@ApacheArrow / Databases / Compilers. (past @SDFLabs, VoDa, @Spotify). Rust/C++/TLA⁺🇧🇷 → 🇸🇪 → 🌎
Joined June 2008
- Tweets29.5K
- Following2.6K
- Followers5.8K
- Likes42.4K
You know what’s really messed up? We didn’t really need AI to know that handling web requests with PHP is an endless source of security issues. We should have a mechanism to quickly revoke certs and secrets when they are guessed correctly (e.g. 4) or leaked. And yet, here we are.
ALT “I don’t quite know how to put this, but our entire field is bad at what we do, and if you rely on us, everyone will die.”
PHP can't be stopped
1995: PHP is dead, learn ColdFusion
2002: PHP is dead, learn ASP.net
2003: PHP is dead, learn Django
2004: PHP is dead, learn Ruby on Rails
2010: PHP is dead, learn Flask
2011: PHP is dead, learn AngularJS
2016: PHP is dead, learn Next.js
2022: PHP is dead, learn Solidity
2026: The NSA is advising that you turn off PHP
You wouldn’t see me picking an algorithm that uses a non-power-of-2 key size.
384 bits in a key? Clownish. Get a grip on reality! Use AES-256-GCM or Chacha20-Poly1305.
If you’re legit, you should have nothing to hide! 🫣/s
Me generating a private key for a side-project I will never launch vs.
a leading provider of digital signature solutions trusted by millions.
ALT triple checking to make sure a CSPRNG is used
ALT getRandomNumer: return 4
I’m finding not knowing about how hard a problem is to be a blessing more than a curse these days. Knowing how hard some things are and seeing agents make mistakes all the time is wearing me out.
Vibe coding a service that handles sandboxes for a harness. Sandboxes can’t download anything from the web.
Felipe O. Carvalho retweeted
ok I think the main thing we've learned this month is that computer programs get faster whenever they're ported to another programming language, and all we need to do is keep porting back and forth until every program only needs one CPU cycle to finish
Long post. I haven't read it in full, but the description of "decoherence" gives a ton to think about.
maevyn.codes/decoherence
Fighting illegal gold-digging and deforestation at Amazon scale is not easy. An administration that keeps funding environmental policing bodies like IBAMA should continue its work.
Brazil registered the lowest Amazon deforestation rate on record over the past year, allowing President Luiz Inácio Lula da Silva to claim success on a key issue that’s been at the center of his platform bloomberg.com/news/articles/…
Brazil has 3% of the world’s population but had 15% of the C0VID deaths because of Bolsonar0’s disdain with the people of Brazil.
#ElesPodiamEstarVivos
Seeing the reasons Anders gave, for choosing Go instead of Rust in the tsc "rewrite" and their porting approach, convinced me Go was a better choice.
Anders Hejlsberg (creator of TypeScript and C#, @ahejlsberg) on two reasons they used Go, not Rust:
Me: If you think about Rust, what didn't it have that, if it had it, you would have picked it?
Anders: I think there are two things. It doesn't have garbage collection. It's done manually, or it's done through the borrow checker. But the borrow checker doesn't allow circular data structures, and our compiler is chock-full of circular data structures.
We have trees with parent pointers. We have types that are recursive. We have symbols that refer. It's everywhere.
And like I said, if we had chosen to rewrite, we could have probably solved all of that. But it wouldn't have been just porting the code. It would also have been solving a whole bunch of new problems that we had bought ourselves by going that route. We tried, and it just wasn't feasible.
So we were just trying to optimize for doing as little work as possible to get us to the payout. And honestly, Rust is no better when it comes to the quality of the generated code or the concurrency gains that we could have gotten out of it.
Go is just great. We got all the bennies for less work by going that route.
If building tools and frameworks is so easy (it is) what is the point of building tools for other software engineers instead of doing end-user products already? What kind of tools survive?
The marginal value per employee that Accenture estimates must be pretty low.
New: Accenture has told employees it will only fund $29 per month of Claude use. Meaning that employees who often spend as much as $1,000 a month are now scrambling to find ways to keep access to the tool. A sign of the continuing crack down of AI 404media.co/accenture-tells-…
I like this Better-is-Better and Worse-is-Better conceptualization.
(re-conceptualization in the case of WiB)
ALT LLMs just reinforce people's original view on types and static analysis: 1. types are great because they can ensure basic sanity of code generated by agents 2. LLMs can ensure correctness better than types because they can write all the necessary tests
There seem to be two groups:
1. Better-is-better group believes that agents finally make the better-is-better solutions happen. Formal methods, static types, Nix, ...
2. Worse-is-better group believes agents will make worse-is-better solution happen because with agents they're no longer worse. Dynamic type systems, bash scripts over neat DSLs, agents running tests dynamically, ...
Quite funny to see
