9dev

I don’t think I claimed agent reviews to be a panacea. It’s a tool that can help you lower the review pressure in companies working with agentic coding tools.

That's a thoroughly uncharitable view. Especially in smaller orgs with a minimum velocity dictated by the company's need to survive, the amount of code required to be written just to keep up with your competitors is massive. Trying to review that all by hand, thoroughly, is draining, thankless, and tedious. You end up with a few fast movers producing most of the code, and some slower movers forced into a reviewer role they never signed up for. It's an unhealthy dynamic.

All of these are angles an AI reviewer can test for as well, and will (IME) mostly catch mistakes correctly. I also still manually review code, and usually also catch issues, but the severity of what I find shrinks ever further as agents get better.

The sprawling code comments are becoming the most draining part of code review though, that's really killing me from the inside.

The point is that the image is composed in a particular way to appear entirely un-composed, spontaneous, but plays with that appearance. The artistic part of the image is that relationship between you, as the viewer, and the composition of it.

Sort of like a person with an amazing taste in fashion, dressing shoddily - but in such a camp way, it's very obviously purposeful in its shoddiness, making it a fashion statement again.

...but yeah, I stumbled across that sentence too.

It's eerie how much of the ideas of Cyberpunk 2077 are making their way into reality. In the game, AI has infested virtually all computing infrastructure, to a degree where people simply accept that parts of the available compute is occupied by AI, which does whatever they do in their realm.

I don’t really care that the things I make will invariably be scooped up and ingested into the training data.

It’s rather that I think we all ought to stop making software that is primarily useful to businesses, because there is no more joy in that with AI-written PRs driving maintainers into burnout. Big tech finally has no more excuses as to why they don’t maintain all the bedrock libraries themselves. So I say, let them do that.

And on the other hand, since anyone can vibe code something now, the value of GitHub projects as CV material has gone down significantly, so I’d expect less people to do that. Good! Open Source as a community, as a movement, doesn’t need these people.

Let’s get back to the roots.

Same. Started to adopt AGPLv3 for every new project. With AI sucking up all the CV-driven contributors, it’s time to take back open source as a joyful hobby for nerds that enjoy programming and sharing their creations with one another, instead of being corpo stans that do free support for shareholder driven enterprises.

> But I do need dedicated comliance officer!

There is no compliance officer required by law, at least not in any regulation introduced by the EU.

> The lower thresholds applies from 250 employees. I still have the same obligations as larger companies!

If you have more than 250 employees, you really should have both a higher salary than a garbage man and be able to afford someone to take care of your compliance duties.

> You expect me to do stuff for free. Or can I demand extra money to match minimal salary on my tax return?

I don't expect anything. You run a business. Anything you do related to that business is your own working time, just as anything I do in regard to compliance or data protection is of course billed working time. You file your taxes in your working time, you pay your bills in your working time, and of course you also read up on laws you need to comply to in your working time. Those are table stakes for doing business everywhere. Do you think American companies don't have to comply to regulations?

> Because I have social responsibility to make some rare stuff available, as you would put it!

All props to you for making that choice, then, but it's still your decision to have a company and that means you have to abide the law.

> But EU is not making it any easier!

The EU is responsible for so many things you just take for granted: A single market larger than the USA with a single currency; hundreds of EU-funded programs for small businesses with grants available easily; common standards across the entire union; protection from foreign traders; cross-border regulation and mobility; even things like funding for public infrastructure, art, and education all around you that you don't know of, because you never cared to look.

Just because you have a responsibility to think about and extra work to enable handling data your customers entrust you with carefully doesn't invalidate all of these efforts.

> So at end I should hope for the best right and relly on merci? My gov just loves to skull fuck "capitalists"!

You should try to think about protecting the personal data you handle responsibly and be ready to demonstrate that when somebody asks. Again, I am in the same spot and have been for years. This is doable.

> Which one is it then?

You don’t need a dedicated data protection officer, because your company is too small for that. You also don’t have to abide by lots of regulations that only apply to bigger businesses. But you still need to comply with the basic requirements, and that is your job as a business owner. I know what I am talking about, because this is part of my job. So unpaid doesn’t really match the reality here, right? Or do you consider filing your taxes as unpaid regulatory bullshit work too?

> Keep on mind I get lower salary than garbage man!

It doesn’t sound like your business is very worthwhile of keeping up, then? I don’t say this in spite, but if you don’t have a reasonably good income from your company, why do you put up with all the hassle in the first place..?

> I do not "store data",.

Sure you do, if you sell anything. You need to know where to ship stuff, customers contact you, pay you, all that. And as your customer, I don’t want you to store that longer than necessary or sell it to someone else.

Yeah, but that's still way too narrow to capture what the law is about. The GDPR doesn't really care about cookies, or storing data on clients in some way. Instead, it's about end-users giving informed consent to processing their data. Not just by hand-waving away some disclaimer, but actually conscious of the consequences of that action, and why it is necessary to do so.

I know this sounds all lofty and Brussels ivory-tower-ish, but I'm absolutely convinced it's the only sensible way to deal with personal information - even if American companies insist on forcing a new normal of lacking privacy on all of us.

You don’t need to hire such a person since you’re way too small for the thresholds. And besides, if you’re unable to accept that you have a social responsibility when you run a business, I don’t know what to tell you?

You also have to keep up with other regulations; that’s the price of doing business. And the churn you’re talking about is way less than you make it to be; it’s not like there is change every month.

We never even once got fined, because we try our best to only store data we need, not track users, and secure the data we have to store as well as we can.

If you indeed do end up with authorities auditing your business, they absolutely value if you’ve tried your best as opposed to not caring at all; I’ve seen that multiple times with friends in various places .

Sure buddy. And it's all orchestrated by the Rothschilds, right?

I'm responsible for GDPR in a small European company that processes fairly sensitive data. It's not that complicated as people like you make it out to be - if you're willing to actually try to do the right thing.

Treating the browser's "disable cookies" feature as a way to reject consent is not real consent. That cripples many legitimate use cases outright; it's neither accessible nor understandable by normal users; it's a technical defence measure, not a way to consciously reject contractual consent.

In contrast, the GDPR demands that you properly ask for consent if you want to process somebody's personal information, inform them why that is necessary, and only process the data if they agree to the processing.

There is clearly a difference here, and IMHO the EU is quite correct here.

It was always possible to ask the user for permission when you actually want to store something on their device, ie. go for an opt-in model.

Create a design spec and implementation plan first. If necessary, split that in phases. Then create a ledger that always holds the current status, and instruct the model to update that after it completes a task in the plan, and to append any issues it encounters during the implementation.

Then you can let it run, and when it stops, point a fresh session to the ledger to pick up the work from where the previous one left off.

You can get more fancy by using something like GitHub issues for coordination too and have multiple sessions create issues and epics and others to work on that in isolated worktrees, but the spec-plan-ledger approach usually works great for small to medium large projects.

As Donald Trump and the Republicans have so aptly proven, all checks and balances depend on an elaborate system of conventions, manners and personal honor, and a general spirit of compliance. As soon as the electorate votes for a party and administration choosing to simply ignore all that, the system folds entirely.

That is also the core problem for reestablishing trust with the rest of the world: Even if a Democrat or just a sane Republican wins in 28 and tries to revert many of the destructive policies the current administration enacted, there is now solid evidence the much-hailed system of checks and balances doesn’t work as advertised. And that means there is not really a legitimate argument to trust the US as much as countries and businesses did, which calls a lot of things into question—the bond market, the petrodollar, investments in the USA, dependency on American services…

They also thought owning slaves was a good idea. Perhaps we shouldn’t let men dead for centuries dictate how to run the country anymore?

Never compact. Not automatically, not manually. Instead, let it write ledgers and checklists or handover prompt if necessary, and start fresh sessions as often as possible.

Mine will just sit somewhere else where he thinks I surely must see him now, and lick his lips when I look at him just to make a point. Sometimes I wonder if he’s considering hitting me with his bowl because I’m obviously too stupid to understand his super obvious question

And use Alpha-3 country codes which are superior in any possible way regardless of YAML :)

right? Sensible nesting (that's how I'd break and indent a long query anyway), folding in proper code editors, proper hierarchy... what's not to like?

I realised that after posting, but then I suggested sending them as header in the first place.

Things are cheap until they are someone else’s problem, I say!

Certainly not OpenAI, the swarm is evolving under their roof as we speak

Should we let vibe-coded agent harnesses dictate protocol design now..?

On the flip side, I'd argue that the current centralisation of user agents (in the classical sense here) that benefit from programmatic content negotiation in form of a handful of harnesses like Claude or Codex is a great lever toward forcing the ecosystem to adopt better practices: If Anthropic added content negotiation as described in this thread to Claude, many sites would be incentivised to improve their web servers.

Not necessarily. They could also send a HEAD request to the URL first, to see the headers only and decide on the available alternates.

I am well aware that few sites are taking that much care of their API in terms of HTTP features, but all of the problems discussed here have solid and battle-tested answers.

That entirely depends on the server. A good solution would be to include Link headers in all responses:

  Link: /some-page      rel="canonical"
  Link: /some-page.json rel="alternate" type="application/json"
  Link: /some-page.html rel="alternate" type="text/html"
  Link: /some-page.md   rel="alternate" type="text/markdown"

Conceptually, I’m not sure I agree. There’s elegance in clients saying "I want this resource, and I’d like to get your markdown version of it. If you don’t have one, I’ll also take HTML." And if you couple that with optional "file extensions" at the end of the url to force a specific format (say, /foo for automatic negotiation, and /foo.html, /foo.json, or /foo.md for the respective media type,) you have a very easy to use API that adapts to the client; not the other way around.

I take the point that it makes caching harder, but I don’t think that should overrule ergonomics concerns.

Unless you have some kind of dynamic DNS with a background daemon, you'll be bothered by NAT eventually. And even then it's hardly as convenient. With Tailscale, I can sit on a rooftop bar in the Medina of Marrakech, connect my phone to the public WIFI, and access my laptop in the hotel WIFI across town. Or production infrastructure on a highly secured server somewhere on the other side of the planet. All without compromising security, and all devices involved just pick the shortest physical link to each other.

It's really pretty cool.