Mostly dev/ml/ops, olive farming. Husband of wife, walker of dog. Doing things @adataopera, making niche software and working with cool businesses - more soon.
Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).
If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!
I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.
Feeling pretty swell about this mentality with all the supply chain attacks happening.
The study, which was used by EY consultants in Canada to market their cyber security business, used made-up data, mis-attributed citations and referenced a McKinsey report that doesn't exist. https://t.co/Jb9Cur1wQv
I strongly believe there are entire companies right now under heavy AI psychosis and its impossible to have rational conversations about it with them. I can't name any specific people because they include personal friends I deeply respect, but I worry about how this plays out.
I lived through the great MTBF vs MTTR (mean-time-between-failure vs. mean-time-to-recovery) reckoning of infrastructure during the transition to cloud and cloud automation. All those arguments are rearing their ugly heads again but now its... the whole software development industry (maybe the whole world, really).
It's frightening, because the psychosis folks operate under an almost absolute "MTTR is all you need" mentality: "its fine to ship bugs because the agents will fix them so quickly and at a scale humans can't do!" We learned in infrastructure that MTTR is great but you can't yeet resilient systems entirely.
The main issue is I don't even know how to bring this up to people I know personally, because bringing this topic up leads to immediately dismissals like "no no, it has full test coverage" or "bug reports are going down" or something, which just don't paint the whole picture.
We already learned this lesson once in infrastructure: you can automate yourself into a very resilient catastrophe machine. Systems can appear healthy by local metrics while globally becoming incomprehensible. Bug reports can go down while latent risk explodes. Test coverage can rise while semantic understanding falls. Changes happens so fast that nobody notices the underlying architecture decaying.
I worry.
Unpopular opinion: I don’t care if most web apps look the same. All I care about is whether it does what it says and does it fast.
Make it fast. Make the UX obvious. Put the right things in the right place and little to no animations.
For fuck sake. When are GitHub going to stop linking fork commits to the upstream repository?
dependencies: {
"@tanstack/setup": "github:tanstack/router#79ac49ee”
}
Commit 79ac doesn't exist in the repo and npm pulls it in as if it does.
This has been abused for over a decade
Science publishing giant Elsevier has joined the dozens of firms and individuals suing artificial intelligence companies over their alleged use of copyrighted works in training AI models
https://t.co/0Ni7HQzrk2
Google Chrome 'silently' downloads 4GB AI model to your device without permission, report claims — researcher says practice may violate EU law, waste thousands of kilowatts of energy https://t.co/tmoMlQIdGM
The RF world is insane.
Researchers recovered AES-128 keys from a Bluetooth chip by listening to its own antenna from 10 meters away.
Crypto-engine switching noise couples into the RF chain, rides the 2.4 GHz carrier, and leaks out as radio.
Highly recommend donating to Blender. I recently used it to mock up something, so we donated $500. Autodesk would have charged $255/month for access to an onerously DRM'd equivalent that would have made me grumpy. It's only fair that Blender should get the payment instead!