Of course there are now whales in Open Source, lol

Thats something I’ve been observing literally everywhere.

There’s so many minor bugs. Buttons not working. Things taking extra 5 seconds to load.

Everything is way worse.

I do work with AI in gamedev, and I noticed that unless I burn literaly 6 billion tokens a month on average (at our large corporate pricing, it’s 3000$ a month, and it is my average), on looping adversarial reviews, the code is shit with hidden bugs.

Looping helps, but makes no financial sense. It is why the top 5 companies (I work for one of them, on a gamedev project, thats why I have unlimited AI budget) think AI is so good. But one-shotting anything will majorly suck. It also heavily works because I have pre-AI codebase knowledge and can prompt around it, suggesting systems to use. But I am loosing it, and it makes everything a mess. Also, PR reviews are still a bottleneck.

It does not make sense, and it is ruining my ability to work without it. Once they inevitably introduce limits, the whole project will go to shit. You can’t one shot stuff. As an AI sceptic, I have to agree that AI makes acceptable code, if you run it through several models, adversarial looping reviews without context, and spend around 100$ in tokens on a task. But THATS SUCH A STUPID WORKFLOW. Without this investment, it’s shit.

I don’t care about my job, I just need the money, and it allows me to focus on whatever I want to do, while prooving to management that this is not worth it or sustainable. I’ve been trying to call the issue out, but no one from management cares. So I tried making it work, and I found the solution - burn 100$ of tokens per task. My salary is half of that.

The whole AI bussines is such a stupid, unsistainable idea…

Btw, this is exactly the thing DNS CAA should prevent, and a reason why you should always have it set up for your domains.

EDIT: Neverming, CAA is only checked on issuance-time, so the CA should refuse to create the cert, instead of browsers checking for it. WTF? What usecase does that have?

EDIT: Neverming, CAA is only checked on issuance-time, so the CA should refuse to create the cert, instead of browsers checking for it. WTF? What usecase does that have?

Omg, I can’t believe this is happening.

I was the only one in our pentesting company who has reported “You don’t have DNS CAA record” as a finding. I was usually told it’s not really a worthwhile finding, that the risk is pretty low.

Haha, I was right!

Reminder that you should set that up for your domain.

I like Bazzite because when I get into some kind of hyperfocus rabbit hole with some kind of tool/language/library/project, it basically forces me to make a Distrobox for it instead of making a mess in my system, and I can easily clean up all of the random packages and dependencies once I get border with it and inevitably start running out of disk space.

As someone who worked in cybersecurity, amd left because the whole field is just snake-oil amd scam, I totally get you.

The field is not for anyone who actually cares about security. It took me few years of trying to realize that, and I left once I found out, but the truth is…

There are mandated check-lists and standarts. There’s a box for every PC having an AV. There’s a box saying that “this app is pen-tested yearly by someone with a pentest certification”, or " the company is using a certified communicatiom channel".

It does not say that you have to fix the things they found in the pentest. It does not ask whether the “certified platform” is selling your data, or is owned by US, or not.

The whole field is just a bunch of extremely annoying checkboxes for company to deal with, and doing it well is actually an annoyance, and they are willing to pay extra so they don’t have to do that.

I’ve seen the same critical vulnerabity repeating for 5 years in each yearly pentest, because the checkbox for ISO just says they do the test. Ot sucks.

But I see where is MS going with this. Ot’s exactly for this - to have an easy way how to fill the checkbox of “you have certified AV on every device”.

What was the non-determinism in compilers? Honest question. Like, where does it comes from?

If you had a bug in a compiler, and a code that caused it, would it, for the same input and architecture only show some of the time? Does it included randomness in how it handles output?

Being bug-ridden is not the same as non-determinstic, if you can reproduce the bug everywhere and thus fix it, so I’m honestly curious where would the non-determinism of compilers come from.

Tbh I trusted him up until the point where he compared AI to compilers. That’s just absolutely crutial misunderstanding where the issues with AI usage lies. Comparing using compiler to code, vs using AI to code, is so immensly stupid that I have started doubting him.

Not because I don’t trust in his skill, but because AI is addicting and dealing with additction/risk of psychosis responsibly takes an entirely different skillset. And resorting to toxicity when defending AI with absolutely bonkers arguments, like reducing it’s risk to “ShOuLd We AlSo bAn CoMpIlErS? WrItE iN aSeMbLy!!” is not a good sign that he is handling it well.

And he even compared it to using a fucking text editor to write commit messages, that wanting to limit AI use in commited code is the same as wanting to ban text editor usage. That’s just plain insane misunderstanding of what the issues are.

You do that inherently when you are writing the code. Every line you write has already had that focus, because you had to come up with it.

That you should also not trust every line of the compiled assembly after you wrote the code, and check it lime by line, is an extremely stupid argument.

Of course, you should get someone else, with a fresh/unbiased opinion to review your code too, but just the act of figuring out every line you write is in some sense a rewiev, that there is at least a plan or reason why it was written.

AI just randomly generates code without thought or reason, and you have to check everything. Unlike assembly generated from code.

That’s how I felt when I found MDMA, and it allowed me to find joy in parties and being around people. If used responsibly, of course.

I’m getting exactly the same feeling with AI now. It is instant dopamine fun, but I can see it being addicting in exactly the same way. Of course I tell myself I’ll use it responsibly, for work, and keep my skills sharp by making sure to do some of my own projects, and be responsible in properly reviewing and checking my code.

Just as I told myself that I’ll keep a healthy pause of two months between mdma use, and have a rogorous vitamine and supplements plans based on the most recommended harm reduction research.

Sure, I did manage to do that for the first half a year or so, you can guess how it is now.

It’s pretty unsettling how exactly the same it feels, the way you slowly start giving up on things you’ve sworn to do, and how you slowly start to be unable to do/enjoy the thing (be it parties or coding) without it.

Lol, I could kind of understand (not really support) his use of AI. While I doubt it’s something you can do for long without starting to make compromises, people who were a really good programmers before will probably use it responsibly for a while, until their skills inevitably erode and (more importantly) their willpower slowly runs out.

But this argument made me loose all my respect for him. It’s so utterly stupid. I hate it when i have to check my assembly code line by line, because it’s not guaranteed that the compiler will compile the same code I’ve written deterministically, and basically just randomizes what it outputs. Or when my editor does not save what I typed, and instead decides based on a random language statistics what to actually save, so I have to double-check my text word-by-word every time.

Oh, wait. No, because the tools are deterministic, and that doesn’t happen. But of course, adding randomness into your workflow, where you have to focus and review everything line-by-line, is the same as using deterministic tools, lol.

I’d add to this that you can install stuff from package repositories, but only if you “layer” it onto your system, which I think slows up boot time, plus you have to re-boot for it.

Also, I highly recommend getting familiar with Distrobox. It can run even gui apps without issues, and is grate for whenever I need to install more stuff and just want to do the regular dnf install, i.e for dev environments.

I don’t see any reason why not start calling it SI.

I really want to see the US companies being forced or fined because they are using AI instead of SI. Force-rebrand OpenSI, make them (and all other US AI companies) change all their marketing materials and force them to scrub mentions of AI from all of their texts. Forbid them from ever using it again, instead of SI.

It would be so funny, a PR and marketing shitshow and I’m here for it.

And as a bonus, we can finally give back the AI term to gamedev. Searching for any materials in regards to NPC/game AI has been a nightmare.

Depends on your threat model. For someone who works in cybersecurity, the hard seperationo files per-project, easily split networking to different VPNs between VMs, and being able to keep sensitive data on a basically air-gapped VM that you can only copy to clipboard from is amazing. And with templates getting a stack of VMs for a new project running is pretty quick.

QubeOS is one of the coolest OSes around, if you work for multilple customers and/or take your data security seriously.

It’s true that I have not considered it from the AI-slopworks PoV, but in general doing development in a container is probably a must nowadays anyway, so why not have a system build around it. It’s not like virtualization is any difficult.

There are already version of debloated windows installs, like Windows X-Lite, btw.

I’ve been able to find a workflow where it’s mostly correct and can handle most of my gamedev related coding without making too many mistakes. I still have to actually read through the code and pay some attention to what it’s doing, and if it misses something and goes on a wild goose chase, it’s unusable and I have to start over (so someone who didn’t know what they are doing would be cooked), but whatever.

Sure, it does require a lot of looping adversarial reviews, and my average token cost is around 3000$ (4B tokens) a month (we have unlimited budgets and a pretty accurate tracking, and also probably cheaper than consumer prices per token with how large company it is), which is actually more than my monthly salary, but it’s just a job, for a company and on a product I don’t really care about, and I can 1) keep slacking in my job while doing my own coding stuff and projects, and keep seeing how absolutely unreasonable the prices are if you want to get at least semi-submitable results.

You could ask if it’s necessary to spend so much tokens - but so far most adversary review rounds do find serious blocker bugs the first implementation had, most of them being some hidden stuff that would be difficult to reasonably find by hand unless you really understand everything around the code, which you should, but the point of AI is that you shouldn’t have to.

Is it worth it? Lol, no. The whole team is loosing codebase knowledge, we’re getting bottle-necked by pending PR reviews that are just stacking up and no one wants to do, so we’re not even more effective, the cost is absolutely absurd and in no way near sustainable or worth it. And the longer it goes on, the less I can realize it’s spewing bullshit and I should stop it and nudge it into a different direction in our codebase, because I’m slowly loosing touch with it, while for now I’m still relying on what I remember from before we went all-in on AI.

And that’s while the whole industry is in the “Uber pricing” phase, so it will get a lot worse. But yeah, if you can burn 100-200$ per a simple implementation task, then it can have a pretty usable results. And that 3000$ a month does not include our CI review bot, that does additional rounds of multi-agent council reviews. And I’m not even working on anything complex, mostly just various menu screens UI. I can imagine the bill getting a lot higher if you get into more involved systems.

I found this being even more of a slippery slope. Your brain learns by making new neural pathways whenever you are thinking about something. If you skip the discovery part of it, and just read a finished train of thoughts/explanation, withoit having to carve the whole path yourself, it will not stick.

There’s a reason why just reading a book without doing any outside the box exercises, or just readinbg answers to them without figuring it out, is almost pointless and nothing will stick with you.

Frustration tolerance is a skill you need to practice and develop, and the more you get used to not getting stuck for a while, the harder it will be to not give up and just go find a direct answer, megating most of the learnig.

There was one defcon talk about it. It’s a lot of pretty complex reverse engineering, so getting really good at reading and understanding assembly and working with debuggers /disassemblers without symbols is a start.

The talk I remember, where they were able to steer and break any car of the model in the world remotely, they got in by finding a unauth vulnerability in a remote call, and then used the firmware update process to bridge the almost airgapped vehicle controls system from the frontend car control (the screen, etc) system.

They boasted how secure it is because it’s airgaoped and compromised frontend can’t touch the critical vehicle controls. It almost was, save for a single function used for updating both at once. It was months of reverse engineering and several bricked cars.

But if you just want to change the frontend a little bit, it’s not going to be as complex, probably. Still really difficult.

What, you don’t have your SWAP set to 1TB Google Drive share?

Take a look at how Firefox marketshare rose when Chrome killed ad-blockers, or how did Discord’s marketshare drop when Discord started asking for age verification, and there’s your answer.