stusmall

Oh come on. That's like saying "This isn't novel. People have exchanged money for goods and services for thousands of years"

I haven't looked into this one but I've seen analysis about past reports that this has more to do with context pollution than any nefarious backdoor. If you pump an LLM prompt with irrelevant information it will just do worse. Some bits of irrelevant information will have a bigger impact than others, but in general it is a good practice to keep prompts detailed but relevant.

Depends on the context and who I'm talking to. That one makes a bit more sense because it is renaming the overarching company to separate itself from one of their products that is declining in popularity in some circle. It isn't unusual that people outside tech forget WhatsApp, Facebook and Instagram are all the same company.

We said a lot of crazy stuff in the 90s but you won't catch me calling it The Information Superhighway in 2026

Kinda feels like the X/Twitter one. When someone uses the new term you learn something about them

You can hold both things in your mind and they aren't contradictory. It can be a bad system but it can still be suspicious if someone behaves outside the norm inside it.

>GrapheneOS has "2G Network Protection" which prevents your phone from connecting to 2G networks

This isn't just a GrapheneOS feature so you don't need a new ROM for it. Upstream Android provides this feature. Being enrolled in Google Advanced Protection program even forces it on. It is also available in iOS via Lockdown Mode. Just a great feature and I'm glad its broadly available.

I mean, if you picked almost any random time in the last 4 years that'd be true.

Oh I want to be clear, I don't want my post to come off as negative. I really do mean things are headed the right direction and I think this harness is super cool. So don't take it that way and thank you for bringing something cool into this world.

There is a lot of room for a lot of different models. For many use cases, intelligence beats out all.

For me in my day job, having extremely fast low quality decision makers over noisy inputs is very valuable. I work in security and having something that can help triage alerts, classify items and group things together is extremely valuable. It doesn't need to be perfect. Just being able to take a set of inputs from deterministic tooling and to be make general priority classifications goes a long way on helping humans look at the most important items first.

This is so interesting to watch. For a couple minutes I was in awe of how quick and cheap it was. Then I saw just how bad the decision are and how it would get stuck in strange loops of going in and out of the same door to no end.

This seems like a technology heading in the right direction but not quiet there yet. Excited for what they are cooking up but probably won't start building around it yet.

>but not fast enough to play Doom yet sadly

Did I miss something? I thought one of the demo videos was it doing pretty decent at the first level of Doom?

AFAIK it wasn't in play here, but yes, we do allow that to a degree via the Defense Production Act

Logo started my love of programming. I will always be thankful for it and that little turtle. IIRC there was a limit of 128 stamps in LogoWriter and my sister and I would fight so much about it.

>I hope announcements like this show that Rust is not a fledgling little language that moves fast and breaks things anymore

I see this on here a lot on this site, but Rust hasn't been that in over a decade. Rust's devotion to post 1.0 stability is massive and has involved some interesting design choices. I started writing run in 2015(?) and only hit one breaking change in the language. It was a niche bug in a macro that was fixed later in a later release.

Just watching hackernews you see lots of news about it, but these are additive and not breaking things. I was still writing lots of mio-style async code after async await was out. You don't have to adapt new style or libraries. I used to have a joke that you could tell a codebase's age based on the error handling libraries used, but even with that it was additive. Often multiple would exist in different parts of the same code base. "Oh wow, I've gone deep on this refactor.... I'm starting to see error_chain"

You may know more about what it powers. It has enabled much faster, higher quality, more stable security software on Linux. Many modern security tools are built on top of it. While end users might not know it by name, it has made Linux easier to support in the enterprise.

Being the _the_ place for open source is what let them dominate the enterprise. Now that they dominate the enterprise, it'd make financial sense to put hard limits on the free tier. It's cynical but it would be foolish to lose that cash machine. It'd open them up for a competitor to slowly build up good will in open source then take them on in enterprise, but right now they are risking losing it all.

I'm generally extremely skeptical about a lot of the model hype that show up in comments. Except when there is an extreme mismatch the performance, quirks and quality of these things are difficult to nail down. You wouldn't know that from the comment section of every single release.

I think some of these are excited, eager users always ready to hype up the new thing. The same crowd that previously would constantly push for a rewrite from angular->react->svelt->god knows what. Instead now it is on a 6 week cycle and about models/harnesses.

I think most of it is bot driven spam by the various labs. It's hard not to notice 3 month old accounts with very strong opinions about various frontier labs and little else.

Ultimately, I think some of it is legitimate shifts in who's in lead and what is the best. You gotta dig through a lot of crap to get to that, and I don't really know how to to.

Ultimately I'm saying is that I always applied a fair amount of skepticism about what I see in comment sections but these day it is extreme amounts.

It often is. Risky Business Features did a fantastic podcast on how different popular methods of guardrails work and some popular methods on defeating them. Absolutely worth a listen because there are some surprising insights in there on how these work, even for day to day use, not just bypasses:

https://risky.biz/RBFEATURES27/

Even more than supporting any agent that support almost anything period. They seem to take the default approach of using open community standards first when adding new features. By investing very heavily in LSP, ACP, DAP, tree-sitter etc it makes it easy for Zed to integrate with tons of different workflows, language, ecosystems etc quickly and easily. Its just good engineering and I love to see it.

> Don't crash my entire PC when there's a large (100+ MB) JSON file in the working directory

I don't think you can put this on Zed. An unprivileged userspace application, even if coded poorly, shouldn't crash the machine.

I can't wrap my head around the idea that distillation is IP theft but mass training on books, music and art without consent is fair use. The two stances are incompatible. If it is transformative use of a book, it is transformative use of AI output.

I'm glad someone ran the numbers on this. Every single Simon Willison post of an SVG is followed with someone dismissing it saying "I'm sure they train on it by now." This is despite a good blog post with sound logic on how easy that is to catch. [1] Glad to see someone took the time for a quantitative analysis of dumb little animals riding dumb little bikes.

1. https://simonwillison.net/2025/Nov/13/training-for-pelicans-...

If you remove the word "AI" from your post it also describes the last 20 or so years of US/Chinese economic competition. They are real, serious competitor but also there is a lot of value in that last 10%. Some buyers need the best and you can charge a premium for it.

The speed in which a copier can catch up to a leader is faster than every before, but everything is faster these days. I think the threat is if can these labs catch up and pass American labs while keeping costs low, but I don't see that happening.

Did it misunderstand "don't believe me just watch" and put a bunch of washing machines in on the Fable 5 $100 at about 1:20?

It looks like some of that high LoC is because they are vendoring some deps. There readme gives the reason to vendor some but not others as:

> These crates sit on the path that renders untrusted model output (diagram source → SVG). Vendoring gives a full audit surface, pins exact source, and avoids crates.io yanks. Local patches and upgrade checklists live in each crate’s Cargo.toml header comments — treat those as the source of truth when re-vendoring.

Which honestly feels like a misunderstanding of how cargo and yanks work. Each upstream package is locked to an exact version in your lockfile along with a cryptographic hash. The upstream can't change the source without you noticing. Unless you update your lockfile you will always pin to the exact version and source. When a package is yanked, it is still available for download if it is already in a lockfile. It just prevents new packages from resolving it. Crates.io will sometimes completely delete a package, but I've only seen that happen in cases of malware. It's fairly rare and seems out of line with the supply chain concerns here.

There are good arguments for relying on upstream package managers and there are good arguments for vendoring all packages. I've never seen a project mix before.

>If everyone starts applying cooldowns, won't it postpone the problem?

There are still research firms who are actively and aggressively scanning new packages once they are pushed. For example socket.dev pulls new packages across ecosystems and performs automated analysis and runs it in a sandbox. We don't have to have them go boom in someone's production repos to find out there is a problem.

Great article! Thank you. Also in case others walked away with the same question I had, I'll save you the googling: use the utility vrrtest to help validate if VRR is properly configured on your machine.

I had the same issue when logged in. I opened a private tab and it worked.

Thank y'all so much for doing this. I really appreciate y'all not putting STIG/FIPS behind the paywall. Rare and aggressive move.