HN user

hacb

236 karma
Posts16
Comments46
View on HN
Claude Opus 4.5 8 months ago

it will be just enough time to finish my quarter roadmap and chill until january

I don't know why submitting a vulnerability on those platforms is still free. If reporters had to pay a little amount of money (let's say, 20-50$, or indexed to the maximum gain of a vulnerability in a given category) when submitting their report, maybe those would be of better quality.

I know that this poses new problems (some people can't afford to spend this money), but it would be better than just wasting people's time.

Unfortunately, the current way of how things work is, like you said, "deeply flawed". You will not change it in a few months, not even in a few years too.

What you can do, however, is to adapt to current threats, the same way adversaries adapt to countermeasures. Fully secure setups do not exist, and even if one existed, it would probably become obsolete very quickly. Like James Mickens said, whatever you do, you still can be "Mossad'ed upon". Should we give up implementing security measures then?

Thinking about security in a binary fashion and gatekeeping it ("this is not enough, this is will not protect you against X and Y") is, _in my opinion_, very detrimental.

This is why I like the Try Hack Me platform so much. You have a lot of walkthroughs and guided challenges to get started and learn the basics; challenges get harder and harder with less and less help. You also have access to challenge write-ups even if you did not complete them, meaning that if you're stuck, instead of losing motivation, you can make progress.

They embrace learning for all levels and helped me so much getting into infosec professionally.

I've been building https://carryless.org, a pack manager for people liking outdoor activities (and ultralight weight wheenies). It is focused on user experience, clean and simple UI. Open-source[1], free forever. Here's an example of one of my packs: https://carryless.org/p/Q22oPD3V

It's basically inspired by LighterPack[2], but LP is left abandoned and the UI is quite hard to work with, unfortunately.

[1] https://github.com/eze-kiel/carryless

[2] https://lighterpack.com/

I'm teaching compsci at university, and since a few years I create all the material I use (slides, exams, sometimes booklets) in Typst. It does perfectly the job, and it's fast. I'm 100% convinced, even tho I was not a big LaTeX user before, so can't compare the two.

In our case, we have strong security guidance about which MCP to use and how; otherwise we're free to use the coding AI tool of our choice (Claude Code, Cursor, ...). There's not KPI about LLM usage _yet_, but I feel it coming soon.

There are also many workshops about how to build with AI etc, so it's slowly becoming part of everyone's work

We're among the companies that decided to be "AI-first" - whatever that means. They are spending huge amount of money and effort to deploy AI tools such as Claude Code, Cursor, etc.

I'm kinda worried about how the massive usage of AI coding tool will affect the understanding of large codebases and complex systems, but to be totally honest I'm really impressed by Claude Code and how it can write Terraform/Helm/Ruby based on the company's idioms (and I'm talking about a repository with 250k+ lines of HCL!).

It was at the beginning of the Copilot era where Github started to vacuum every line of code on their platform.

Also, I liked the idea of Codeberg and not being dependent of big corps. It was a technological regression (even if Github as a lot of issues) but it felt good. Big projects with a few hundreds stars stayed on Github, for community.

I moved most of my projects from Github to Codeberg, and as anticipated got much less interactions, contributions, visibility etc. on them. Also Codeberg had quite some big issues with their underlying infrastructure during the last 2 years, but they seem to have done a lot of work to make it more reliable.

Now, I publish projects on Github only if they are worth sharing/being discovered, but most of my code is done on private (and sometimes public) Codeberg repositories.

Of course, an AI will not "magically" code an app the same way 10 developers will do in a year, I don't think we disagree on this.

However, it allows you to do things you don't understand. I'm again taking examples from what I see at my university (n=1): almost all students deliver complex programming projects involving multi-threading, but can't answer a basic quizz about the same language in-person. And by basic question I mean "select among the propositions listed below the correct keyword used to declare a variable in Golang". I'm not kidding, at least one-third of the class is actually answering something wrong here.

So yeah, maybe we as a society agree on the fact that those people will not be software engineers, but prompt engineers. They'll send instructions to an agent that will display text in a strange and cryptic language, and maybe when they'll press "Run" lights will be green. But as a professional, why should I hire them once they earned their diploma? They are far from being ready for the professional world, can't debug systems without using LLMs (and maybe those LLMs can't help them because the company context is too important), and most importantly they are way less capable than freshly graduated engineers from a few years back.

10 years from now we can all laugh at the idea of people defending doing stuff without AI assistance.

I hope so, but I'm quite pessimistic unfortunately. Expertise and focus capabilities are dying, and we are more and more relying on artificial "intelligence" and its biases. But the future will tell

The calculator did not erase math wizards

The major difference is that in order to use a calculator, you need to know and understand the math you're doing. It's a tool you can work with. I always had a calculator for my math exams and I always had bad grades :)

You don't have to know how to program to ask ChatGPT to build yet another app for you. It's a substitute for your brain. My university students have good grades on their do-at-home exams, but can't spot a off-by-one error on a 3 lines Golang for loop during an in-person exam.

I agree with you, but in my case I'm teaching programming, so doing table-top assignments is a no-go for me. I wrote too many C programs with a paper in a pen to know how bad it is. :)

That's why those assessments are tailored to be done at home, and then they send me an archive or a Git repo link.