Sometimes the url for the login page changes or I'm logging into a different part of the site and my password manager doesn't recognize it. My university used Duo for authentication but depending on which resource you were trying to access, the subdomain might be different. How would I immediately know that I had just typed in my credentials to a misspelled domain or a hacked user account on a school web server displaying a phishing login? That last one would be even more nefarious because my browser might not even display past xyz.abc.edu/ and it would even have a valid SSL cert. Even if my password manager didn't recognize that URL and I manually typed it in, my passkey manager certainly wouldn't even attempt sending a key.
The real problem is that companies/institutions should procure one domain name, and stick with it. There's no reasons so need to be redirected through 6 domain names when signing into Microsoft, all of which look like a phishing attempt URL.
This line of thinking I feel like assumes it's the only program running on your computer. Using less of my CPU and memory means my computer can do more things in parallel, or even run more instances of the harness. My laptop is sweating when I got 5+ claude code sessions running.
I haven't monitored CPU usage so closely, but seems to get heavy with basic tool calls and editing. Memory usage definitely is out of hand, have an idle session right now eating 500MB
Coding agents have been been such a blessing for my Emacs setup. Only getting more psyched about emacs. It was pretty good before but my elisp skills never really advanced much beyond gluing together existing libraries and copy pasted snippets. Now I'm having a blast vibecoding tools I could only dream of before, beyond what I even knew was possible.
Yup. When you give an LLM a "true" REPL, it stops guessing and starts empirically assessing the situation and achieves results faster, costing you far less tokens. And when you have something like Emacs - a malleable substrate you can programmatically change inside-out, it gives you immense capabilities to shape your environment, truly dynamically.
You just don't inject the real secret unless hostname/whatever rule matches the request, right? I don't know if that's how this works but it's my assumption.