m11a

How long did it take from the first DBMS to get to Postgres? The first OS to get to Linux? The first compiler to get to LLVM? For Postgres and Linux and LLVM to become mature enough to hold the revered reputation they have now?

The jury's still out on AI, but coding agents have only really worked for about 6 months now. It's not exactly a fair statement to make. Obviously good things take time and thought. And understanding the full implications of technological advancement also takes time and thought.

I had conversations with Ben a few years ago about his economics research (incidentally related to some research I was doing at the time). I wouldn't have guessed he was close to 70. He's a sharp guy.

(I also think his economics research is excellent, and the comments elsewhere about his track record aren't particularly fair.)

Right. But given that the entire point revolves around QuePaxa, it's strange to see no discussion on it. If that weren't the point, the article would be "Why Cloudflare implemented and deployed Paxos".

Which would also be a good read, but this article also isn't that. It doesn't discuss their experience deploying the protocol, aside from the following statement:

Meerkat is not deployed to production, but we have run multiple proofs-of-concept with up to 50 replicas distributed around the world, to great success. Leaders in our proof-of-concept clusters constantly fail, and the cluster keeps operating with no increase in error-rate.

I think it would've been more interesting to read why Cloudflare chose the specific algorithm they did, see an example of a pathological but common situation Cloudflare sees at their scale that makes other protocols unsuitable for them, therefore they made X choice and this led to Y gains in production (or on dummy workloads, or whatever). As it stands, there's nothing here actually specific to Cloudflare's workload or deployment. It doesn't even state their use-case beyond "small pieces of control plane state (e.g., leadership for replicated databases)"

This article is a bit hard for me to grasp the main ideas of because, given Cloudflare's requirements (e.g. no strong leaders), it immediately seems like they should be comparing to leaderless protocols like Paxos-class algorithms. Comparing to Raft and saying it's better because Meerkat is leaderless is confusing, because Raft is an adjustment to Paxos to specifically have strong leaders. So I'm 3/4 the way into the article and I don't see what's unique here.

I think the unique idea here is supposed to be QuePaxa's idea of avoiding timeouts for ensuring liveness. The actual discussion of QuePaxa is limited to one paragraph at the end, and tbh only a couple sentences of that paragraph.

I feel like the article could've been titled "Consensus protocols and linearizability: a brief explainer", or "Paxos vs Raft", or similar. It just doesn't feel like it communicates what it claims to communicate, and is a bit confused on who its audience is, just IMO.

It depends on the model provider. OpenAI's is very limited and precisely written.

Plus, open-source models hosted on SaaS inference providers tend to come with a strong ZDR agreement too.

Most corporations likely have zero data retention agreements with LLM providers, at least for API usage.

(Sure, you could be sceptical on whether the LLM provider is upholding that, but I personally do trust them. The trust betrayal if ZDR wasn't actually ZDR would be too great and commercially damaging for them to lie.)

Says a lot about just how much money they’re raking in from core business.

I mean, you’d resort to an obfuscated approach if you thought the ‘malicious’ users would remove your direct telemetry. The other users could be perfectly happy about it, but if you announced the change, obviously the malicious users would hear about it too and disable it.

This isn’t a comment on whether I agree with the change. Just that your analogies aren’t applicable here.

I mean, after the US just signed an export control ordering Fable access blocked to non-US users (including European nationals), I doubt European and "US-aligned markets" are eager to ban Chinese models against their own interests.

California already has very high taxes. I think marginal tax rates are higher in California than for UK tax residents, certainly for CGT, and roughly similar for income tax.

I'd say the fact that California remains the epicenter of tech despite its high taxes suggests concentration of talent matters far more than tax rates.

If Railway's account was suspended due to an error, not a TOS violation, I doubt they'll pull such a card. If Google were sued, such a blatant lie would be found in discovery pretty quickly and I doubt a court would look upon it favourably. They'd also be starting a public PR battle that they'd almost certainly lose (assuming there was indeed no real TOS violation) which would make them look completely untrustworthy. So I doubt Google will do that.

bastawhiz is probably right in that Google will offer some credits and an apology, and Railway will reduce their dependence (probably), rather than a lawsuit. And I doubt Railway wants to be on the bad side of one of the few big cloud providers. But I'd be surprised if Railway didn't have a good argument to make for compensation or a lawsuit.

I’ve learned that in AI, until you can get your hands on something and try it yourself, assume all claims are false.

I'm not sure security through obscurity is a great practice?

Not to mention, I presume the core bits of Cal.com's source code are already in place and aren't going to change significantly?

Like, this feels like a business decision and not a security decision

Cloudflare's Code Mode is conceptually the same as Anthropic's Code Mode (https://www.anthropic.com/engineering/code-execution-with-mc...), or the various open source implementations that predate and postdate those blog posts.

tbh, that companies tried to make something proprietary of this concept is probably why its adoption has been weak and why we have "MCP vs CLI/Skills/etc" debates in the first place. In contrast, CLI tools only require a general a bash shell (potentially in a sandbox environment), which is very standardised.

If I recall correctly, the ‘official’ Python one is a fork of FastMCP v1 (which then removed the attribution, arguably in violation of the original software’s license)

K8s gives you orchestration of Docker containers. I don’t think it handles the container boundary any more than Docker does.

I don’t think it should be assumed to give network isolation, unless you’re also using extensions and something like Cilium for that purpose. I don’t think it’s the right primitive for agent sandboxes, or other kinds of agent infra.

(Obviously, you could still run a custom runtime inside k8s pods, or something like GCP’s k8s gVisor magic.)

Don't think that's a valid comparison.

Apple can do those things because they control the hardware device, which has physical distribution, and they lock down the ecosystem. There is no third party app store, and you can't get the Photos app to save to Google Drive.

With Claude Code, just export an env variable or use a MITM proxy + some middleware to forward requests to OpenAI instead. It's impossible to have lock in. Also, coding agent CLIs are a commodity.

seems to be on it’s way out

Change is fraught with chaos. I don't think exuberant trends are indicators of whether we'll still care about secure and high quality software in the long term. My bet is that we will.

I agree, and as much as I think AI helps productivity, for a high security solution,

Recently, with Claude's help, I rewrote everything on top of rusty_v8 directly.

worries me

Is WASM’s story for side effects solved yet? eg network calls seems too complicated (https://github.com/vasilev/HTTP-request-from-inside-WASM etc)

Node in Docker doesn’t have full isolation and ‘sandbox’ escapes are possible. V8 is comparatively quite hardened

The quick setup is cool! I’ve not seen this onboarding flow for other tools, and I quite like its simplicity.

So ... any bets the cause isn't DNS?

It might meaningfully change the business model of LLM businesses. Becomes seemingly much harder to universally charge $30/mo subscriptions when the user is bringing their own API key.

Right. IIRC, the acquiring bank would send an authorisation advice to the issuer when it comes back online. An auth advice is like notice that a payment happened, the issuer doesn’t really get a say in rejecting it (as it does for an authorisation). For the most part, anyway.

If that transaction brings the customer into a negative balance, it’d be between the bank and customer to figure that out. Especially if the customer has no overdraft facility and isn’t supposed to be able to go negative, and isn’t able to easily recover the payment, or the customer is considered vulnerable, then the bank will often just swallow the loss.

I’d agree. The biggest exception I can think of is X, which post-Musk has plans to reduce/remove ads. Though I don’t know how much this tanked their ad revenue and whether it was worth it.

I think the problem is, so many demos are cooked these days, that it’s so much more trustworthy to see it work live.

Codex got ported to Rust

For Rust, there are a few blogs that lean more on fundamentals and language design (like https://without.boats/blog, https://smallcultfollowing.com/babysteps).

For misc Rust engineering, like the OP, I agree it’s quite scattered. I personally like to save good ones in my Feedbin as I encounter them

Think you need a healthy mix?

eg: if you want distributed systems, esp Java-style, https://www.martinfowler.com is a pretty handy reference. (similar for other areas of SWE).

It’s nice to have a single resource that documents a bunch of non-obvious but still-generally-accepted engineering practices relevant to a domain. It’s of course an opinion, but is reasonably uncontroversial. Or at least, you won’t go too wrong while you develop your own taste in said domain.