hackerman70000

Fair point. I was conflating taste with design, which is a different thing. But I think this actually strengthens the argument. If even the people whose entire job is visual judgment are mostly executing within constraints set by someone else, then "taste" as an individual moat is even weaker than the article claims. The leverage is in setting the constraints, not in having better judgment within them

For the evaluation question: for small code models, try-to-compile rate on generated functions is the simplest metric that actually correlates with usefulness. Perplexity tells you the model learned the distribution, compilation rate tells you it learned the structure. Beyond that, exact match on function body completion given a signature is more informative than open ended generation benchmarks

Cool project but calling it a Dropbox replacement is doing a disservice to both Dropbox and to people who might actually use this for important files. Dropbox is a sync engine. This is a web UI over object storage. Those are fundamentally different products solving fundamentally different problems

Six months from now half of these abstractions will have been renamed or removed once real users push back on the cognitive overhead. Google has a pattern of releasing infrastructure that's perfectly shaped for Googles problems and awkward for everyone else's

"AI agents are not adversaries" is doing a lot of work for a product pitch. Supply chain attacks via pip install, prompt injection via fetched documents, and model hallucination all produce behavior indistinguishable from a malicious actor at the syscall level. Whether the agent "has intent" is irrelevant to the kernel. Defense in depth means you assume the threat model you're comfortable with is wrong

This reads like cope. If taste were a real moat, designers and art directors would be the highest paid people in tech. They arent. Execution speed, distribution, and capital are moats. Taste is a tiebreaker at best. The market consistently rewards "good enough, shipped fast" over "exquisite, shipped late".

Cloudflare pushing PQ by default is probably the single most impactful thing that can happen for adotpion. Most developers will never voluntarily migrate their TLS config. Making it the default at the CDN layer means millions of sites get upgraded without anyone making a decision

The specs were derived from the code, not from the original requirements. So this is "we modeled what the code does, then found the code doesn't do what we modeled." That's circular unless the model captures intent that the code doesn't , and intent is exactly what you lose when you reverse-engineer specs. Would love to see this applied to a codebase where the original requirements still exist

I reread this every couple of years. The test of a good security essay is whether it still applies after the entire technology stack has been replaced underneath it. This one passes every time. "Default Permit" is now the default posture of every AI agent with tool access

The real story here isn't Gemma 4 specifically, it's that the harness and the model are now fully decoupled. Claude Code, OpenCode, Pi, Codex all work with any backend. The coding agent is becoming a commodity layer and the competition is moving to model quality and cost. Good for users, bad for anyone whose moat was the harness

Finally an LLM that's honest about its world model. "The meaning of life is food" is arguably less wrong than what you get from models 10,000x larger

What does the "continuity layer" actually do? Is it injecting the architectural rules back into the system prompt at each turn? Because that's what I do manually with a pinned context file in Cursor and it solves 80% of this drift problem

The progression from "best editor" to "operating system" to "I literally run my company from it" is the most Emacs thing I've ever read. But seriously, the git-based review of AI agent output is a smart pattern. Automation without blind trust is the right framing

The title is doing a lot of heavy lifting here. "Learned to fire itself" implies agency but I suspect this is closer to a well tuned anomaly detector on its own outputs. Still useful, just not as dramatic as it sounds

I'm the one who found and reported these while doing security research at striga.ai. The pac4j team was responsive and shipped fixes quickly. If you use pac4j with LDAP or rely on its CSRF protection, upgrade to 6.4.1 / 5.7.10 / 4.5.10

Every team I've seen write a fetch wrapper eventually reimplements half of axios, just worse. The article works for a bookshelf demo app. In production you'll want retries, timeouts, request deduplication, cancellation - and suddenly your "simple wrapper" is a library with no tests and no docs

The problem with "permission boundaries" is who defines them. You're just moving the hard problem from "what should the AI do" to "what conditions should gate execution." That second question is equally hard and equally context-dependent. Still useful as a framework though, at least it makes the failure mode explicit.

Stock photo pipelines are wild, someone tagged this "code on screen" and it ended up on a C++ book cover. Same energy as every "hacker" stock photo showing htlm

The prototype chain lookup on a plain object as a strategy map is a pattern that shows up everywhere in JS, not just axios. Surprised this wasn't caught earlier

This is why AST-based sandboxing in JavaScript is fundamentally fragile, every new syntax feature is a potential gap