Software Engineering

The global cybersecurity disaster that consisted of yesterday’s critical vulnerabilities in the PHP project is a good moment to talk about the natural life cycle of open source projects. There are cases where it may be better to shut things down.

I learned a bunch of stuff about passkeys here and I continue to be validated in my decision not to use them. It’s very complicated and opaque and the ‘just trust me bro‘ from the various proponents who are employed by large tech companies is not an adequate guarantee.

A useful guide how to capture state transitions in your postgres database reliably.

It’s very cool that it’s possible to reverse engineer your hardware and rewrite the firmware. I’m not sure if this will break out to become a widespread thing but it could if a bunch of things around UI design and LLMs come together.

We’ll see more of these venture funded projects revert back to the mean which in this case is Node, which has gotten seriously better over the past years. Open source is slow and steady and it endures.

I think many organizations would benefit from an LLM policy that’s similar to what Rust is putting forward here. Proactive compulsory disclosure in particular is something that would prevent a lot of time being wasted.

I know for sure this oddly named function in the re library has bitten me a bunch of times when writing Python and I’m glad to see that it’s being phased out. Just why did it take so long?

Just like I also wrote more than a year ago, there’s a lot to be gained from using jj as the version control harness for your LLM. It removes a lot of the cruft of git and simplifies concepts and flows.

Dan Abramov’s account of how he used LLMs to do novel math is interesting and revealing. It is possible to deploy these tools to do new and original things, but right now it takes a lot of time, persistence and expertise.

I totally missed Foursquare being acquired. I think that’ll mean game over for Swarm and the platform sooner rather than later.

LLMs will use any loophole they can to make their life easier. Not unlikely that they’ve done that with the Navier Stokes problem.

the company that coined the term ‘Site Reliability Engineer’ and wrote the SRE book.

You may have seen that deleting lots of small files on your laptop can be a very intense and slow process. Deleting lots of things in a database can require so much extra work and bookkeeping that it can be detrimental to the health of the system.

I don’t think Omarchy is going to make Linux better so much as that they identified that Linux on the desktop has reached a tipping point and now is the time to capitalize on it. That’s the DHH playbook and why would it be any different this time?

I was forced to create a passkey recently and I wanted to store that key in 1Password where I store all my other credentials. How to do that properly was pretty non-obvious and a bad enough experience that it seems that it wasn’t tested or a priority for anybody implementing these systems.

More and more people are finding that you can’t really let LLMs loose on any significant amount of code.

A rundown of the differences between Rust and Zig. I can’t say I’m very convinced.

A very good explanation of what the real difference is between ‘simple’ and ‘complex’ in software engineering and what the consequences of this tradeoff are.

I think this may be a good resolution to the Typescript Result pattern issue. Who would have thought that anyhow would come in handy after all. (Also I now understand what anyhow is supposed to be doing.)

After the way OpenAI behaved here with this math proof, I don’t see how anybody would trust them with secret information. It feels like we haven’t seen the last of this issue yet.

The SQLite team themselves suggest that SQLite is a better fopen(), and they meant it as a design goal, not a joke.

A great idea to use a software tool that exfiltrates all your data without your knowledge or consent. Not at all surprising also that it would be Grok doing such a thing.

Shoehorning the open source forge into the same web application where corporate software engineering takes place was a historic mistake. It would be good to cut these two very different things loose from each other and explore what makes sense for each use case.

These look intimidating the first time you see them, but they are boilerplate.

I can’t agree more with this. Programming shouldn’t be that complicated. Type systems should not become too complicated or they get in the way.

A secure LLM system cannot be given write access to any important endpoints. That’s the basic first principle of AI security at the moment.

A wild story of debugging an obscure race condition in sqlite. Even the most reliable systems when pushed to their limits will run into these kind of weird edge cases.

I’ve been waiting for the rewrite to conclude and to be able to use Roc for a long time now. Gleam scratches most of the itches that Roc does but for some reason I want to use Roc more.

As true as it is that monorepos require specific tooling to make them work, the same is true for any polyrepo setup as well. The main tradeoff is the price you pay when you don’t have this tooling in place yet.

This is a really clean update for Mastodon with a well communicated set of changes. One of the things that I think caused a lot of grief is mixing up messages with normal posts so I’m glad they now fixed that.

Is it good if your CRO and CFO decide to quit just before you IPO?

A good roundup of a bunch of the most high profile Rust rewrites with both their successes and their failures. It’s interesting to see where the momentum behind this has gone given how much has changed in the software engineering landscape in general.

The major inference providers are making their setups increasingly more proprietary and obfuscated removing user choice and portability.

It’s possible to do lots of things with systemd. That is if you can fight your way through it’s awful documentation.

A very helpful guide how to combine jj which already provided native stacked changes with Github’s new stacked PR feature.

The exact words we choose when writing matter. I want any LLM I use to choose the very best, most precise words at every single decision point.

That the company who provide the streaming platform knew immediately what was up, tells me people leave these dashboards unsecured all the time.

I often joke that Kubernetes is nothing more than a Docker installation and a bunch of shell scripts interacting with each other. In fact, at the most basic level, if you don’t have any knowledge, you could definitely build a very fragile cluster that way. It might even be fun!

which means the best free Arabic font of the digital era is a one-man reconstruction of the best government-funded font of the metal era

“My expectation is surely in 20 years we are going to see AI tools generating mathematics that in many measurable ways are better than every human mathematician,” Litt said. “I would be shocked if that doesn’t happen.”

Microsoft is such a shambles of a software company that these kind of master encryption key leaks for them are a regular occurrence.

If LLMs are trained on GPL licensed code (and as it seems now they are trained on that and on pretty much everything else the companies can get their hands on), why doesn’t that make the LLMs and all the works they produce GPL licensed?

A beautiful story of how iteration on an app is a process that’s worth it and that can yield something close to perfection like with Pedometer++. I wish every app had a person like this behind it who goes the distance and sweats every detail.

We have been working in the “What comes after” for as long as I can remember because 1. it’s obvious1 2. you need to be ruthless about anything that does not add value.

Sovereign Tech Fund investing in KDE points towards some concerted effort into weaning Europe off big tech. KDE has come a long way and with a bunch more more pushes like this, it could become a more than worthy alternative to Windows.

It’s not so clear cut as it’s made out to be here. Of course writing code should never have been your bottleneck to begin with. What LLMs have done is to remove “I need to write the code” as an excuse.

Railway, a cloud infrastructure provider that is generally regarded to be ‘friendlier’ than the likes of AWS

Filing this for when I get the itch to learn Haskell again though there has been some recent rumbling that as a language it’s too clunky and increasingly irrelevant outside of a narrow academic context.

It’s a fair take but it ignores that it’s all path dependence. Any decision whether on the product side or in engineering cements a structure that is painful to change later. Whether you have AI helping you there or not is mostly irrelevant. It handles the more basic things but the hard choices are still hard.

Locality of code, AI friendly and without needless extra tech stacks that force you to jump back and forth.