waterTanuki

Because no other language has ever had supply chain attacks ever, in history. Nope.

https://blog.rust-lang.org/2022/05/10/malicious-crate-rustde...

https://en.wikipedia.org/wiki/Log4Shell

https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-an...

https://about.gitlab.com/blog/gitlab-catches-mongodb-go-modu...

https://www.reversinglabs.com/blog/packagist-php-repo-supply...

When your senior developers retire, and if the LLMs haven't caught up to their level by that time, where do you think new senior developers will come from?

> Homebrew is working on an official Rust frontend that will actually have full compatibility. Hopefully this will help share effort across the wider ecosystem.

Where can I read more on this effort?

LocalStack built a mock of proprietary APIs, not on top. There's a distinct difference.

Firefox doesn't seem to like your website. I get an insecure connection warning.

Error code: SSL_ERROR_RX_RECORD_TOO_LONG

Works on chrome though

Debian isn't known for being bloated so I don't get what the selling point here is. If I want a stripped down barebones system why not just use Arch?

We need more creative names for rust packages because this is going to cause confusion

There's already Oxide computers https://oxide.computer/ and Oxc the JS linter/formatter https://oxc.rs/.

Not to sound harsh, but it sounds like you're greenfielding most projects and don't have to worry about collaborating with a large dev team or onboarding new developers which is a luxurious position to have. It's been the exact inverse for me where getting up to speed or maintaining a python codebase is exhausing and maintaining rust/go/typescript projects has been much less of a burden.

Any time I've worked on a python codebase with 3 or more people on a reasonably sized project, it turns into a mess than becomes much more of a cognitive load than any compiled language. Here are my experiences:

- numerous lsp errors and warnings that drown out real bugs and issues (no one is null checking in python, or correctly typing their functions beyond the primitive types)

- hodgepodge of tools like conda, python version <= 3.5, etc. required for project (because one person refuses to migrate to uv)

We've seen the exact opposite trend of what you've said. Typescript has surged in popularity because the quality of LLM output scales with context, and untyped languages like python/JS leave most of that context out that no machine can parse. These tools do not reason. They are token generators. Pure functions. Some outputs have more weight than others.

Not a FAANG engineer but also working at a pretty large company and I want to say you're spot on 1000%. It's insane how many "commenters" come out of the woodwork to tell you you're doing x or y wrong. They may not even frame it that way, but use a veneer of questions "what is your process like? Have you tried this product, etc." as a subtle way of completely dismissing your shared experience.

I find your comment disingenuous at best.

> The internet was not a bastion of high quality content or discourse pre-AI.

I have read thousands upon thousands of pages of AI-related discourse, watched hundreds of videos since 2022, maybe even a thousand now on it. NEVER at any point in time did people opine for the "high quality" internet of before. They opined for the imperfect HUMAN internet of before. We are now seeing once pristine, curated corners of the internet being infected with sloppypasta.

This is quite a broad brush to paint the internet with. It's like saying The Earth is not a bastion of warzones/peaceful places to live. That is HIGHLY dependent on location.

A camera doesn't use unlicensed IP from other sources to produce an image. The makers of the camera explicitly gave you a right to own the photograph taken with the parts used to assemble the camera.

If you're concerned about the amount of RAM, this isn't the laptop for you. Grandma doesn't need 16GB to browse Facebook and look at family photos.

I'm actually glad they restricted the memory, because it will create market pressure for devs to stop wasting system resources on bloated electron apps and NextJS. With RAM prices skyrocketing these days people need to be more conscious of how much system resources they're taking up.

I've grown to hate using python in production since LLMs have been around. Python cannot enforce minimum standards like cleaning up unused variables, checking array access, and properly typing your functions. There's a number of tools built to do this but none of them can possibly replace a compiler.

Compiled languages like Go and Rust are my new default for projects on the backend, typescript with strict typing on for the frontend, and I foresee the popularity growing the more LLM use grows. The moment you let an LLM loose in a Javascript/Python codebase everything goes off the rails.

Are you working for 3x less the time compounding monthly?

Are you making 3x the money compounding monthly ?

No?

Then what's the point?

I've noticed a steep decline in software quality as a consumer since Covid, but especially since ChatGPT came out.

That hasn't changed. Whether it's apps that hog too much memory, games that use too much storage, unresponsiveness, or just plain cryptic error messages, everything feels more fraile than it used to be.

Perhaps its the growing pains of LLMs, a horde of junior programmers pushing stuff to production that the seniors were too "old fashioned" to notice.

Only time will tell.

Hi, I'm one of those people.

Welcome to being a human being, where you need dozens of different accounts and passwords and passkeys and authenticators to live in modern society.

Apple passwords just work. They integrate nicely with most websites where I can authenticate using biometrics instead of copy-pasting and leaving my credentials on my clipboard.

And let's be real here, no one else in the industry comes even close to the amount of investment, research, and maintenance of security platforms than Apple. I would not bet against Apple's security failing.

Everything is a tradeoff between convinience and security. I think Apple's password manager is the perfect middleground. I let it generate different passwords for every site, store my passkeys etc.

No one has the time to fully optimize their security footprint. No one. And if you do you're either A) working in a sensitive area that requires it for your job or B) being targeted by state-level threat actors or C) lying. Anything beyond a password manager + 2fa is severe overkill for anyone else.

I don't understand why I would use this over aws CDK in python.

cdk is already an abstraction over the javascript cdk,

which is an abstraction over cloudformation,

which is an abstraction over the api..

I just want to navigate some of the claims made by Stelvio and others in this thread and see if maybe I'm missing something after reading the docs:

- Ship Python to AWS in minutes, not days: I can already do this with cdk? It's highly dependent on the project requirements. AWS already provides a sleuth of high level constructs with sensible defaults.

- great for really small apps where you want your resource definitions colocated with the code using them: CDK is just code? You can put it all in one place or split it into files. I don't get how this is new.

- easier to manage IAM permissions this is the bread and butter of cdk. I can simply do Resource.grantRead(lambdaFunction) without touching IAM. Who was complaining about this?

The only advantage I see here over CDK is using Pulumi as the underlying resource engine, which I admit performs better on deployment speed. But then we arrive to the question: Why not just use Pulumi, which already gives me IaC in python?

There has to be a way to set permissions right? The demo video they provided doesn't even need permission to read file contents, just read the file titles and sort them into folders based on that. It would be a win-win anyways, less tokens going into Claude -> lower bill for customer, more privacy, and more compute available to Anthropic to process more heavy workloads.

> you cannot simultaneously support rule of law and support that those recklessly ignore it.

Hillarious you write this knowing full well the DoJ is violating a law passed by congress saying every single one of the Epstein files had to be released 3 weeks ago.

The lawbreakers are running the country now.

Tried it out on a local test postgres db.

First error: "Connection failed, no module named 'psycopg2'"

One of your merits listed is "Pure JavaScript developer experience". I don't think most devs, even JS devs would consider this a merit lol. Cool project either way.

I'm skeptical of formal verification mainly because it's akin to trying to predict the future with a sophisticated crystal ball. You can't formally guarantee hardware won't fail, or that solar radiation will flip a bit. What seems to have had much better ROI in terms of safety critical systems is switching to memory-safe languages that rely less on runtime promises and more on compiler guarantees.

Most, if not all the points made in the article, seem to stem from a sense of "we need to optimize the code to be readable by mathemeticians, not programmers" which is fair, depending on what you're doing. But goes a bit overboard with the safety argument, which we've seen much better ROI by focusing on memory safety, rather than abstract mathematical proofs.

In fact, the entire safety argument is undermined by the author themselves:

> The engine is closed source. You cannot see how fft or ode45 are implemented under the hood. For high-stakes engineering, not being able to audit your tools is a risk.

What's the point of optimizing your code to be easy for physicists/mathematicians to read for safety, when you can't even verify what the compiler will produce?

I suppose it basically boils down to whether your orgs engineering is run by academics or software engineers, but Matlab doesn't really do anything that python can't for free. And python is more accessible, has more use cases, and strong academic support already.

Elmo already cancelled out any progress made by buying a social media platform and getting the most anti-science anti-NASA admin in history elected. He's done a net negative on the world at this point, even if the scale is vastly larger than most people.

I'm not really interested in the problems that can come with orbital compute. We've seen them listed ad nauseam.

Have we seen any benefits to orbital computing by launching a cluster of raspberry pis to LEO? Surely this isn't an impossible task to test out on a smaller scale?

I'm in favor of banning all social media for under 18s.

I'm heavily against any form of mandatory form of identification for using non-government online-services.

Is it even possible to do the former without doing the later?

The amount of people who think because something has a few useful edge cases being incompatible with a bubble is staggeringly high. Dot com was a bubble, and yet we still use the internet widely today. Real-estate was a bubble, and people still need a place to live and work.

Just because YOU find the technology helpful, useful, or even beneficial for some use cases does NOT mean it has been overvalued. This has been the case for every single bubble, including the Dutch Tulip mania.

> Healthcare has to be rationed.

In a society that values McDonald's staying cheap and Coca-Cola superbowl ads, maybe this is true, but it's not a universal rule at all. On the other end of the spectrum from kidney transplants are regular checkups and ability to walk into any doctor's office to get your flu/cold checked out. Rationing healthcare at these stages is only going to make it worse as people wait until they need an emergency room visit to get care.

UBI isn't about making financial sense it's about keeping the last traces of society duct taped together before it all collapses. Remove all pathways to a middle-class life and you're left with a populace on the precipice of violent revolts.

This is a highly recycled talking point that only applies to people lucky enough to live in the vicinity of Standford, UCLA, Mass Gen, Cleveland Clinic, or Johns Hopkins AND afford a visit and is extremely dismissive of the millions of other Americans who can't. Rural hospitals have been shuttered and some people have even been turned away at emergency rooms now. This claim simply does not match up to reality, no matter how many graphs you put together.