joshkel
The article faults LLMs for not being more creative (riding in the city in the rain, in East Asia, in outer space, etc.). But, if prompted, "Generate an SVG of a pelican riding a bicycle," with no additional details or specification, then I would _expect_ something generic: a side view, nondescript terrain or perhaps terrain associated with a pelican (i.e., beach), little clothing (because birds don't wear clothes) with the possible exception of something strongly associated with bicyclists (a helmet).
The article talks about "the LLM diversity collapse problem," which makes it sound like LLMs are getting less diverse over time, but the linked benchmarks suggest that newer, more capable models are _more_ creative.
Out of curiosity, I tried a couple of prompt variations in Opus 5.5. "Be creative" did a beach scene but added fish to the bike basket and a lighthouse in the background - not too creative. "Pick a unique and creative variation of this concept" resulted in a "midnight circus act" of a pelican riding a penny-farthing on a tightrope while balancing a fishing pole with fish (and, this time, two lighthouses - the tightrope is implausibly strung between them).
I really didn't mean to encourage emotional manipulation, soulless optimization, listicles, etc., although I agree that a lot of writing online falls in that bucket, and it's even likely that the advice I uncritically quoted was aimed at that bucket.
I obviously should have thought more carefully and written more clearly.
But I don't think that "Write each sentence to give the reader a reason to keep reading" and "Actually provide value to the reader" have to be mutually exclusive. Instead, I think of it as (like you said) communicating the value effectively: dispense with the throat-clearing, meandering intros, irrelevant personal details, weak thesis statements, etc., and write tight, well-crafted prose that respects the time and honestly maintains the interest of those who'd benefit from the value you can provide. (I certainly don't claim to be an expert here! Appreciate the video link.)
"The sole purpose of the first sentence is to get you to read the second sentence. The sole purpose of the second sentence is to get you to read the third sentence… and so on."
(quoted from https://thehustle.co/write-like-hustle-boring-stuff-writing-...; the original idea is apparently from Joseph Sugarman)
A year or two ago, I finally gave up:
1. The IDE was simply too slow - notably slower and "heavier" than VS Code in particular - and it seemed to regularly get slower.
2. Bugs - from the complex (TypeScript constructs that tsc itself handles just fine while WebStorm's code analysis kept throwing false positives on) to the trivial and silly (failing to properly handle the <col> tag in React), and often staying open for years.
Meanwhile, VS Code just kept getting better, addressing the complaints I had with it while staying fast.
I work almost exclusively in TypeScript these days; as other commenters pointed out, I'm sure that JetBrains products are still great for other languages.
And their refactoring tools remain second to none. I'm profoundly disappointed in our industry that the VS Code developers apparently looked at JetBrains, with its arsenal of expertly crafted, deterministic, testable refactorings, and said, "Nope, we'd rather make everyone use inherently random language models for anything more complex than Rename Symbol."
Personally, I'd be happy with a larger suite of utility functions (say, most of Lodash / es-toolkit - remove the need for left-pad silliness), probably SQLite bindings (having a good persistence layer is great, it's perhaps the most robust and most widely deployed software on the planet), but not YAML (complex, security concerns, parser differences) or image handling (again, security concerns).
Node.js is, IMO, actually pretty good these days; they're regularly adding useful built-in tools that remove the need for add-on packages. (The ecosystem is so big that getting those updates to filter out is hard.)
"When Claude proofreads text written by a person, what it gives back has generally only been lightly edited; because nearly all the words are the person’s, there’s very little (if anything) for the watermark to attach to. Depending on the length of the text and how heavily Claude has edited it, those changes might not be enough to make Claude’s involvement detectable."
(emphasis added)
> Even if Plaintiff had made a “vote dilution” or “one person/one vote” claim under the Equal Protection Clause, it fails. Plaintiff does not assert facts that would adequately support such a claim. Plaintiff does not allege... that natural person voters are a minority or are politically cohesive [or] that entity property owners vote sufficiently as a bloc to usually defeat the preferred candidates of natural persons.
Although he also notes that the recent Callais case, severely weakening section 2 of the Voting Rights Act, may change this - and, of course, waiting until the Legalize Asbestos Consortium is doing its thing and trying to file a lawsuit is much more complex than preemptively saying "only natural persons can vote."
Yes, and these are positive changes. But they aren't security boundaries, and they don't mean that pip won't execute arbitrary code: a malicious update could ship an update with sdist instead of wheels, a malicious pyproject.toml could provide an arbitrary-code `build-backend`, etc., and pip would still function as designed.
I appreciate the clarifications/corrections on PHP.
> Which most people don't install directly, but have already had built for them by their distro.
Yes, but the original claim was that npm is "particularly susceptible to these attacks" because "npm can execute code after install and most package managers don't do that." I don't think that's accurate: we've seen hundreds of NPM packages compromised in multiple high-profile attacks over the last several months, while .tar.gz was used for decades with nowhere near the same number of compromises.
Rather, I suspect it's a combination of factors: Early JS had a relatively anemic standard library in the early days, and NPM made code reuse dramatically simpler than before. This normalized the use of large and deep dependency trees among JS projects. And the extreme popularity of JS, the centralization of NPM + GitHub, and increased usage of automation makes attacks more practical and more lucrative.
Taking a step back from that particular debate, I'm very much in favor of changes like what you describe.
Taking still another step back, I'm not sure that even those will be enough. If I download a package, it's because I intend to run its code at some point: if it's malicious, I may be less automatically hosed than if its postinstall script runs, but I'm still hosed at execution time. I trust my distro packages, not because they don't execute arbitrary code on installation (RPMs and .debs both do), but because I _trust my distro_. NPM et al. simply cannot vouch for every package they host.
Thanks for the reply!
Python packages traditionally use setup.py to install code, and setup.py is all executable code under the installed package's control.
Native Ruby Gems execute arbitrary code via extconf.rb.
Pre .NET Core, NuGet packages could ship scripts like `install.ps1`. That's been removed, but they can still ship `.targets` and `.props` files that are incorporated into your build (and so can run code at build time).
PHP Composer packages can ship install scripts or configure themselves as Composer plugins.
The venerable .tar.gz approach to packaging, covering decades of C and C++ code, is all about executing code during installation.
There are measures that can help (e.g., PHP Composer doesn't run install scripts of _transitive_ dependencies) but the JS space is adopting measures that can help too (like pnpm's approve-builds).
"If the jury determines that at any time before those dates, Musk either knew — or had or should have known — that he had a claim that he could bring, then his suit was brought too late. The consequence of being too late is swift and absolute. If the lawsuit was filed late for a particular claim, that claim is out of the case; if it was too late for all of Musk’s claims, the lawsuit is over."
That's where the question of fact (i.e., the requirement for a jury decision) came in: "What was the statute of limitations?" is a question of law, but "When should Musk have known that OpenAI was moving too much toward for-profit?" is a question of fact (and, here, determines whether the statute of limitations applies).
I want software that works.
Yet the economics of the software industry, and perhaps the economy as a whole, seem to inexorably push toward the former.
> TypeScript 6.0 arrives as a significant transition release, designed to prepare developers for TypeScript 7.0, the upcoming native port of the TypeScript compiler. While TypeScript 6.0 maintains full compatibility with your existing TypeScript knowledge and continues to be API compatible with TypeScript 5.9, this release introduces a number of breaking changes and deprecations that reflect the evolving JavaScript ecosystem and set the stage for TypeScript 7.0.
Most date/time libraries that I've seen have a only single "date/time" or "timestamp" type, then they have to do things like representing "January 13 2026" as "January 13 2026 at midnight local time" or "January 13 2026 at midnight UTC."
Temporal has full-fledged data types representing the different concepts: an Instant is a point in time. A PlainDate is just a date. A PlainTime is just a time. ("We eat lunch at 11am each day.") A ZonedDateTime is an Instant in a known time zone. Etc.
Temporal draws a lot of inspiration from Java's Joda-Time (which also went on to inspire .NET's Noda Time, Java's official java.time API, and JavaScript's js-joda). This is helpful; it means that some concepts can transfer if you're working in other languages. And, more importantly, it means that it benefits from a lot of careful thought on how to ergonomically and effectively represent date/time complexities.
I interpret this as meaning there was an implied "if you screw this up" at the end of "they could kill three major product lines with an email."
As phiresky points out, you're still "download[ing] arbitrary code you are going to execute immediately afterwards" (in many/most cases), so it's far from foolproof, but it's sufficient to stop many of the attacks seen in the wild. For example, it's my understanding that last month's Shai-Hulud worm depended on postinstall scripts, so pnpm's restriction of postinstall scripts would have stopped it (unless you whitelist the scripts). But last month's attack on chalk, debug, et al. only involved runtime code, so measures like pnpm's would not have helped.
Dr. Hipp's position is paraphrased as, “I cannot trust the compilers, so I test the binaries; the source code may have UBs or run into compiler bugs, but I know the binaries I distribute are correct because they were thoroughly tested" at https://blog.regehr.org/archives/1292. There, Dr. John Regehr, a researcher in undefined behavior, found some undefined behavior in the SQLite source code, which kicked off a discussion of the implications of UB given 100% MC/DC coverage of the binaries of every supported platform.
(I suppose the argument at this point is, "Users may use a new compiler, flag, or version that creates untested code, but that's not nearly as bad as _all_ releases and platforms containing untested code.")
https://fortune.com/2025/09/18/sardar-biglari-war-against-cr...
Or maybe it's a small enough API but a lot of concepts. Or maybe I'm just grumpy that the days of "it's just a view layer" feel long ago.
https://hacks.mozilla.org/2010/06/beyond-html5-database-apis...
Not necessarily. My take was that the practice of choosing may well be more valuable than the harm of the occasional regretted choice.
I'm disgusted with the executive branch's actions and congressional GOP's enablement. And, since the administration at times seems to want a fig leaf of legality, maybe the bill would make a difference after all by giving them more coverage. But, overall, I'm not sure that it's the "game over" step change that some commentary makes it sound like it is.
I could be misunderstanding - comments / counterarguments welcome.
1. Cook only cares about pursuing profits, but at a shareholder meeting where shareholders were pressuring him to pursue profits, he lied to them (and had the presence of mind and acting chops to pretend to be uncharacteristically angry about it), because he believed that the story would get reported on and Apple fans would want to hear it, and he made the calculation that that would be more beneficial to his bottom line than being honest (or at least more politically neutral) with his shareholders.
2. Cook really does believe about accessibility, environmental issues, and worker safety, and he tries (or at least likes to think that he tries) to take steps toward those causes at the expense of profits, but he's also a complex and flawed mixture of motivations and is capable of compromising his values (and/or of letting those under him compromise their values) to varying degrees in the face of financial rewards or the pressures of the capitalist system.
#2 seems more likely and is more consistent with my view of humanity in general.
> “When we work on making our devices accessible by the blind,” he said, “I don't consider the bloody ROI.” He said that the same thing about environmental issues, worker safety, and other areas where Apple is a leader.
> As evidenced by the use of “bloody” in his response—the closest thing to public profanity I've ever seen from Mr. Cook–it was clear that he was quite angry. His body language changed, his face contracted, and he spoke in rapid fire sentences compared to the usual metered and controlled way he speaks.
More broadly, I know that for-profit businesses are concerned with their bottom line, and I know businesses regularly throw other values under the bus in pursuit of profit. But I'm not sure it's possible to build a successful business (in terms of maintaining consumer trust, attracting and motivating decent employees, etc.) without some values beyond what's immediately quantifiable on the bottom line.
(Our project mostly uses Chart.js, so I'm more familiar with it.)
First is if you compile with `-Werror -Wall` or similar; new compiler diagnostics can result in a build failing. That's easy enough to work around.
Second, nearly any decent-sized C program has undefined behavior, and new compilers may change their handling of undefined behavior. (E.g., they may add new optimizations that detect and exploit undefined behavior that was previously benign.) See, e.g., this post by cryptologist Daniel J. Bernstein: https://groups.google.com/g/boring-crypto/c/48qa1kWignU/m/o8...