eddythompson80

Does a security incident page really need to connect to 11 3rd party domains. smh

I'm confused by the status page. It says no active incidents, also no recent incidents. But when you click on a list of all incidents, there are 4 from earlier today with the most recent one from 1 hour ago. Is that not considered "recent incident"?

You can't make these argument against the position that all these problems will be solved. Any problem you point to, someone would argue that an LLM can solve. Expensive compute? costs could get 1000x cheaper. Longer context gets worse output? Newer models would solve that. Ever increasing massive codebase? We'll get a 1B or a 1T context window. Time spent in test runners? parallelize, or selectively select tests, or even better; ask the LLM to optimize the tests or develop a 100x faster chips. Runtime cost of extraneous abstractions? Ask the LLM to keep functionality and focus on performance.

If you seriously believe we have "solved coding" or achieved AGI in coding, what is not possible? Any argument you can come up with will be easily dismissed with "we'll just ask the AGI to solve that problem".

There is always something useful to learn, even if it's a mistake. pnpm in particular centralizes your packages, and symlinks them to each project that needs them, which cuts down on file copy and disk usage significantly. The same principle could be applied to cargo/rust, python venvs, dotnet, or even large C++ projects could improve their disk usage and file copy significantly if they followed the same idea. Why do you have to have a massive target folder in every rust project if all that could live in a hash addressable shared store. Its the same basic idea of CoW or deduping file systems, but done in the application for far better result.

There are these charts, studies, and articles about global wealth inequality that make the rounds every now and then. They often make the point one would expect them to make. I was nonetheless surprised to learn that because of the way assets and debt are used to calculate these numbers, the poorest people in the world aren't those surviving on $0.10 of daily income in some underdeveloped part of Africa as one might think, but rather an odd mix of med or law school graduates in the US and stock traders or gambling addicts in rich countries. One French dude alone is at the bottom with a net worth of -$8B.

Not true. Azure has a very different internal pricing. You can often get a glimpse of it if you have a.. particularly enterprising TAM. What happens sometimes (Like now when compute/GPUs are in high demand) is finance department would calculate the opportunity cost on allocating those resources internally vs selling them externally. The calculation isn't even always straight forward. What is the opportunity cost of using compute for internal CI or company operations vs selling them externally? It's not a straightforward equation and you would have to adjust the scale often depending on how clogged your internal processes get.

The extremely discounted internal cost promote waste, so there is always a room for improving efficiency, but that too has a cost.

Not even close. "enterprise" companies are negotiating contracts. Call it pre-provisioned capacity, wholesale pricing, etc. Same is true for AWS, Azure, Salesforce, or literally any SaaS provider ever. There is a reason literally every single pricing page for any SaaS provider has an "Enterprise? call us" column.

Unironically, I think we will see a lot more of this given how engineering is being done currently. I have been involved in 2 green field projects in the last 2 years. Both have been rewritten or had massive "ship of theseus" type changes multiple times over that time window.

Engineers working on new products, thanks to LLMs, have very little understanding of the technical details of the product. They have the same level of understanding a traditional high level manager had of products they owned. If you ever worked in an engineering org with an M2 or M3 who always attended your outage review, and in every outage review something has to involve some issue with Postgres or your Kafka queue, that disconnected M3 would conclude:

    "Almost every outage involves some problem with Postgres. My conclusion, observed over the last 6-12 months, Postgres is bad. I see this new FancyDB or DynamoDB thing is popular on Twitter. We should try that"

I have lost count of the number of idiotic takes like that from M2s or M3s who have no idea how things work but instead focus on keywords they can latch onto that seems to be in the intersection of all issues. Then the logical solution is just to remove that and see what happens. This used to be very expensive, but if you can throw an LLM at a code base and say "Replace Postgres with FancyDB, split it to a list of logical checkpoints adding regression testing when missing to each checkpoint and open stacked PRs for all checkpoints", let it churn for an after noon, and 46k-line change PR (and $800 token bill) later you are ready to try FancyDB, why would you not give it a try? Then if you have issues with FancyDB, are you gonna spend the time to understand what's going on or just say "lets try DynamoDB next"?

*VS Code extension for Claude Code for Cursor VS Code Fork

Probably depends on the company. Plenty love to publish useless blog posts about how “We, a SaaS company that produces React components, fixed a vulnerability in Ubuntu Kernel” because we’re involved in all of our tech stack like that. Linux kernel, node and react is our stack and we take ownership of it seriously dawg.

I don't disagree with you, but I think generally when the mistake involves compromised user data, the answer is a bit more emotionally driven. People get rightfully mad when things like that happens, and services usually keep the incident in a "Mitigated" status while they "work with their customers to ensure blah blah blah" or whatever. Everywhere I've personally worked the Mitigated->Resolved involves publishing a postmortem, repair items, and general assurances or safe guards based on learnings from the incident that the issue won't happen again. However, the industry as a whole doesn't have a standard for what the line between Mitigation and Resolution is.

Yes my view mostly from within large engineering organizations. And yes, what you describe is pretty typical for engineers (and especially founding engineers) in young startups. Doubly so if it’s a startup with a technical product. Large organizations always envied startups’ efficiency and pace because of that, which is why the traditional sense of product management has been handed to engineering teams. This has been happening in the enterprise side for a long over the last 15 years and predates AI as I mentioned. It’s just more collapsing of disciplines now which is the answer I was giving to OP’s question.

This has been happening before AI, but AI has turned it up to 11. The way I usually put it, senior engineers are the new engineering manager, engineering managers are the new product managers, and product managers are now something in between sales, consultants or social media contacts. AI made senior engineers pick up more product management from their engineering managers, and engineering managers are picking up more sales and social engagement, and product managers are in a limbo but the young ones are pushed to junior engineer roles.

In large companies there is also the politics game. The more freed time senior engineering manager and senior product managers get, the more politics intensives and waste more of their time.

I use the term “product management” in its traditional sense of establishing scope, feature prioritization, user experience, shape of integrations, etc.

Warren Buffett once gave a great answer to a similar question, but it was about the textile industry. He said technological advances that promise to reduce waste by x% or improve efficiency by Y% or boost production by W% or reduce cost by Z% rarely actually pay off. They would get textile machines manufacturers promising them great improvements in the new line of machines, and for the most part, those improvements would be realized, but their end margins as a business wouldn’t improve. He said it’s simply because the same technological edge is given to all their competitors as well. With no moat (his famously favorite metric) all textile makers were always competing on the same grounds regardless of the technological progress.

not saying it's not possible to setup your environment that way, but in my experience, if you're installing outside a sandbox, you're also running outside a sandbox. I don't even follow the flow of installing packages outside said sandboxed environment being a container or VM and running inside it. People who use dev containers will have the entire toolchain in the dev container, and with VMs, while you could share the file system with something like virtio-fs or SMB/NFS, I don't understand the flow of `npm install` on the host then run in a VM. that sounds pretty awkward to me.

I think it's mostly about attach surface. There is nothing fundamentally different in the threat model or security boundary between any language in terms of how they manage their dependencies. Even platforms like Maven or NuGet that don't have an install script, you're still likely to trigger a build or a quick run for the application right after installing that would trigger code execution anyway.

The chances of a person getting hit during the `npm install` phase is bigger but not that different than the `dotnet add package ... && dotnet run`.

I do agree though that the massive surface of npmjs, pip, and even cargo means that package signing is also not realistic. If you have the average 300 npm packages, no one is gonna pay attention to the authenticity of 200 different signing keys. It would be a lot easier with something like java where you probably just need to trust a handful like openjdk, jackson, junit, or log4j keys and be 90% there. (And hope the supply chain attack hasn't compromised the signing keys too of course)

That sounds insanely expensive. AWS S3 only makes sense if your workload is also in AWS. Using AWS S3 while having your compute elsewhere is a recipe for an insane egress bill.

Unfortunately ANC for plane rides is the most important feature for me. I always get out of plane rides tires and with a headache. Good ANC headphones reduce that significantly for me. I don't think any wired-only headphones have decent ANC. Nothing like the current bluetooth headphones at least.

Plenty of recent Bluetooth headphones support wired audio and wired charging while listening. Newer ones have replaceable batteries too (with some screws, though the process could be made simpler).

Honestly, the first set is the replacement for department stores where you could go and experience the product for yourself. They try to solve the problem of the first impression you might get. For example, I have been in the market for an over-ear bluetooth headphone, and as a result started checking online reviews. There are a ton of audio review sites now that do lab acoustic testing, mic samples, write articles with details about dimensions, weight, build quality, materials used, head comfort, cup depth, clamping force, ANC performance, etc.

Extremely detailed and generally great testing. Though tbh, if you were in a department store with all the options in front of you, you would give them all a try and pick the one that you like the most. You can evaluate half of these variables for yourself in a moment by holding and trying it out. If you're an audiophile, then you would can have your music and give each a listen in the store and decide better than a curve graph.

I spent a ton of times reading all the reviews and narrowing down the options, but was still between 3 or 4. Ended up driving 45 minutes to the nearest bestbuy and they had a decent selection. It was amazing how quickly I eliminated options and ended up picking one I liked.

Are language servers forced to support it?

I don't know man. Marijuana is/was banned in most of the US. LOL, how do you ban a plant?

Completely incoherent reasoning that's falling for a clear false dichotomy fallacy.

Yes, I know that this article is about IP rights for Netflix shows and movies. OP said they initially thought it was for all of Xbox, which is a theory that's been gaining traction online in gaming and tech spaces that Microsoft is trying to sell the Xbox business maybe to Tencent, a Saudi fund or private equity[0]. There were a bunch of threads about it on various gaming subreddits.

[0] https://www.theverge.com/games/962837/microsoft-xbox-spin-of...

I’m not following how that is a response to what I said. I’m not talking about Valve’s profits. I’m talking about the profit of the game developers selling their games on Steam.

I think I understand why Microsoft costs are higher than others due to their a spending spree, so the break even is much higher.

I initially misunderstood OP. However the more I think about it, the more it seems similar though. If Steam is charging game developers a 30-20% cut, that must mean those game developers margins are higher than 30-20% or there will be no point selling on Steam. It seems that Xbox would be expecting their Studios to operate at the same efficiency as others in the market then, no?

Yeah, that's the Nintendo model I mentioned.

Nope, you are not really comprehending my comment, and that’s a false dichotomy. Here is a non-exhaustive list of extremes:

- No regulations what so ever, it's free for all

- Complete ban on all AI

- Only OpenAI and Anthropic can do AI

- Only the Government, the Military, NASA or other entities approved explicitly by Congress can do AI.

That's not the current status quo either

> hold companies and individuals responsible for the consequences of their actions.

Are you referring to the model providers or the companies/individuals using the models or both?

Like I totally get it about the one instructing the model that result in some harm (be it the model provider themselves or ones using it). If a person buys a gun and commits a crime, they are held responsible not the gun maker or seller (assuming the seller followed selling regulations too, and it wasn't the gun maker or the gun seller who committed the crime obviously). That's already the case though. For example, Cyber attacks are a crime regardless how you do it. It's not like a company can trade publicly today that's using AI to attack other companies intentionally. I'm sure if huggingface or the government wanted to sue OpenAI for cyber attacks, they could be successful in getting paid for damages or getting a fine imposed. All parties are just choosing not to at the moment, but if a company makes a habit of doing that, they will get sued. If Chase or Amazon tell Meta to stop Muse from using them, Meta will have to abide or they will get sued.

On the other hand, holding model developers and providers responsible for the model's results would be a form of AI regulation, right? Like you can regulate social media websites by holding them responsible for their user's posts too or deregulate them by not doing that, we ended up with the latter. If Section 230 never happened in the 1990s, then the internet would look very very different today.

Furthermore, it seems to me that holding model developers and providers responsible for the results of their models would be that regulatory capture every one is against, no? like how can an opensource model developer exist without getting sued into oblivion. And how can a small model provider survive if there is always a looming disaster they might be responsible for. As a result only the big players would exist and they would heavily control who gets access to these models through a lot of inner deals and contracts on how they can be used.

oh I see. I misunderstood OP

Doesn’t Steam also take a 30% cut?