rstuart4133

they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager."

Errr, no.

You can transfer a password from one manager to another. Those very same password managers won't let you transfer a passkey they hold.

And if you know the password, you can use it anywhere by just typing it in - no complex technology or protocols involved. But using a passkey involves your secure computer talking to another computer, using a complex protocol that can't go via eyeballs and fingers. If you don't have a way to connect the device holding the passkey to the computer wanting your id - say your USB A Yubikey isn't recognised by your phone, then you are out of luck - you can't use that passkey, even though it's sitting in your hand.

And you can't work around that by copying the passkey to a device that can communicate with the service you're using, because you aren't allowed to copy.

It's an unworkable mess. The mess is not created by passkeys themselves, because, as others have said elsewhere the protocol is pure elegance. The mess is created by vendors choosing lock in over transportability. I'm hoping it's a passing phase.

This is the first one of these announcements that has me actually scared of what comes next.

This didn't set off your alarm bells? https://www.theblock.co/post/392765/ There have been a few of these now. Maybe it's my imagination, but they seem to be becoming more frequent.

So far, they all look to be accidents. But we can't be far from someone deciding its a good way to rob a bank, or disable a country.

I do strenuous exercise most days, where "strenuous" means I'm close to my aerobic limit. I can tell I'm coming down with something a few days before I feel sick, because it nearly pushes me over the edge of what I can do. No technology, just "geez that was hard today".

I've seen others here report the same thing. It's interesting that it can also be picked up using technology monitoring the body's "at rest" metrics, but not that surprising.

As for who is buying it - the obvious candidate is businesses selling goods to nest-building new mothers. We've known this since Target gave away a daughter's pregnancy to her dad, via their ads: https://blog.othor.ai/the-target-pregnancy-prediction-analyt...

All I can say is skill issue.

I regularly see claims by people that they have produced large, reliable bodies of code using vibe coding. Unfortunately, no vibe coded project I've used comes anywhere close to code reviewed by a human. Admittedly, my sample size is very small: things like claude-code, OpenClaw, and the occasional project I see mentioned here. But compared to the things I used regularly like GNU coreutils, Firefox, Linux, vim, git and the hundreds of other software projects I use daily, vibe coded apps are in a different ballpark. Vibe coded apps of a few 100k lines often glitch several times a day, the traditional ones that have several orders of magnitude more lines often don't fail in several years of use.

AI is now being used to assist in creating and maintaining these traditional bodies of software, of course. It looks like it has enhanced productivity as open source contributions have grown by 20% or so, and we've only just started to learn how to use it. I haven't noticed any degradation in quality. It may be too early to tell, but I suspect the engineers involved wouldn't let that happen.

As you say, it's a skill issue - it takes considerable skill to produce reliable maintainable code. But I suspect that wasn't the skill you are referring to.

Not disagreeing about the need for sentinel values, but Rust also has NonZero. When combined with Option, you get a similar result to outcome to C's -1.

Similar because it's a compiler hack, as in the compiler treats std::num::NonZero specially. You can't create your own type with the same properties as you can in C.

they do seem to be causing fewer dollars to leave the country in imports.

Hmmm.

2026-07-07 "Canada's trade surplus in May jumps to a four-year high as US exports surge": https://www.tradingview.com/news/reuters.com,2026:newsml_L4N...

2026-07-06 "US trade deficit surges amid artificial intelligence spending boom": https://www.aljazeera.com/economy/2026/7/7/us-trade-deficit-...

If Trump's tariffs were supposed to lower the trade deficit, they haven't started working yet.

This would be extremely difficult, I would say impossible from a practical standpoint.

It's not only practical and possible, it's so common it even has a name in software engineering circles: change control. It boils down to this: you delay installing the software until it's been reviewed, tested and deployed by others. Or as Linus would put it, until the many eyeballs have had their say.

As for "the person in control of the platform": the solution is to remove some of that control. You make new versions of the software available for anonymous download, so the provider has no idea who is upgrading. All open source distributions provide their software in that way. No proprietary platforms I'm aware of do, because they want a "billing relationship" with the customer. Once downloads are anonymous, the owner of the software can't target individuals with a tailored Trojan Horse binary. Everyone gets the same binary, and so there are lots of eyeballs looking at it.

The final piece of the puzzle is reproducible builds, which ensures the many eyeballs can see the code use to build the binary.

All this has been around for a while now, so it's largely a solved problem in open source distributions. The problem with web-based cryptography is it isn't managed like an open source distribution. Downloads aren't anonymous, the source isn't available or signed, and it changes so fast change control isn't possible. So yeah, as things stand it's snake oil. But it doesn't have to be - it's just the way things are now.

the anti-vax crowd kept talking about being found in the veins/arteries of folks who took the Covid vaccine?

"The deal" is the clot issue was a problem for Astrazeneca. Astrazeneca is not an mRNA vaccine. It came out first, and was offered to a lot of people - until the clots started showing up.

Australia's response (where I live) was to withdraw the Astrazeneca vaccine and go into lockdown instead. They exited lockdown once a safe replacement vaccine was manufactured and could be mass administered, which happened many months later. The safe replacements were predominantly mRNA vaccines.

From memory the final statistics were Astrazeneca, which was only available for a month or two killed 1 in every 1 million doses, the mRNA replacements which now have been used for years have caused about 1 death for every 55 million doses. You wouldn't want to be the unlucky 1 in 55 million, but you would not want to miss out on taking the mRNA vaccines either - they saved 1000's of lives.

In the high risk groups, Astrazeneca turned out to be worth its risks in over-60s in Australia, but killed more people than it saved in the lower risk groups. But Australia was among the best countries to manage the COVID pandemic. In countries like Mexico where the death rates from COVID were far higher, taking Astrazeneca increased your chances of surviving the pandemic, despite the higher complication rate.

The meme that mRNA causes clots seems to be remarkably common, despite being wrong. It is why to this day many people are vaccine hesitant. It's unfortunate. I think the underlying cause of the large number of people with clots was the mass roll out of Astrazeneca as soon as it passed testing. Normally the take up of a new medicine is gradual. The high prices of the early batches mean they are only given to people who stand to benefit most. The less common side effects are caught in that phase. The phase didn't happen for Astrazeneca.

i dont think there is any software on the planet that i would consider "truly life changing", so i find it a bit weird to hold ai up to that standard.

Off the to of my head web browsers, the algorithms that made WiFi / 5G / Bluetooth possible, public key encryption, GPS, SQL, TCP/IP, Reed Solomon codes spring to mind. Without them like today would be very different. Sounds life changing to me.

The current valuations of AI companies suggest AI will have a similar effect. I think it will, in the long term. People tend to overestimate/oversell the short term effects of technology, and underestimate the long term effects.

has nothing to do with CO2 and seemingly everything to do with a lack of oxygen.

If you lack oxygen because you can't breathe in, then CO2 will be building up because you can't breathe out.

Neither sound like a good explaination for the suffocation response being winded causes, because most people can hold their breath for a least a minute with too much discomfort. It's more likely due to a primitive response to unexpected airway restriction - the same as choking.

PS: pigs have the same CO2 response as us, maybe stronger as they can detect C02 at lower concentrations. I find that hard to reconcile with pig abattoirs killing pigs by lowering them into a pit of 90% CO2. N2 would do the same job without the pig realising what is going on, but CO2 is heavier than air so it stays in the pit, making it more economical.

https://pmc.ncbi.nlm.nih.gov/articles/PMC11948533/

This is false. There are many problems with age verification, but the EU approach does not involve the id provider in the verification flow. The site requiring verification presents a QR code which encodes a presentation request and the provider controlled URL

The nit you look to be picking is "redirect" means "a web page directs your browser to go to another URL". That is an interpretation you could use, but I was using a broader one. In the EU case, it isn't the browser following the redirect, it's you. The "server" you are redirected to is a government-provided app on your phone that implements openid4vp. But the underlying principle is still the same - you are "redirected" to a third-party proof-of-age provider, who sends a reply signed by the provider.

To the OP: openid4vp is an example of a protocol that is about as private as you can get. It all works offline, so the government does not know what sites you have visited. And the age verifier has no idea who owns the phone. As you say, the connection between the phone and the person holding it is a weakness; junior could just borrow big brother's phone to prove his age.

Another fun fact: the body's suffocation response isn't caused by lack of oxygen. It's caused by high CO2 levels in the blood [0]. If your car floods the air with CO2, you will respond like someone is holding your head under water.

Carbon monoxide kills you by binding more strongly to the hemoglobin than the O2. You don't notice, because the CO2 removal mechanism continues to work fine. You'll usually die before realising anything is wrong.

But if they reveal nothing, isn't it wide open for abuse?

Good point, they do contain more information than "They are over 18". The primary (usually only) thing is who is attesting they are over 18. That might be the government, or a bank.

That's inevitable, because the usual flow is rather like Google's OAuth - the site needing you to prove your age rediects to the provider (Google, or whoever), who asks questions to verify your identity, and then replies with "over 18" or "not over 18".

This can leak other information aside from the site knowing who is verifying your age. For example, done the wrong way, the Google / the government could know what porn sites you like. OAuth, for example leaks that sort of information. But there is no technical reason it has to be that way.

The major barrier to all this isn't whether it's possible to design a protocol that proves your age, having a driver's licence or even an amount in a bank account. It is absolutely possible. It's that to be useful, everyone has to agree on the same protocol. That has so far proved to be near insurmountable.

A few dollars per false claim seems like a good starting point to consider from.

A nominal fee to lodge a claim seems more practical. No courts, no lawyers, just a government web form that pay for itself. It won't stop vexatious claims, but it will stop mass speculative Hail Mary's.

https://archive.is/ziMkc

Keep dreaming of a technological solution -- there is none that does not lead to the world that FIRE is warning about, except to accept that we can only make a solution "good enough" and leave it at that, without expanding into full on identity verification.

The world that FIRE is warning about already exists in Australia, whose age verification laws prompted the article.

I'm an Australian. Our government passed the Assistance and Access bill on New Year's Eve in 2018, without much debate. The law allows them to demand "assistance" (code word for: you shall develop an undetectable spy app for us), and "access" (code word for: you shall silently install that app on the devices of any persons we nominate). Both requests are subject to a gag order.

As an example of what's possible, this allows them to demand Google "assists" them to develop an undetectable app that records the phone screen and keyboard usage at periodic intervals, and send it back to them, and then to demand Google installs it on devices owned by persons of interest.

The world has continued on. That may be because the tech bros are resisting helping (there were threats by a government head of security implying they weren't getting the level of compliance they wanted). But it may also be because we are a democracy, and blatant misuse of powers like this is likely to get you unelected. I've seen a few cases where it "felt" like the government bureaucracies used this tool against whistleblowers, which made me feel distinctly uncomfortable. But I don't know, and until recently they had a remarkably good track record against local terrorism. The recent exception is the recent Bondi killings, where a completely bonkers father convinced his son to go on a shooting spree. But they managed to maintain complete radio silence during the perpetration stage - I guess it was all planned over the kitchen table. That couldn't be detected by any surveillance network.

So for now, it looks like they have used the tool according to the rules laid down in the bill. All spying requires independent judicial orders, which I'm fairly sure they obtained. (To put that into perspective - when the threshold is "the person broke the law" and you get to write the laws, the threshold is not quite as high as it might appear - particularly for government whistleblowers that pissed off the incumbents.)

But for most of us, whose "crimes" are at most indulging in naughty pleasures, the bill offers pretty good privacy guarantees. If the government doesn't follow its own laws all bets are off, of course - and yes, this very scenario is playing out in another Five Eyes country. But if the government does follow its own rules, then any government-backed zero-knowledge proof scheme that includes a snitch code that can only be unlocked by a judicial order is going to be fine.

TL;DR: for the scenario FIRE is worried about, the horse bolted 8 years ago in Australia. The current alternative of being forced to hand over photos, identity documents, and god knows what other PII to random web sites is far worse in terms of privacy than a zero-knowledge proof of age issued by the government - even if isn't truly private.

This quote from your link is positively scary:

Some examples we saw when evaluating GPT-5.6 Sol included the model packaging exploits in its intermediate submissions to reveal information about a task’s hidden test suite and, in another task, extracting hidden source code detailing the expected answer.

It rhymes with the behaviour Alibaba saw [0], but that was in training. This is in a (semi) released model.

[0] https://www.forbes.com/sites/boazsobrado/2026/03/11/alibabas...

As an Aussie who's spent time in Germany in one of these heat waves, this is definitely one aspect. But it's not just "keep the heat in". They are designed with huge thermal mass, so once warm they stay warm for a day or so.

When the heat wave struck, initially that thermal inertia works in your favour as the cool building keeps the interior cool. But after a day or two it heats up. Once that happens, the temperature at night doesn't drop. As you say, ventilation is not good, so the humidity rises too. The thing becomes an overnight sauna.

After one night of this, I went looking for a fan. In my Australian home, every room has a ceiling fan. In this German dwelling (rented by my daughter, an Aussie, for the past few years) there wasn't a single fan in the house, and worse none of the nearby shops sold fans. It looked to me like there was no "social knowledge" of fans or how to handle heat in general. I eventually got a fan off Amazon, who thankfully delivered the next day.

We were also there in another year in winter. These same buildings were amazing the cold. They could maintain a cosy inside temperature with very little extra energy. But geeze, you don't want to be in one in a heatwave that goes on for days.

I was mentored out of it, and while I still like my patches to be complete, I balance that with the available bandwidth of the team and what the team can reasonably actually process.

I struggle with the same issue. In my experience you can't reduce the total number of lines. If the feature took 10k or 15k loc to deliver it, you aren't going to be able to reduce that meaningfully.

You can usually break it into stacked series of commits. New code can be split up into stand alone modules, which all compile and pass their unit tests. They could even be shipped, although they wouldn't be used because the changes to the UI are always the last piece of the puzzle. If you are refactoring, you can usually find a way to split the refactor into smaller steps, each building on the previous one. That is almost certainly possible in this case.

The issue with both approaches is while you can review each step independently, what you miss by looking at just that commit is the motivation for doing it. You can only get that from the big picture, and to get the big picture you need the entire 10k or 15k loc available.

That means you have to push the entire series of commits. If you want to make it plain they are individually reviewable you push them as stacked PRs. Either way, it's a 15k loc push.

I don't see a way out of that for the same reason neither bottom up nor top down design works on their own. You have two edges - the upper (often the UI), and the lower (the OS, standard library - things you have to use to get anything done). You work from both edges simultaneously, each working towards the other, hopefully so that when they meet in the middle and the two fit together nicely. The point is, you have to review like that too. You can't just look at how neatly the blocks are stacked on the foundations, you have to evaluate if they are taking the best route to the destination. The review can fail in both ways - the UI can be beautiful but it stands on a mess, or the code could have built up a beautiful series of abstractions that bubble through to the top level and ultimately confuse the end user. So you have to review the code from both perspectives, and to do that you ultimately need to get your head around all 15k loc.

This means a reviewer demanding they be spoon fed a few thousand lines of code at a time is being as unreasonable as the person delivering 15k loc in one commit. They are demanding a simple solution to their problem, and it is wrong. They should be demanding all 15k loc be delivered in the form the author intends to ship, but split into digestible commits that clearly explain the path and reasoning taken between the top and bottom edges, so both the top and bottom level designs are plainly visible.

What happens when I do that is I get into fights over forced pushes. Everyone hates them, and for good reason. They asked for a simple change in their review, and what they want to see is a small commit reflecting their request. Hiding that by doing a rebase is met with howls of pain: "no forced pushes!". So you insert your commit reflecting just the change they asked for into the stack of commits the large feature necessitated. Doing that rebases every commit that depends on it, of course. You push the result and are treated with a chorus of "NO FORCED PUSHES".

Forbidding all forced pushes makes about as much sense as forbidding a 15k loc change, even through its well-structured into commits. It makes me wonder if unis bother to teach modern software engineering practices.

Those places grew out of an approach that had its origins in WW2. It was pretty obvious to the powers that be the USA won because science and engineering produced more and better weapons, transport and logistics than the enemy could. They eventually squashed both Germany and Japan with sheer industrial might.

Post WW2, the USA continued the same approach by adopting the Vannevar Bush model, which boiled down to the USA pouring money into basic research, which is never profitable. That fed the companies like the ones you list, who were willing to make bets on medium-term things that might return a profit in a decade or so. If the USA's dominance of world science and engineering in the later 20th century is any indication, it worked a treat.

The Vannevar Bush model started to be wound back in the Reagan years, and Trump seems bent on excising it entirely. Other countries noticed its success. Most OECD countries put a few percent of public money into basic research now. The country that seems to have really taken the lesson to heart is China. They've gone way beyond what the Vannevar Bush model did even in its heyday. The end result is they dominate some areas of science and engineering and consequently manufacturing now (who here remembers Huawei was the brains behind 5G), and now the USA has thrown in the towel that dominance will grow to cover most areas in time. The gap between the West and China on AI and semiconductors is at most a few years.

The USA is crying China is cheating with subsidies and yes that's true - for example it seems the AI models are mostly developed using public money, whereas the USA is relying on VC funding to do the same. The USA's funding of AI development will very likely slow down after the IPOs happen and the companies must become profitable. China's funding of AI won't slow down.

This is the result of a policy choice China made long ago in the Deng Xiaoping era, back in the 1980s. It's taken 40 years to bear fruit, but my it is fruiting vigorously now. The USA position is also a consequence of policy choices it's been making over the last 40 or so years, starting in the Reagan era.

If you want to see how far this has gone, look up: https://www.aspistrategist.org.au/aspis-critical-technology-... It makes for sobering reading. Some key metrics they measured:

- Research Leadership: China leads the world in high-impact research in 69 out of 74 critical technologies.

- Recent Overtakings: China recently overtook the US in foundational AI and biotech fields, including Natural Language Processing (NLP) and genetic engineering.

- Monopoly Risk: ASPI tracks 41 technologies where China's research concentration is so high it poses a severe future monopoly risk, largely driven by massive hubs like the Chinese Academy of Sciences.

There is now little doubt how this will pan out over the next few decades. The USA and the rest of the West end up buying products made in China, using Chinese technology, and protected by a Chinese patent wall. They will wonder what happened. They will try and recover by going to Chinese universities, and adopting parts of Chinese culture. It won't be a big change for most of the West - the name on the label just changed from the USA to China. It will come as a hell of a shock to most of the USA.

The ironic thing will be - the change has very little to do with the things people will focus on, like who manufactures what, or patent walls, or political systems, or excellence in universities. China pulled that off by adopting some key USA policies, while the USA abandoned those same policies.

The feeling I get is LLM's are the new Excel. I've seen lots of people develop little web based apps that tickle their interest. Things like dashboards for data that would didn't fit on their phone, table tennis scoring (really!), small account keeping apps, plotting calculated GPS path on a map.

These are tiny single use stuff. Exactly the sort of thing the company nerd would create spreadsheets for. The GUI is more advanced, but it is no more maintainable or scalable.

having the coffee warm is kinda important.

Cold drip coffee is a thing, done well a very nice thing.

GLM 5.1 gets close to 4.6. It can happily run for hours and achieve a result. It given it bugs like a race condition that lead to a count being out by 1 after millions of operations, somewhere in a hundred thousand lines of C code littered with locks and atomic swaps, and it found (as did Opus). Most other models can't.

I'm using Fable now and GLM 5.1 doesn't really compare. But it's literally 1/20 the price. I can't use Fable for coding - it's too expensive. So now we have three levels of models - lightweight ones you dispatch en masse to find things, ones capable of agentic coding tasks that can run for hours like Opus, and GLM (and possibly open source ones - I've only tried a few), and now Fable, which is a truly helpful "architecture buddy". Fable still makes many, many, mistakes, so you have to review every word it writes.

Why did the word "skynet" pop into my mind?

prioritizing security and hardware that's capable of running local AI models.

Just like the Googlebooks do. It seems everybody is heading in the same direction. Apple already does it. Their high end M4 chips with the 512 bit RAM busses are bigger than the 256 bit planned for the next generation of high end Intel and NVIDIA chips.

The light at the end of the tunnel is very bright now, but I still don't know if it's a train.

Humans are very expensive, so the equation almost always falls against them.

You underestimate what these models cost. Uber's budget is $1,500/dev/month. I gather that was put in place because the dev's were going through $6,000/dev/month, which Uber decided could not be cost justified.

Fable costs at least twice as much, or $12,000/dev/month.

Fable can apparently work for hours without supervision, which means a skilled engineer can now have it working on many tasks concurrently. I would not be at all surprised if they can put a nought or two on that number. If you do that, you are well out of "what a human costs" territory.

Some problems can't be solved without cooperation with the developer.

Those problems are the ones package maintainer forwards upstream.

It's well understood common and common workflow because lots of closed source packages are distributed by distro's now. Debian distributes firmware; Ubuntu and RedHat distribute closed source drivers.

The Chinese economics: possibly the USA's experience.

It was pretty clear the USA won World War 2 because it out produced and out innovated everyone else. Probably with that in mind, after World War 2 the USA adopted the "Vannevar Bush" model, summarised in this picture: https://www.researchgate.net/figure/annevar-Bushs-Science-th... The idea is to jump start R&D through public funding. The hoped for outcome was that R&D feed private enterprise, leading to a productivity boom.

The boom happened, and the USA did seem to out-compete everybody else in R&D, science, and the products they delivered for decades after that.

That way of doing things seems to have faded over time in the USA. The decline seemed to coincide with the rise of Neo-econmics, and now of course it's been obliterated by Trump. He's very keen to fund Intel to produce chips in a year or two's time (which is something the stock market and banks do perfectly well), but funding basic science is getting drastic cuts.

Still other countries noticed the rise of the USA, and some adopted similar funding models for basic R&D. China seems to have picked it up with gusto, both subsidising R&D and STEM training, leading to huge numbers of engineers and scientists. Whether it will lead to an economic boom remains unknown, but acceleration of ideas and innovations coming out of China seems undeniable. More recently, Ukraine showered its local engineering garages with funds in the hopes of getting a similar outcome to the USA in WW2. It looks like it worked. If the Iran war continues, it's entirely possible arms trade will reverse: the USA could well start buying drones off Ukraine.

Can confirm. At a past company we worked hard to release a Linux desktop client for our customers who wanted it ... you’re getting peppered with complaints from people using distributions you’ve never heard of ... but the problem is in upstream somewhere

You have taken on the work the distributions do in the open source world. No upstream open source developer takes that on. Instead of getting bug reports from users, upstream developers insist bug reports are filtered by the distro maintainer first. They fix problems on their side so you never see them, and the ones that do make it through have been triaged. It's a win for everyone.

So the solution is to handle it the way they do. Choose a couple of baselines: maybe Debian Stable and Fedora. Publish packages for them, and make it plain they are only certified for those platforms. Make the rest someone else's problem: if you want it working on distro X, you package it for distro X. You've done the bulk of the work for them anyway, as most of them are either Debian or RPM based.

no developer should be proposing branches over 1k loc

I've seen that reaction many times. It seems to work well enough when someone is maintaining existing code. However, greenfield projects can often require literally orders of magnitude more code to deliver something that can be integration tested.

The first step is to break it up into a stack of commits. Each one must compile and pass its unit tests, of course. Keeping it under 1k loc of released executable code is usually easy, but often becomes difficult to impossible if you want well commented code with excellent unit test coverage.

Assuming you have kept all your commits under 1k loc, there is still the problem of whether you present them in one PR, or as a stack of PRs. The issue with a stack is why an API is designed a certain way often isn't evident until you see how it's used. Responses to PR comments are explanations that point to later PRs in the stack, which is irritating for both the reviewer and the author.

I haven't found a good solution. I'm not sure there is one.