krinchan

My problem is that Claude kept screaming across several sessions that it echo'ed a default password for a local, ephemeral development container into a session across SEVERAL sessions.

I get dinged continually for a vendor supplied container that writes an appropriately scoped access key to disk in plain text on startup (we are working to eliminate it but it requires migrating to an entirely new way of doing things the vendor only released earlier this year and I got derailed by other priorities).

So like if established enterprises using off the shelf scanning software are breathing down my back about this...what the actual hell is happening inside flock that this was fine. Lol.

I mean, at some point I'm not paying these guys to sit around and fiddle with their swarm of agents role playing an entire product team and need to see some results. I've seen at least five of these guys at my $job spontaneously combust into employment ending AI Psychosis.

Idk. After having THREE Quest 3s brick themselves within the extended warranty period, I really want an alternative. I can do normal cardio but rhythm games like Beat Saber and more are just such a better time of knocking out a decent hour of cardio several times a week for me. Beat Saber is more easily modded on PC and while the number of games I play is really low, this is worth it for me.

The shift here is that up until now output (code, in this case) required a degree of competence. As such, we socialized that being able to put out the code showed a degree of competence. The act of putting together a PR with working tests showed you had a level of knowledge past "I want X to do Y."

Now, you have a lot of people taught that output (a working PR) is competence. They walk around thinking they are competent because they can produce output.

When faced with criticism on working code, they collapse and flail immediately because to admit they can't explain or defend the code is to admit they are not competent. From there you've hit pretty much all of the problems that the rest of the Internet suffers from: cognitive dissonance, digging in because being wrong threatens your constructed identity, constructing echo chambers of AI Influencers peddling the latest prompt, and so on.

It's not just the status quo, it's a nightmare to enable. Somehow between Google Play Advanced Protection and Google Account Advanced Protection I have to resort to several reboots and adb + USB debugging sideload to get an app loaded. @.@

I feel like we work at the same place. IT Husbandry/Debt Paying/KTLO whatever you call it is being ground into dust. Especially repetitive stuff that I originally would've needed a week to automate and never could get to the top of the once quarterly DevOps sprint...bam. GitHub Action workflow runs weekly to pull in the latest OS images, update and roll over a smoke test VM, monitor, roll over the rest or rollback and ping me in Slack. Done in half a day.

I've got a couple Claude Code skills set up where I just copy/paste a Slack link into it and it links people relevant docs, gives them relevant troubleshooting from our logs, and a hook on the slack tools appends a Claude signature to make sure they know they weren't worth my time.

That said, there's this weird quicksand people around me get in where they just spend weeks and weeks on their AI tools and don't actually do much of anything? Like bro you burned your 5 hour CC Enterprise limit all week and committed...nothing?

No, Claude Code reads the CLAUDE.md in the root of your project. It's case sensitive so it has to be exactly that, too. Github Copilot reads from .github/copilot-instructions.md and supposedly AGENTS.md. Anigravity reads AGENTS.md and pulls subagents and the like from a .agents directory. This is probably why you have to remind it to re-read it so much, the harness isn't loading it for you.

I got an email update for a very adult kink event recently that was entirely written by Claude with emoji bulleted lists and everything. All that was missing was the EXECUTIVE SUMMARY header.

My reaction was about the same.

As someone who started out a GenAI skeptic, I’ve found the truth is in the middle.

I write a TON of one off scripts now at work. For instance, if I fight with a Splunk query for more than five minutes, I’ll just export the entire time frame in question and have GHCP (work mandates we use only GHCP) spit out a Python script that gets me what I want.

I use it with our internal MCP tools to review pull requests. It surfaces questions I didn’t think to ask about half the time.

I don’t know that it makes me more productive, but it definitely makes me more attentive. It works great for brainstorming design ideas.

The code generation isn’t entirely slop either. For the vast majority of corporate devs below Principal, it’s better than what they write and its basic CRUD code. So that’s where all the hyper productive magical claims come from. I spend most of my days lately bailing these folks out of a dead end fox hole GHCP led them into.

Unfortunately, it’s very much a huge time sink in another way. I’ve seen a pretty linear growth in M365 Copilot surfacing 5 year old word documents to managers resulting in big emails of outdated GenAI slop that would be best summarized as “I have no clue what I’m talking about and I’m going to make a terrible technical decision that we already decided against.”

I meant b from the first set which maps onto c from the second set. Lol. I should've been clearer.

The article pretty clearly lays out it's at least functionally B. The problem is Dell doesn't publish the drivers necessary for the Windows installer on it's website. You can only reinstall windows from the recovery partition or via online download via an EFI program, similar to Apple Recovery's online re-installation. Those install methods include all the Dell bloatware and telemetry settings cranked up to 11.

They seem to have the api base url hardcoded in their firmware[1]. The repo seems to have pretty clear instructions for compiling and flashing modified firmware. From there, it's just a matter of writing a decent server to implement the calls documented in BYOD/S[2] and Private API.[3]

[1]: https://github.com/usetrmnl/firmware/blob/e3db8c37990c2333ec...

[2]: https://docs.usetrmnl.com/go/diy/byod-s

[3]: https://docs.usetrmnl.com/go/private-api/introduction

Having RTFA: I think it's an interesting take to centralize zoning at the state level. Houston (which has no zoning ordinances) is a terrible place to live, but it's definitely an affordable place to live.

The incentives at a state level around housing might actually balance differently because at that level economic activity, jobs, etc. matter more than property taxes. Something that isn't often mentioned, because the focus is always on California or the US, is that property values are directly tied to the overwhelming majority of municipal budgets via property taxes incurred as a percentage of that value. Not only do constituents vote for more expensive residential property, local governments want expensive residential property even if their voters didn't.

This is exactly why California has been trying to move some of this power to the state level: local governments are fighting tooth and nail to hold on to their tax revenue.

ETA: The property tax thing is more complex, but still applies. States like Florida and California cap how much tax assessments can increase for property you own that is your primary residence.

This still encourages these states to drive up property values because it tempts you into cashing out via selling. Every state with this sort of cap also immediately reassesses real estate to the price it sells at the following year. A high property value versus the tax assessment is just a deferred revenue stream, so it's a driver to encourage consistent turnover in the market. The only real way to do that is to constantly drive prices up, which drives the cost of living up, which turns over the residents faster.

So capping tax assessments like that, just makes the cycle even more viscous, in my experience living in Florida for a time.

Just say BofA.

Billpay Checks are actually Cashier's Checks and are drawn from account numbers that aren't your account, btw. It's one of the reasons it's far more secure to pay any bill requiring a check this way.

Check fraud is massively on the rise. They don't even need a physical check, just the info. They're printing their own checks now and depositing them electronically. They also hire homeless right off the street to go in and cash the checks for them. Homeless keeps $100, the fraudsters make the rest.

If you're using checks the way you say you are, it's only a matter of time before you have to deal with swapping out bank account numbers.

I use a USB foot-pedal mapped to `.

Aha! That makes sense! Yes that can be a problem. We exclusively use a single (our own) IdP so it's less important for us. But good to know as some future feature work will actually make this important.

Thanks!

That's something that isn't OAuth2 or your end point is accepting something insane.

Are you talking about the PKCE variant of authorization code flow which is what replaces implicit flows in native apps and SPAs? Because those use code_challenge and code_verifier fields, not the state field. If you're doing all that in the state field with signed nonces you really should move to PKCE.

Yes because embedded XMLDsig is great! I've never seen a SAML implementation that worked reliably across IDPs outside of Java, honestly.

It isn't. OAuth2 really did away with AuthZ and focused on AuthN, regardless of what anyone says.

You have scopes but even those outside of the OIDC scopes are wishy washy and meaningless outside of each implementation.

...what?

The server generates the auth code and redirects the user agent to your callback. You exchange that code with the IDP (over HTTPS which yeah that's its own nest of wormy trust) to get back a token. They can't inject a token because you don't get the token from them, just the one time code. If it's opaque you introspect it to validate or you just validate the JWT signature after pulling the keys from the JWKS endpoint. Introspection is standardized and an RFC. The state param is just a fucking session identifier.

All these URLs are defined and provided via the .well-known/openid-configuration endpoint. If your IDP publishes that endpoint correctly, most OAuth2 client libraries Just Work (TM) when pointed at the IDP domain.

Do EITHER of you even use OAuth2 outside of just cargo culting something you found off GitHub?

Most of these package systems being attacked run arbitrary code on your system when you install the package in order to allow native extensions to compile. Maven/Java simply downloads a (relatively) inert zip archive that your IDE might do some static analysis on to provide autocomplete.

Along with all the scanning and what not, I think that’s the biggest reason you see attacks primarily on npm, PyPi, and to an extent Ruby Gems.

You're referring to the launch of FedNow, right? It's interesting because most of the analysis I've seen keeps assuming it'll be more B2B and that people will just continue to use P2P apps. However, I don't see any reason said apps won't move to FedNow themselves. The underlying ACH should be fairly easy to swap out with FedNow, right? Venmo and CashApp have only free money (in the form of lower fees and faster settlement) and better security to gain, it feels like.

Most vimdevs (myself included) have a plethora of plugins cobbling together a custom and comfy IDE. Almost no one is using a plain text editor now.

And emacs users never had a plain text editor, never claimed as such, and woe be to you if you call it such in front of them. Lol.

I can see how it’d be read like that. Please allow me to be clear, they did not do that. I do not think they did that. There is absolutely ZERO proof they did that.

However if they were to do something outlandish and insane like that, it would not be surprising. NCMEC is drunk on their own power and status. They are on a holy crusade and even constitutional rights mean absolutely nothing to them in their quest. The people at the top are crusaders on a holy war and there are no means that they would not use to these ends.

There are many people in the trenches who are fighting a good fight. They deserve our respect and empathy. However the people at the top…see above. NCMEC needs to be reined in, but of course the second anyone in Congress even looks at them sideways you get a screeching voice of the minority going on about the children and then you’re in the news as a child predator.

In a way, they are responsible for shaping the discourse such that democrats got knocked on as “for” CSAM which is what led to Pizzagate taking hold. But I don’t believe for a second they intentionally, directly created it. But it’s not a big stretch from where they are now.

Back when the news first came out there were several blog posts posted to HN by people who host user uploaded photos at scale who had NCMEC come knocking at their door to strong arm them into participating in their programs.

They are not even a proper government agency yet they walk around with the balls to pretend they are equivalent to the NSA.

I am against CSAM as much as anyone but NCMEC and their database is a total farce. They produce mountains of unactionable reports, false positives, and their (or was it Microsoft’s) weird hashing thing was visually identifiable as CSAM itself and reversible. That letter was just a whole mask off moment for them.

I wouldn’t be surprised if NCMEC had a hand in starting Pizzagate tbqh. I have no proof and I don’t think that they did. But if it broke the news tomorrow I would be like, “Nah that’s totally believable.”

It's like the other day there was a post where someone wrote an entire blog post about how they changed a tight loop with a function call in Golang to pass a pointer to a struct instead of by-value so they stopped allocating and copying on each call.

Like...duh?

I suppose that's why I find Golang less weird to work with than others in my cohort. I spent a semester in the depths of C and OpenGL so I'm intimately familiar with by-value vs by-ref.

> kinda like

You seem to have missed some words. Please point out how Tailwind is not a tool that makes working with CSS more standardized and simpler for someone just sitting down to your code base?

Literally the entire original comment was just that Tailwind fills much the same role as Bootstrap did, just with far more capabilities. Thus, it engenders the same flame wars that were fought over Bootstrap. You responded by saying, "It's a superset of Bootstrap."

Which is what I was saying by "Very fancy Bootstrap"?

Okay you pointed me at a Tailwind plugin that provides Bootstrap classes.

I have no idea what point you're trying to make.