tharkun__

This very well may be AI written. Then again, the stuff our PMs output, all pre-AI, now would all qualify as "AI written".

There are certain writing styles, which even if you wrote them all yourself, most people will now attribute to AI. The all-too-common em-dash, yes sure. Guess what, it's a thing that was actually taught as "the thing to use if you write properly". So guess what lots of folks consciously put into their writing to sound more professional even before AI. Bingo!

Similarly CVs. A lot of the stuff that lots of us complain about post-AI was "good practice to do" pre-AI. But most people didn't bother. Couldn't be bothered. Now that AI was trained on it and people ask their AIs to write CVs, it's all over the place.

A cover letter that actually picks up on the actual job description posted and connects it up to your CV? That used to be hard work and most people didn't bother. It made you stand out. Now it "reeks of AI" :shrug:

That's a fair enough thing to say but then also setting the default to 7 days is no longer a necessity, because security researchers can automate running a new version through an accelerated time sandbox, can't they?

And no they can't and is probably why this change is happening to dependabot: A common pattern is sampling time before and after a sleep/timer, then aborting/delaying if the sandbox looks like it accelerated time by having a 1s sleep timer expire after 0.1s. Malware would also try to use different time sources and try to correlate them.

And yeah, like you say as well, of course its an arms race in the same way that back in the day state of the art viruses and worms were and anti-virus software was.

And personally I still liked it more when malware/supply chain attack actors assumed everyone was upgrading within a day or two while I was doing it after 7. You don't have to outrun the lion, just the guy slower than you and who's between you and the lion ;)

Cat and mouse like the sibling says ;) Like if you start changing system time, I'll keep a log of system time to detect any "jumps" and then "behave normally" if I detect this. Of course I'll run the code that does this through "my obfuscator".

The thing with cat and mouse based on time is that this now became a default. I rather liked my odds when malware authors assumed that the defaults were that dependabot updates right away. If the general consensus online seems to be 7 days, then I'll set my dependabot to wait 10 days, so on average I'll catch even things people report over a weekend. Now that the default is a longer time period, I have to change my time period to be even longer, which actually increases my risk in another way: I'll stay vulnerable to _actual_ vulnerabilities vs. supply chain attacks for longer.

From my own experiments with local, low VRAM model use vs. what I'm used to from using Claude at work is that being good at "coding" is of no use, if you're worse at "tool calling" as coding in an agentic way requires quite a bit of tool calling.

If you can "hide" different models of 8GB VRAM requirements each that have those specialties and mix and match them for me without having to manage it manually, I'll be impressed. Until then I will keep using my Claude, because "remarkably good _for their size_" models I've tried so far just sucked at trying to use them the way I code at work with Claude.

And if every malware developer worth their salt now introduces code to "wait out" that period of time, we're back to square one.

This assumes that they employ clandestine enough techniques that you have to actually install, wait and observe the behavior for longer than the cooldown period in order to detect this, because the code is "obfuscated" enough to evade static analysis of the code. It's anti-virus / anti-anti-virus 101 all over so to speak.

The good thing I suppose is that it raises the bar. Your regular "virus generator" script kid (sorry: supply chain attack generator script kid) can no longer pull this off.

Caveat: I have not been able to try that model locally, so no personal experience. Running this locally at usable speeds would be cost prohibitive for personal coding use for me.

But if we can believe you that it's doing what a Claude model was doing a year ago then I'd say: OMG no I really never want to go back to that level of frustration getting an agent to do what I want it to do.

This reminds me of Xiaomanyc.

When I first found the channel I was like "wow that dude speaks so many languages so well!".

He does not. I can't really judge for most languages of course, but for the ones I can, he really isn't good at all :shrug:

Hah, this reminds me of my "ancient past".

This must have been CS 1.4 or 1.5 times. I had terrible internet. 36k modem times, super high (ish - 150+ms at the very least, been a while, don't quote me, maybe it was way higher even?) ping to a server that had all the custom maps I loved.

I got accused of cheating.

I didn't.

Simply a result of CS/HL netcode. I was able to "run circles" around others. Something in that version favored my local client view of things I suppose. I literally just went around corners and if there was an enemy I circled them while driving bullets into them w/ my P90. They died without even really seeing me (from what they were saying). On my end everything looked smooth and normal.

This tactic never worked all that well on servers where I had the usual <120ms ping. I guess never mind at <15ms :)

Exactly, as in, really, will they? Where and at what price, especially across an actual enterprise that needs to deploy them to lots of devs? There's much more than just the actual model.

Of course my numbers are a sample of one and I am not spending a lot of money or time on it. Just lazily trying things on my "happen to have this" hardware. But basically trying out the Claude Code I'm used to from work but locally with a bunch of open weight models.

I can run super tiny models on my 8GB NVIDIA card. They all suck (I have to use <=~5GB models if I want "usable" ~250k context that doesn't need to use system RAM and CPU (which makes things super slow).

I've also tried a GLM 4.7-flash, which even though it's super slow (in comparison) with ~250k context and it just doesn't cut it vs. the Claude Sonnet or Opus I get to use at work. All the while these are all touted as "totally usable, Claude/ChatGPT killer!" replacements.

It's just not "there" with tool use or building software for that matter. Like, just a simple Claude "web search" fails with it. So I asked it to build itself its own "web search" functionality and it just couldn't. It made so many mistakes its just not funny any more. And it couldn't recover from them either. I retried a few times (as I didn't have python installed and it wanted to implement it using that - this happens to be new system - never mind other attempts). I spent as much time doing this (and failing) as I spent building an actual full feature at work last week w/ Sonnet.

If it can't build itself a simple web search to .md file tool/skill, how am I supposed to trust this with actual coding? I'm used to being able to point Claude at our large code base and essentially work with it like a junior doing my bidding. Maybe 5.2 is a killer game changer vs. what I was able to try out (if slowly) but you really have to show me to convince me at this point. And not with synthetic benchmarks. In those, all of the models I tried are supposedly super awesome.

And for the love of reading, please do not bold stuff all the time. It's the single worst thing for reading attention. I can't help but jump from bolded text to bolded text and in the end I'm not reading anything.

That and the fact that you can rotate w/ left click as well. Turns out I naturally drag the mouse a little. So having rotate on right click only would be way less annoying, especially when combined with the momentum.

Not sure what you're seeing, but I see quite a few overlapping lines. One of them easily solvable if you move `addresses` down. It starts with the `orders->users` overlapping `orders->addresses`.

Also, the `reviews` table overlaps the line from `order_items` to `products` and moving `order_items` down for example gets rid of that problem.

Not saying the project isn't cool, but this layout isn't optimal as per your constraints.

Yeah they told me the same.

But it doesn't work that way. I've had them for months now and I still notice them. While walking, while looking around. While driving.

Is it much better? Yes.

Stop noticing? Heck no.

I'm still giving it some time but I really don't like the sudden weird feeling I still get from time to time. And I can't even figure out why it's fine much of the time and then suddenly I get that weird feeling again.

And just having to double chin it to see the ground in front of you is so annoying.

Oh so much.

Progressives here. The very bottom irritates me to no end during the day. If I drive in the morning or walk around I feel absolutely horrible. Like I'm drunk.

Sure, if I need to read something really really close on my phone in the evening, when the eyes have gone tired it's kinda OK. I do need to focus on the bottom of the glasses.

But I still (after months) usually just look straight ahead (sometimes that "mid section" is not right for what I'm looking at) or I need to intentionally look down, in order to actually look through the top of my glasses.

I think the progressives are worse than getting two pairs, but I can't tell for sure yet, since this is the first time for me and I believed the optometrist who recommended progressives (from own experience, being a little older than myself).

I will have to try the other way soon I guess.

Like right now, evening, I can't read this screen on the bottom of the glasses. The laptop is too far away. To look through the top, I have to look down. Like "double chin territory".

At normal cell phone distance, I can't use the bottom part. It's sorta blurry. I need to try and find the middle. Which is the smallest sections (I don't have huge glasses. Maybe an inch top to bottom, which all the progression has to fit into.

Tap water if chlorinated is not great for the coatings on modern glasses I've been told. YMMV if you're not in such a place.

I mix my own spray bottles from dish soap, non chlorinated water and a bit of rubbing alcohol actually. Water is softened.

Not the one down-voting you btw. Disagreeing is fine by me.

I would ask you tho: What incentive do AI vendors have to even try and detect this? It's in their interest to use the most naive interpretation, i.e. what my original comment mentioned, as it shows how "good" their models are, coz nobody ever changes much if anything ;)

Never mind that they really can't unless they're going "creepy mode". If I use Claude/Codex et. al. to agentically write something, then let the session just sit while I go about in my IDE changing things and then I commit and push, are you telling me that the vendors do or should track all of the changes made to the files they touched and report back to base what got overridden by me, the human?

No sawdust is bad. But it's also bad if you cut all your boards into sawdust. Completely. Obliterated. No useful output, only sawdust.

% of AI suggestions accepted vs. edited is also a BS metric that Anthropic et. al. like to push, similar to LoC, because they're large numbers and large numbers must be good, right?

Well guess what, I have auto-accept on and then adjust after it's "done". And I do it by telling it what changes to make and those have auto-accept on as well. That's quite a high "accept" rate, by definition. But in reality it may have churned on 50% of the lines it generated and auto-accepted first.

Sorry, didn't see this until now.

I understand you may not want my conversations and I might believe you. You seems like a nice dude.

I don't want my conversations to be forever recorded. I need my private corner. As an analogue: I want to be able to talk to some guy at the office without there being listening devices that's recording me. I want to be able to shut a door and nobody else in the office can listen in. I don't want to be forever forced to have every single conversation ever in front of the entire office.

That's what me talking to my intern is. I'm not gonna spend time to "sanitize" a conversation. I won't trust an LLM (or your code/LLM prompts) to sanitize my conversations. Heck me saying "WTF you stupid piece of electrons floating the ether" is literally what made the probability machine take the turn that made it come up with a stroke of genius from its training data. Whatever is valuable: The outcomes, plans, requirements, system invariants etc. I'm entirely fine to put in the repo. But: I am putting them in the repo.

We do that at work w/ the "AI first" projects. There's a lot of documentation to help the LLMs that everyone including PMs and designers now are using be on the same page. Essentially a lot of the stuff that used to be floating around people's heads or in various other places like the ticketing system or wiki, is (supposed to be) kept inside the (or a separate "docs") repo.

Regarding automating away: Totally agreed and models have come a long way in a short time but are still not there. And if "coders automate themselves away" so that "PMs can now code" is the thing, well then I'll be the better PM that knows how to get the LLM to do their bidding better than the PMs that will "vibe themselves into a corner". Like, when we talk to our PMs and designers about how we make the AI know all these things so we can move as fast as we can, they generally are just not comprehending, can't follow, can't replicate.

As for self-recording your own conversations and learning from yourself for yourself, the same way you learned more/better coding techniques for yourself: Yes absolutely and that's what I'm talking about. I do have a CLAUDE.local.md and I'm sure there's stuff in there that isn't just "personal preference" but actually helps me be better w/ Claude than others. I'm not sure I could tell you which parts those were though to be honest. Same way I try to teach some of my techniques to others. I gladly help them troubleshoot and they can learn from seeing me and how I come up w/ the stuff I come up with. Most people don't pick up on it or don't even pick it up when I explicitly tell them. Their loss. I guess some of this is https://news.ycombinator.com/item?id=48109460 ;)

This type of thing so much.

AI is being pushed so much at work right now. For non-dev stuff even. The amount of things that people think are "awesome never seen this" is staggering.

Just because you haven't seen file format X converted to file format Y before and now you asked the LLM to do it and it worked, doesn't mean you needed an LLM for it nor that it's remarkable. The LLM knew how to do it because it learned from a bazillion online sources for deterministic converters that cost nothing (and have open source). But now you're paying, every single time, for a non-deterministic version of it and you find it cool. It's magic ...

But I guess they deserve it.

If that is your manager, do so, sure. But make sure your manager is "such a manager".

If I was your manager, and you sent me your seventeen page AI generated thing coz you think I'm just gonna summarize anyway and I expect something long: You misread me.

I make a point all the time to everyone that won't listen, to not send me walls of text. I'm not gonna read them. I'm gonna ignore them, close your bug reports until I can understand them because you spent the time to make them short and legible. If you use AI for that, I don't care. But I better have something short and that when I read it makes actual sense and when I verify it, holds up. If I wanted to just ask AI, I'd do it myself. You have to "value add" to the AI if you want to be valuable yourself.

Hehe, same, this is fun and enlightening, both because of my own reflections in order to reply to you and in seeing your take on things.

I don't mix identities tho, so HN it must stay.

    what is bad about preserving the conversation that led to the code creation

Now, "point in time" learnings from conversations: Very valuable indeed! Whenever I talk to team members when I catch something that was potentially "just believing the AI", it usually was and yes it would really be valuable to see their actual interaction with the AI. Maybe they still have it around and we dig together. What I also do is to show them how I do prompts to get the results I do get. Sharing and learning, definitely.

But nobody needs to commit my literal "WTF DUDE!" to git ;) Yes, yes I do swear at it and if they ever take over, I'm dead, they're gonna come for me. It's a fun outlet actually. I do not have to "compose myself" and write a very nice message as I would with an actual intern. I can just outright tell it what kind of BS it concocted yet again.

I absolutely understand why you and also Anthropic et. al. would want my actual conversation data for learning and I hope they do honor their pledge to not do so on our corporate accounts. Statistical models live from data like this. I'm not gonna give it up just like that. I'm fine fine-tuning the machine to my likings, making local or company wide shared skills, absolutely.

Surveillance is everywhere you let it. I'm sure you seen Flock posts on HN. Now think "Gallup type thing is set loose on your actual AI conversations to figure out if you should be fired". You swear at AI, you must be part of the next layoff. WTF? Why? Like similarly, one of my besties at work, we always joked around in ways that if someone not familiar with us would overhear, they'd probably think we're fighting. We were having the fun of our lives. But nobody would. It was all in an office or at lunch and nobody would record us. But now translate that to in-writing, always recorded "little outlets". You'd have to self-censor.

That's neither fun nor healthy. It's like the Covid/Remote work vs. in-office difference if you ask me. For many many years, working in offices, I'd come home, after way too much commute both ways usually and I'd be totally drained. Nothing left for the family. I'm an introvert, so just regular office-life is draining. Covid was the best thing that ever happened to me, since we've been remote ever since. I can leave work and I still have "social budget" left. It's so awesome. Why I bring this up: Coz working with the AI intern is so freeing. I literally have it work for me like it was an intern. But I do not have to be "careful", I don't have to be "nice", I don't have to be in "teaching mode and spend 3 hours that I could've done myself in 20 minutes". I can just say "WTF dude! that's BS, adjust the skill so this never happens again" and a minute later it's done. In contrast, I spent 20 minutes talking to a "Senior" someone just to get them to abstract to a higher level and answer the important customer focused question on some problem instead of doing a technical deep dive yet again.

Sorry, tangent </rant> :P

On the spidey senses: Well guess what, this is still an economy where my and their skills matter. They swim in the shark tank or they sink. I'm not gonna do their work or their learning for them. I'll help them along to a point but at some point they gotta learn to outswim the shark (or if you like the lion metaphor better, to run away from the lion faster than the next guy.

TL;DR: If it's not cached, does it really matter if it's offline for some time?

Long version:

If you're so popular all around that you really really want a very very short TTL, people will query all the time from all the places that "count", won't they? So it's gonna be cached.

If you're not so popular or not all around, what does it matter even if you had a very very short TTL? You're not loosing much.

No it doesn't. DNS breaks as soon as TTLs run out. It's your choice to set them so low that stuff breaks immediately.

Funnily enough capitalism is trying to do the exact same thing!

I guess communism was more efficient at doing it!

(bit tongue in cheek of course - I guess capitalism is better at pretending/leaving enough scraps for the masses so they don't notice as much)

Haha, OK, we both tend to "text-wall" it seems, so seems we both shouldn't complain about LLMs. Or I guess: now we know how everyone always felt reading our stuff :P

    no dude rules

Just very recently, I saw a PR comment on why someone was choosing to do something in that particular way and what the other bad options would've been, i.e. justfying thei choice (at least they did do the "calling out" part. I had to comment about how none of that made any sense to me and why we didn't just do "other thing Y". Well turns out the AI had misled them, they believed it and it went downhill into a rabbit hole from there. I do believe that w/ the right spidey senses, even in an "unknown situation", it's entirely possible to come out the other end. But many if not most people succumb to the AI's nice and "sounds true" type language.

    As a sideline: LFS doesn't really pollute your repo

    no extra effort needed, and once there tools and LLMS are pretty good at helping us extract insights.

Most LLM assisted bug reports on the other hand are huge walls of text with low signal to noise ratio. I.e. essentially the old

    If I Had More Time, I Would Have Written a Shorter Letter

    critical thinking is what makes code better,

Btw, I write all of this as someone that has been coding exclusively w/ the use of Claude Code and Codex for more than 6 months now. On purpose.

I don't understand how "wall of text" is related to git large file support. The wall of text is a problem for me, the human. Sure, there are ways, like "be brief", caveman etc. In a large repo with lots of different people over time, I can't see how it won't just be wall of text again. It's just too much. TL;DR. And coz DR, the LLM will have buried bullshit in that text, which future session might read and "believe".

As for "no dude", no that can't be put down into rules. Not all of it anyway. We have stuff encoded in the repo wide md file, I have my personal one etc. and the various agents still don't do what we tell them to in all cases or a new model comes out and it no longer works. For example, for finding the root cause of a bug, it's very important to have actual proof and references. It's getting there w/ my instructions in the .md but it doesn't always work and I do have to "dude" it from time to time.

Is that back and forth valuable to have in files that are going to be part of the repo? I very highly doubt it. Having new rules that came out of the back and forth in a checked in AGENTS.md, sure, that is valuable. Or nowadays in individual "skills", like a "root cause finder" skill that can have very specific instructions about being thorough in proving its "found the smoking gun" BS ;)

I've seen enough PR descriptions created by the agent. Fluffy wall of text that looks good but is factually wrong. Seen it way too many times. Too many people just look at whether it looks good and then pass it off as truth. I'm tired of it and making that into "nice HTML" doesn't make it better. It just makes it look even nicer but not more true.

Re: reproducibility. My parent poster (and I guess you as well) wanted to have the prompt/conversation as "documentation". I don't see why that would be helpful. The only reason I could see would be for "reproducibility", which you won't get with an LLM. I don't see why else, but do tell me.

What I can agree could be valuable are the "why"s. I.e. the stuff that already should have been part of the ticket/requirements document. If you want to store that inside the repo as text files, instead of the original tickets or documents, that's fine of course. But I don't see how a "recording of how the code came to be" is valuable. It's like having a recording of all my IDE keystrokes and intermediate code state in pre-LLM days. Not valuable. What's valuable are the requirements and the outcome (i.e. code). Not "the thing in between".

Now don't get me wrong. Recordings of how people code/use their IDE can be a valuable teaching tool. Both as good and bad examples. And the same can be true for an agent coding session.

FWIW, BDD and frameworks like Cucumber don't work at all in my experience. The people that'd need to fill these out don't do it properly (they can't) and then we, devs, are stuck with brittle and un-debuggable stuff that's worse than if we just used regular code to encode what we understood from them.

It's the same reason (most) PMs armed with an LLM still won't get anything usable done. They can't do it properly. They still need devs. But the gaps are shrinking. Some few PMs can get stuff done w/ both Cucumber, could wireframe UX with previous tools and can now do so much easier and better with an LLM.

    It would be nice if people also committed their initial prompt and chat session with the LLM into their codebase

It would only "work" if every single piece of feature you wrote was 100% written by the LLM from a single, largish and well defined prompt, the LLM works for a few hours and out comes the feature. And even then you have no reproducability (even if you turned around and gave it to the exact same model, no retraining, newer model, system prompt etc.).

I know you're trying to be funny but ... technically it's 100% clear: You should talk HTTP, because that's the URL scheme here. The port makes no difference. You just happened to use a port by name. For all we know I run my HTTP server on some NFS related port so all the script kiddies try all the wrong exploits on it or something ;)

    “people like me are still needed” is just a desperate form of self-persuasion.

Most of what these PMs can produce nowadays turns boardroom heads, sure. But it's just that: visuals and just enough prototype functionality that it fools the people you're demoing to. Seen enough of these in the recent past.

Will there be some PMs that can become "software developers" while armed with an LLM? Sure!

But that's not the majority. On the other hand, yes there are going to be "software developers" that will be out of a job because of LLMs, because the devs that were FS and could take an idea from 0-1 with very little overhead even in the past can now do so much faster and further without handing off to the intermediates and juniors. They mentor their LLM intern rather than their intermediates and juniors. The perpetual intermediate devs with 20 years of experience are the ones that are gonna have a larger and larger problem I'd say.

The Staff engineer that was able to run circles around others all along? They'll teach their LLM intern into an intermediate rather than having to "10 times" a bunch of perpetual intermediates with 20 years of experience.

If it's anything like the animated Babylon 5, no thanks :(

If you love animated stuff I guess it might be fine.

Damn, now I want to binge-re-watch Firefly.