HN user

mdeeks

1,269 karma
Posts1
Comments304
View on HN

Two years? That exists right now. You only have to point Codex Security at an open source repo. There are a lot of tools and companies that are spinning up today that do autonomous pentesting.

I'm not even sure a specialized model is needed here. It probably just needs the right harness around existing ones.

I expect the next two years to be absolutely brutal for hacks. Attackers have supercharged tools in their hands right now. Defenders are only getting started and will have to plow through a massive backlog of newly uncovered vulns.

The major short term downside is that open source or personal projects won't be able to afford things like Codex Security.

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes.

I'd say it is about 90% accurate for us. Often even the "Low" findings lead us to dig and realize it is actually exploitable. Everyone makes these mistakes, from the most junior to the most senior. They are just a class of bugs after all.

I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. Highly recommend you get something enabled for your own repos ASAP

Starship V3 2 months ago

What? There are three flags flying in my street alone and I'm in the middle of the liberal bay area.

I'm not quite understanding your project. What is the use case? Is this so I can package up an existing terminal app as a dedicated desktop app?

If so that actually sounds really cool. I'd like a dedicated lazygit app in my tray at all times.

I feel like pricing needs to be included here. I kind of don't care about 10 percentage points if the cost is dramatically higher. Cursor Bugbot is about the same cost but gives 10x the monthly quota of Qodo.

I know this is focused solely on performance, but cost is a major factor here.

They aren't just building "a lot" of renewables and nuclear, they are building an absolutely mind boggling amount of it. Last year it was more than the rest of the world combined!

Who cares about mental gymnastics. It's a win for literally everyone and I hope you ca see it that way instead. Competition is good. It drives others to keep up.

Despite what the current US govt wants, the economics of solar and other renewables will drive it. Worst they can do is slow it down a bit.

I didn't say China isn't doing anything. They are rolling out a mind boggling amount of clean energy right now. More than any other country by far. It's honestly incredible scale. It unfortunately isn't keeping up with their emissions though. The data is from 2023. It's very possible that in the last two years China has been able to stabilize emission growth.

I actually disagree a bit on the first part. I think developing countries have a right to have higher per capita emissions as they raise their standard of living and economy where they can get to the point of widely adopting clean energy.

This is one of the places where per capita doesn't matter as much as total emissions. We have one planet. The yearly total and cumulative matters the most.

China is by far the leading emitter. Over double of the US as of 2023 (latest available data I can find). China's emissions also aren't falling, they are skyrocketing. The US emissions ARE falling.

The US dominates in cumulative, which is essentially the measure of the total damage done to the planet. The US is doing something about it though. Yearly emissions have been dropping since 2007.

https://ourworldindata.org/co2-and-greenhouse-gas-emissions

I signed up and tried it with Cursor. It is very close, but still has a lot of rough edges that make it hard to switch:

  * Once in Cursor I can't click on modified files or lines and have my IDE jump to it. Very hard to review changes.
  * I closed the Ona tab and couldn't figure out how to get it back so I could prompt it again.
  * I can't pin the Ona tab to the right like Cursor does
  * Is there a way to select lines and add them to context?
  * Is there a way I can pick a model?

Thanks, I'll give it a shot. I wish your site would show me what it actually looks like. It's a lot of words and fancy marketing images and I have no feel for the product. It leaves me unsure if I should invest my time.

I'd love to see a short animation of what it would actually look like to do the core flow. Prompt -> environment creation -> iterating -> popping open VSCode Web -> Popping open Cursor desktop.

Also, a lot of the links on that page you linked me to are broken:

  * "manual edits and Ona Agents is very powerful." 
  * "Ona’s automations.yaml extends it with tasks and services"
  * "devcontainer.json describes the tools"

PRs work well for what they are. Ship off some changes you're strongly confident about and have another human who has a lot of context read through it and double check you. It's for when you think you've finished your inner loop.

AI is more akin to pair programming with another person sitting next to you. I don't want to ship a PR or even a branch off to someone sitting next to me. I want to discuss and type together in real time.

What you're describing feels like the next major evolution and is likely years away (and exciting!).

I'm mainly aiming for a good experience with what we have today. Welding an AI agent onto my IDE turned out to be great. The next incremental step feels like being able to parallelize that. I want four concurrent IDEs with AI welded onto it.

This is possibly what I want? It's hard to tell from all of the marketing on the site.

I want to run a prompt that operates in an isolated environment that is open in my IDE where I can iterate with the AI. I think maybe it can do this?

Yes, but my point is often times I don't want to. Sometimes there are changes I can make it seconds. I don't want to wait 15+ seconds for an AI that might do it wrong or do too much.

Also it isn't always about editing. It is about seeing the surrounding code, navigating around, and ensuring the AI did the right thing in all of the right places.

I feel like these background agents still aren't doing what I want from a developer experience perspective. Running in an inaccessible environment that pushes random things to branches that I then have to checkout locally doesn't feel great.

AI coding should be tightly in the inner dev loop! PRs are a bad way to review and iterate on code. They are a last line of defense, not the primary way to develop.

Give me an isolated environment that is one click hooked up to Cursor/VSCode Remote SSH. It should be the default. I can't think of a single time that Claude or any other AI tool nailed the request on the first try (other than trivial things). I always need to touch it up or at least navigate around and validate it in my IDE.

Not sure why you are being downvoted. It's an interesting thought.

I will add that us having children completely erased the desire to get a dog. We almost got one just before our first born. Now we can't imagine. I think it's a combination of what you're suggesting, and also because a dog requires a lot of time we just don't have now.

Interesting, because I find that very intuitive. If my cursor is on or next to formatting, it'll inherit it.

I find formatting after the fact a lot easier too. Bold a line? cmd+shift-right and then cmd+b. Trying to add formatting after the fact with markdown isn't fun. Though many editors try to helpfully insert markdown for you with hotkeys, it often fails on multi-line things.

I really hope Apple Notes makes this something that's opt-in and I don't have to see. Thankfully it sounds like it is an export only feature.

I think there is a bifurcation of people who like markdown and people who like rich text. And both groups have strong opinions. Apple Notes was my goto rich text editor. Fingers crossed that they aren't making this worse for us.

Related: I switched away from Bear notes because personally I find markdown hideous to look at. This post made me go back and check on it today and it looks like Bear notes now supports hiding markdown right after you type it. This seems like a really good compromise, though I still don't like that I see it when I place my cursor on it. Worth a shot if you're a "never markdown" person like me.

I ride the bus and Bart in the San Francisco bay area and I've lived here my entire adult life. It is not fine. About once a week some kind of event happens. Off the top of my head these are things I have experienced both on Bart and AC Transit (though mainly Bart):

* I've been punched twice. Not hard, but an angry person hitting me in the shoulder and the back because they were drunk or high and I guess I looked at them wrong

* I've been shoved out of the way hard probably five separate times?

* People openly smoking crack, smoking weed.

* People high out of their mind. Just on monday some guy had his pants around his ankles high out of his mind swirling around and rubbing up against riders.

* A man shouting and punching the top of the train saying he's going to kill himself

* A man screaming profanities, calling women the c-word, sluts, saying he's going to rape people

* Multiple fights

* Someone getting their phone swiped out of their hand and punched in the head when he tried to chase them.

* I watched someone eat most of a burrito, stand up, turn it upside down and squish it onto the seat.

* I saw a man with a concealed gun tucked behind him into his belt walking around the station looking for someone.

These are definitely some of the worst events, but something on the spectrum of "bad" happens weekly.

Sometimes I do, but its eight times the cost and takes an extra 30 minutes each way. Ideally I would love to take public transportation. I love the idea of it, the economics, the traffic reduction, and the general social benefit. Unfortunately here it comes with some big negatives and they really wear you down after over a decade of it not really changing much.

It's not about PR budget or whatever. It's about the fact that they have an incredibly easy to use app, with millions of people actively using it, and a ton of software engineers who are really great at logistics problems like this.

Our transit authority hasn't managed to spring this up for us and I'm not confident they have the capability.

FWIW I'm not "younger people". I'm just someone who's been using mass transit to commute for the past 15 years and desperately wants something better. I don't care if it is an original idea. I just want it to exist.