evolve-maz
Sentinels just help you wrap that up nicely and for more general use cases, but theres value in stepping back and thinking about where the unset vs no op case matters.
I'm glad they're doing this, because it lets me see an extreme of LLM development.
Those sorts of changes are really rough to manage. Maybe still manageable by LLMs but we'll find out.
While that's not technically the case here (given Mononoke's license) it is still quite negative in my view. We will have fewer people wanting to share ideas openly since LLMs are so good at not only finding them, but also not attributing them. This also leads to a loss in diverse collaboration, which is probably one of the biggest drivers for good software.
Right now there's probably a lot of these "novel" ideas floating around which models can present as their own, but that's raiding our coffers with no inbound future stream.
That exploration helped me see whether general "best practices" are applicable in this frame, and let me justify if not.
That was also prevailing opinion pre LLM:
> Only the hands on engineers can shape it since the design evolves in step with writing the code.
So I'm curious to know where people changed their minds.
> Architecture astronauts are out of touch and shouldn't give any advice because they haven't written code in ages. Only the hands on engineers can shape it since the design evolves in step with writing the code.
To
> I focus on the architecture patterns and high level goals and let the LLM take care of the rest.
Similar commentary was shared about anyone not writing the code daily, not just the architects.
No gotchas, I just think it's something which calls for introspection.
If I still need to do db-like things in python I think duckdb is better.
Sorry to hear you're having a rough time with work. I do think AI availability has made otherwise smart people put out lazy work. But I also think that there are more people who still "code by hand" than you think.
You might find some joy by going to certain events where people talk about different items coding-wise. I enjoyed the talks for this conference recently https://www.youtube.com/@softwareshouldwork (particularly Richard Hipp's, Delaney Gillilan's and Carson Gross' talks), maybe you can find similar spaces. The benefit has been Youtube's algorithm recommending me better software talks now too.
This work was fraught with bugs, a large portion of which came down to disagreement of what was coded v/s what was written. Even if you had airlines sign off sentence by sentence exactly what you wrote down in English, that's too open to interpretation.
People don't appreciate how the same sentence can be read five different ways by different people (or the same person on different days). We had to structure our documents to be closer to pseudo-code than to English to get any meaningful consensus on the definition.
.PHONY: help
help: ## Show this help message
@grep -E '^[a-zA-Z_-]+:.?## .$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' @echo "" @echo "Examples:" @echo " make deploy" @echo " make deploy-branch BRANCH=feature-x" @echo " make deploy AUTO_START=true"
.PHONY: deploy
deploy: ## Deploy from current branch (default main) (use AUTO_START=true to restart service after)
@$(MAKE) _deploy BRANCH=$(git branch --show-current)
On the flip side, it helps to have endpoints which have a query param linking to some sort of resource update time stamp. That way you can query to only get those items changed since last poll.
They need that data so they can push into wider job automation, displacing the SaaS companies who used Anthropic in the first place.
- Ask cursor to summarize your existing repo to write you a nice readme
- Cursor opens repo
- Cursor looks at current code
- Because it's going above and beyond, it also wants to give you some metadata about the code (other branches for things in development, maybe previous tags as milestones, etc)
- To do that, it runs some git commands
Now the malicious behavior. I ask Cursor to evaluate some remote repo. It clones it down and then runs the git command from the working directory. However, if you just call "git ..." from the command line there is ambiguity about that. What if there's already a git file in the directory which windows thinks you want to execute?
This could happen with an untrusted repo. Or could happen from you switching branches to a compromised branch (which you wouldn't expect to immediately run some code).
Normal way to handle this is using fully qualified path names for things. E.g. instead of git ... you give the full path to system installed git. Annoying for humans to type but trivial for Cursor.
The good managers I saw also had this ability. The managers I didn't enjoy working with / saw struggle were ones who either never had that ability, or had lost it a long time ago.
Note I'm speaking about line management. There's a world of difference between managing a dozen or so individual contributors vs managing senior managers / directors. However, managing LLMs is analogous to line management.
My experience with good developers has been:
- Create something a bit ugly which works
- As more use cases come in, refactor code and clean up old gnarly bits
LLMs tend to work architecture astronaut style mixed with a junior for implementation. Build theoretically good interfaces but then implement dependencies across all of them. And when changes happen, keep feeding that cycle.
In that case, the backend will likely have a class instancr representing it, with the first field being a discriminator on the class and the remaining fields being the details. And regardless of what the frontend does, the backend will revalidate always because you can never trust data sent from a frontend.
All that to say, maybe the form could be server side rendered, with an adaptor to convert a class definition into an html form fragment, and either embedding the js "rules" into the html itself, or making it a web component for containered usage.
Doing it this way is a big deviation from the current status quo, but I've found it to work very well and cut out a whole range of bugs. Plus it makes me think about what is truly client side state (no chance of staleness) vs server state cached in client to avoid repeat server calls (could be stale, leads to bugs).
From personal experience, any "correction" leads to an LLM writing more code, or stripping apart interfaces and mixing logic poorly, or adding some hidden control flow just to catch that edge case rather than the general case for that category of input.
Obviously you need a mixture of high recall and low false positive rate. If 7/8 flagged items are fine its much more likely people will ignore the warnings, much like they would any security tool with a 90% false positive rate. That is not optimized for the customer.
The recommended htmx way would be to hook up an onclick button to inline js or if you dislike that, a function called goBackOrInbox. It can then be something like:
function goBackOrInbox() { if (document.referrer) { const path = new URL(document.referrer).pathname; if (path.startsWith('/inbox')) { history.back(); return; } } window.location.href = '/inbox'; }
And if you use that pattern a lot then you can parameterise the function with whatever the route should be.
Using an LLM to one shot a small function (something i would do with a very specific search on Google or SO) is handy. Giving it a harness and free access to a code base leads to some terrible code, and doubling down with more instructions and agents in the loop means more time writing the rube Goldberg orchestration rather than just opening up an editor and writing code.
Yes you have to add this yourself, but you only need to add one js function once and be done with it.
I've used the callback pattern for custom error handling for all hx responses.
- Form submission in front-end admin panel for users, for "new scheduled job"
- Form allows defining a job name, job type (while I let users define jobs, I limit it to a subset of python functions that I trust but are still general enough), job parameters (just a json blob for kwargs for the python func), frequency, and timeout.
- For the whitelisting of functions it's easiest to have a directory in your src which has the different python functions that are usable, and when you do a "get" for the form you populate the dropdown with the scripts from that directory / some metadata.
- The backend (fastAPI) saves the details in a DB and creates a CRON file for the job, to add to the crontab. I basically have a template bash statement with the timeout built in and logging hooked up to it. And when python functions are called I have a helper which grabs the JSON kwargs from the DB or a filecache (if remote DB and I don't want to hit it every minute or something) to avoid cmd line injection.
- Also have an "edit scheduled job" which opens the same form view but with items pre-populated, and the submit going to a patch endpoint instead of a post.
It's stupid simple but lets users define a range of jobs. Things like having daily backups, where to send the backups, pulling things from / pushing things to an API frequently, etc.