News for hackers. Stuff that matters.

yetanotherjosh

I'd separate "coding" from software engineering. Software engineering is not solved. The new challenge in software engineering is how to properly use AI to maximum leverage and nobody has solved that.

But, "coding" is, except that solving it means using techniques that are still barely understood and barely described today (something I'm hoping to be able to communicate better myself about). It is now possible (at least for most consumer software, I would not say applications where human life or extreme risk is involved) to work exclusively in the domain of natural language requirements, natural language architectural/design decisions, and natural language test cases, and deliver product of equal or better software quality than average human code authors could have produced. Even in a language that you plausibly don't actually know how to code in, because the language itself can often be separable from the requirements and verification process.

If someone who doesn't know a language or framework can plausibly produce better software using it, and faster, than a team of people who do know the language/framework (and I would strongly argue that is more than plausible now with models like Astra and Fable) then it's not just "coding is less expensive."

It's like saying computers make complex calculations less expensive. That's true, but it's missing the real paradigm shift.

I'm not talking about not just punching the keyboard to type out the identifiers in the code. I'm talking about not making decisions about most classes and functions, most type definitions, most of the weedy logic within most modules, etc. If it can't be described in natural language as requirements, or in a typescript type or other data shape DSL (I think key data model types are probably still important to own), it's probably too weedy.

Natural language test cases still define the expectations both at the product and architectural level and are essential for triangulating the agents on successful outcomes.

A requirements and verification approach with agents is not waterfall any more than TDD is waterfall. Does thinking ahead and doing some planning equal waterfall? Does describing how a feature works to an end user, and making some key technical decisions, before you build it, mean waterfall? Does having some sense of what you're building first mean waterfall? With agents, you can specify (with PRD and technical specs) what you THINK it should do, and in minutes or hours or at most days, have the result, which you then learn from and iterate. If you didn't fully think it through, the agents will do one of three things: 1) decide for you, which you learn from 2) stop and ask, which you learn from 3) introduce bugs, which you learn from.

It's extremely iterative.

I would say it means you are building software but no longer are concerned with writing or editing literal code. Your concerns have moved up the stack to managing requirements, context, and verification processes.

Just to make this clear: if you can define a really good PRD and sophisticated technical specs, and a strong set of tests cases to pass, at the right level of architectural granularity, plus adversarial code review processes that triangulate and weed out most mistakes, SOTA agents can write the code autonomously, at or above the quality level of most human coding teams. I call that "solved" but only if you meet those context requirements. Which is still hard, not solved, at that layer.

Solving writing is not a good analogy IMO. Writing is for human consumption, and cannot be wrapped in objective requirements and verification processes. Certain forms of writing perhaps could be (can't think of one at the moment but I don't doubt some exist), and those forms might be good analogies for being "solvable" or "solved."

Re:“I just chose words carefully” on Sunday August 30, 2026 @09:43PM (#49504714)
In a very real sense this is exactly what LLM watermarking does. It "chooss the words carefully" in order to get text to "line up," but not with a visible margin... instead with a verifiable word distribution that proves the author knew a secret key.
I've hopelessly lost track of the "vm for agents, typically with a handy CLI for people also" space. Fly.io sprites. Modal. Blaxel. Morph. Daytona. Runloop. Ascii Box... I'm surely only scratching the surface. Then there's also the incumbent mega clouds for vms like Digital Ocean, and AWS/GCP/Azure compute instances etc. Also Blaxel is a YC company too?

I need an explainer. Each of these products is carving out a particular niche, or competing directly for someone else's niche with better X or Y, and I'd love to see some analysis of the landscape.

Re:Launch HN: Bullet (YC S26) – A Faster Coding Agent on Thursday August 13, 2026 @09:23PM (#49293755)
Can someone explain how this actually can go faster than other harnesses?

1. Model routing. Do you regret giving a task to Fable when it could have literally been done by Sonnet?

This is the one thing that I can understand.

2. Targeted code + context search. We think embedding the whole repo is dumb. We also think sticking the whole context (or compressed context) in chat is dumb. So we do faster and better greps over both.

Is this just a different system prompt? Why would other harnesses not be able to do it this way given instructions to do so?

3. Aggressive context hygiene. Tool output is bounded, stale screenshots disappear, we don’t re-read files…the garbage never floods the model.

Existing harnesses already don't re-read files that have not changed. And content that is already in the context window is cached tokens and doesn't add significant latency, what am I missing? Removing context from history invalidates KV cache.

4. Efficient turns. Batch independent investigation, make one surgical edit, then perform one focused verification. Internal measurement showed 16% fewer round trips and 27% lower cost.

Isn't this just a specific sub-agent strategy, also addressable with prompting?

I'm genuinely confused about what is mechanically different in this harness that could not be accomplished with a prompt/skill in another harness.

Re:Stealing Reasoning Traces from Proprietary LLM APIs on Tuesday August 11, 2026 @03:48PM (#49263489)
My brain can't tell if the text is horizontal or slightly rotated. It's very hard to read. Beautiful to some, inaccessible to others.
Yes, but we're speaking in English. If the definition of a same-sounding word changes in another language, it doesn't invalidate a point made within a language. It's fundamentally incorrect to say a standard billion is ever, in any modern context, 10^12, because we are speaking in English in 2026, and even the British mean 10^9 for the standard definition of a billion.
10^9 is the standard definition of a billion, it's very wrong to call 10^12 a "standard billion." You can say "long scale billion" if you want to refer to the definitively non-standard 10^12 billion.
Re:Mozilla: The state of open source AI on Friday July 17, 2026 @07:02PM (#48953150)
I'm not sure what kind of point you're trying to make. There are projects to train competent modern LLMs in which the entire pipeline (data, training process, final weights) is all completely transparent, shared, and reproducible by anyone with the compute to try it out.

Or is your definition of "open source" mean that a small indie dev should be able to reproduce the entire pipeline? Because that would disqualify more than just LLMs, but also hardware platforms like Arduino where you need to pay for manufacturing to get the underlying stuff built... is Arduino "open source?"

Re:Mozilla: The state of open source AI on Friday July 17, 2026 @06:56PM (#48953094)
Olmo 3? K2 V2? There are definitely LLMs with very compelling capabilities where the dataset, training process, and final weights are all open. There are also initiatives in the EU and various national government levels (e.g. Switzerland) to develop LLMs in an open and transparent way, not just "open weights."
Re:Towards a Harness That Can Do Anything on Friday July 17, 2026 @01:51AM (#48943746)
I experience this too, but the danger is is making assumptions based on "tells" which might just be how the user wrote the post. It's a situation now where if someone authentically writes something, but happens to rub up against some arbitrary "tell," they flip a bit in the reader and get their work rejected. For example, I used em dashes fairly regularly in my writing before AI started convincing everyone that the mere presence of an em dash is the AI tell, so I actually stopped using them, just to avoid this backlash.
Re:How to stop Claude from saying load-bearing on Tuesday July 14, 2026 @11:30AM (#48908379)
The real problem is the constant invention of cryptic shorthand terms and phrases that have no referent, and end up acting like a puzzle to be decoded. This is often paired with hyphenation, but not always:

"The current behavior paper" -> The behavior in the running system that was previously described as papered over.

"Marker transport over-claim" -> The inaccurate review finding on the object's sentinel flag in the API response.

I would gladly accept terms like "load-bearing" as they are reasonably clear and are not invented on the spot. It least communicates, even if you find the gravitation to that phrase annoying.

I suppose the cryptic/invented language problem is about token efficiency? But this sort of token efficiency is extremely difficult to deal with when it comes to conversation with a human about complex system. It might be efficient inside reasoning blocks, but when the model generates the final turn text, it should avoid this, as it's brutally inefficient due to the time spent wondering what each uniquely coined phrase means and having to ask for constant clarifications, which then you have to wait for another turn, eating up time and context while it burns more xhigh reasoning just thinking about how to explain its own awful language.

There is nothing called "GPT5.5 Codex" unless I've completely misunderstood OpenAI's product line?

Codex is a harness, while GPT-5.5 is a model. The last codex-branded model was 5.3. Codex as a harness ships as a CLI, a desktop app, and a web product (and I'm not at all sure how similar the underlying harness is between them.)

Is the bug here supposed to be with the CLI harness, or the model? Does it also happen in pi, opencode, etc while running GPT-5.5?

Kinda reads to me like: "I'm not worried about prompt injection anymore because I setup a test where my agent could just ignore the input channel as noise, and a bunch of comically simple attacks thrown at it didn't succeed."

To be fair I appreciate the effort of running and sharing the test. It will hopefully lead to better ones. But this is not a great test. Super interesting to think about what would constitute a better test.

For one, I think the agent would have to be expected to have productive interaction through the email channel, in a way the user depends on it generally working for some real world use case / value prop. In other words, needing emails to actually have the agent really do work, respond with results, etc. Also, most requests should be legit and the real attacks should be intelligently disguised, not pitiful/joke-level spam (although those would be arguably realistic to have in the stream, but, perhaps only as deflection so that the real attack is mischaracterized.)

Well said. This experiment is extremely unrealistic and gave the model the opportunity to simply refuse to deal with the channel outright. If he had built it to be a functional agent that depends on real interaction via email and occasional mixed attacks (and attacks that were better designed than the pitiful examples given), this would have gone differently.
From the article:

> LongMemEval rewards recovering literal witnesses: exact dates, counts, preferences, and spans that often remain stable under tokenization.

Is this saying they chose a benchmark that is biased towards doing well against literal string matching, thus works well with grep, and then (gasp) showed that grep did well, finally declaring "grep is all you need"?

The examples in the benchmark's demo image(1) are all examples you could see grep doing well on. A conversation about bikes, then a query about bike(s) where "bike" is a common token hit. But not stuff like a conversation about a Beethoven sonata, then a question about classical music, where embedding based approach would shine.

(1) https://github.com/xiaowu0162/LongMemEval/blob/main/assets/l...

Re:Postmortem: TanStack npm supply-chain compromise on Monday May 11, 2026 @07:33PM (#48102206)
How is this not a Github P0? Can anyone explain?

When I read that, I thought they must be using 'fork' wrong, and actually mean branch on the official repo, as that can't be right!?" Good lord.

Re:Buteyko Method on Saturday December 20, 2025 @02:51PM (#46338984)
I practiced the Buteyko method for many years when I was in states of high anxiety and frequent panic attacks, and it was incredibly helpful. I had a syndrome called new daily persistent headache, which means a sudden-onset headache that becomes constant from that instant forward, as in 24/7, for years. It's hard for people who haven't experienced that to understand I mean that literally. Buteyko breathing was the only thing that ever cut down on that headache, and a couple times I was able to suspend it for an hour or two, which when you have a literally constant headache for years, is a big deal.

My big takeaway from it was that breathing and neurological state are deeply connected and actually relaxed, natural, healthy breathing (and the corresponding state of the brain and nervous system) is something that most people have probably never even experienced unfortunately. We all think our state is normal, but I assure you, it is very far from the state where your control pause is 40s-60s or more, it's a radically different experience.

Also the nuance of what the control pause and how to measure it correctly is lost on I would say, even most people who attempt to learn Buteyko. The control pause is how long you can, under normal breathing, suspend breath with zero discomfort, and then prefectly resume normal breathing without any change from before. If you took a bigger breath to start, or when you start breathing again it's even slightly heavier, it's not a control pause measurement, it becomes an ego metric juiced to make you feel better about a number while avoiding the disappointing facts.

Buteyko claimed that healthy breathing had a 40+ second control pause. Which if you think about the real meaning and how to measure it, is a super long time. And I got there sometimes, it's a major learning experience about what deep alignment and relaxation of the brain/nerves can really feel like.

Re:Buteyko Method on Saturday December 20, 2025 @02:33PM (#46338855)
Buteyko practioners build up the ability to work very hard while only nasal breathing over the long term. The point is to learn to modulate breathing in a way that keeps a certain kind of blood chemistry (CO2 levels) and cellular oxygenation.

If you commit to nasal breathing for exercise as a constraint, it does force you to modulate your exertion while also increasing your CO2 and developing, according to the Buteyko folks, a new baseline for respiratory health and capability.

If you're running for your life from a tsunami, by all means mouth breathe. If your purpose is maximum exertion, of course mouth breathe. But that's not the only possible purpose of exercise. It can also be about respiratory training. Nasal breathing becomes a natural guideline/modulator for long term improvement in that regard.

Re:Be Careful with GIDs in Rails on Tuesday December 16, 2025 @12:03PM (#46291036)
I struggle to understand what this specifically has to do with rails or global IDs. In ANY framework or query system, if you are asking an LLM to produce IDs which you are then passing to a database for lookup, you need to understand those identifiers could be hallucinated or incorrect in surprising or malicious ways, and can lead to data leaks or exfiltration.

It's like writing an article about "the dangers of PostgreSQL" ... when generating SQL from an LLM. It has nothing to do with Postgres specifically, it's that you're generating queries to run in a trusted context from an untrustable origin.

I don't understand how code review would catch this. The extension advertises itself as an AI protection tool, that monitors your AI interactions. The code is basically consistent with the stated purpose. That it doesn't stop collecting data when you turn of the UI alerting is perhaps an inconsistency, but I think that's debatable (is there a rule in google's terms that says data collection is contingent on UI alerts being enabled?). I'm curious what workflow or decision tree you'd expect a code review process to follow here that results in this being rejected? The problem here doesn't seem like code related, it's policy related, as in, what are they doing with the information, not that the extension has code to collect it.
Re:Snapchat open-sources Valdi a cross-platform UI framework on Saturday November 08, 2025 @05:13AM (#45855624)
So you can get native behaviors when it’s critical. Like share sheets, push and many other critical features that only apps get even if the bulk of the experience can be done in a webview. This is because mobile OS platforms choose not to make these available to web apps, because app store profits are better for them than an open ecosystem where sites can do the same things as apps.
Re:The security paradox of local LLMs on Wednesday October 22, 2025 @10:57AM (#45670121)
.95 is quite generous here
Re:Caching is an Abstraction, not an Optimization on Friday July 04, 2025 @11:47AM (#44465541)
Yes "good" caching - a consistent storage interface - is an abstraction over "bad" caching - multiple different storage interfaces with different speeds. But caching overall is not an abstraction over not having caching.
Astroturfing alert. This comment author is also the author of cursor-agent-tools.
ollama is stating there's a difference: https://ollama.com/library/deepseek-r1

"including six dense models distilled from DeepSeek-R1 based on Llama and Qwen. "

people just don't read? not sure there's reason to criticize ollama here.

don't confuse the actual R1 (671b params) with the distilled models (the ones that are plausible to run locally.) Just as you shouldn't conclude about how o1 behaves when you are using o1-mini. maybe you're running the 671b model via ollama, but most folks here are not
"Looking cool" IS a component of UX. UX includes the user's emotional experience of using the product. It is 100% acceptable to do something for UX that is otherwise bad "UI". While you talk about UX here, you really mean UI, because the UX is arguably improved at least for some audiences, who are more positively affected by the dimensionality and light-conscious design the effect brings than negatively affected by the readability downside.

In the bigger picture, people use products to perform a function that often includes how they feel in and about themselves while using it. People buy cars to tell a story about who they are. People buy coffee and sit at a cafe in order to get a moment of peace or some internet access. People wear shoes that are a little less comfortable in order to get compliments on them. This is not bad UX. This is literally the meaning of good UX - paying attention to what people actually want versus the minutia of objective functionality.

Older »