Bruce

code, music, wandering...some days not in that order | @[email protected] |

[Bruce @bpark0]

"only work for free if you can and if you want to" (on #OSS) :) awesome talk on open source from @indirect #rubyconf

[José Valim @josevalim]

Just stop whatever you are doing and read this.

[Zach Daniel @ZachSDaniel1]

Please remember that the overwhelming majority of people that you hear talk online about the current state of programming are not building anything that:

- is dealing with significant amounts of money
- has non-trivial financial risks from production defects
- is being collaborated on by even a single other person
- has been and is being iterated on over a long time scale

also remember that the overwhelming majority of takes online are:

- not coming from a place of actually wanting to provide you with useful information
- are at least in some capacity posturing. This industry is changing at a rapid pace and seeming ahead is of legitimate financial importance to individuals
- bad

[José Valim @josevalim]

Woot! https://t.co/3q87OK38TD will now serve llms.txt for Elixir/Erlang packages if the accept header is text/markdown. If you have a package and you use ExDoc, update to the latest version (which generates .md files by default) and republish your docs.

[Nathan Lambert @natolambert]

Labs starting to pull up the ladders on the ability to diffuse AI was inevitable. Doing it without telling the user is misaligned.

[José Valim @josevalim]

Alright, after a full week with Codex, I understand why folks like @chris_mccord and @antirez have been praising it.

It’s far more thorough than Claude Code. When you ask for a change, it does a better job of understanding the system and the different areas that will be affected.

The only downside is that it can sometimes overreach on smaller changes, but that’s partly because I’ve been feeding it piecemeal requests. I’m starting to trust it with larger tasks now, something I didn't feel much comfortable before.

[José Valim @josevalim]

So apparently when you install Claude Desktop app, they write a manifest file to several browser directories, even if you have never installed any of those browsers or never opted into using Anthropic's browser extension?

[Steve Yegge @Steve_Yegge]

I was chatting with my buddy at Google, who's been a tech director there for about 20 years, about their AI adoption. Craziest convo I've had all year.

The TL;DR is that Google engineering appears to have the same AI adoption footprint as John Deere, the tractor company. Most of the industry has the same internal adoption curve: 20% agentic power users, 20% outright refusers, 60% still using Cursor or equivalent chat tool. It turns out Google has this curve too.

But why is Google so... average? How is it that a handful of companies are taking off like a spaceship, and the rest, including Google, are mired in inaction?

My buddy's observation was key here: There has been an industry-wide hiring freeze for 18+ months, during which time nobody has been moving jobs. So there are no clued-in people coming in from the outside to tell Google how far behind they are, how utterly mediocre they have become as an eng org.

He says the problem is that they can't use Claude Code because it's the enemy, and Gemini has never been good enough to capture people's workflows like Claude has, so basically agentic coding just never really took off inside Google. They're all just plodding along, completely oblivious to what's happening out there right now.

Not only is Google not able to do anything about it, they don't seem to be aware of the problem at all. I'm having major flashbacks to fifty years ago as a kid at the La Brea Tar Pits, asking, "why can't they just climb out?"

My Google friend and I had this conversation over a month ago. I didn't share it because I wanted to look around a bit, and see if it's really as bad as all that. I've been talking to people from dozens of companies since then. And yeah. It's as bad as all that.

Google is about average. Some companies at the bottom have near-zero AI adoption and can't even get budget for AI. They may have moats and high walls, but the horde is coming for them all the same.

And then there are a few companies I've met recently who are *amazingly* leaned in to AI adoption. One category-leader company just cancelled IntelliJ for a thousand engineers. That's an incredibly bold move, one of many they're making towards agentic adoption. In my opinion, that company is setting themselves up for a _huge_ W.

As for the rest, well, it's the Great Siloing. Everyone's flying blind. With nobody moving companies, no company knows where they stand on the AI adoption curve. Nobody knows how they're doing compared to everyone else.

Half of them just check a box: "We enabled {Copilot/Cursor} for everyone!" Cue smug celebrations. They think this is like getting SOC2 compliance, just a thing they turn on and now it's "solved." And they don't realize that they've done effectively nothing at all.

All because of a hiring freeze.

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Gabriel Chua @gabrielchua]

https://t.co/XRT5v67j3B

[dax @thdxr]

everyone's talking about their teams like they were at the peak of efficiency and bottlenecked by ability to produce code

here's what things actually look like

- your org rarely has good ideas. ideas being expensive to implement was actually helping

- majority of workers have no reason to be super motivated, they want to do their 9-5 and get back to their life

- they're not using AI to be 10x more effective they're using it to churn out their tasks with less energy spend

- the 2 people on your team that actually tried are now flattened by the slop code everyone is producing, they will quit soon

- even when you produce work faster you're still bottlenecked by bureaucracy and the dozen other realities of shipping something real

- your CFO is like what do you mean each engineer now costs $2000 extra per month in LLM bills

[dax @thdxr]

i've said before tech pretends to be ultra rational but is no different than fashion

this is happening again in a funny way - people flex using more expensive models, they're luxury, the cheap ones are for the poors, they need max intelligence the world has to offer

[Grant Slatton @GrantSlatton]

the technocapital hyperobject at the end of time begins to pull itself together

[Elixir by Software Mansion @swmansionElixir]

For those who missed the news: we made Elixir run in browser – and named it Popcorn🍿

With Popcorn, you can run and compile Elixir code in-browser, play with IEx, and even use OTP apps. And yes – it’s pretty fast.

Sounds fun? Play with a live demo – link below 👇

[Bruce @bpark0]

@unclebobmartin And ice cream, right? Grace and humility go well with ice cream I hear... 😜

[nixCraft 🐧 @nixcraft]

Apple Mobile Processors Are Now Made in America. By TSMC https://t.co/qhfolmGZOd

[José Valim @josevalim]

Hi @ryanflorence. LiveView does not preclude JS, JS is part of our ceiling! That said, you are welcome to break Livebeats: https://t.co/V6oshAHnXe

For comparison, you folks could build a Remix version of Livebeats (Remixbeats? :D), so we can try it and exchange notes! [1/4]

[José Valim @josevalim]

Many forget that the client-server architecture is a *distributed system*. The request-response workflow we have historically used helped us forget it. However, if you keep a WebSocket connection open with bidirectional data, you can no longer ignore it. 🧵

[Matt Boyle @MattJamesBoyle]

John Cena is bullish on Postgres too.

[Brian Cardarella @bcardarella]

I didn't have enough time to get to it at my LiveView Native talk at @ElixirConfEU but I wanted to share some perf comparisons to React Native (thread)

#myelixirstatus

[Sophie DeBenedetto @sm_debenedetto]

I'm extra excited about this one! As an Elixirist with a web dev background, it's easy to feel intimidated by both BEAM and "ops" concepts. This book is here for you to fill in those gaps and supercharge your Elixir dev skills #myelixirstatus