0123456789ABCDE

my understanding, and experience, is that you 1. run a bunch of sessions with small permutations to create variety, 2. run more sessions dedupe reports into a smaller collections of potential vulns, 3. run a handful of agents at max effort to write PoCs + write-ups, 4. rank findings, 5. finally look at what, if anything that, was found. maybe ask questions, try and understand if the PoC is running against a realistic setup.

until you can confirm a vuln report is valid, you must assume it is invalid.

always has been

claude code has opusplan — uses opus while in plan mode, switches to sonnet for execution.

https://code.claude.com/docs/en/model-config#opusplan-model-...

edit: you can make it work with sonnet for planning, and haiku for execution, or any other combination you fancy to work with.

https://code.claude.com/docs/en/model-config#control-the-mod...

https://x.ai/news/anthropic-compute-partnership https://www.anthropic.com/news/higher-limits-spacex

no pull-requests, no branch protections for `master`. i mean this works, but you probably need those rails in place.

"rebasing 70+ commits from master on top of their branch" is not a real thing

like, i want to believe you. it just doesn't work the way you're describing it.

the docs checkout, ty

† https://www.anthropic.com/news/series-h

these are changes tacked to my git config over time. they're the result of working in a constant crunch state, where smooth forward move was more import than the state of the git history you left behind. these options remove small annoying road bumps. you should avoid some of them if you're working under different constraints, or the commit process differs such that these options don't apply.

it all starts with `pull.rebase=true` it makes `git pull --rebase` the default behavior. then comes `rebase.autoStash`, which just wraps the rebase with a stash push/pop envelop. if rebase is not your thing, and you prefer merge, `merge.autoStash=true` works the same. finally `push.autoSetupRemote=true` will skip asking you to set a remote tracking branch, it makes `git push` default to `git push --set-upstream`.

  #~/.config/git/config
  [rerere]
      enabled = true
      autoUpdate = true

    [pull]
      rebase = true

  [rebase]
      autoSquash = true
      autoStash = true

  [merge]
      # zdiff3 adds original text markers and removes matching lines from conflict regions
      # https://git-scm.com/docs/git-config#Documentation/git-config.txt-mergeconflictStyle
      conflictStyle = zdiff3
      autoStash = true

  [push]
      autoSetupRemote = true
      default = simple

  [init]
      defaultBranch = main

but i think you meant: tag all code repos as unsafe, because you assume all code is unsafe, and 1. i don't fully agree with that, and 2. that's half of my argument. 1. historically most languages bootstrapped their compilers with one of those, some eventually reaching the selfhosted milestone (ex: https://go.dev/doc/go1.5#implementation). 2. tagging repos with `unsafe code`, or if you prefer to stay with original `maybe vibes` tag, implies you have some level of confidence in the tag you are applying, and that you also can back that tag with some common understanding of its meaning. i do not think we have established what `vibed` or `ai coded` actually means. some know what their personal definition is, but it is not a shared understanding of the definition.

as matter of non-exhaustive sampling we currently have vibe coded and ai code, ai co-authored and ai completions/suggestions, and ai aided. which one should be picked? nevermind the term ai is fuzzy, but how do you even begin the process of classification? a process that by it self, is likely to use more of the dreaded ai technology. where would github draw the line for this tag, such that it avoids backlash from users?

pick your broad strokes: llm generated with no human revision; llm generated with human revision; llm wrote large parts of the change set, but a human made adjustments; lm generated small snippets — implying the contributor accepted the suggestions, llm aided with codebase understanding (RAG); lm picked symbol completion and types; ml model used for refactoring suggestions.

for github the question† is: what is important for a user that sees this tag? what does the user care for? how does that affect their decision process when considering using, or participating in a project.

there are much more interesting questions, than wether a repo accepts vibe coded contributions, still not easily answered. show me: total lines of code, or a ranking per language (only a percentage is currently displayed), code complexity stats, code churn, merged pull-requests vs total pull-requests, avg reviewers per pull-request, merge pull-request non-members vs members, mtt member reply on issues, mtt member reply/action on pull-requests, or split that between merged and non-merged pull-requests

† also github has been absorbed into a large proponent of ai, microsoft

ideally one would pick something a bit more forgiving than a linear function, to avoid penalizing too much users connecting from CGNAT

my paypal aversion stems from interacting with the service. ex: charges show in my CC but are not listed on paypal account

mostly, but not enough — i have been experimenting with this, and what i found to help is:

  - help menu is the default, not an error message to stderr. ex: `gh pr` and `gh pr --help` are byte identical
  - if the subcommand, or the options passed are wrong, present suggestions. ex: `gh gists` -> "Did you meant this? gist"
  - the help menu should provide examples like `tldr`. sprites.dev tool `sprite` does this well, `gh` is in the training set so theirs is shorter
  - can you append the docs url to the bottom of the help menu?
  - you're serving llms.txt, right?

you can however convince claude to create a local command with the extracted prompts for stuff like autodream

see: https://hn.algolia.com/?query=dang%20title%20automatic&type=...

> Is an agent going to match the effectiveness of methylphenidate in ADHD? I doubt it.

having, only recently, been diagnosed, it is clear to me methylphenidate > claude-sub-pro-max

  https://chatgpt.com/?q=how%20to%20decompress%20a%20tarball
  https://claude.ai/new?q=how%20to%20create%20a%20tarball

function name becomes a human readable summary, string docs the description

edit: bottle.py and fastapi are the most significant contributions to web frameworks in python — decorators for path handlers, typed input/output, automatic docs

if buyers were to perceive stripe as being dificult, they might churn. i certainly do this on paypal pages.

this does not seem to match reality, see:

  1. count for claude as co-author: 25M
  2. count for speakeasy as co-author: 917
  3. count for stainless as co-author: 6.2k
  4. count for alembic as co-author: *Your search did not match any commits*

assume no deep learning, of any kind is involved: you write a program, you are the author, right? you compile the code, are you still the author? do you have to attribute co-authorship to gcc/llvm/oracle?

i think not, you are still the author, same as when anyone else uses an llm to write code.

ianal

co-authorship implies ability to hold author rights, which afaik an algorithm can't do.

are folks adding speakeasy/stainless co-authorship lines to their commits? should i add alembic as a co-author after making some changes to the database schema?

  Co-authored-by: buf generate <noreply@github.com>

google has been running ClusterFuzz since ~2012, and naptime was announced in 2024 (https://projectzero.google/2024/06/project-naptime.html). they call it big sleep and codemender now.

openai announced aardvark last year, no they call it codex security.