Izmaki

> nobody would even bat an eye because you can just vibe code this without effort.

To me, this is implying that software engineering in 2026 is less impressive than 10 years ago because "you can just vibe code this without effort". Having used AI a fair bit for both business and pleasure I can assure you that you can't always "just vibe code" something useful. Discrediting software engineering because a power tool was popularized in the field is... eh. I don't agree with that.

It sounded like you thought that with AI anyone, even children, can solve literally any problem with ease and therefore it's not very impressive (...and "perhaps we don't need 20+ software engineers building that app if 5 can do it with AI").

Don’t listen to people telling you not to post your age on the internet. This is solid work and you did this instead of being stuck in one of the hundreds of +1 dopamine traps in Roblox or yelling at other (often times much younger) kids in Fortnite like many of your peers did.

You did something meaningful, you even waited to share it with the world until version three, and you learned a ton doing it. Well done, dude!

Hold up, are you the type of person wanting to fire software teams because we can just ask the Product Owner to vibe code the new features?

This is fine. All of this is fine. :’)

Everything is untested or WIP. What is the news here, sorry?

It has to do with how you can abuse how the TCP data is streamed, not that a web server detects a pipe.

The Way Back Machine link works again, go read the blog post. :P

From the blog:

> Execution in bash is performed line by line and so the speed that bash can ingest data is limited by the speed of execution of the script. This means if we return a sleep at the start of our script the TCP send stream will pause while we wait for the sleep to execute. This pause can be detected and used to render different content streams.

> Unfortuneatly its not just a simple case of wrapping a socket.send("sleep 10") in a timer and waiting for a send call to block. The send and receive TCP streams in linux are buffered on a per socket basis, so we have to fill up these buffers before the call to send data will block. We know the buffer is full when the receiving client to replies to a packet with the Window Size flag set to 0 (Win=0 in wireshark).

Unrelated: I clicked your user profile and wondered what that keybase.io thing was... turns out your proof expired and should no longer be trusted. :P

"That identity proof for <name> is pending, revoked, or non-existent".

Ps: I fear the day keyboards will ship with a "—" button, so we can no longer easily identify AI generated text.

> Why this matters: Modern infrastructure uses too many execution engines — Docker for dev, containerd for production, Firecracker for isolation, CRI for Kubernetes, MCP agents for AI.

It is my understanding that Docker Engine adds capabilities (such as network stack) on top of Containerd (which is a project maintained by the same people), and "CRI for Kubernetes" is a Container Runtime Interface which COULD be something other than Containerd but often is just Containerd. So in essence the reason why yet another runtime exists is that we have a runtime for containers (Docker/Containerd, Containerd and, for example, Containerd as the CRI in K8s), a runtime for isolation and a runtime for AI agents.

That seems like an unnecessary argument on its own, which makes me wonder why it's listed as the first argument.

The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different.

It's more of a "this is possible" than "this is a real concern", of course.

Except you can't really be sure, still: http://web.archive.org/web/20250622061208/https://www.idontp...

OK, which one of yous tried to `sudo apt install bobs and vageen`?? xD

Not to mention that a webserver can be configured to show one sh file when a regular browser visits and another when curl etc. gets it. Show one thing, install another.

What's your favourite (online or offline) model for image generation?

> We implemented safety measures across the full model development lifecycle.

Any suggestions for the best open, non-opinionated model?

> You may not use Wheesper to:

>

> break the law, facilitate illegal activity, or violate another person's rights;

> threaten, harass, stalk, exploit, or seriously harm another person;

> share child sexual abuse material, intimate imagery without consent, or sexually exploit any person;

> publish another person's private or identifying information without a lawful basis;

> impersonate someone, commit fraud, deceive participants, or conduct phishing;

> infringe intellectual property, confidentiality, privacy, or other proprietary rights;

> distribute malware, harmful code, spam, or unsolicited bulk messages;

> probe, disrupt, overload, scrape, reverse engineer, or bypass access controls, rate limits, bot protections, or security measures, except where applicable law expressly permits security research; or

> help another person do any of the above.

---

...then what the heck do we need this service for?

(Obviously, this comment is meant as a joke.)

It's not sarcasm. If I had to pay $25 to perform my work from an ever-growing pile of projects, I would be losing money. That's not "cheap intelligence" for me. It certainly is for my employer, though, because for the mere price of $25 extra per day they can get 4*X the product per period of time.

In Scrum terms my personal velocity grows by a factor of four or more with access to agentic AI workload, but if it means that I will just be asked to "consume" 4*X more Story Points per sprint, I'm not the winner in the end, my employer is. If they asked me to complete X Story Points per sprint regardless of my velocity, and they let me take the days off when I was done, I would be the winner. But that's not how it works.

AI is "Cheap" for the person/organization that gets more product for less money, not for the individual person building the product faster.

Seconded on the "not cheap" argument here. I've spent $25 worth of tokens completing a one-week task in an afternoon, or rather my company spent the money. I would never have personally felt OK with throwing this much money after some prompting back and forth for a few hours, one lazy Saturday afternoon. I ran the risk of not finding the solution before the token usage would be too high for me to want to carry on, if I was my own credit card linked to the account.

Of course money in this situation is a bit of a funny measurement, right, because if I was able to take the rest of the week off as soon as I had solved the one-week problem, then I would have no problem at all throwing even $100 worth of tokens at it, so I could enjoy a nice 4-day "mini-vacation".

How cheap "cheap" is, is indeed "in the eye of the beholder".

> but that is more costly and and less efficient.

Maybe this is the clue as to why our concrete crumbles after 100 years: it's not economically efficient to make it last longer?

In my experience more than 9/10 programmers I've worked with have never used Docker before and of those who have, the majority have never used Docker for anything personal.

If I hand them an image for a Dev Container, sure, they might use it, but it becomes "a thing we need to do, to compile our code in our IDE" not a tool they would use for isolation*.

*) OP seemed to imply that containerization would be nice for safety and security compared to bare metal, but containers were never built for isolation in the first place, mind you. They are namespaces and chicken-coop-like-jails at best.

Must be nice to be able to even buy a controller.

How awesome do you feel right now? This is HUUUGE! To think that a scroll was unreadable for so, so long, until we invented machines that let us read it slice by slice. It's such an unfathomable achievement - we made machines that let us read 2000+ year olds fragile scrolls without ever opening them - and you helped do just that.

Hats off!

I feel like we need a vibe coded guide in this modern day and age.

I don't fully understand CORS and was hoping he'd explain how it works. :(

Wait 'til the author discovers that you can use ping (ICMP) to transfer data, too! :)

I've wanted to love Zen for a while, I really have, but every time I start using it, it just feels... I don't know... foreign? Too new for comfort?

I think it's one of those "once you get used to it, you never go back" technologies, but I also think it takes a bit of time to get used to it. Thoughts?

In my experience they're sometimes a little too aggressive and I have to disable the "shields" for the page to function correctly. I have never seen an add while using Brave and that's after 1.5 million trackers blocked and 50 gb bandwidth "saved".

The only browser I would switch to away from Brave is one that, as was described by another user in here, sandboxes all pages/domains and ensures that no data leaks outside unless you are actively allowing it. Think Qubes OS but for browsers. I imagine a nice "drag this domain-box into the Facebook domain blob of a tree structure to allow linking and sharing of data" would be a cool feature. That would make it easy to select and confirm which FAANG company gets your data on which domain.

Say what, now?

Anonymity and encrypted communication are two very, very different things. Have one but not the other and you're essentially handing off your private data incl. passwords to whoever that has a tap on the communication between you and the server can fetch them, too. Have the other but not the one and everyone will know who you are, but they can't eavesdrop.