stusmall

I'm glad someone ran the numbers on this. Every single Simon Willison post of an SVG is followed with someone dismissing it saying "I'm sure they train on it by now." This is despite a good blog post with sound logic on how easy that is to catch. [1] Glad to see someone took the time for a quantitative analysis of dumb little animals riding dumb little bikes.

1. https://simonwillison.net/2025/Nov/13/training-for-pelicans-...

If you remove the word "AI" from your post it also describes the last 20 or so years of US/Chinese economic competition. They are real, serious competitor but also there is a lot of value in that last 10%. Some buyers need the best and you can charge a premium for it.

The speed in which a copier can catch up to a leader is faster than every before, but everything is faster these days. I think the threat is if can these labs catch up and pass American labs while keeping costs low, but I don't see that happening.

Did it misunderstand "don't believe me just watch" and put a bunch of washing machines in on the Fable 5 $100 at about 1:20?

It looks like some of that high LoC is because they are vendoring some deps. There readme gives the reason to vendor some but not others as:

These crates sit on the path that renders untrusted model output (diagram source → SVG). Vendoring gives a full audit surface, pins exact source, and avoids crates.io yanks. Local patches and upgrade checklists live in each crate’s Cargo.toml header comments — treat those as the source of truth when re-vendoring.

Which honestly feels like a misunderstanding of how cargo and yanks work. Each upstream package is locked to an exact version in your lockfile along with a cryptographic hash. The upstream can't change the source without you noticing. Unless you update your lockfile you will always pin to the exact version and source. When a package is yanked, it is still available for download if it is already in a lockfile. It just prevents new packages from resolving it. Crates.io will sometimes completely delete a package, but I've only seen that happen in cases of malware. It's fairly rare and seems out of line with the supply chain concerns here.

There are good arguments for relying on upstream package managers and there are good arguments for vendoring all packages. I've never seen a project mix before.

If everyone starts applying cooldowns, won't it postpone the problem?

There are still research firms who are actively and aggressively scanning new packages once they are pushed. For example socket.dev pulls new packages across ecosystems and performs automated analysis and runs it in a sandbox. We don't have to have them go boom in someone's production repos to find out there is a problem.

Great article! Thank you. Also in case others walked away with the same question I had, I'll save you the googling: use the utility vrrtest to help validate if VRR is properly configured on your machine.

I had the same issue when logged in. I opened a private tab and it worked.

Thank y'all so much for doing this. I really appreciate y'all not putting STIG/FIPS behind the paywall. Rare and aggressive move.

Become the dumbass change you want to see in the world

I think 3? I feel like that's often enough. Sometimes it's nice to do a quick dumb ass gag on a whim. If I am anything I am a man who loves a dumb ass gag.

Can't agree more. I was skeptical that Kagi could be that much better. I felt a little silly paying for a service that had always been free. After using it for a week I can't imagine going back.

Too many times I used to google my vet by name and the response would be some random other vet in next town over. I'd end up calling them and immediately hang up realizing google fed me bullshit again.

Kagi just focusing on a doing a good job. It's their singular focus and its worth ever cent.

That's a minor nitpick that probably worth making in this context. People often casually use free and open interchangeably, like the the person I responded to did. There are times when it does have a real semantic difference in meaning... but here? Not really. The thread is even about a free software project.

I agree with the rest of what you say. Politics, governance and identity are unavoidable in any kind of community. It's just part of it and unavoidable. It's about dealing with it fairly, clearly and with respect.

Honestly, when was open source not political? Look at early GNU writing. The topics have change but it being political absolutely have not.

That was a fun thought experiment while I waited for my ralph wiggum to finish running. Now thinking is over and back to the vibe

Oh my God. That's so exciting. I did a prototype a while back for writing UDFs in WASM for a query engine. The fact that everything needed to be copied in and out of the environment killed it. Excited to try it again if/when this lands

Not always. The calculations take its useful life expectancy as an input. If they estimate it correctly you have highly likelihood of it breaking, burning out or being woefully out of date by the end. At the 10 year window you are looking at losing support for security updates.

So if you are lucky you might end up with something that still runs but most folks won't find it particularly useful

Does anyone know if this will impact ACP invoking Claude? IE using Claude from zed. I assume not but looking for confirmation

GitHub has been basically the default for free public git hosting for a long time. I was curious what bitbucket has and it looks like the free tier is so limited, I can't imagine a lot of people hosting vibe coded open source there.

I got "or similar" from Firefox and exact make and model from chrome. Probably a browser issue and not a hardware issue.

It also contains LLM dishonesties like that the bundle size is KB

That one jumped out to me too. The phrasing is so wiggly but technically correct it feels intentional. When I saw it I didn't blame it on the LLM, which is worse.

Otherwise it's a super cool looking project

It's pretty common if you have IT and finance teams that are paying attention. Sure a lot of shops let them waste away on a shelf, but that's what it is, waste. If you have fungible inventory that isn't likely to get used soon it is just a mistake it let it sit around unutilized. If it is cash, it is easier to utilize on other projects.

Except it's not counter to history for SaaS services. Many will ban unauthentic usage from non-human clients. Getting banned from a SaaS service for boting is nothing new

Enron had a system like this. They regularly worked on large, long term contracts that became profitable over years/decades. They wanted to push rewards forward so would estimate the total value of the contract and book the profit when it closed. Mark-to-market accounting wasn't unheard of the time but using it for assets without an active market was unique. Without the market to make against, the numbers were best guess projections.

The problem is everyone along the line is incentivized to be aggressive with estimate (commissions for sales are bigger, public financials looks better) and discouraged from correcting the estimates when they go wrong.

Estimating multi-year returns on frontier models looks harder than estimating returns on oil and gas projects in the 90s.

Especially when the original claw had to change its name because it was piggybacking on another products hype...

NYT recently did a fantastic calculator. It isn't simple flat one or the other is cheaper. It takes into account buy vs lease, milage, local energy cost, length of ownership etc

https://www.nytimes.com/interactive/2025/upshot/ev-vs-gas-ca...

This falls under the "something similar" category but it's direnv support is great https://zed.dev/docs/configuring-zed#direnv-integration

It isn't 1:1 since there probably won't be ansible provided configs, but I find writing nix devshells per project to be low effort and high reward. It'll only be a couple lines if all you need is a specific version of ansible

This is the way. This is how I do it with mine but use channels instead of flakes because I'm a giant curmudgeon.

My devshell can be found here and is dead simple: https://github.com/stusmall/stuartsmall.com/blob/main/defaul...

I used Zola for my SSG and can't think of the last breaking change I've hit. I just use the pattern of locked nix devshells for everything by default. The extra tools are used for processing images or cooklang files.

I was listening to the press conference and almost went back to edit my comment with a note about it. Honestly, coming out of that I have no idea if what is his saying is reality. As things stand and what we know, it doesn't make sense. We don't know about more troops currently on the ground. He said the VP has agreed to assist, but she is publicly saying very different things. I hate we are in a place as a country where we can't believe basic things about important topics our president says.

We aren't occupying Venezuela and rooting out everyone in the current regime and putting them on trial. We just arrested a handful of people leaving the rest of the government intact. It playing out like WW2 doesn't make sense

The people in Venezuela want democracy. It's a fundamentally different situation.

"We will, in fact, be greeted as liberators" - Dick Cheney (but I'm sure it'll work out this time)

There is a whole lot of directions this can go after we arrest the dictator, but a liberal democracy magically immediately popping isn't on my list. There might be one in the future but there will be a lot of chaos and violence between now and then.