yusefnapora

I mean... this has been the most common response to pretty much all LLM criticism since GPT 3? I have yet to see any substantial critique of LLMs that isn't immediately met with "but have you tried the latest models? they're so much better now!"

The article is also clear that it doesn't really matter whether the thing "works" or not - the process of using it is no fun for the author, so why would they want to use it for things that are supposed to be fun?

A rule doesn't have to be perfectly enforceable in order to serve a useful purpose. The rule assumes good intent on the participants, and it communicates what kind of behavior is welcome vs unwelcome. The submitter knows whether they used an LLM or not. If they want to lie about it, that's on them - I'm sure they can come up with whatever justification they want for that, but it's ultimately antisocial and gross behavior.

It's hard to interact with a particular dialect day in and out without it eventually seeping into your habits of speech and thought. So the people most likely to care are your friends and family once they get bored of hearing about the "key insights" you've been having all day.

So confusing how holding people in confinement, starving them, and selling their labor to others without compensation gets people tossing the word "slavery" around. Obviously it's the people paying wages to voluntary workers without giving the government a cut that are the real slavers!

It's not that nobody likes it, in fact the problem is that people like each instance of it well enough in isolation. Millions of people think it's "good enough," so it gets amplified and repeated until every PR description starts to sound like a toothpaste jingle.

The proposed bill would still allow you to choose to be on-call. Your boss just has to compensate you for your time explicitly when it falls outside of agreed hours, instead of getting an implicit claim to your entire life by virtue of your employment agreement.

Presumably Suzie also serves the people in her community who want tanned skin but don't like the sun. A data center offers nothing of value to the community it's embedded in - neither jobs nor any useful product or service. All the benefits accrue to the owners, and the very real costs are paid by the people breathing in the fumes from the gas turbines, or paying an extra hundred bucks a month for power.

If you don't understand why people don't want them, you're probably trying not to. It's not that hard.

No one is "making things insecure" here - it was already hopelessly insecure by design. The author is just revealing the uncomfortable truth.

> ensure this doesn't happen again with more deliberate and effective prompt injection

How can this possibly be accomplished? Even if every actor in the open source world with good to neutral intentions decides that this is anti-social behavior, that does absolutely nothing to secure your system against people with bad intentions.

A system that pulls in arbitrary unstructured text input and treats it as trusted instructions is insecure by design. Asking the entire world to sanitize your inputs for you is a choice - good luck with that.

The project README has explicitly asked users not to use LLMs for years before adding this "malware" to the output. Since LLM users seem incapable of understanding consent, apparently a more firm reminder was needed.

As mentioned in the blog post, if your system is susceptible to this kind of "attack," what is your plan when someone with actual malicious intent gets involved?

As mentioned in another comment, it's even more clear cut in this case. They actually put the original git sources in their project repo and instructed the agent to use it as the "source of truth".

Simple thought experiment. If you handed this same agents.md file (https://github.com/gitbutlerapp/grit/blob/main/AGENTS.md#sou...) to a human software developer and let them work on exactly the same goal, would their output be considered a derivative work?

You consider it a malfunction for your system to not accept and execute untrusted inputs? And now it's the responsibility of _every program that produces text output_ to tailor the output so as not to cause you problems?

I feel like I'm taking crazy pills here. Time to log off for a while, I guess.

Unfortunately, it seems that few of the people willing to pay money for software development actually care whether you understand the code or not. Unless it breaks in a publicly embarrassing way, of course. Then "you own the code" and the sacrificial human in the loop can be dredged out to take the blame.

All the incentives nudge you towards less and less critical evaluation of the output. The results of careful evaluation are much harder to measure than "this guy is cranking out 10x the code compared to last year!" And while you were busy thoughtfully internalizing the output, the guy next to you has been letting Strega Nona's pasta pot go brrr and spew another thousand lines of spaghetti on top, ready for you to review. Eventually "lgtm" becomes the default, and "do you want me to go ahead and implement that for you" starts sounding like the only way to keep your head above water.

Parallels is quite good - I can watch 4K YouTube videos at 60fps with no noticeable frame drops on an M1 Pro, and general desktop animations, etc. are fine. That said, I do occasionally get rendering glitches, usually in Firefox where a small rectangular portion of the screen will briefly flash black while scrolling quickly through a page.

The biggest quality of life issue for me personally is the trackpad. Although support for gestures and so on has gotten quite decent in Linux land, Parallels only sends the VM scroll wheel events, so there's no way to have smooth scrolling and swipe gestures inside the VM, so it feels much worse than native macOS or Asahi Linux running on the bare metal.

Your ignorance is easily cured in the age of the internet. Why hold on to it?

GitHub is having an incident at the moment: https://www.githubstatus.com shows

Update - We are investigating reports of issues with many services impacting segments of customers. We will continue to keep users updated on progress towards mitigation. Jun 17, 2025 - 19:53 UTC

The color change doesn't bother me nearly as much as the change in proportions. Insetting the face on the right and removing its curvature makes the smile look super weird and less "human" to me. I'm sure I'll get used to it, but it feels a little off.

Those examples are all either zero cost or "buy once, use forever." How is that an argument against outsourcing your core competency to third party in perpetuity?

Good thing my MP3 files only store a psycho-acoustic model of that Metallica album!

I mean sure, if you go to painstaking lengths, you can trick your computer into making some noise that seems vaguely similar to the copyrighted work it was trained on, but I trust the consumer to make their own fair use evaluation.

I think it makes sense if you think of Tauri as a "view layer" for rust apps. If you're building a rust GUI app using something like Dioxus, I could easily see wanting to bundle a cross-platform renderer with consistent "quirks", vs having to adapt your frontend to work with all the platform web views.

It has trade offs in terms of memory usage and binary size, but Electron has already conditioned users to expect every todo and chat app to be 500mb on disk and use a gigabyte of ram at idle. In other words, if Electron would make sense for your project, but you want to use rust, this seems like a good fit.

How do you get from “ Right now, nobody knows from whence personhood rises” to (paraphrasing) “once we can recreate the connectome, we can back people up?”

If we don’t know what it even is, why is it so inevitable that we’ll be able to recreate it in another medium?

Why not bring a forklift into the gym?

“But the plans were on display…”

“On display? I eventually had to go down to the cellar to find them.”

“That’s the display department.”

“With a flashlight.”

“Ah, well, the lights had probably gone.”

“So had the stairs.”

“But look, you found the notice, didn’t you?”

“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”

― Douglas Adams, The Hitchhiker’s Guide to the Galaxy

I'm rewatching the originals now, and it occurred to me that they were made during that magic period when computer graphics were advanced enough to be believable, but still expensive enough to be used sparingly.

By the time the Hobbit movies were made, it was cheaper to make all the orcs into digital props than to hire and costume a bunch of actors, and everything looks like a video game.

So because a few tech enthusiasts never got over solipsism, we all have to pretend that every simulacra of human behavior has a rich inner life?

Have you ever been in _any_ situation in which you've had complete data?

You don't actually need to rebuild the world, just the part that changed. It's rare to have other nix derivations depend on the dotfiles directly, so changes don't "cascade" to the rest of the system. I just timed how long it takes to rebuild my system after changing my neovim config and it's ~30 seconds. Which sounds like a lot compared to the zero seconds it takes to edit the config without nix, but it's fast enough that I personally don't mind.

Some people do use nix just for their system config and manage their dotfiles separately, but for me it's simpler to just have one system that installs the software I want and configures it the way I like it, rather than two things I'd need to keep in sync with each other.

But in order to qualify for distributing via your own website, you need to have had a million installs in the prior year. So everyone who could potentially use that distribution method will by definition be subject to the CTF. It seems like an indie dev's only non-Apple option that can avoid the CTF is to distribute through a third-party app marketplace and hope to stay under a million installs.

I was just thinking this morning how I wanted something like Decap CMS but a bit simpler. Got this running on Cloudflare in ten mins and it seems great so far. Thanks!

Sounds like a job for a bot that follows your Plex / Jellyfin history and clicks play on the original streaming service. You get to avoid whatever terrible UI the media conglomerate shackled their content to, get a persistent copy that works offline, and the creators still get paid. Everybody wins :)