I am reading this as a potential leak of almost every possible piece of metadata related to the operation and the business but a limited leak of customer data.
This goes to show the benefit of maintaining separations between the control plane and the data plane.
This site does say it has SQL logs which have some amount of customer data and there is a mention of some snapshots/imports- this looks like a case where the control plane and data plane end up getting entangled. Its possible the attacker could have reset customer database passwords to try to connect to them or could have exfiltrated customer data by initiating snapshots but just didn't want to deal with the increased risk of detection.
TiDB is for large scale data. You generally wouldn't use it unless you have at least 1TB of data. A 10TB leak of information is less than the size of a single small customer database for them.
I am reading this as a leak of every possible piece of metadata but not an actual leak of customer data. They have SQL logs which do contain customer data and there is a mention of some snapshots/imports.
(POV when storing 1PB in Oracle) when I saw the 10 TB in another post, I was like "wait, isn't this sold to scale out, we have 100 times the data here".
They are showing this new version scoring significantly higher across multiple coding benchmarks, beating Sol 5.6 (6.1 is the latest) across 10/11 benchmarks.
I am going back to DeepSeek for writing code. I was trying out using Sol and liking the result, but this should close a lot of that gap. I use Opus/Sol for an implementation plan and code review also use them for grilling. DeepSeek is also running verifications.
> For example, benchmarks in our initial list heavily cover AI-exposed lawyers’ tasks, but barely cover any of the O*NET tasks of similarly AI-exposed legal secretaries or court clerks.
This technique seems dubious- what is stopping AI from doing the computer work of legal secretaries and court clerks as well?
Solving math problems is one of the hardest theoretical jobs. Software engineering is one of the harder practical jobs. AI is now much better at these tasks than humans because it has been able to properly train for them.
For other computer-based jobs it's a matter of AI getting properly trained for them. If a job is harder to verify or the training data is more limited, it may be much more difficult to train AI for it but I don't think there's any reason to think it won't happen eventually.
I think I agree. I'd be surprised if in a casual universe everything we perform cannot be represented by an abstract program and so should be performable by AI.
But, it may be that the performance of some roles is constrained such that the physical shape or rate and breadth of knowledge utilized isn't advantaged by the benefits of digitalized intelligence, and so would be approximately acting just human anyways. And in that case there may be enough human's available to do it just because they want to, fully fulfilling the demand for it.
Rust does have one glaring weakness: compile times. I suspect in the LLM era we will see the rise of a language or perhaps some sort of Rust redesign that achieves what Rust has with great performance and great type safety but also has better support for fast compilation.
I have found that agents are good at writing Verus proofs in a Rust code base, and that these proofs have only a minimal negative effect on the normal compilation path. I have a skill for using Verus: https://github.com/gregwebs/skills-sdlc/blob/main/skills/rus...
Compile times are really only an issue of you need to iterate extremely fast.
One of my spare time projects is a "prompted" 3D modeling app that is now (incl sub-crates I maintain) about 500k lines of Rust.
The link stage is the longest. An incremental build (w. sccache+mold) where I changed a few source files is done and runs after maybe 20s max on my 2022 Rhyzen 6800H-powered laptop.
I think this is acceptable when working on that kind of project.
For games where this matters I usually prototype in some other language first, TS, Python, Lua, whatever then translate to Rust when game mechanics and magic numbers are settled.
Or you simply put those into a config file that gets watched by the game.
At work we have an image manipulation crate that takes like 30mins to 'dev' and about an hour to 'release' build.
The WASM version takes even longer, about 2h, and needs like 55GB RAM during build.
But that crate has only to be built once a month.
And if it mattered we could split it because it's a metacrate made of ~20 sub-crates.
Yeah, it would be nice if Rust were even faster (I remember compile times almost a decade ago, when I started using it)!
But I think for the typical use cases where you would (should!) reach for it, it's quite ok already.
And if not you can work around it quite painlessly.
Mojo looks interesting [0]. It is designed by Chris Lattner himself [1] and has an interesting take on borrowing references (Rust's DNA) comptime execution inspired by Zig. And it targets CPU and GPU (NPU, TPU) as first class targets. Recently reached 1.0 release.
It’s especially bad when working on multiple projects at the same time. Memory and CPU contention kills performance.
I’ve switched one of my projects to Go and it took a day for Opus to do the port and another couple of days to finish the features I wanted. I’ve never liked the language and still use Rust in plenty of places, but I can’t argue with how much faster iteration is.
Ask your agent to build a simple bash/zsh/whatever cargo wrapper that maintains a machine build lock.
It should exclude cargo check, tree etc. ofc.
CPU contention from parallel cargo runs absolutely kills (build) performance.
Also my setup has instructions that agents keep working if they have open items while the lock is taken; i.e. launch a subagent or a shell with a watcher to run the build and don't block on it.
This makes all the difference when you have multiple agents on multiple workstreams on the same machine and they target Rust.
Senior engineer and all SWE positions will become more like a technical lead.
If you can direct AI and produce more value per $/time spent then a non software engineer directing AI to develop software then you still can produce a lot of value.
This should be the case now for most things that are not a prototype. The job has changed from "writing code" to "shipping software". A technical lead.
Software products making ever more intelligent AI software development accessible will continue to reduce the need for software engineer involvement. But there’s also going to be 1000x more software. So there may continue to be opportunities for those that adapt.
If you can direct AI and produce more value per $/time spent then a non software engineer directing AI to develop software then you still can produce a lot of value.
This should be the case now for anything that is not a prototype. The job has changed from "writing code" to "shipping software". A technical lead.
As AI gets more intelligent and the tooling around it develops and organizations figure out how to get it access to the data, the level of involvement needed for software engineers will decrease. Since the cost of developing software is plummeting, the amount of software being used is going to expand greatly- that will keep the technical lead positions available longer and also create more opportunities for consultant engagements.
Although someone can use AI to rewrite every software dependency and every paid piece of software, its still not worthwhile for them for most software, especially if the price of the software is low compared to the complexity it hides.
Users of a paid software product still need a human to be responsible for it.
As you develop your skills with AI, you now have the ability to develop your own software products. So there's an opportunity to become a small business owner. You didn't want to do these non-technical roles, but now you can continue to direct AI to automate all the aspects of the business.
> If you can direct AI and produce more value per $/time spent then a non software engineer directing AI to develop software then you still can produce a lot of value.
Sure, in the same way a skilled photographer can take better photographs on an iPhone than I can. Nevertheless, because any twit can take good enough photos on an iPhone, the need for the specialized skills of an expert photographer are much less than in, say, the 1930s.
That's why AI is dangerous. It's not because it makes human skill useless, it's because it makes non-human skill good enough. When was the last time you hired an expert photographer, or skilled dressmaker, or a master cabinetmaker? Maybe once or twice in your life, because the iPhone camera, fast fashion, and Ikea are good enough.
Software is just language, translating human intent into concrete machine action. That translation being automated doesn't mean, the intent had been made superfluous.
When no human knows what the machine is doing exactly, how do you know your intent is being followed? The seeming sufficiency of superficiality the public "enjoys" is an illusion needing upkeep.
Machines cannot make meaning, nor can they originate intent. They can't keep themselves suspended mid-air, detached from human understanding. You need engineers who understand human and machine, identifying the reasonable among the un-reflected wishes and making it explicit and precise.
> When no human knows what the machine is doing exactly, how do you know your intent is being followed?
No one is saying that no one will know what the computer is doing, but fewer people will have to. We are moving up the abstraction hierarchy, just as we have done since the stone age. In my grandparents' generation, knowing how to fix an internal combustion engine was a common skill among young men; today, it's been abstracted away. In the same way, I don't know how my clothes are manufactured, where my electricity is generated, or whether my CPU's "management engine" is spying on me. I don't need to know the details, because everything "just works." The same thing is happening with AI.
the need for the specialized skills of an expert photographer are much less than in, say, the 1930s
Without even looking it up, I expect that this is patently untrue. I bet way more people make a living as photographers today than in the 1930s.
EDIT: yep, about 4x as many today, and slightly more per capita even.
Not saying your overall point is off, but the fact that you picked a bad example is illustrative of a broader point: it’s very difficult to tell in advance how technology will impact employment.
EDIT: can’t reply so I’ll just add this here:
As I understood it, your entire point was that people don’t have as much need for photographers, dressmakers, and cabinetmakers today, because technology has given us low-skill or no-skill options that are good enough. Is that a fair characterization of your argument?
This is definitely true for some categories (agriculture, or elevator operators), but again, there are more professional photographers working today than in the 1930s. It wouldn’t surprise me if there are more seamstresses / tailors / etc too, more professional carpenters, etc.
Some of this is basic Jevon’s paradox in action, and some of it is just that median American is much wealthier (in real terms) than a century ago, so even though we can buy lots of “good enough”, there’s still a larger market for high-end skilled artisan labor than a century ago.
Not really. The number of photographers doesn't tell you everything about the demand for them. Back then photography was still competing with portraiture as a way for capturing likenesses, both options relatively rare and expensive, but photography certainly cheaper and requiring vastly less skill. It was a very different market than today's where I'd say the work is mostly in weddings.
1. The demand for photographs is fixed. The demand for software is infinite.
2. A photo is just what it appears to be. A program's code can't be gleaned from its output. Without checking the code you can't know if it's good enough or not.
3. For a lot of use cases, good enough isn't good enough. A good enough robot in a factory produces unacceptable defect rates, a good enough space rocket explodes way too often.
> The demand for photographs is fixed. The demand for software is infinite.
A highly dubious assertion. If demand for software is infinite, why don't we have infinite software, since we now have the ability to create infinite software?
> Without checking the code you can't know if it's good enough or not.
And even after checking the code, you still won't know if it's good enough, as evidenced by the large number of bugs that get shipped. I think it's clear that AI can do at least a good job checking code as humans can, so my argument stands.
> good enough isn't good enough
It seems like you are playing word games instead of addressing my argument. Can you please explain the point you were trying to make with this argument?
> If you can direct AI and produce more value per $/time spent then a non software engineer directing AI to develop software then you still can produce a lot of value.
Even if true (which I'm leaning towards that it is), when will companies realize this?
We could be in for a decade long software career recession until the effects of poorly managed and written software trickles down to lost customers and company bankruptcies. Bad decisions in large companies take a very long time to produce clearly visible effects.
> As you develop your skills with AI, you now have the ability to develop your own software products.
I think this is a dead end. We're quickly approaching a state where software is no longer a product that can be sold, but rather a tool used by someone selling a service.
> We could be in for a decade long software career recession until the effects of poorly managed and written software trickles down to lost customers and company bankruptcies. Bad decisions in large companies take a very long time to produce clearly visible effects.
this does not mean software jobs would come back, you'd just end up in the amazon situation where today you use word made by JOXHSWW, then there are too many bugs and you buy another word made by ANSJJGG and so on.
Some B2B software will continue, but B2C can just become a single person fly by night with some models, or you can end up doing it yourself. A couple of years ago a model one-shotting a game of pacman was sci-fi, now it's just another benchmark, maybe the next model benchmarks will be one-shot photoshop or word or whatever. Either way today's C is more interested in doomscrolling tiktok on their phone than to booting up a computer to do some photo editing anyways.
As the article says, "taste" is still important in steering a model, but for how long? and how many people with taste do you really need compared to a few years ago where you needed people with taste AND a lot of people to execute.
It feels AI is just the next step of outsourcing, writing specs in the evening then magically the next morning software appears which might or might not work the way you expected, and the cycle repeated, only today the cycle is in your terminal and takes minutes vs hours/days
If the market is filled with cheap products and a clone of your product can be easily made, then the survival of the business is in positioning, marketing, packaging the product, distribution, sales...
This makes the technical skills required but not sufficient part of the whole business and there are many businesses (like restaurants) that are bad businesses, because many people are willing to open a restaurant as a life-style choice even though most of them are not a good business. This influx of new competitors, make the current restaurant owners profit to go down, because of the increased competition that isn't purely market driven.
In the software world that means "a small product" won't have any moat & pricing power, and your competitors might be wiling to subsidise it for years as a side project, making the whole market suffer from profit erosion (an economic term) leading to zero profit long-term equilibrium.
For example try charging per message (as previously charged by SMS/MMS) in the era of subsidised messenger apps with free calls and messages.
This makes the unique position of SAAS software with 9$/month subscription highly doubtful in the future.
> If the market is filled with cheap products and a clone of your product can be easily made, then the survival of the business is in positioning, marketing, packaging the product, distribution, sales...
Most people stop after having gotten their dopamine hit. It was the case before, it's still the case now with AI.
Try any newly released software, and you'll notice a trove of issues, whether it's UX, UI, features not working properly. Errors, etc. All of the unsexy work that is needed to go from "it works" to "thousands / millions of people can rely on it daily".
Playing the long game has always worked, and will always work.
There are two ways forward for any company (whether big or small):
- Expand the pie: push AI to its limits while keeping your employees, new markets, new offerings
- Keep the same pie, and increase the size of the slices among the shareholders (employees or not)
DeepSeek is presumably break even or better and costs 20-40x less than frontier models. Its intelligence is lagging the frontier by a lot, but its already plenty good to contribute to certain aspects of software development. There is a lot of opportunity to make model usage more cost effective for software development.
Fine grained network policies is supported by microsandbox- a project that has already been working hard at building an abstraction layer over multiple different technologies. Microsandbox (on unix) builds on top of libkrun (a VM abstraction layer for unix). I am building a convenient runner on top of microsandbox: https://github.com/runcontain/runcontain (undergoing a rename right now).
The best thing Microsoft could contribute right now would be great technology for light-weight containment on Windows.
This article was similar to what I told people a year ago.
A year later and AI used properly is a better programmer than I am. Used properly means given meticulous guidance to write production quality code. I see very few people using AI properly now, but that will change soon, particularly if lower cost options become widespread (you need to spend a lot of time and tokens on testing and verification). It's not that delivering hand-written code will just decline, it's that it will be like writing assembly- something that's unsafe and needs to be justified.
The job of a programmer is now to be a technical lead and work through technical decisions with AI, write specs, and review work. But as AI gains intelligence and organizations figure out how to give it access to the information it needs, it will make better technical decisions than humans.
As long as a programmer can in some way produce more value/$ using AI then someone that doesn't know programming, then there's a huge value to programmers. But I don't see the place where AI can't go up the chain and do that itself as it gains more intelligence.
This is effectively true of any job that can be done at a computer. Although programming is one of the more difficult jobs its also one that is easy to train on.
My advice if one's main goal is job security would be to do something in the physical world.
> It's not that delivering hand-written code will just decline, it's that it will be like writing assembly- something that's unsafe and needs to be justified.
Woah, I gasped reading this. It is an extremely plausible future state of software development. Human written code can if fact be dangerous and sloppy compared to AI very soon.
You don't need to be a good writer to recognize good writing, the same goes for code.
Okay bit of nuance; this applies to fiction / nonfiction writing based on writing style, not so much correctness - for judging correctness you don't need to be good at writing code (or legalese, or fiction), but you need to understand what's written on the one hand and what the writing should express on the other.
> You don't need to be a good writer to recognize good writing, the same goes for code.
I don't see how these are comparable. Let me re-word that statement with analogous disciplines: You could argue one doesn't need to be a chef to recognize good food, the same goes for building blueprints.
To understand if writing is good for a certain domain or purpose, you really do need to at least be decent at writing for that purpose.
If it’s just about aesthetics or how it makes you feel, then yes I agree because how it made you feel is a signal of whether it’s good. Code is not like this, code is about accomplishing a specific function.
I agree with OP. It’s already the case that when I write code by hand I forget to do stuff that an AI with good instructions would never forget. I struggle with Boolean conditions that get more complex than a few operators while the AI can easily explain and track things like that. Debugging in your head was necessary sometimes to figure out why something was doing unexpected things, now you ask an AI and explain the strange behavior and it will tell you exactly what the problem was in seconds. In summary, at least let the AI review your work, you will be surprised how many issues it finds. At some point it’s just not worth it trying to do things manually, it’s even becoming irresponsible, like not using a type system ( though even that argument was polemic once)
You are explaining why it’s safer “for you” to let AI write code for you, considering the safety here is being put forward in comparison to coding in assembly. That’s fair.
But it still doesn’t explain based on what principle and logic this is the case with regard to coding in a higher level language vs. assembly.
Let’s reframe the question: why do you think writing in assembly is less safe? Do the same reasons apply to AI coding? What are those reasons?
Don’t get me wrong, I think it’s good to let AI have a pass at the code, but this doesn’t lead to the above conclusion IMO.
This has been my experience as well. AI writes better code than me. Rarely I touch it to improve, but often reading it makes me realize it took care of things I did not even think of.
LLMs will always be biased by the training set used on them. I don't see how they will become an entity that knows everything there is to know about a domain to make the correct decisions.
I know from experience that Claude will be confident about something, but when I push back it will concede quickly. And it will happily overly complicate the code, come up with made up requirements or rules that it inferred but are completely bogus.
This goes to show the benefit of maintaining separations between the control plane and the data plane.
This site does say it has SQL logs which have some amount of customer data and there is a mention of some snapshots/imports- this looks like a case where the control plane and data plane end up getting entangled. Its possible the attacker could have reset customer database passwords to try to connect to them or could have exfiltrated customer data by initiating snapshots but just didn't want to deal with the increased risk of detection.
TiDB is for large scale data. You generally wouldn't use it unless you have at least 1TB of data. A 10TB leak of information is less than the size of a single small customer database for them.
reply