max_k

Quite possible. Ours were good, they just didn't benefit from LLM superpowers back then.

After my Mythos experience, I was wondering if there is really still a market for human code audits. I guess yes, but the work will be different, just like coding (and marketing and so on...) is different now. You still need to have an expert to wield the new powerful tools.

That part was not 100% serious. Only 90% or so.

To err is human, I know that as much as anybody. Before the advent of LLMs, there were several (human) audits of my code for vulnerabilities, but they found little, which I was proud of. And now, Mythos had a quick look and found hundreds and hundreds of bugs (many of which were critical and even more were really emberassing).

Of course, I knew there were bugs that just weren't found because the auditors weren't looking closely enough, didn't have enough time/budget etc., but this unspecific feeling is different from having all the bugs accumulated over a quarter century slapped in your face at once.

No, the Mythos reports do not come with POCs. It's a lot of redundant prose explaining the bug it found (much more than I'm willing to read), it explains how it can be triggered, but doesn't generate actual exploit code.

But that doesn't matter for me. It shows me real bugs and less than 1% false positives. Some bugs are truly nasty and urgent, most are trivial and not exploitable at all, but they're bugs and so I'm fixing them.

Mythos isn't mythically superb for being the best LLM model, but only for not having these annoying guard rails that make all others randomly refuse to cooperate when you need them the most. Whoever invented guard rails - please stop! - they just slow the good guys down in the race.

Same here. I got access to Mythos two months ago, it confronted me with decades of nasty bugs I wrote. This has been stressing me out a lot, caused sleep deprivation (the bugs follow me in my sleep, yes, really). All other progress is halted, I've been squashing bugs day and night. I see a light at the end of the tunnel.

Bottom line: it's a good thing. My software will be better after that. Even if it's currently not good for my ego (and my health). But I'm glad for all the tools that help me improve quality.

And sure, I can just ask LLMs to fix the bugs, which works well half of the time, and produces bad slop in the other half. This is where human expertise and judgement is still necessary to avoid letting our code bases drift into LLM spaghetti hell.

Difficult compared to what?

Mutating a std::vector is much more difficult because you need a coarse lock and serialize every access with it - there's no other option. Linked lists, on the other hand, can be made thread-safe with a single coarse lock, or many finer-grained locks, or atomics, or fancier tricks like RCU.

All of that is difficult, sure, but what is less difficult than thread-safe linked lists?

Every day, all day. It is a myth that linked lists fell out of fashion.

Of course, "it depends". There are things that better live in tightly-packed arrays (large lists of free-standing objects), but there are things that are almost impossible without linked lists. In these cases, being "intrusive" has massive advantages.

I guess you can spend an entire coder career without having to use linked lists, and then you cannot imagine why anybody would ever use them (and make it a meme). The linked lists that do exist in your programs may be abstracted away from your visibility.

Therefore: sure, an article about linked lists will spawn numerous HN comments from such coders who don't know the shoulders they're standing on. It's linked lists all the way down... below the flat surface of high-level frameworks.

Funny idea, refreshingly simple HTML design - but why does it require JavaScript? Blank page with nojs.

Thanks, but I feel we're all just feeding this one troll. Don't bother replying anymore, it's pointless.

> imply that HTTP and FastCGI are interchangeable and they are not.

But they are interchangeable!

FastCGI and HTTP/1.1 are indeed on the same level. Both are transport protocols for HTTP requests.

It would be technically possible to implement FastCGI as alternate transport protocols in browsers and web servers, just like HTTP/2 (SPDY) and HTTP/3 (QUIC) are alternate transport protocols for HTTP requests.

(This is not what the article and my comment are about, as others already pointed out.)

FastCGI has "parameters" and HTTP headers are special parameters starting with "HTTP_" (mimicking CGI's environment variables). All parameters not starting with "HTTP_" can be trusted because only the web server (= FastCGI client) can construct them.

Oh, there's another stgit user! ^5 Coming from darcs, I couldn't use git until stgit came along, and today, it's one of those few tools I can't imagine working without. Nothing else matches my way of code hacking. So often, I watch people making a big mess with git, and I always recommend stgit to them, so they can post proper and reviewable branches for merging. But in all these years, I could never convince anybody.

Yes, "it’s just the linter being noisy".

> Otherwise, the very first commit should be removing all the personally identifiable information and other telemetry sent back to Matt's personal website

This is one of the things I removed in our WordPress fork. I found it horrifying to learn that an open source software does such a user-hostile thing, and wondered why nobody but me objects.

Related: do only what is necessary. This works on so many levels and is my magic trick to make software faster.

It's a pity computers are so fast and have so much memory that people can get away with not caring about minimalism.