Software Engineer | Guitar | Cooking | History | Philosophy Spiral out. Keep going.
United States
Joined July 2022
- Tweets2.8K
- Following308
- Followers330
- Likes2.4K
I find myself picking up the phone and calling businesses more and more because AI text chat bots are terrible, and even if they weren't no one likes to talk to them because consumer confidence has been so thoroughly eroded by bad experiences.
It'd be interesting to see the data on consumer behavior as more and more AI text chat bots take over support.
I had @grok 4.6 generate a very long mdbook for a site I've created while I was asleep last night, hoping it'd burn through a chunk of the remaining 50% of my tokens before the reset on Friday.
Fortunately it was near-perfect.
Unfortunately it only used 2%.
I can't endorse Grok enough.
If you spend money with Anthropic, stop.
They are outright anti-technology, are irreparably damaging the industry in a cowardly and pathetic attempt to benefit themselves, and do not deserve your money.
They are making you worse at your job, and that is their goal as they lie through their teeth about “how concerned they are”.
This has to be the single most morally bankrupt company that has ever existed in modern technology, and nobody—least of all developers who know better—should support them.
Just stop.
Today, on the heels of a very large production deployment involving load balancers, networking, applications, and a mix of 10+ application and db servers both on VMs and as-a-service, I carved out the requisite few hours to manually produce the documentation.
I could have uploaded all the notes and existing docs into a copilot chat and had it spit out the documentation, but I chose not to, despite AI being able to complete such a task, imminently more so than writing code.
The reason I wrote the documentation myself is because I also have to maintain the system. I want to know it--and actually writing out what *it* is--*is* the process of coming to know the system.
Skipping the process of manually producing the documentation introduces a risk vector that *will* come to bear.
The production of the documentation is as important as it having been produced, and to the extent this applies to documentation, it applies infinitely more more to a code base.
>be me
>oh thats an interesting post
>i should go look something up before responding tho
>come back to X three minutes later to respond
>state refresh nukes post
@nikitabier whhhhhhhhhhhy
Are you observing deadlines that actually exist out there in the world?
Or are you creating deadlines?
One of these approaches produces positive outcomes, and the other is a disaster factory.
Luke Skinner retweeted
Handmade Hero enjoyers least affected
Software horror: litellm PyPI supply chain attack.
Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.
LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.
Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.
Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.
Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.
People confusing the production of picks and shovels with gold prospecting.
Just because you may be able to produce picks and shovels faster debatable doesn't mean you know where you gold is.
Not only has that part not changed, it is and always has been the real bottleneck.
Luke Skinner retweeted
They are going to reinvent... scripting and open-source
There would be a real, justifiable case for vibecoding if it resulted in more plate appearances for ideas.
But I don't see that. I see people building stuff and it taking just as long as before.
Anyone who has worked at an organization larger than 3 people are familiar with the knowledge gaps that appear when people think they're being clever by outsourcing parts of projects to juice efforts.
We've known for a long time that this is why you never outsource core organizational competencies.
Yet, that is exactly what is happening with outsourcing to AI, except worse becauase it happens at scale, everywhere, and there's no human to go back to when you need to ask questions to figure out what was actually done.
I've not heard anyone provide a viable solution to this problem.
