They definitely wouldn't be if attackers knew that it would then bypass cooldowns!
Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.
No, but there's a bigger tradeoff for not upgrading. In one case it's that you're potentially exposed to a known vulnerability, vs the other case where you might just be missing out on some new or slightly reworked feature.
We need something external that actually checks to see if source code matches built artifacts, and also possibly something Llm based that checks to see if you’re making checked in code vulnerable or directly adding something malicious.
Yeah those exist… the trouble being we need something that doesn’t exist
There needs to be a service that does reproducible builds of opensource projects as they sit and publishes results for people to scrape freely.
To be robust itself against attacks, likely 3-4 services.
But then that needs funding to be sustainable … and companies are incredibly cheap. Especially right now. As such… shrug :(
Maybe something as a skill for LLMs to run that actually checks build reproduction from source for a project and all of its dependencies? But then that’s gonna burn some tokens ….
I do this for personal projects … but at work they’ve started rationing tokens… as such… idk?
Exactly. They want people to be scared because they see where this is going. Soon AI will be building AI and anybody will be able to do what they are doing. And the winner is hardware, not software.
So they goal is to hype up the dangers real or not so high that they forbid others from doing what they are doing because they are the only ones who can safely do it.
The problem is not vibe coding. The problem is the people doing this were never good software engineers before vibe coding.
Simply put you still need good practices to produce working good code with AI.
Oddly what I have found best is patterns that many would cringe and demeans unit test and integration test.
Yes I still vibe unit test and integration test, but more than ever I have to put on my PM and QA hat, even more so with web dev.
For me the only part of the process that has changed is I don’t write the code. I still setup environments to run the code, I still manually poke at things I suspect will be fragile. But most importantly I still always run the software before shipping it.
> Yes I still vibe unit test and integration test,
False sense of security. What's stopping the agents from doing an elaborate form of "Assert.IsTrue(true)" in some/most/all of the tests since you are vibing it and not reviewing it?
Exactly what happened in a PR from a few months ago, from the beginning it felt wrong, pytest was moved from the dev group to the main import section. Then imported in our models. To add ignores everywhere.
Couldn't have said it better myself. Issue at hand is if you're working in an environment that enables such people and even encourages that behaviour. Suddenly, their voice is the same where it was never even a whisper before, and you can't do anything about it. It is extremely demotivating and I would actually propose a more radical approach to it - either embrace the shit in full and commit to it as well or really do engage into another company where there's a better filter for hiring. The latter are usually smaller companies because they can't afford no to.
Except that it is the enabler. Without AI there are no 5K lines of code that no human has ever seen. AI introduces a new category of problem that did not exist before.
Well said. The problem is that vibe coding can paper over bad engineering practices for awhile. And results look good, and when you raise concerns people look at you like you're dumb and trying to slow things down.
But the underlying bad practices _will_ bite the same they would have before AI, you just don't know when.
It's a really frustrating state of the industry to be in.
Absolutely. Rui is awesome. He's always been awesome. I was his director and then vp for a long time (also replaced by awesome people, thankfully). The day he left to make a go of mold and such I was sad for us and super excited for him.
No. I wrote my integrated linkers with rcc for pe/coff, elf and macho by myself, and macho was the worst to be dealt with. elf was pretty easy, easier than pe/coff.
Mine is also much faster than mold/wild, because I do much less work, and I have all the objects already in memory. Similar to tinycc. Only when someone needs a very unusual unsupported linker feature, I have to fallback to an external linker, which is ~100x slower. The less work it has to do, the faster. I dont appreciate the unix habit to use intermediate files all along, which needs additional readers and writers.
The only people being ignorant at the ones saying deepfakes are illegal.
It’s more complicated than what is being touted as fact.
In most jurisdictions creation is legal, it’s publishing them that is not. In some jurisdictions threatening to publish them is also illegal. Most jurisdictions that have a creation policy apply to doing deepfakes they sexualize minors, which likely would have been illegal to possess under other laws.
Then we have a consent issue. Creating and publishing them could be entirely legal if the subject consents to such.
So yah. It’s not “deep fakes are illegal, let’s arrest everybody !!!”
To be clear, creation is likely legal, publishing not so much.
Additionally, intent is important with regard to AI hacking.
Same here, 20+ years, no degree. but have a slightly different view about folks with CS degrees.
It really comes down to the individual. Those who are good with CS degrees would likely be good without them. The majority of those who picked CS as a degree because “it pays well” are truly awful. Only a small handful end up enjoying and understand how to write code and make good software.
I agree about the existence of people who really just aimed for the grades (sometimes dubiously) to unlock a career. There were also enthusiastic folks with whom I learned a lot.
While I'm an interested self learner, I significantly benefit from structured learning. I don't think I would have had the breadth of depth of knowledge if I didn't do a CS degree since I didn't think I would have done such a variety of focused projects and homework. I would "shop" for good teachers and wait until they taught to take a course. I would have lots of questions in class. At the end of many of my semesters, I genuinely felt like Neo's "I know kung fu" - knowledge given on a platter. I didn't think I would have left covering undergrad subjects if I didn't, well, feel the need to earn my keep and at least aim for higher level studies and get assistantships for initial financial independence.
That being said, this was all before the YouTube era. Although, YouTube is a double-edged library of distractions and amazing educational material.
Oh man, I have that too. I am always told by my best friend "well, you go it right, but entirely wrong words" -- or something to the effect I got the feeling, notion, or concept right, but the wrong words.
This has affected me a lot though, I know what is going on in songs, but can't ever remember the right words, but still some how end up sining stuff that means the same thing :/
reply