rspeele
Joined 13 years ago
Joined 13 years ago
* A bad actor finds a real, theoretically severe but not easy-to-actually-exploit vulnerability in some popular software. E.g. it's an exploit that can get you pwned 100% with RCE, but only if you are using it in configuration X on platform Y with kernel version Z on a Tuesday.
* They design a patch that closes that vulnerability but subtly opens a more dangerous one known only to them. They privately test their patch against LLM reviewers, tuning the approach until the introduced vulnerability typically escapes detection by automated review.
* They "responsibly disclose" the original exploit and helpfully share the patch. In the hurry to fix the original exploit, the patch itself gets only cursory (claudy, codexy) review. By now this has happened so many times that just applying whatever code changes ClodSed were GTG is the status quo.
* When the new vulnerability is eventually discovered, they can plausibly say "oh my agent didn't catch that", which is true. In the meantime, they use the new exploit that only they know about.
This particular project is so low effort I'm leaning towards it being parody.
See: https://rustoffrails.org/how-it-was-built
> Hey Claude, write a set of guidelines for how Claude should build Rust web apps. Like Ruby on Rails, you know, but in Rust. Claude doesn't automatically know how to do this so I'm counting on you, Claude, to teach it. Make sure it's opinionated. I don't care what the opinions are, but it's gotta have them.
Edit: oh my God, not only is the framework just markdown files, it has an MCP server for agents to read the markdown files. Ok, I'm convinced it's a parody.
Also: "No line of the framework was typed by hand."
So it's not even your wish list.
I could prompt Claude "write down best practices for building web apps in rust, then build <my idea> as a web app in rust following those practices." How would that differ?
I can't tell if this is a satire of "markdown engineering" or not. Poe's law in action.
Some parser combinator environments are better than others. Haskell's applicative style is pretty good:
(\x y z -> ...) <$> parser1 <*> parser2 <*> parser3
F#'s FParsec has pairwise operators `.>>`, `>>.`, and `.>>.` for capture-left-ignore-right, capture-right-ignore-left, and capture-both-and-tuple. These rapidly get unwieldy: parser1 .>>. parser2 .>>. parser3 |>> (fun ((x, y), z) -> ...) // ugly nested tuples!
So they have functions like `pipe3` instead: pipe3 parser1 parser2 parser3 (fun x y z -> ...)
Still, what a pain when you mix in some "ignored" parts in between the "captured" parts. Ugly and awkward to follow. pipe3 (whitespace >>. parser1) (char '(' >>. parser2 .>> char ')') (whitespace >>. parser3 .>> whitespace) (fun x y z -> ...)
I wrote a library some years ago to alleviate my issues with that F# flavor of this problem. My solution is very similar to yours in that it also asks the user to think of it as like regex "capture groups"!https://rspeele.github.io/FParsec-Pipes/Intro.html
My approach is more symbolic-operator flavored than yours though. In mine you always start a chain of parsers with `%%`, separate with `--` and end with `-|> function`.
%% parser1 -- parser2 -- parser3 -|> fun () -> ...
If you want to capture any part of the chain you use the unary prefix operator `+.` to mark it captured and it will get passed through to the consuming function. %% +.parser1 -- parser2 -- +.parser3 -|> fun p1 p3 -> ...
I used it extensively in a SQL parser:https://github.com/fsprojects/Rezoom.SQL/blob/master/src/Rez...
Shame on them for such weaknesses as:
* Desire to make memorable achievements in their field
* Missing the social elements of sharing and discussing problems with their colleagues
* Sense of self worth linked to ability to make a unique contribution to society
* Fear of losing status and income in a ruthlessly competitive economic system
* Anxiety over debts already accrued during years of studying
* Regret over choice of career path and roads not taken
Astra would never.
Mathematicians acquired their skills over long hours of study, but weren't asking to be paid just to sit around passively being smart, but to keep working on new results. It is the lost opportunity to do work they are lamenting, not the lost opportunity to sit on their laurels. So no, it doesn't sound like rent-seeking.
Oh yes, this new world is terrible for rent seekers. It's like the kum-bah-yah free software world Stallman might have imagined. Information wants to be free and all. Can't stop the signal. Very counterculture. Like the Adobe clone apps.
Except for the closed SOTA model weights, out of reach hardware, and the resulting $200 subscription rent now paid readily both by anybody trying to create something new, and anybody who wants to rip it off. That particular flavor of rent seeking is booming.
I myself am a "rent-seeker" in an alternative sense of "I seek a way to pay for my own continued shelter via my creative output" and it definitely seems like it's gonna suck for me.
With bitcoin nothing is reversible so every step of the process is a huge security risk where you can fall off a cliff and experience financial permadeath of "your" crypto, assuming a sufficiently motivated attacker.
* OpenSCAD -- cool idea, good for a few types of highly procedural parts, but most of the time I'd rather a parametric sketch-based interface over pure code.
* FreeCAD -- the most features of any open source CAD, but poor UI, tendency to crash, and the advanced features like loft kind of fall flat compared to commercial equivalents. You think you'll be able to model a part, but it becomes extremely frustrating if you actually need the advanced tools.
* SolveSpace -- pretty stable and reliable. Fast, compact, great sketching interface, good discoverable UI. You can predict what types of parts you can model with it and what types you can't. Doesn't try to do everything but is good at what it does.
You can tell which one is my favorite! N features done to a good level of polish and with somebody making sure it all "makes sense together" beats 10xN features all 80% done and haphazardly mashed together in different menus/workbenches, for any tools I want to rely on.
I am noodling around with a slopcoded CAD tool of my own these days, just out of curiosity to see how far Opus5.5/GPT6 can get doing it in F# and to experiment with some workflow concepts that match the way I like to design parts. But like you said, progress is slow. For stuff I actually want to get done, SolveSpace remains my go-to, and I greatly admire its coherent design.
[0] https://github.com/rspeele/infix.el
[1] https://github.com/rspeele/LicenseToCIL
[2] https://github.com/fsprojects/Rezoom.SQL
[3] https://rspeele.github.io/FParsec-Pipes/Intro.html
Yet, it's utterly hopeless to try to take the same stance visual artists are nobly holding. Of the programs I use daily, how many have I ever even glanced at the source code? I could count them on my fingers. And I'm in the target audience: a programmer, enthusiastic about the trade, one who has contributed to open source...
Conclusion: within a rounding error of NOBODY cares about the code. Of the weavers who were displaced by the automated looms, or the furniture-makers displaced by mass produced pressboard, some of the most skilled could still ply their trade for the rich who wanted to flex their bespoke handmade goods. Programmers writing code by hand will not even have that luxury market. It makes me depressed but I don't see any way around it.
My hope is that I can use my knowledge, willingness to spend long hours fighting with a computer, and industry experience to at least make better software with agents than the average vibecoder. I sadly don't think I'll get anywhere trying to play John Henry vs. the Steam Drill, trying to beat it with my hand-typed code. Maybe somebody who's 10x the dev I am can do that, and Godspeed to them, but I thought I was pretty decent and I don't have a chance.
Hell, it's not even possible to prove any code was written by hand, other than by having uploaded it pre-2024ish. For this reason I really feel bad for those coming up right now, who have the same enthusiasm and fascination for Real Programming that I did, but no way to prove themselves and no motivation to in a world that values that skill less all the time.
I also initially looked around the desk for a physical cartridge, such was the effectiveness of the rest of the “game”.
First job had me using a programming language I wasn't super familiar with and trying to add a feature to a codebase 100s of KLOC, all written by other people. Definitely a sink-or-swim moment. My skills of reading and navigating the dreaded Other People's Code were all honed over the next dozen years.
That being said AI is a lot better at reading code than I am, as demonstrated by its ability to find incredibly subtle bugs in huge codebases. So I'm not even sure those code reading skills are all that useful now. When I have to review somebody else's code I get more mileage from pointing an AI at it and asking targeted questions like "how does this handle when a Foo's approval is revoked" than reading it myself line-by-line. I'm not saying I never use those reading skills but the ability to get the big picture, chase down deep callback chains, know where to look... those skills are likely to atrophy.
It's like using GPS vs. knowing the roads as well as a cabbie. GPS gets you pretty damn far for zero effort.
Perl 6?