If anything, AI agents will finally likely formalise that open source maintainers are NOT obliged to review any contributions or pull requests or issues.
Open source comes with the license that YOU can modify it (fork it and do it!) The last decade many ppl forgot about this
🚨 Active supply chain attack: A mini Shai-Hulud campaign hit npm packages under the @redhat-cloud-services namespace.
The compromised packages execute install-time malware to harvest developer and CI/CD secrets, with encrypted exfiltration and GitHub-based fallback mechanisms.
Unfortunately, there is a hack related to @gnosispay and the "delay module".
Please be patient while we try to contain the damage. Rest assured, Gnosis will cover all user losses.
I've got an agent in a loop optimizing a renderer with the goal to minimize frame times (and tests to measure). It got times down from 88ms to 2ms and allocations down from ~150K to 500. Sounds good, right? Wrong. This is exactly why agent psychosis is a big fucking problem.
As an experiment, I rewrote the Ghostty core render state in Go, with access to identically laid out data structures as Ghostty and the exact same validation tests. I made a purposely naive renderer (simple, correct, but slow). 88ms per frame with 150,000 allocations (horrendous, lol)!
I then kickstarted a Ralph loop to bring the frame times down. I told it it can't modify input data structures or the public API or tests (they're correct), but it can do anything else it wants. It got to work.
It has worked for about 4 hours. I've spent around $350 on this experiment so far. The results?
88ms => 1.5ms
150K allocs => ~500 allocs
Incredible right? Nope.
My hand-written renderer I ported has frame times (same benchmark) of ~20us (0.020ms) and 0 allocations in the update path.
This is the problem with psychosis and lacking systems understanding. If you don't understand the system, you're going to accept that this is an incredible result. If you understand the system, you'll see better solutions immediately and can do roughly 75x better on throughput.
The people who blindly trust agent output are in the former camp. They're sheeple, overdrinking from a fountain of mediocrity.
Standard disclaimer: I use AI all the time. I like AI. The point I'm making is to not blindly accept results. Think. Analyze. Learn.
I can now probably say this:
Two months ago, inside Anthropic someone suggested building a token leaderboard.
A heated internal debate followed and the decision was made to *never* ever do it… because several people inside Anthropic simply thought ahead of the consequences
🚀 Wow, this is finally happening!
npm plans to block postinstall scripts by default in a future release
In the near future (phased rollout), we will likely get a warning
soon, I'll be required to finish an entire play of Minesweeper in order to pass the captcha thanks to AI (no, I didn't miss dragging the bird to the correct place, the "Please try again" error was from a previous attempt, it presented me a much harder game at first 🤷♂️)
when you go to devcon to present the EIP you worked so hard, but then they tell you to wait a little while some people take the stage first and start to sing and dance
Linus Torvalds weekly update on state of Linux kernel went off on AI-powered bug detection tools.
Many researchers are finding duplicate bugs and sending to security list e-mail, making it “almost entirely unmanageable”.
He says the “tools are great, but only if they actually help, rather than cause
unnecessary pain and pointless make-believe work.”
Wants researchers to take action instead of just flagging bug:
“f you actually want to add value, read the documentation, create a patch too, and add some real value on *top* of what the AI did.
Don't be the drive-by ‘send a random report with no real understanding’ kind of person. OK?”
***
Link: https://t.co/Imns5YEvay
claude's sandbox is a good idea, but in reality, after trying it for some time, I'm disabling it, too many questions even in auto-allow mode, quite annoying
@dcbuilder@donnoh_eth@joshdavislight Problem is this the second time I'm seeing people spreading misinformation because they blindly believed AI is correct because the training data really thinks Verkle is in Glamsterdam 😅
@dcbuilder@donnoh_eth@joshdavislight Problem is this the second time I'm seeing people spreading misinformation because they blindly believed AI is correct because the training data really thinks Verkle is in Glamsterdam 😅
A couple of weeks ago I left Consensys after nearly a decade since we launched Infura.
It's been an incredible journey and a true privilege to help power Web3 through multiple cycles alongside some of the best people in this industry. The brilliant core devs and hardworking RPC teams. The creative builders and diligent security engineers and auditors. The world-class founders pushing the frontier of token design, blockchain scalability, and decentralized coordination.
I'm deeply grateful for everyone I've had the good fortune to work with, support, and build with along the way.
I'll share more about what's next another time.
For now, just thank you.
switched to cmux (powered by libghostty)
I've been using multiple macos spaces + ghostty instances + multiple tabs for claude/codex instances, but cmux seems to be a more manageable replacement