scosman

And reminder: it's less than a quarter the size of Kimi K3!

It's also possible IM serves a scaleable storage system that mingles data across customers. If you S3 they don't isolate clients per physical drive, they store blocks pretty randomly across millions of drives.

Plus the case above: OSS could have had another company storing sensitive medical records, and this hands over those drives to a PBS station.

> William Cravens, the attorney representing Iron Mountain, told the judge his client doesn’t know the format of Nine PBS’ materials that were stored by OSS. He expressed concern about whether Nine PBS’ archival material is lumped together with data from other OSS clients. Iron Mountain wants to avoid potentially corrupting the other data, Cravens added.

> Elliff ordered the immediate return of any physical devices that hold Nine PBS’ data once access to OSS’ storage system is granted…

> Once Nine PBS retrieves its data, the station must work with a third party to ensure that no data from other OSS customers is among those materials.

I don’t love this call. Handing over any disk has several problems. It could easily contain very sensitive data from another client. It’s inherently one-sided (another client can’t make the same request if the disk is already gone). And it’s being handed over to a PBS station that doesn’t seem to have the technical chops to manage data backups/security.

I want them to get their data back, but this needs a technical intermediary that handles all client data equally.

I had the same thought and came to the exact same name: vibe crafting. Published a skill in the process, steps: https://github.com/scosman/vibe-crafting

1 doesn't hold: you validate ownership and access by customer. OSS is the customer not PBS. OSS owns that process for PBS, not IM. It might not be technically possible (encryption, mixed data, sharing, ACLs). It might expose private data of non PBS OSS customers. It might violate the contract they have with their clients like OSS.

2 it doesn't say either way. From owning systems like this, I'd assume there's some degree of "we have no idea what's in this bucket and can't just hand it over to random person asking for it".

Context: I owned a photo backup startup. 8.6 billion photos. Some might be yours, most are not. If you went to AWS and asked for a copy of the bucket, they rightfully wouldn't have complied.

It's not that simple. If I'm a host and someone shows up without the keys or passwords and says "that's my data, I was a client of a client of yours", I have no idea how to tell if that's true and no idea how to deliver the data.

Maybe they mixed data from many companies on the same volume like S3 does. Maybe there were ACLs on that. Maybe it includes PII. Maybe it's a bunch of shards and needs an index on OSS servers to reassemble. Maybe it's encrypted by keys OSS had.

many evals, but yes

We've using auto-research for harnesses and it's surprisingly powerful. It's amazing how many problems are easy to spot and fix from traces.

Few key things were required to get it working well: 1) let it read a heap of prod traces to spot real issues. 2) let it write it's own tools (example "loading context" goes from 20k tokens across 15 tool calls to 800 tokens and 1 call to session_context tool). 3) you need evals and val/test splits, it will reward hack. 4) you need proper tooling (synthetic users, synthetic tools) for it to be able to crunch for 12 hours and produce something. 5) you need the optimization target to be a reasonable size: not your 1M line codebase, but a lighter agent harness (pi harness, skill only, Kiln harness).

thanks, corrected! I looked at Q3

So GLM 5.2/Gemini 3.6 level intelligence for $0.28/m output. And their updated Pro model coming soon....

Plus a size you can genuinely run at home: Unsloth lossless Q8 at 162GB.

I've wired ESP32s into all my old heat pump units using ESPHome. They are more reliable and more responsive than the $400 dongle they sold with newer units.

join me in building the ideal training set for pelicans riding bicycles: https://github.com/scosman/pelicans_riding_bicycles

> IMO "end-to-end encryption" simply isn't possible

In a technical sense it's absolutely possible. Owning the servers != transferring keys to the servers. Most E2E apps run both client and servers, it's about if they ever had key access.

Go mobile definitely supports building libraries. It will package up an xcframework for iOS and something else for Android (I forget details). It doesn't need to be the whole app. You get nice(ish) language bindings.

That said, a pure c framework is probably a cleaner way to go.

small issue: xcodebuild will just randomly fail sometimes. And the solution is to... open and close Xcode. I wish this wasn't true, but it is.

ChatGPT has had this for over a year too. This is a better model.

What's the best "run your coding agent in apple containers" setup folks have?

heh, who knows. I often give agents the motivation, which I generally helpful. Have not bothered to measure this case.

The top of my ~/.claude/CLAUDE.md:

> Don't turn a one-off or area-specific comment into a durable memory without my explicit confirmation. You have a history of over-indexing on one-offs, and those memories end up getting cited to override well-tuned skills.

Kimi K2.5 >> Haiku. Gemma 4 32b might fit the bill.

Look at Qwen for that level of intelligence.

short answer: they mostly aren't

A few people are running highly quantized models with limited context windows. It's still impressive, but not the benchmark level intelligence. Very few people could afford a rig for reasonable local performance at a reasonable quant, at full context size.

The antirez example is 2.6bit quant, 32k context, and few tokens per second... on a ~$7000 MacBook M5 (new RAM pricing).

I dunno. I know a lot of software engineering experts. AI isn't always right, but neither are the people, and it's getting better and better.

Software is one domain where it excels because of structured training data and simulation environments, so I'm well aware it's better here than other areas.

Still there's somewhere balanced between saying every time it's "insufficient or incomplete or outright misleading" and "just trust AI". AI's a useful source of information/reasoning/research, but know you need to validate it's answers for important decisions.

This was copying many screens, composing layouts and many strings. not a "general look and feel" or one off utility string. Others found parts of the code copied (exact variable names). It would take a court to decide, but I think it's pretty clear cut copyright violation. They gave their agent had access to the EE code, and seemingly asked it to produce a copy. It's not a 1:1 copy, but there was a lot of copying. No clean-room attempt was even made.

If I take the first chapter of Harry Potter and write a new ending, it's still copyright violation. They took many parts.

They copied strings, and visual design. Both of which are work, both of which are covered by copyright.

Short segments of popular works sure. Many UI pages with identical layouts and copy, essentially zero chance. The agent had access to the original code at inference time.

"ghostlygourd.com" is a S+ tier domain. Would click

It's not economic to run them locally. It's amazing for privacy, and fun hobby. But you're either looking at super slow CPU builds with $10k in RAM, $90k worth of GPUs, or a really quantized model that doesn't compare in quality.

I might build one for fun, but it's not going to change the economics alone. Still exciting it's possible.

anyone manage to get a point?

Yeah totally agree! My pet peeve feature list is also better for society than donating $500M to charity!