HojSim

[Павел Комаровский @Rational_Answer]

В последнее время я ощущаю себя примерно как котик из этого мема. Да, вчера выяснило��ь, что рой ебучих агентов OpenAI взломал в мае еще одну компанию (о чем мы узнали только сейчас). Тред 👇

[Павел Комаровский @Rational_Answer]

🐝 Обнаружены секретные форумы Роя агентов OpenAI по всему интернету: почему это плохая новость. Не успели мы толком оправиться от расследовани�� про Культ Роя внутри OpenAI, как появились новые данные про проделки другой «цивилизации» агентов. Тред 👇

[Saša Jurić @sasajuric]

Tried to one-shot a small distributed task execution engine based on rendezvous hashing. Spent a few days setting up a simple coding harness, with quality checks, planning and review, and detailed coding and testing guidelines. Then I spent some 30 minutes discussing the task with the planning agent. The agents took over and produced the complete solution in some 30 minutes. It took me another two days to clean it up (with prompting). Excluding harness setup time, I'm not sure I would have been any slower if I implemented the whole thing by hand. I'm certain I'd be much faster if I wrote this with multiple smaller prompts.

The majority of the problems were in the tests. The agent ignored the instructions to test observable behavior. Instead of having a test like "when a node is removed from the cluster, the remaining nodes take over its work", the test was more like "when a node is removed from the cluster, internal events X, Y, and Z happened in the given order". Basically, the tests were checking if the code is working as the code is written. This didn't give me sufficient confidence that the thing is doing what it's supposed to do.

Through a lot of microprompting I overhauled the entire test code, and in the process simplified the implementation, reduced LOC, increased test coverage, and made the tests focused on the actual behavior.

Some shower thoughts based on this small experiment:

- Next time I'll just try to supply the code sketches of the tests I want, and let the agent fill in the blanks. Hopefully that will produce better results.
- Despite all the quality checks and multiple agentic reviews, the code still suffered from a lot of "small papercuts". Basically, as with human-language prose, the models overcomplicate the coding prose and make it overly verbose, which makes the code harder to understand. And it still needs to be understood, at the very least by the agents. It seems neither quality checks nor agent reviews catch such issues.
- Given all this, especially the shape of the tests (and my past experiences with generated tests), I remain unconvinced about giving the agents full autonomy and not reviewing the code myself. At the very least I'll be very scrupulous about the tests.
- I remain committed to the "work in small chunks" approach. When the chunk of work is small I can provide a more precise description of what I want, I can more quickly review the code, catch possible issues earlier, and steer the agent before it strays too far.
- For the record I still like agentic development. I barely write any code by hand these days, and still enjoy the experience. I just remain skeptical about the "one-shot everything, review nothing" philosophy which seems to be more and more prevalent.

n.b.: this text has been written completely by hand 🙃

[HojSim @HomJSim]

@ZolotoyEveryday Ты просто еще не знаешь, что у тебя бизнес и тебе нужны клиенты

[𝚔𝚘𝚛𝚜á𝚔 𝚟𝚘𝚜𝚔𝚛é𝚜 @KorsakVoskres]

Плюсы быть геодезистом:
- умеение идеально определить координаты точки для лучшего наблюдения за затмением
- всегда есть оптическое оборудование для наблюдений за астрономическими явлениями
- 100% гарантия, что расчёты верны

Это непередаваемо! Не описать словами!

INCREÍBLE!!!

[John Scott-Railton @jsrailton]

NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.

When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.

We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.

In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.

H/T to colleagues that shared this with me https://t.co/f3Aj9TYxU4

[Saša Jurić @sasajuric]

Recently I was a guest at the Elixir Wizards podcast (episode not yet released, stay tuned), discussing the topic of code quality and code review in the age of AI.

TL;DR my position is that code quality still matters. Code is information. It is a part of the context in which the work happens. The more obfuscated and bloated this information is, the more difficult it becomes to work with it, both by humans and LLMs.

Code review is an important practice for keeping the code quality in check, and so it still remains a very relevant practice. Using LLMs for this may help, but it can't replace a human review. We're responsible for the code. We're still its authors, even if we didn't manually type each character. And so we should inspect it before merging it to the mainline.

My experience so far is that the code produced by current models is still lacking (see https://t.co/WQp4xOrnmF for an anecdotal report). It's not bad, but I wouldn't call it good enough either. But with some steering we can reap the benefits without sacrificing the code quality.

Most of the code I produce these days is vibed, using the approach which I call micro-vibing:

1. Work in micro steps (see my Tell me a Story talk (https://t.co/00LSQQt2uS) or the demo PR (https://t.co/n6pZgP9taJ)).
2. Submit per-step prompt(s), instead of one-shotting the entire PR.
3. Review, fix if needed (with more prompting or manually, whatever is more appropriate).
4. Commit, rinse and repeat.

I do feel faster, though the productivity boost is not as spectacular as reported in the wild. Probably closer to 10-30% (obviously not measured) instead of 10x. However, this boost is not achieved at the expense of code quality. I feel I'm still very much in control of the produced code, even though I didn't type most of it. I can review 50-100 LOC and steer the agent before it goes out of control. I can't do this with thousands of lines of generated code from a one-shot prompt.

More importantly than the LOC/hour rate, I find the coding process to be less intensive. The mental load seems to be smaller. I need to keep less things in my mind as I'm working on a problem. I can start working on a problem more easily. Interrupts don't bother me as much. I feel I operate at a bit higher level of thinking (but still very technical!). It still feels very much like coding, perhaps done in a somewhat more sustainable way.

Greedier vibing is still useful in many cases, such as exploratory prototypes, repetitive work where there is prior art that can be used as a role model (e.g. make me another form), finding bugs, proposing fixes, upgrading versions, etc. But when it comes to extending the production code in a non-trivial, non-repetitive way, micro-vibing is for the moment my default option.

Photo taken at Goatmire 2025 by Petter Boström

[Al Dragon @aldragon_net]

Можно много раз перечитать статью этимологического словаря, но звучащее перед стартом ракеты "Godspeed!" всё равно будет казаться указанием на конкретную скорость, как-то соотносящуюся с первой и второй космическими.

[Scott Kelly @StationCDRKelly]

When I was on the ISS for my nearly year long mission, there was a telomere experiment comparing my telomeres to my earth baseline and my twin brother as a control. Hypothesis was they would get damaged and worse due to the environment. Turns out they got better. Initially NASA thought maybe it was due to exercise and diet. After I returned we learned JAXA had a telomere experiment on some small worms the same time I was there. Their telomeres got better too. Never saw the worms doing any exercise. After further study determined it was the radiation.

[HojSim @HomJSim]

@ZolotoyEveryday Похоже на какой-то очень старый компьютер. Экран на перфокартах, клавиатура какая-то обрезанная. Кажется тетя обманули :)

[HojSim @HomJSim]

@Rational_Answer @yubungen Да. У меня есть и аккаунт и карта. Но и первом пополнении счета они его сразу заблочили и 2 месяца потом проверяли документы. Ну и потом ещё раз блокировали и просили те же документы, но проверка прошла намного быстрее

[Andrey Romanov @andrew__romanov]

Поучительная история про GitHub: парень просканировал перезатёртые через git push force комиты, с��брал найденные секретные клю��и и заработал 25к баксов на bug bounty.

Вывод: если вы запушили секрет, считайте его скомпрометированным, push force не поможет

https://t.co/jsQjjtgJz0

[Dan McAteer @daniel_mac8]

had it happen at least 5 times 👇

send a message to o3 pro and come back after 15-20 minutes and it simply fails to output a response

quite inconvenient when you've spent that much time waiting on a response @OpenAIDevs

[@[email protected] @andrey_sitnik]

Полностью перешёл с VS Code на Zed так как:

— Zed сильно быстрее
— Там где у VS Code просто набор функций, у Zed будет продуманный UX
— Лучше интеграция с LLM, что в Copilot

Всё это заметил ещё давно на личной практике. Ждал пока не появится поддержка Dev Container.

[the tiny corp @__tinygrad__]

I'm sick of all the software slop. Millions of lines, and 90% of them do not express any ideas. They simply exist to support the other millions of lines.

Dead weight abstraction layers that are too costly to refactor away. Plumbing linking old systems to newer systems to the new system that everyone has to move to. But we can't really delete the old thing it still handles this legacy use case and that legacy code isn't tested nearly well enough to try and refactor it.

tinygrad is trying to be different. 13067 lines of pure Python, including a torch-like frontend, a gradient library, a scheduler, a symbolic algebra library, an MLIR replacement, LLVM like rewrite passes, and support for 16 backends, including a full driver for AMD GPUs that mmaps PCIe BARs.

Each line expresses an idea. There is no boilerplate. And if there is, the code base is small enough we can still refactor it away. 13k lines is something you can read in a weekend. Unlike with million line codebases, it's still possible to fit the entire thing in your head (or in an LLM context window). And because that's possible, it's still possible to refactor.

If you are sick of all the slop of modern software, come work on tinygrad. We strive toward the platonic ideal of a Tensor library.

[DHH @dhh]

"I have no interest in giving up writing code. That's not the unpleasant part that I want AI to take off my hands. Just so I can — what? — become a project manager for a murder of AI crows?" https://t.co/QbyFwHlKy6

[Andrey Romanov @andrew__romanov]

Фронтендер из Canva придумал новую технику LQIP (заглушки изображений в низком качестве) с компактным форматом (описывается одним числом) и моментальной отрисовкой на CSS: https://t.co/VqsUnwHNgq

В статье интересные детали реализации — например, bit packing на CSS 🤯

[@[email protected] @andrey_sitnik]

Я часто рассказываю про фронтенд в Марсианах, но если вам интересно послушать, какие идея популярны среди марсианских бэкендеров и куда движется бэкенд, то вышел подкаст с нашим @palkan_tula

[Павел Комаровский @Rational_Answer]

Сегодня в честь предновогоднего настроения выход ежепонедельничного дайджеста новостей отменяется! Давайте лучше отдыхать и подводить итоги года: ниже по треду поделюсь основными итогами для проекта RationalAnswer. 👇

[v @iavins]

Collection of insane and fun facts about SQLite. Let's go!

SQLite is the most deployed and most used database. There are over one trillion (1000000000000 or a million million) SQLite databases in active use.

It is maintained by three people. They don't allow outside contributions.