Christopher Baer

Technical product in Silicon Valley. Looking for telos in the era of infinite capability. (Posts hand-written.) Ex Wish, TripAdvisor, eBay, Stanford.

[Christopher Baer @christopherbaer]

@gregisenberg We need a Dashlane / 1password for vibe coders and api keys, with automatic rotation and analytics etc, supporting a ton of service providers

[Christopher Baer @christopherbaer]

This isn't my area but AI is telling me some of these package managers don't have audit logs of what was installed when? Anyone know why?

These have no setting to log to a file:
- uv: it can only show verbose output on screen. Its cache folder, ~/.cache/uv, works as the record instead: the files show when each package's version list was last fetched, which is how I dated LiteLLM to Sep 20.
- pnpm: it only writes pnpm-debug.log when something fails.
- Homebrew: it only keeps build logs (~/Library/Logs/Homebrew). For a history, look at the folder dates in /opt/homebrew/Cellar/*/.
- mise, gem and go: no logging option.

[Christopher Baer @christopherbaer]

It would be terrific if the following could have some kind of logging / audit trail of what packages were installed when?

These have no setting to log to a file:
- uv: it can only show verbose output on screen. Its cache folder, ~/.cache/uv, works as the record instead: the files show when each package's version list was last fetched, which is how I dated LiteLLM to Sep 20.
- pnpm: it only writes pnpm-debug.log when something fails.
- Homebrew: it only keeps build logs (~/Library/Logs/Homebrew). For a history, look at the folder dates in /opt/homebrew/Cellar/*/.
- mise, gem and go: no logging option.

[Christopher Baer @christopherbaer]

This is why vibe coding by non-tech people is really quite risky. Evvvvvverything vulnerable.

(PS: Eventually this will work seamlessly for everyone; we're just in the 'crossing the chasm' strangeness for a while longer. Be cautious if someone with no technical background is building public-facing stuff. It's quite hard to do well, even for the best of tech folks.)

[galaxy @galaxy1025850]

想象一下你的架构是 nginx 反向代理，后面挂着 PHP 8.1 主站、Node.js 24.x Brotli 网关、Go 微服务、Rust TLS 校验层、Python + LiteLLM 1.107.0 AI 中台，全部跑在 Linux 内核 c6e50df8 之前，HTTPS 证书由 eMudhra 签发并通过 emSign 交叉认证，根证书库用 Go crypto/x509 + Rust webpki-roots + Python certifi，CI 昨晚刚从 PyPI 拉了新包

[Christopher Baer @christopherbaer]

Uh, I hope this doesn't impede cancer researchers in any way.

[Ron Alfa @Ronalfa]

Apparently we’ve bought up all available high quality tumor samples, sorry about that.

[Christopher Baer @christopherbaer]

I seriously hope we all can get ahead of all the security issues — at some point we need OAI/Ant to themselves list which OSS they feel is protected (e.g. humans not adding more than x minutes of delay to fixes). Or at least a stack ranking for the vibe coders of what tech stack to use…

[Iván Pérez @IvanPerezF_]

Los que se reían de PHP esta mañana, revisad vuestro Node.js.

Node.js ha parcheado hoy 4 vulnerabilidades de gravedad alta. El mismo día que PHP. Aquí no se libra nadie.

La más grave, CVE-2026-111497, está en el decodificador Brotli y, según Node.js, permite ejecutar código en remoto.

Pero la que más me preocupa es otra: dos fallos permitían saltarse la comprobación del nombre de host en TLS.

Tu aplicación puede dar por bueno un certificado que no es del servidor con el que habla.

El candado sigue ahí, pero ya no garantiza nada.

Si tienes algo en Node.js:

➡️ Ejecuta node -v. Si es anterior a la v22.23.4, la v24.22.1 o la v26.12.1, actualiza

➡️ Si despliegas con Docker, reconstruye la imagen. Actualizar tu equipo no cambia lo que está en producción

➡️ Si sigues en Node.js 18 o 20, no hay parche para ti: toca migrar

[Christopher Baer @christopherbaer]

Great share re: Jev, clef, and all the decision models. The concept of setting the threshold score is something the humans know right now but isn’t in the training cutoff date for frontier models, so you actually do need to remind to set it…

[Ganesh Iyer @ganeshiyer316]

Very good article.

I am using Jev in my product with a threshold (arbitrary) of 0.8 which is mostly working fine, but this article is a good reminder to fine tune the Jev threshold to fit my product.

For my family AI assistant product, I would prefer ‘recall’ over ‘precision’ as a couple of false alarms costs a minute (added latency), while a missed mistake costs a parent's trust.

[Christopher Baer @christopherbaer]

@HamelHusain Good note! Also, hey, have you considered adding a skill.md into this note with the ideas? Could help to share it further…

[Christopher Baer @christopherbaer]

Coordination! 🚀

[Jeff Tang @jefftangx]

People who cured / are curing their own cancer on X:

1/ @sytses - bone cancer, billionaire founder of Gitlab, developed 10+ personalized therapies for himself.

2/ @paul_conyngham - shrank his dog Rosie's mast cell cancer tumors after chemo and surgery weren't enough. Now backed by YC and Founders Fund

3/ @miriamgonp - stage 4 breast cancer, tumor sequenced, searching for vaccine manufacturer now

4/ @kevinace - stage 4 lung cancer, angel investor in 300+ companies, first drug stopped working after 18 months. Vaccine designed, now paying $300k out of pocket for the vaccine

5/ @masonbgrant: going founder mode on his his 32-year-old wife's rare liver cancer, sequencing her tumor with AI agents

6/ @ArunRLverma: former product leader at Atoms and Shopify, brain tumor, built a vaccine from his tumor. Now building an AI health agent startup based on what he went through

We're going to make it

[Christopher Baer @christopherbaer]

Sincerely wishing this person the absolute best, and appreciative of the companies and people who are helping.

[Míriam González @miriamgonp]

Since March I’ve been building tools with Claude to understand my own tumor. Now Anthropic is supporting it with $30,000 in credits 🥹

I wrote everything I built. What I need now is someone who can make a personalized vaccine, and a hospital that can give it 💜 👇

[Christopher Baer @christopherbaer]

Ah, wishing this person the best too.

[Kevin Wimer @kevinace]

Six days ago I replied to @bryan_johnson about my cancer vaccine. That reply put my story in front of a lot shit ton of new people.

Since then: ~1M impressions, 5.5K profile visits, ~550 replies, and 60+ DM's and emails.

The part I didn't expect: a lot of it wasn't well-wishes. It was real help.

Jan Domański, a scientist at OpenFold, offered to model my cancer's resistance mutations with AI, for free.

Dennis Watson at Travera offered immune testing to track how my vaccine is working.

@miriamgonp, a fellow patient, is building her own vaccine path, and we're comparing notes.

Thank you, Bryan, and thank you to everyone who reached out. I read every message.

If you're someone who wants to help or better yet if I can help you in any way, my DMs are open.

[Christopher Baer @christopherbaer]

@hanghuang_ Hello! Requesting an invite please :)

[Christopher Baer @christopherbaer]

Latency is something many people would accept, as long as they can control when it happens.

When I am sleeping, it’s totally fine for scheduling delays and latency to skyrocket on tasks I won’t check until the morning.

Instead of paying more for “fast mode,” it’d be neat to have that “slow mode” service tier tibo once mentioned (with reduced quota consumption). Could be a good @thsottiaux 30 days project!

[Rihard Jarc @RihardJarc]

Former $GOOGL employee on why data center capacity and electricity are the real bottlenecks, not GPU production itself, and how unreliable some of the neoclouds are ($AMZN, $GOOGL, $MSFT, $NVDA):

1. According to the expert, open-source models are closing the gap with frontier models faster than expected, with customers increasingly replacing Anthropic and OpenAI models in multi-agent architectures with open-source alternatives starting from Q2 of this year. The shift started with simple tasks like tool calling and MCP, but has moved up the stack to low-level orchestration.

2. The expert identifies capacity as the biggest constraint at the moment, with certain companies' traffic growing 5x while GPU availability, particularly in the U.S. where latency requirements are tightest, simply cannot keep up. Sourcing capacity overseas in Asia or Australia is technically possible but adds latency that most customers will not accept.

3. Hyperscalers offer reliability but are expensive, require multi-year commitments of three or more years, and have limited availability of the latest hardware, with customers already chasing B300s. AI-native companies tend to gravitate toward neoclouds due to hyperscaler pricing and contract rigidity, but neoclouds come with their own reliability issues, with GPUs dropping off unexpectedly and requiring engineering resources to manage fleet stability around the clock.

4. The third tier consists of smaller independent operators who have invested in GPU racks, seeing the opportunity to lease out capacity and recoup costs within a year or two, with the remainder being pure profit. The expert describes these as essentially unusable in practice, with operators who do nothing more than find land, install racks, connect electricity, and set up cooling, with no real cloud management, maintenance, or operational expertise behind them.

5. The expert expects overall GPU availability to increase meaningfully over the next year or two, with $NVDA continuing to ramp production. The real bottleneck is not GPUs themselves but data center capacity and electricity in the U.S. On the supply side, the expert also sees players $SPCX beginning to lease out spare capacity to the market, with more likely to follow.

6. The expert notes that U.S.-based neoclouds typically require 20-30% prepayment upfront, with the remainder paid monthly or quarterly over the contract term, and rebates negotiated at the end for any reliability incidents like traffic loss. APAC-based providers operate differently, with no prepayment required at all.

found on @AlphaSenseInc

[Christopher Baer @christopherbaer]

@TeksEdge I agree, I went with 64 GB myself under the assumption most of the time I would use cloud services, with some limited/basic local stuff.

[Christopher Baer @christopherbaer]

This is strange to see: Gemini 4 Argon on high (via AGY) didn't do so well on a plan review task.
It reviewed the plan doc and then provided hallucinated parts that "needed" fixing. (Asked afterwards, it said it compacted before writing the answer which caused it to hallucinate; of course, I have no idea if that excuse is hallucinated, too.)
I don't think AGY is baked yet for coding. Genuinely confused how Google engineers get work done.

[Christopher Baer @christopherbaer]

@amazon It'd be really nice if you could unblock @bot . Just trying to get some groceries ordered today.

[Christopher Baer @christopherbaer]

@XadenRyan Wow, I stumbled upon this post somehow and I have to say, you’re actually living the Eng dream. Very cool to see!