Building power tools for knowledge workers.
Australia
Joined April 2013
- Tweets3.4K
- Following2.1K
- Followers2.7K
- Likes4.3K
announcer on this brisbane train now spruiking industrial action updates, that was weird
"we have restored 91% of services across brisbane"
"the next station is southbank"
Craig B. retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
one researcher. 3.5 months. agents wrote 99% of the code for a frontier-scale pretrain.
Today, we're sharing a major milestone in our mission to democratize frontier AI development:
Pretraining at scale without a pretraining team.
We set out to answer an ambitious question: Can we significantly reduce the time, human expertise, and compute needed to pretrain a competitive foundation model from scratch?
The result is Mirendil-Base, our first pretrained coding model, built by one researcher in just 3.5 months with less than $10M in compute, including all research, experimentation, and the final training run.
Our approach is already showing promising results as we scale to even larger models.
This is an important step toward a future where a single researcher, empowered by AI, can accomplish what once required an entire research organization. As these capabilities improve, we believe frontier AI development can become accessible to far more people and teams.
More to come soon, including independent evaluations, post-training benchmarks, and API access.
cool but be real tho, can a software team in Australia use this right now or is it wait listed (like signin with chatgpt) ?
cool, but wonder if exclusive or it’s bringing it on par to Anthropic/xAi - how could you know?
As someone said the other day, software engineering is starting to feel like astrology
As it stands, Grok Bot is heavily biased towards computer-use on the remote computer but you CAN get it to control software on YOUR computer.
THE TRICK is to be explicit in the prompt.
I use it for cases where I am not super comfortable with using a remote grokbot-owner computer such as banking app use.
But I get the vibe like maybe they are trying really hard to not have users use it like THIS because perhaps remote is a better UX or some other leverage.
not sure if this is an even spicer take but I would say just eliminate merge , it’s not a non-negotiable
re-arch from the ground up to dynamic stitch objects
and/or
delete all god objects in your existing codebase
there is actually a remedy to CI cost blowout, and you can attain it fairly easily without doing anything drastic like migrating off GitHub. it’s this:
- don’t use GitHub actions for anything other than actions that would require a distributed mutex. this essentially limits CI to just the deploys and data migrations
- for everything else , have the agents run the builds and publish from whatever machine it’s coding on
but what about audit of build success on the commits , you ask ?
- add a lightweight skill that instructs the agents to do a github signoff[1]
- it’s easy to build your own signoff (it’s just an API call piggy backing off the logged in GitHub user to “gh”) or you can use @dhh’s github.com/basecamp/gh-signo…
[1] signoff is one or more verification tick on the commit in github. you can add this without needing actions to run the actual build, it’s just an API call
We are either going to need more compute, or better CI.
AI driven dev means more code/tests and more frequent changes trying to merge and deploy to production.
E.g. 10× the changes × 5× the test suite cost = 50× the compute (and higher peak compute demand due to parallelism).
And that's before you rebase a few times to keep up with the fast moving trunk, then battle a merge queue due to flaky tests.
There are a few things everyone should be doing. First off, you make your test suites leaner and faster. High signal units, massive parallelism, thoughtful end-to-ends.
What needs to come next is compute reduction. You should only run the tests that relate to the change you are testing. The next step is getting even smarter. Models can be used to predict which subset of the related tests are most predictive of failure which lets you get to the failure fast and avoid unneeded subsequent test runs.
calling it. this is the best cross-agent multiplexer
do your self a favour and start coding w/ it now
New Herdr UI is out!
• Multiple GitHub accounts
• Drag to reorder devices
• Better tab tear-off
• Cmd-click links + clickable dropped files
• Optional network latency/loss indicator
github.com/penso/herdr-gpui/…
install herdr first (or upgrade it) and then install the desktop from herdrui.dev
as an existing herdr user it took me about a week to get all my workloads over to it, because it requires herdr daemon to be upgraded, but wow, i don't think i'll be looking back to any other setup now that all my remote and local sessions can be monitored in one place
my agent now selects the appropriate coding agent to use based on credit abundance or scarcity...
and i use a colour codes mechanism to make it easy to understand it at a glance, here is how it works:
“there are still things a coding agent isn’t better at than me.”
you’re a conscious piece of the universe. you can feel music in your bones, fall hopelessly in love, hold someone as they take their last breath, and stare at the stars in wonder that you exist at all.
and your big flex is that a coding agent still has limitations?
thread makes a fair point. the autonomous business is a non-starter if everything stops for the week when a weekly limit is hit.
but, those who find ways to continue amidst the early constraints get a massive head start
if a secret gets leaked that should never have needed to be a secret in the first place, who’s fault is it really?
FINALLY found how my key got leaked and got the $90,000 bill from google
Opus 5.5 said codex had PUBLISHED MY ****ING .ENV TO CLOUDFALRE PAGES ‼️
Meanwhile codex couldn't find anything, refused to explain itself and flagged my chat for cybersecurity risk lol
Craig B. retweeted
FINALLY found how my key got leaked and got the $90,000 bill from google
Opus 5.5 said codex had PUBLISHED MY ****ING .ENV TO CLOUDFALRE PAGES ‼️
Meanwhile codex couldn't find anything, refused to explain itself and flagged my chat for cybersecurity risk lol
anthropic’s write up and my post from yesterday seem to land on a similar conclusion.
if your coding agents get sent on crusades because your review agents aren’t on point, you’re going to burn tokens for zero or negative value.
keep your review agents sharp and focused! and don’t rely on them for protecting against things that could be stopped earlier - ie through agent-friendly arch, and hook-based deterministic rule checks
Claude writes about 90% of Claude Code's code.
From June to September, merged PRs more than doubled while the share reverted fell by more than 40%.
We wrote about how we changed code review to get there, and how to adopt it:
claude.dev/blog/solving-code…
