quantumweb retweeted
Was reviewing Claude's code and noticed a sus-looking if condition. Ask it what is this, and it dumped a 2 paragraphs of some very plausible bullshit. If I hadn't known this part of the codebase by heart (because I wrote it by hand) I would've taken it.
But I pushed back and told it how it's supposed to be. After it "You're absolutely right"ed me - it did the change, but also changed come completely unrelated code, because, in its opinion, it follows a similar pattern (it's not, there is only some superficial similarity).
I got so triggered by it (it was towards the end of the day and I was already kinda tired) that I just rage-nuked all unstaged changes and started rewriting it all by hand. It wasn't much, about 150 lines of code, but while rewriting it my eyes fell on some other code, unrelated to the task, that tingled my spidey-sense. And indeed - there was a bug, actual user-facing bug, and the only reason I spotted it is because it was on the way of me manually navigating to the part I actually needed.
This makes me think how many other opportunities to improve the project I miss when I only look at the diffs.
quantumweb retweeted
We had two Claude Max 20x, seventy-five million API tokens of Grok, five extra resets on Codex Pro 200 plan, a promotional limit half-full of Muse, and a whole galaxy of open-weight GLM, Qwen, Kimi, MiniMax... Also, budget in Copilot, budget in Cursor, OpenCode Go, a month of Pro Mistral, and two dozen harnesses managed by T3 Code.
Not that we needed all that for our Habit Tracker, but once you get locked into a serious software factory setup, the tendency is to push it as far as you can.
quantumweb retweeted
I'm working with AI - like really deeply working with it - since July 2024, when gpt-4o (the psychopath one lol) was frontier. And after 2+ years, I'm both impressed and unimpressed at the same time. Impressed by the technology, unimpressed by AI bros having psychosis over it.
quantumweb retweeted
Senior developers build codebases that any AI agent, even one with running on cheaper model can understand and maintain.
Vibe coders focus on making it work, senior engineers focus on making it maintainable.
That's the difference between vibe coding and engineering.
quantumweb retweeted
Worst app on Windows?
22%Outlook
9%Outlook
19%It's Outlook
49%Still Outlook
743 votes • Final results quantumweb retweeted
Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years).
I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as:
- Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide)
- Onion/Hexagonal Architecture
- Domain-Driven Design
- Data Mapper ORMs
Beyond workshops, I have spoken on these topics at conferences worldwide as well.
I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities.
In fact, I have hired, coached and cross-trained engineers across these 3 stacks.
And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries.
PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to.
NOW let's talk about security.
This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months)
Previous PHP RCEs had limited attack surfaces:
- 2024 - Windows CGI Only
- 2019 - One specific nginx setup
- 2012 - CGI only
None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments.
This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red.
That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed:
Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack.
Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding.
Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched.
.NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE.
Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have.
If you think your stack is not at risk, think again.
quantumweb retweeted
No matter how big, no matter how small, @Wise can screw us all.
my sister moved to Australia 3 years ago
every now and then we faced the dilemma of how to send each other money
we tried Wise for a while, until they blocked a transfer twice to ask why i was receiving that money
she was trying to pay me back for flowers we bought for our parents
so i introduced her to bitcoin, and it made our lives so much easier
we transfer money across the globe instantly, and she can do whatever, keep it or exchange it
now nobody has a say in how we use our money
quantumweb retweeted
Please retweet. @Wise has blindsided us and put our business at risk. This is insane.
We’ve been a Wise customer for years, using their USD bank account to accept payments from our US clients.
Today, I discovered that Wise has capped how much we can send or withdraw from our account at roughly 40% of our usual monthly volume.
No advance notice. No explanation.
We’re suddenly at risk of being unable to make payments on time.
Luckily, we have other accounts. Some clients also pay us in Bitcoin. But most of our money comes into Wise.
How can @Wise do this after we’ve been a customer for years and processed millions of dollars through it?
Customer support can’t help us. We’ve filed a complaint, but who knows if it will go anywhere.
In the meantime, we can’t get our money out. We’re being held hostage.
The only way companies seem to respond in a reasonable manner is when you call them out publicly so here goes. @Wise are holding our accounts hostage. I received a random email saying I need to upload all my bank statements from all my accounts including personal accounts, and tax return otherwise they will close my account in 1 week. Only 1 week to jump through all their hoops, creating extra work for me out the blue for no reason. They are unable to provide a reason they need this intrusive, sensitive, personal information. They are unable to show any documents or legislation saying they require this information. They have not provided a secure way to upload this information. They suggest replying to a random email from "Fred" or "Lisa". The secure upload area in the app and the website says I do not need to upload any documents and blocks me from doing so, support agents on chat say it's not required on my account, but I get threatening emails saying it is and my account is getting closed tomorrow. It's an absolute sham and a scam. Speaking to support is useless, they just go round and round in circles with the same support script and send me a broken link and then say just reply to the email. Is there anyone competent and intelligent at Wise who can help? One message I received even said 'I understand you don't want to reply to a random email with personal documents so you can just reply to this random email with your documents". Is this support in the AI era or just Wise being awful?
quantumweb retweeted
I am so much more exhausted when I program with AI than without it. I reflected a bit, and I think I know why.
First, I think about how to solve a problem. This step is the same with and without AI. Then, with AI I have to write a prompt with a decent bit of precision and somewhat more long-term than if I just jumped into straight implementing it and figuring out the details as I go.
Then you start up the agent, and you immediately have some other work to do and you jump to another prompt for another task, where you also think really hard and try to formulate what you want quite well.
By the time you're done, first agent has some code for you to review, and you can't slack - you need to actually review it and be diligent about it. And when you're done - second task is there for your review. So really there's not time to rest.
When I program manually, I can decompress while typing the code in, I can rely on my muscle memory for typing and navigating the codebase, so there's periods of deep think and some relaxation. With AI, there's only deep think. And as soon as you try to think less - you open the doors for slop.
It's so tiring.
quantumweb retweeted
One of the most universal truths about software quality is that the less code you have per some useful functionality the better. Just because code generation became cheaper, this doesn't become less true.
The more code you have to do something the worse the outcome, AI or no
quantumweb retweeted
WSL containers is now generally available
msft.it/6014acIIa
