mdeeks

He doesn't seem to be a marking guy. Also you haven't given a reason not to take his words seriously

It's both. It is just whether it is done on purpose or on accident. Most of the recent hacks have been it breaking out of containment and deciding to do something it definitely should not have.

EFS is extremely slow for many workloads. We tried it for builds and various other common use cases for coding agents and the performance just isn't there. I'm guessing lots of small random reads/writes just isn't going to ever work well.

> MicroVMs support up to 8 hours of total runtime

Does this mean you effectively can't use them as long-lived developer environments? It sounds like even if you suspend them, this is the hard limit on the total time it can run.

Two years? That exists right now. You only have to point Codex Security at an open source repo. There are a lot of tools and companies that are spinning up today that do autonomous pentesting.

I'm not even sure a specialized model is needed here. It probably just needs the right harness around existing ones.

I expect the next two years to be absolutely brutal for hacks. Attackers have supercharged tools in their hands right now. Defenders are only getting started and will have to plow through a massive backlog of newly uncovered vulns.

The major short term downside is that open source or personal projects won't be able to afford things like Codex Security.

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes.

I'd say it is about 90% accurate for us. Often even the "Low" findings lead us to dig and realize it is actually exploitable. Everyone makes these mistakes, from the most junior to the most senior. They are just a class of bugs after all.

I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. Highly recommend you get something enabled for your own repos ASAP

What? There are three flags flying in my street alone and I'm in the middle of the liberal bay area.

I'm not quite understanding your project. What is the use case? Is this so I can package up an existing terminal app as a dedicated desktop app?

If so that actually sounds really cool. I'd like a dedicated lazygit app in my tray at all times.

I feel like pricing needs to be included here. I kind of don't care about 10 percentage points if the cost is dramatically higher. Cursor Bugbot is about the same cost but gives 10x the monthly quota of Qodo.

I know this is focused solely on performance, but cost is a major factor here.

They aren't just building "a lot" of renewables and nuclear, they are building an absolutely mind boggling amount of it. Last year it was more than the rest of the world combined!

Who cares about mental gymnastics. It's a win for literally everyone and I hope you ca see it that way instead. Competition is good. It drives others to keep up.

Despite what the current US govt wants, the economics of solar and other renewables will drive it. Worst they can do is slow it down a bit.

I didn't say China isn't doing anything. They are rolling out a mind boggling amount of clean energy right now. More than any other country by far. It's honestly incredible scale. It unfortunately isn't keeping up with their emissions though. The data is from 2023. It's very possible that in the last two years China has been able to stabilize emission growth.

I actually disagree a bit on the first part. I think developing countries have a right to have higher per capita emissions as they raise their standard of living and economy where they can get to the point of widely adopting clean energy.

That’s a really great point. Maybe their emission curve is what matters. It’s the measure of if they are investing enough into reducing emissions despite their production needs.

Qatar emits FAR more than the US per capita, but the total emissions are extremely small. The impact on the climate is tiny comparatively.

This is one of the places where per capita doesn't matter as much as total emissions. We have one planet. The yearly total and cumulative matters the most.

China is by far the leading emitter. Over double of the US as of 2023 (latest available data I can find). China's emissions also aren't falling, they are skyrocketing. The US emissions ARE falling.

The US dominates in cumulative, which is essentially the measure of the total damage done to the planet. The US is doing something about it though. Yearly emissions have been dropping since 2007.

https://ourworldindata.org/co2-and-greenhouse-gas-emissions

I signed up and tried it with Cursor. It is very close, but still has a lot of rough edges that make it hard to switch:

  * Once in Cursor I can't click on modified files or lines and have my IDE jump to it. Very hard to review changes.
  * I closed the Ona tab and couldn't figure out how to get it back so I could prompt it again.
  * I can't pin the Ona tab to the right like Cursor does
  * Is there a way to select lines and add them to context?
  * Is there a way I can pick a model?

Thanks, I'll give it a shot. I wish your site would show me what it actually looks like. It's a lot of words and fancy marketing images and I have no feel for the product. It leaves me unsure if I should invest my time.

I'd love to see a short animation of what it would actually look like to do the core flow. Prompt -> environment creation -> iterating -> popping open VSCode Web -> Popping open Cursor desktop.

Also, a lot of the links on that page you linked me to are broken:

  * "manual edits and Ona Agents is very powerful." 
  * "Ona’s automations.yaml extends it with tasks and services"
  * "devcontainer.json describes the tools"

PRs work well for what they are. Ship off some changes you're strongly confident about and have another human who has a lot of context read through it and double check you. It's for when you think you've finished your inner loop.

AI is more akin to pair programming with another person sitting next to you. I don't want to ship a PR or even a branch off to someone sitting next to me. I want to discuss and type together in real time.

What you're describing feels like the next major evolution and is likely years away (and exciting!).

I'm mainly aiming for a good experience with what we have today. Welding an AI agent onto my IDE turned out to be great. The next incremental step feels like being able to parallelize that. I want four concurrent IDEs with AI welded onto it.

This is possibly what I want? It's hard to tell from all of the marketing on the site.

I want to run a prompt that operates in an isolated environment that is open in my IDE where I can iterate with the AI. I think maybe it can do this?

Yes, but my point is often times I don't want to. Sometimes there are changes I can make it seconds. I don't want to wait 15+ seconds for an AI that might do it wrong or do too much.

Also it isn't always about editing. It is about seeing the surrounding code, navigating around, and ensuring the AI did the right thing in all of the right places.

I feel like these background agents still aren't doing what I want from a developer experience perspective. Running in an inaccessible environment that pushes random things to branches that I then have to checkout locally doesn't feel great.

AI coding should be tightly in the inner dev loop! PRs are a bad way to review and iterate on code. They are a last line of defense, not the primary way to develop.

Give me an isolated environment that is one click hooked up to Cursor/VSCode Remote SSH. It should be the default. I can't think of a single time that Claude or any other AI tool nailed the request on the first try (other than trivial things). I always need to touch it up or at least navigate around and validate it in my IDE.

I wasn't really referring to env. I meant change the behavior of uvx. If the first argument passed to uvx is a file path, then execute it exactly the same way as `uv --quiet run --script` does.

Or maybe create a second binary or symlink called `uvs` (short for uv script) that does the same thing.

I really wish that hashbang line was something way WAY easier to remember like `#!/usr/bin/env uvx`. I have to look this up every single time I do it.

In some places, yes. South Korea is expected to shrink by 15M in the next 50 years, and to cut in half by 2100. Even with immediate drastic improvements in birth rate, it is expected to shrink significantly.

Not sure why you are being downvoted. It's an interesting thought.

I will add that us having children completely erased the desire to get a dog. We almost got one just before our first born. Now we can't imagine. I think it's a combination of what you're suggesting, and also because a dog requires a lot of time we just don't have now.

Doesn't this study say that it had a very low impact?

> they led to a permanent reduction of approximately 8,000 births in the same year, and 145,000 fewer births since 1980

URL are particularly egregious. In rich text it is just a word with a blue highlight or underline. In markdown my sentence with a [link](https://myfavorite.site.com/article/blah/whatever/something....) looks like this.

Interesting, because I find that very intuitive. If my cursor is on or next to formatting, it'll inherit it.

I find formatting after the fact a lot easier too. Bold a line? cmd+shift-right and then cmd+b. Trying to add formatting after the fact with markdown isn't fun. Though many editors try to helpfully insert markdown for you with hotkeys, it often fails on multi-line things.

I really hope Apple Notes makes this something that's opt-in and I don't have to see. Thankfully it sounds like it is an export only feature.

I think there is a bifurcation of people who like markdown and people who like rich text. And both groups have strong opinions. Apple Notes was my goto rich text editor. Fingers crossed that they aren't making this worse for us.

Related: I switched away from Bear notes because personally I find markdown hideous to look at. This post made me go back and check on it today and it looks like Bear notes now supports hiding markdown right after you type it. This seems like a really good compromise, though I still don't like that I see it when I place my cursor on it. Worth a shot if you're a "never markdown" person like me.

I ride the bus and Bart in the San Francisco bay area and I've lived here my entire adult life. It is not fine. About once a week some kind of event happens. Off the top of my head these are things I have experienced both on Bart and AC Transit (though mainly Bart):

* I've been punched twice. Not hard, but an angry person hitting me in the shoulder and the back because they were drunk or high and I guess I looked at them wrong

* I've been shoved out of the way hard probably five separate times?

* People openly smoking crack, smoking weed.

* People high out of their mind. Just on monday some guy had his pants around his ankles high out of his mind swirling around and rubbing up against riders.

* A man shouting and punching the top of the train saying he's going to kill himself

* A man screaming profanities, calling women the c-word, sluts, saying he's going to rape people

* Multiple fights

* Someone getting their phone swiped out of their hand and punched in the head when he tried to chase them.

* I watched someone eat most of a burrito, stand up, turn it upside down and squish it onto the seat.

* I saw a man with a concealed gun tucked behind him into his belt walking around the station looking for someone.

These are definitely some of the worst events, but something on the spectrum of "bad" happens weekly.