nemothekid

I think the point is it is hard to claim that this exploit is the "end of the world", if it is trivially defeated by the default setup. Almost every deployment of php is going to be fronted by apache or nginx, and the default client_max_body_size for nginx is 1m.

Maybe I'm finally old, but I don't see how it's surprising that Raleway is at all successful. Heroku built the same business ~15 years ago and had plenty of "enterprise" clients. I don't really understand if there's that much more value in Raleway vs Vercel, and Vercel claims to have OpenAI and Meta as clients.

For me, what was strange is there were no write-ups on how the vulnerability actually worked. It really does feel like a lot of people went "Claude found a bug, and Claude says it's dangerous" but no one actually verified how exploitable it actually is? Not to say its worth ignoring, but compared to Heartbleed (where exploits had to be written by hand) there are a lot fewer active PoCs.

If you cannot make the effort to communicate to me about your project, I don't know why I should bother reading it.

Frameworks in the past didn't always have custom designed web pages, but at least one could understand if the author spent time actually building documentation.

If Claude is writing all the documentation, that has freed up "resource constraints" that you can use to actually make sure your site is legible. If you can't pass that bar, I don't know why anyone should seriously consider your framework - just like if someone had created a framework without documentation in the pre-ai days.

I think my new tell for low effort sites is if they default to the standard Claude Design language. This site has all of it

* Unnecessary badges

* text-uppercase section headers

* Randomly italicized words

Man I recently executed a migration from Aurora to Planetscale. I seriously considered PingCap but decided against it because I thought they cloud pricing was too complex. I wonder if my personal information is in the leak.

I haven't checked in a while, but I believe nginx does not support http/2 with proxy_pass.

>What would I gain from using a passkey?

The number one gain I see with passkeys is that they are phishing resistant. The biggest issue I've had with TOTP keys is they aren't phishing resistant.

Forcing people to use passkeys gives the authentication layer a stronger means to ensure that people are logging into the correct domain. A password manager accomplishes this, but it's very difficult to enforce. (I've heard a number of variants of "John Smith sent me an important document and when I went to open it, the password manager didn't work so I just copied password")

Instead of a database, the LLM will expose an api endpoint and build a database on demand?

That's interesting. Maybe to decrease latency the LLM could "cache" it's build of it's database and reuse in between instances. It could host this artifact on a "hub" of git trees and then any new use cases that come up, can be added to this git tree. Then it can possibly be reused in different use cases.

There are plenty of businesses with customers that don’t sell products. The PMF distinction is useful because many startups are actually specialized consultants/agencies, not products.

There are plenty of companies (successful ones) that I’d argue don’t have PMF, but have plenty of customers (ex Palantir)

>If software developers want their users to manage their own ordering schemes or use customization features, make it easy and convenient to do

This is akin to telling parents that if they want to their children to clean their rooms, you should make it easy and convenient to do. Obviously this is non-sensical: if you make a mess it might be hard and inconvenient work. Thats why kids don't do it!

I find some tech criticisms to be simply inane; the tech companies are not going to absorb the costs of educating users or fixing unworkable strategies. Not because Bezos needs to buy another yacht, but because the companies that try to do that all die before they get big. There is a giant graveyard of startups who have tried to be the "responsible and patient parent", and they have all died. Users don't want to put up with it, and if given the option will run to the company that just handles everything for them with a subscription fee or reselling their data.

If Jev can maintain its cost and speed with multi-modal input I think it will be well worth the hype.