been the big change and I don't think we really know yet whether the problems we're already seeing with that approach can be resolved effectively.

Not any time. Your feedback loop must provide some direction so the iteration is at least heading towards an improvement. For novel applications you might not have a convenient way to do that yet.

Even with that provision there's still a possibility of incrementally updating output converging on a local maximum. That local maximum might not be a solution at all. If it is a solution then the model might still miss much better solutions that a real developer with more insight might find.

As you said yourself the models need external feedback if they don't have sufficient information to make adjustments by themselves. In some cases that feedback might be "Start again because you're hopelessly off track". Sometimes even when they start again they just get hopelessly off-track again. That can happen even if they are explicitly prompted to do something else. So even closely supervising the LLM and not using self-iterating agents isn't guaranteed to get good results for novel applications.

Would I routinely code in assembly today? Not for (almost) any new project.

Can I understand assembly and have I used that skill to understand performance problems or debug unexpected behaviour (including some that really did turn out to be caused by bugs in popular compilers)? Absolutely.

I'm not generally a fan of the comparison between what LLMs do and what compilers do. Compilers might vary in their output for given source code but they still follow (hopefully) well-defined specifications. Their behaviour is deterministic and the behaviour of their output is deterministic. With sufficient understanding you can reason about that output or diagnose faults in the compiler behaviour if you ever need to. None of this is true for LLMs.

1. We are working on different types of application and code.

2. I am in a bubble and no-one in it has experienced the standards and productivity that SOTA AI tools can achieve.

3. The advocates are in a bubble and no-one in it has experienced the standards and productivity that expert developers can achieve.

I hope the answer is 1. I fear the answer is 2. I suspect the answer is 3.

That certainly can be true but I would challenge "generally". If you're working on something novel then it's not exactly unusual for even SOTA models to produce a first attempt that makes some very bad assumptions but then get stuck when instructed to use correct axioms instead. This looks a lot like the suduko meme - without any real insight into the problem the models end up just iterating around in circles and never finding a solution.

You probably won't see this very often if you're working on simple CRUD web applications where there are millions if not billions of lines of code in the training data set. IME you will probably see it quite frequently if you're working on - for example - software to control some kind of equipment or analyse the results of some kind of experiment where the LLM might have little if any training data about the field you're operating in.

It can feel that way with all the hype but I very much doubt that is really true. I see an industry that is rapidly dividing into two camps - "move fast and break things" and "this actually needs to work". Writing everything with agents and merging while barely even checking what is in the PR has become standard practice in the former but it will get you laughed out of the room in the latter.

All those extra tests are churning through tokens and CI resources. These are far from free in a direct financial sense. I've also noticed some of the more recent models will try to do a lot of experimentation and ad-hoc testing by spinning up shells or running something like Python scripts direct from a command line. Every time they do that you either have to review whatever they propose to run carefully - which is slow and tedious work - or stick the tools in YOLO mode and hope that your agents don't accidentally wipe your entire filesystem, open your firewall for malware to take over your network, and perhaps launch a few nuclear missiles.

I would respectfully disagree about the value of unit tests as well. The reason unit tests appear to have less value in the LLM/agent era is because current LLMs suck at decomposition and other architecture-level work. They just see a mass of code and change it as a mass of code. This probably results in orders of magnitude more code being written/changed than would have been necessary for a skilled developer working on a well-maintained code base to solve the original problem and that automated work also takes longer in wall time. Again this gets brushed under the carpet because a lot of people trust that LLMs are so good that their costs are negligible regardless of how much work they do. People used to say that about the Cloud transition as well because not needing so many in-house staff to manage your resources was going to be a huge saving. Today we have companies bringing in consultants because they literally can't even work out how much they're spending on AWS by themselves. Instead of having a few greybeards who could make a Linux server do anything we have a few increasinglygreybeards who know which combination of 17 AWS resources they need Terraform to spin up so they can write the web server equivalent of hello-world.c. Meet the new boss - same as the old boss. :)

This does feel a lot like the "Agile era" that was the last silver bullet that was supposed to fix software development forever and the "Cloud era" that was supposed to fix infrastructure and deployments.

Agile had a few good ideas. Code reviews and automated tests are commonly used today.

It had a few plausible ideas that it took too far. We are better at recognising the value of incremental development over big up-front design today - despite the ironic clash this seems to be having with agentic workflows - but almost everyone hates stand-ups and lots of projects have gone off the rails by breaking things down far too much and never committing to anything and so never getting anywhere.

And it had plenty of ideas that almost all of us have thrown out as unpleasant and/or unworkable. Pair programming comes to mind immediately.

What didn't really change was the fundamental nature of software development. Did we adopt a few useful ideas and get a bit more efficient and improve quality a bit? Certainly. Did we get orders of magnitude better at anything and give up all the tried and tested ways of working in favour of radical new ones that never quite felt right? No.

On our current trajectory I'm expecting a broadly similar outcome for LLMs. They're now very good at some things. But they are still pretty bad at other things that also matter - and some of the reasons they are bad at them are an inherent part of how they work and therefore probably can't be overcome (at least not with incremental improvements on the technology that still basically work the same way). So I am expecting to see a period of consolidation with a lot of organisations pulling back from their dramatic leaps into the unknown and downsizing of dev teams once the big AI companies start squeezing financially and the problems of developer burnout and stagnating skills and low morale that we're already seeing after just a few months become endemic. And then as I suggested in another comment I think it's also increasingly possible that we'll see developers unionise and/or push for professional regulation and licensing so they can resist the pressure to just ship whatever their agent wrote without even bothering to check it but still being responsible when inevitably things then go wrong.

There seems to be disturbingly little objective evidence of that. There's certainly a lot of code being written but how much actual value that code is adding is another question. With the scale of resources that have been pumped into AI-supported software development over the past few years where are all the new applications and the quantum leaps in quality and performance in the applications we already had? If anything I seem to be seeing more anecdotes going the opposite way so far.

I respectfully disagree. IME writing a good test suite is one of the areas where current LLMs perform worst. They certainly like to write plenty of tests but those tests aren't necessarily adding much value and they don't necessarily cover the important functionality.

Given how heavily LLMs and specifically agentic workflows still rely on producing something vaguely correct and then iteratively applying guard rails to reach something that actually works I humbly suggest that trusting a very substandard test suite to be one of those guard rails might be unwise.

Which is - of course - absurd. Accepting responsibility without demanding the corresponding authority is a fool's game.

I have never been much of an advocate for unionisation in the software development industry. I didn't think it was necessary to protect the interests of the workers because for most of the industry's history the workers have largely been able to stand up for themselves anyway. Likewise I've never been a big believer in accreditation and licensing practitioners in our field - because who is qualified to judge someone else worthy in such a young industry with so little hard data about what works or doesn't work? I find my views on these subjects are evolving now.

It's not about protecting jobs if they truly aren't needed any more or protecting people working in the industry who refuse to move with the times. The Luddite philosophy isn't going to get us anywhere here. And besides - if AI is as effective as its advocates have been claiming then there should soon be more demand for capable developers to take advantage of the new opportunities. (The Jevons Paradox is relevant here.) But it is about protecting standards. If the tools aren't doing a good enough job then expecting professional developers to ship the code produced by those tools even though they know it's junk is something that needs to be challenged. And if developers are being expected to ship anything important without having the slightest idea whether it even works then that's even worse.

We had a lot of silliness going on when the very low interest rates and huge amounts of VC funding were propping up ideas and practices that would never have survived otherwise. Today we have a different kind of funny money distorting the industry but it's still propping up ideas and practices that we wouldn't normally support or perhaps even tolerate. And just like before no individual is going to be able to hold back the tide and it's going to have to be a collective effort to push back - hence my evolving views on topics like unionisation and accreditation. We've all seen the drop in quality across much of the industry and we all know why it's really happening because we see how the sausage is now being made.

How can you exercise situational awareness against a zero-day attack?

There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.

The Web used to be a great place before surveillance capitalism and adtech took over. Some of us remember it. People participated because they wanted to. People contributed content because they enjoyed it. The incentive was a sense of community and contribution and shared knowledge - and usually there was no expectation of direct financial gain. Basic hosting was included in everyone's normal ISP plan. SEO wasn't a thing. Blogspam just to generate pages to host ads wasn't a thing. AI slop just to generate even more pages to host ads wasn't a thing. And there was still more genuine and worthwhile content out there than anyone could read in a lifetime.

If 95% of the modern Web disappeared tomorrow and all that was left was what people or organisations were still willing to contribute because they enjoyed it and/or it provided some direct benefit then the Web would probably be a much better place. I cite as exhibit A the fact that we're all here posting our thoughts on HN - itself a site that has always run without any of the intrusive advertising we're talking about - without any compensation or reward other than the enjoyment of the discussion and perhaps the chance to learn something new.

I see no reason to tolerate any sort of online advertising that conflicts with the above ideals. We should simply set rules that decide what is acceptable and drop legal nukes on any company - or indeed any entire business model or industry - that fails to comply. Low key advertising for YC's next round? I doubt a single contributor here minds the little banner that pops up at certain times of year. In-your-face auto-play videos that accidentally (or not - it doesn't matter) advertise something dangerous before your kid's favourite show plays? Sue everyone and punish the offending businesses without mercy. It's really not that complicated.

The modern trend of trying to tie everything you ever do to a specific phone number and in some cases not even allowing multiple accounts to be created using the same phone number undermines that compartmentalisation.

My own creepy Google story was about their relatively recent Google TV Streamer products that have basically replaced the old simple-but-effective Chromecast sticks. As soon as we started to set one up it wanted us to have a Google account (entirely unnecessary of course because we had accounts on each relevant streaming service already) and that in turn wanted all kinds of data about where our home was and so on. Obviously the device has wireless connectivity so I'm suspicious that it's also scanning for other network and location data and phoning home with that as well to associate with the physical address it already asked for.

It turned out that when we eventually reset it and used the remote (slow and painful as that is) to type in our credentials for the streaming services we wanted to use then we didn't need the Google account after all. But of course they've already got that account now and no doubt associated lots of quite detailed geographic and network information using just that five minute data grab. This kind of thing really should be just plain illegal. It's deceptive, intrusive, and malicious.

People who used to contribute valuable content have pulled it because the bots were scraping it and reusing their work for free. Of course that was always technically possible but it used to be considered bad manners and not enough people did it to break the whole model. That's evidently no longer the case.

People who want to access real content are now interrogated with the assumption that they're probably a bot before they can even see a basic web page. Those interrogation systems are themselves are now running through a very small pool of providers with far too much influence and control to be healthy.

One of the most valuable means of communication and shared knowledge we have ever invented is being effectively destroyed before our eyes. I don't know what the solution will be - though I fear that the idea of privacy and anonymity online will suffer serious collateral damage - but I suspect that some new information network only available to people willing to identify themselves as a specific real human being in some relatively robust way will be a big part of it just as many sites are now gating their content behind user accounts.

I wonder whether the latter might be sufficient: have your terms state that user accounts are only available for real people and by using any automated system to attempt to create one the operator agrees to pay the site operator some ludicrous amount of money in recognition of the damage to their operating model that is posed by deceptively allowing automated access. And then make sure that such terms actually stand up in court - by legislating to enable them if necessary - in enough of the world to kill the AI scraper/bot model.

For all the claims about security problems - and there were many and the complaints were valid - people seem a bit too willing to overlook the much greater attack surface of modern browsers that still incorporate similar flexibility and functionality but through other protocols and native Web standards now instead. For better or worse today's "evergreen" browsers roll out new functionality more quickly than before but their most important innovation was introducing frequent automatic security updates to a general non-technical audience at a time when that certainly wasn't the default for most desktop software. Take a look at how many significant security issues get fixed in any of the major browser on each update cycle and you can see that even today this is still far from a solved problem.