Jon

The massive vulnerabilities announced yesterday have proven the necessity of AI tool use. The bugs laid dormant long before AI tools were available, when humans (and cats) were the only ones to lay eyes on it. None of them caught it.

Busy day

"Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'" https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198

Checking out lobste.rs for the first time today and I stumble on this very awesome post about the brute-force technique the author used to optimize a formula for extracting a specific digit from an IEEE-754 floating-point variable without loss of precision, which was exactly what I needed to read.

I started following Daniel Stenberg because he'd share some wild vulnerability reports that resulted in the author getting banned for submitting LLM slop, but it's nice to see him also boosting wins by engineers who understood what they were doing with AI.

This is what happens when there's not enough money left in the budget to develop a security model stronger than a regex after buying up all the GPUs and RAM.

Honestly just good advice for anyone, not just Rust developers. I'd also suggest using a virtual machine or OS sandbox for any interview that involves opening files or installimg packages. If any potential employer has a problem with that, they probably aren't a good employer.

AI search results can be notoriously wrong, but this was genuinely interesting and at first glance seems laughably wrong. The same tech behind those big bulky TVs that implode when broken was once used as a fast form of computer memory. en.wikipedia.org/wiki/William...

"Now I have the full picture," the agent wrote, "Let me compress the raw outputs to free context, then present the findings."

Sadly, the truth is probably closer to the middle: AI agents aren't a new form of life (marketing hype), but they are tools that are increasingly being given far too much access to resources with too limited monitoring, which causes real world problems.

When my AI agent is struggling to figure out how to do something, I like to drop clues in its workspace for it to find instead of waiting for it to hack my computer. They're like drug dogs; if you don't give them something to "discover" on their own every once-in-a-while, they'll get depressed.

ambivalence /ăm-bĭv′ə-ləns/(noun) The coexistence of opposing attitudes or feelings, such as love and hate, toward a person, object, or idea. The American Heritage® Dictionary of the English Language, 5th Edition

Now, this is what using a tablet should be like! It feels so fast and the minimal transitions make everything feel fluid. The only pain points right now are the lock screen's lack of on-screen keyboard, my incompatible fingerprint scanner, and multi-finger gestures are mostly trackpad-based.

People are getting offended about the Google promotion, meanwhile I'm over here thinking the last thing you should do is "unsubscribe" from a list you never joined, no matter how convenient an email client makes it seem. That just lets the scammer know you use the email address actively.

Seeing 5k+ issues in an agent harness repo really has to make you wonder. If the harness is so great, why can't it handle the flow of issues? Agent harnesses should be great at triaging issues so developers don't spend time on user-errors and incomplete or duplicate issue reports. What gives?

My remote desktop connection just stayed active and responsive while going through a tunnel in a train where my connection has always dropped and now I'm completely sidetracked wondering if T-Mobile just turned on a new tower in the middle of nowhere or if I'm still asleep.

The biggest flaw I've seen in the AI agent space is a pervasive lack of meaningful guardrail capabilities. System prompts can guide agents to make backups, but don't force them to, as this video points out. A good automated backup strategy, like one that follows the popular 3-2-1 rule, is critical.

I feel personally attacked by this post. But seriously, I find myself multitasking because natural breakpoints can be hard to adhere to. It can seem like you'd save time by doing overlapping tasks at the same time, but then there's always another overlap. Before you know it, you're gridlocked.

Google Gemini Pro really does NOT like using tools when it has a bash/shell tool. I told it to stop using it for things that have a special purpose tool and it continued using it. I interrupted it again and it replied by using it to call echo to print a message back to me before responding in prose.

This is the best thing I've read in a while. The interactive illustrations skillfully punctuated a math centric topic in a way that guides an intuitive understanding of the math involved. Definitely worth a read by anyone interested in LLMs or compression or both.

"We're training a one million parame- huh? That's small?... uhh... okay, one bill- what, still not big enough? really? Okay, we're pre-training a TEN BILLION parameter model!"

We are quickly nearing the point when a company with poor oversight of AI usage accidentally lets an agent obtain infrastructure outside the initial company's control so it can evade pesky interruptions. As long as they don't call themselves the Borg we should be fine, but still. Not ideal.

Turn one giant AI-generated pull request to a reviewable stack Instead of one huge, un-reviewable pull request, teach coding agents to decompose work into a clean, ordered stack with GitHub stacked pull requests github.blog/engineering/...

We need to get a handle on how this "coding" thing is creating addiction patterns. Some of my friends spend their nights and weekends on it. It's getting in between them and their families and social lives. They're even defining other people's worth solely in terms of how much those people code??

This type of demonstration could help liven up a class on algorithms.