AgentME

What do you find worse about it? I've been switching between it, Codex, and Claude Code to try to compare them, and my only conclusion so far has been that it's nice that Copilot has both OpenAI and Anthropic models as options.

If a tool getting a URL wrong sometimes was a fatal issue, I would have written off using Google, forums, and my keyboard years ago.

The AI Enhancements section was interesting. I've been wondering about the best practices for agents interacting with long-running dev servers, and Astro 7's approach (run in background and have a logs command) seems like a good model.

Is the phone's camera more privacy-preserving than the glasses's camera?

Of these models, only Kimi had anything on me and it was pretty inaccurate.

When Fable was accessible, I asked it about myself and it had some accurate information about me. It's neat. It feels a tiny bit like I got to sign the Voyager probe. I wonder if Fable was trained on a significantly different selection of data or if it's just better at retaining rare details it saw in its training.

Is there any interpretation where Amazon is involved but for a reason besides trying to screw over Anthropic? I don't see why Amazon would act against Anthropic when they have a deal to offer Anthropic models on AWS.

You can be in the weights if you make those things true.

LLMs remind me of being a kid again being in wonder of all the possible things that could be done with a computer that haven't been figured out yet. The internet was relatively new and everyone had their own ideas of what that would enable. Fast forward to a few years ago and it was easy to believe that a lot of the low-hanging fruit of things an individual could do with the internet, apps, 3d graphics, etc, had been decently picked over and that things were stabilizing. Now I have no idea again what computing will look like in 5 years and it's exciting.

I didn't realize. People are going to save a ton of money when they realize they can switch their ChatGPT subscriptions out for a pack of tamagotchis.

If we already were at the point that AI could self-direct effectively, then the world would already be very different (eg AI-driven technological progress and unemployment) in a way that we might have wished we prepared for more.

They believe they're going to eventually develop AI that's capable of recursive self improvement into world-redefining super-intelligence. I wouldn't expect someone in that position to risk giving away their lead. I expect we're going to see more of the top labs selectively holding back their best stuff.

This isn't that surprising after it was reported on that he had notes about claiming to "come out as a Republican and against the woke agenda" as a PR plan to defend himself. (https://gizmodo.com/sbf-floated-coming-out-republican-tucker...) I wonder if Trump is selling pardons and whether SBF still has the means for it. It's depressing that the US's state of affairs is such that this might be a workable strategy for him.

We could rename "cooldown" to "pre-release period".

Gmail stopped using email contents for ad targeting in 2017.

GPT-4 was announced in March 2023 and wasn't made available to all developers until July 2023.

Are there standards for a video to declare a default subtitle track to use?

No, the reference to May 19 in the article is about a previous supply chain attack against AntV (https://www.stepsecurity.io/blog/shai-hulud-here-we-go-again...). I think there may be some copy-paste mistakes where they reused part of that previous article and didn't contextualize it correctly.

The npm package `@redhat-cloud-services/chrome` version 2.3.1, which was part of this current supply chain attack, was published on June 1. The malicious package version is no longer listed on npmjs.com's web UI since it was taken down, but the publish date of 2.3.1 can still be seen in https://registry.npmjs.org/@redhat-cloud-services/chrome by searching for the version number there, and the publish date was 2026-06-01T10:54:42.121Z.

I find the article extremely annoying for not having a clear timeline of when these malicious package versions were available.

The security companies looking for and reporting the issues aren't going to use the cooldown too.

Even for English speakers, the subtitle experience with pirated movies is often lacking. Movies with non-English-speaking characters are often meant to have subtitles for their dialog and not for English speakers by default, but many pirated versions don't do this. I recently saw discussions online of a lot of people saying they went an embarrassingly long time without knowing there were supposed to be subtitles for the aliens in District 9 or the mute hand-signing girl in The Boys.

It's worth pointing out that the article explicitly calls out your first mixed technique:

Finally, one should never mix the encode and decode steps of the two quantizers. That’s just broken code. It’s an easy mistake to make, though.

OpenImageIO uses the standard division by 255 technique: https://openimageio.readthedocs.io/en/latest/imageoutput.htm...

But there is a second level of people reviewing packages on npm. They're the ones that report issues like the github issue this HN thread is linked to, and they very frequently get malicious npm packages taken down within a day of publishing. The big issue is just that not everyone is using a cooldown to avoid packages less than a day old and so people who install new packages at unlucky times don't get the benefit of that layer of review.

I was thinking this through more and realized that a callback directly in a thread local variable isn't quite enough: You need to keep a stack in the thread local variable. Every try-handle block pushes a callback in and pops it when exited. (Javascript's AsyncLocalStorage is naturally nestable so you don't need to manage a stack yourself with it.)

That's what I was thinking. You could get almost all of this pretty directly in Javascript by putting a callback function in an AsyncLocalStorage instance or, in other languages, in a thread local variable.

People in the WebAssembly standards group are recently considering relaxing the limitation that the main thread can't use atomic.wait: https://github.com/WebAssembly/threads/issues/177#issuecomme...

Spaces takes this shape. (Disclosure: I work on it.) Issued names live in a binary Merkle trie. The root of that trie is committed to Bitcoin’s chain

Who can update and publish the merkle trie onto the blockchain? Is it only Spaces themselves who can? If so, this seems a little inferior to more direct blockchain solutions like the Ethereum Name Service which exists as a smart contract on a blockchain that anyone can use directly.

Your deno.json/package.json should generally pin things to their major version (eg. "^3.1.4"). Your application's lockfile (deno.lock/package-lock.json) which is generated by default pins your dependencies and your sub-dependencies to exact versions.

Isn't Lua equally monkey-patchable? Both of the languages, along with Python and Ruby, represent nearly everything as mutable objects.

Javascript/Typescript as it is now isn't a great language for a real capability system because any code can monkey-patch global objects and use that to steal capability objects from elsewhere. JS code of different privilege levels needs to be run in separate realms at the very least. (Though there are proposals for things like frozen realms that try to make JS more suitable for capability systems.)

One issue was that all dependencies had to be pinned to exact versions. If some sub-dependency of yours got a bugfix in a minor or patch update, your project only gets that update once the dependency updates to bump its dependencies and then you update that dependency. (Pinning exact versions of everything has its place but that place generally should be in your own project's lockfile.)

Also, if multiple dependencies of yours share a sub-dependency, then unless they pick the exact same patch version then you're almost always going to have multiple versions of common sub-dependencies loaded. (It's great that multiple versions of a dependency can be loaded at once because it lets you avoid the classic "dependency hell" issue, but having multiple versions of nearly all of your common sub-dependencies gets wasteful at some point. Generally there's rarely a good reason to have multiple versions of the same dependency that only differ in patch or minor version.)

(Deno's current support for NPM and JSR avoids these issues.)