darccio

I was about to start building it but that could escalate to HackerHackerHack where all the HackerHacks created, posted, and mentioned would be listed. We don't want a Cambrian explosion of HackerFoo sites.

I'm working on https://corb.ax from the containerization side. I can check on integrating it with Herdr.

Docling is also a tool to consider, purely local, even though it's now AI-friendly too: https://docling.ai/

This censorship mechanism comes from 2011, when it was created under the Spanish Socialist Party's government lead by Zapatero. There was a lot of backlash, but the Intellectual Property Comission (also known as "Comisión Sinde") was never dissolved under the next governments' rules.

Re: La Liga's censorship, it isn't promoted by the government but by La Liga itself with the collaboration of the largest ISP, Telefónica/Movistar. Movistar used one of the subsidiaries to denounce themselves and other IPs so they would reach a friendly agreement (again, with themselves) that the judge considered enough to enforce the current Cloudflare blocks.

Indeed, this approach sounds like the way to go for a really independent ecosystem. Thanks for the clarification and the additional insight!

Just to clarify, when you say "self host issues/PRs" is it mostly "self host a knot"? I kind of expected something similar to what you can do for CI but I'm not able to find any docs regarding self hosting issues and PRs outside of Tangled itself.

This approach feels just "add friction to your AI usage". It seems the worst of both worlds, both hand-coded and vibe-coded. You paste your code into a chat so it can tell you what to type yourself (the codebase access rule looks optional, but the copy-paste is one way by design). Replace "chat" with "Stack Overflow" and it'll sound familiar. You don't need to paste code into a chatbox if you're going to do an AI review later anyway.

The security argument is the strongest part of the post, and I don't disagree with it, but what it buys you is the review, and a review catches what you missed, whoever typed the characters. None of the ten dogmas follow from that.

My general approach is to design beforehand, do an adversarial review with AI, socialize it with humans (if needed), generate a plan, and start working item by item. Always keeping me, the human, in the loop (not that `/loop`), going through the steps generating code. Finally, a manual review and one AI adversarial review of the feature branch in a clean context, going section by section manually and discussing anything relevant, and off you go.

Writing code by hand feels great, but even local models can generate fine code. Deterministic linters and quality checks are what keep the quality in line. You can always modify things as long as you're in the process, but at the end of the day, you'll review more than you write. We're closer to being the assembly line's inspector than the crafters we once thought we were.

A PR staging area. This would be a good step forward.

I'm a happy smolmachines user. It has some rough edges but it works really great. I haven't tested microsandbox and boxlite, and maybe they consume OCI images too, but smolmachines is a winner because of that.

I wonder if it's usual for other professions/fields to have this tendency to create laws/aphorisms so ingrained. I'm biased as software engineer but it seems to me that is more common in computer science than others.

Even with Sonnet or "lower" models like Kimi is trivial. The only thing I still find with AI-generated code is some degree of overengineering.

I don't feel they resist. Quoting them:

> We understand your concerns and truly appreciate your suggestions. As previously mentioned, this is not something that is enforced by the reference implementation — these are simply recommendations, not requirements, for any wallet implementer. That said, we recognize that this is a sensitive topic, and we may need to revisit it, even at the level of recommendations.

> The README files for both the iOS and Android Wallets have been updated to mention only OWASP MASVS compliance, without referencing any specific APIs.

I understand their position, but I also get the concern, especially around existing implementations like the Italian app. I think it's mostly that they have different priorities than ensuring that the reference implementation is a perfect guideline for member states.

This looks like a good vector for a European Citizen Initiative around removing all technological dependency on non-EU providers.

Having explored that approach (†), I can tell that generating Go assembly is harder than it seems.

†: I've tried to transpile Rust code through WASM into Go assembly, and I've also explored how to inject trampolines into Go binaries (which involves generating Go assembly too).

It makes no sense. eIDAS 2.0 specs don't require specific hardware [0]. They basically store verifiable credentials [1] and any other cryptographically signed attestations.

This feels like laziness from German implementers, as they don't want to (quoting the spec literally) "implement a mechanism allowing the User to verify the authenticity of the Wallet Unit".

0: https://eudi.dev/latest/architecture-and-reference-framework...

1: https://eudi.dev/latest/architecture-and-reference-framework...