Exodus: The Helium Sea was quite the page turner. Can recommend for anyone looking for some science fiction to read with great world building.
(It's the second book of two, first one is Exodus: The Archimedes Engine)
Remote
Mathias Fußenegger
@mathias@social.fussenegger.pro
mastodon 4.7.3Trying to figure out a way to build software that doesn't suck
Biased towards Diversity, Equity and Inclusion
252 Followers
121 Following
34 Posts
Joined November 10, 2022
Blog:
Business:
Codeberg:
Github:
I'm pretty sure there's a lesson buried in the reactions to LLMs allegedly making it easier to find security vulnerabilities.
The talk is either centered around the use of LLMs themselves or about how maintainers can(n't) keep up with patching. Very little reflection on why software is full of holes in the first place.
Today I had to change ~100 function calls to use a different function in Python. The signature was complex enough that I didn't trust regex, so I picked up my old friend comby (https://comby.dev/) .
But it took a few attempts to get the pattern and replacement right, so I thought it would be neat to have interactive feedback directly in #neovim
Initial prototype:
Replying to
I also realized that my conception about its quality impact was short sighted. I was looking for PRs with subtle bugs, but that's not the main issue
What's more of an issue is if the review load goes up if more people contribute. The ratio change of review vs working on the codebase yourself degrades your mental model over time and makes it harder to keep cohesion up and ensure different components compose well.
At the same time, the contributors don't develop a good mental model if using LLMs
I'm currently making my way through The Expanse books - had only seen the show before. In one of the books there's a reference to the "Be Angry At The Sun" poem from Robinson Jeffers. In particular this part:
> Be angry at the sun for setting
> If these things anger you.
And it's been on my mind a lot. Still not sure what to make of it
I'm glad to learn that I'm not the only one who isn't happy with conventional commits
https://sumnerevans.com/posts/software-engineering/stop-using-conventional-commits/
This article currently makes the rounds:
https://ergosphere.blog/posts/the-machines-are-fine/
One part that puzzles me a bit is this:
> Schwartz can use Claude to write a paper because Schwartz already knows the physics. His decades of experience are the immune system that catches Claude's hallucinations
Maybe I'm far away from mastery but I still frequently discover that I don't understand something I thought I did.
The notion that you can stop practicing because you've mastered something strikes me as dangerous
I had no idea the situation with Smart TV Apps is that bad.
Glad I don't have a smart one.
Replying to
@nadiyar There are some obvious signs like PR description pointing out how it was tested.
Sometimes it's a look on the profile. If someone has 100+ contributions per day across many different projects there is no way they could have spend a reasonable amount of time to review, or even understand the issues.
But in many cases it is more subtle. Like an exessive amount of trivial comments. Then it's hard to tell for sure.
Question to folks who create release notes including stuff like:
- chore: Update depXY to 0.11.4
- chore: Update depXY to 0.11.3
- chore: Update depXY to 0.11.2
- chore: Update depXY to 0.11.1
Why?
Replying to
@sobek@social.linux.pizza yep. Good chance they never sign it
I'm overall pretty happy with my experience on Mastodon - except for the situation around long threads. With the default UI getting 20+ fragments in reverse order with other random bits inbetween is bad enough that it makes me unfollow or mute people.
Especially odd to me if the people in question also already have a blog for long form posts.
I wish either Mastodon improved the UI for that, or made it easier to raise post length, or people were more considerate for that limitation.
How do people deal with the now very common compromises of packages you might use?
So far on my radar is:
- Lock versions/hash
- Avoid unnecessary deps
- Configure update cooldowns
- Using nitrokey so at least GPG/SSH key can't be extracted
- Run terminal used for editor and builds under systemd-run/bubblewrap with BindPaths so you have a $HOME / env without any credentials.
Any other suggestions?
I had just caused a service outage by triggering a deployment on Digital Ocean which tried to checkout a git repo from Github, but failed due to another Github outage. Unfortunately the DO build process didn't realize the checkout failed and happily continued the build+deployment despite the code missing due to the failed checkout.
Good way to end the week I guess.
In discussions around LLM I've heard the argument that it's a tool like for example a Navi. That comparison felt off, but I couldn't articulate why.
In the latest You're not so smart episode they touched on that - making the distinction between cognitive off-loading (Using a navi, but still reasoning about the road) and cognitive surrender (Using a navi, driving into a lake)
LLMs users are apparently prone to cognitive surrender, with interesting implications.
Replying to
@chaudum@mstdn.social I also remember years back when people made the argument that as a good programmer you need the right kind of lazyness - to avoid doing the boring work and instead come up with better solutions.
Based on some of the code reviews I've done over the last couple of weeks I get the impression that LLMs reinforce the wrong kind of lazyness. E.g. creating redundant test cases because it lowered the effort too much.
Starring at an if statement with a condition that spans 7 lines and includes 5 function calls I wonder if the rise of opinionated formatters was the first step towards conditioning programmers to no longer care about how code looks like.
I've been using ZubanLS for a few months now and I'm overall pretty happy with it.
Worth checking out if you're looking for a python language server:
Hadn't seen this one before:
> Overall, the study participants who saw the biased AI text shifted their positions toward those espoused by the AI.
> Interestingly, the people in the study didn’t tend to think the AI autocomplete suggestions were biased or to notice that they had changed their own thinking on an issue in the course of the study
Replying to
@Dorianix Jedenfalls nicht in einem Ausmaß das die Kosten für Software nahe 0 drücken würde.
Das ist eine Verzerrung von bestehenden Begrifflichkeiten. Wenn man bisher von Implementierungskosten gesprochen hat ging man zumeist davon aus das dass Ergebniss auch entsprechend funktioniert und Wartungsfähig ist.
Im Titel zu schreiben das die Kosten gesunken sind, aber dann im Text zu revidieren dass wenn man ähnliche Ergebnisse will wie bisher doch Aufwand nötig ist, wirkt für mich Betrügerisch.
Replying to
@Dorianix Ich würde meinen von "Code ist jetzt quasi kostenlos" zu sprechen wenn Mindestanforderungen wie " funktioniert" nicht erfüllt sind, ist ziemlich irreführend.
Aber passt wohl zum Gesamtbild, und irgendwie muss man den Hype ja am Leben halten.
Replying to
@RosaCtrl@social.vivaldi.net Interesting, I guess one could make the argument that if the challenge/effort is not writing the paper, but elsewhere, spending less time on the boring part can lead to more practice on the important bits.
On the other hand, things that feel boring can turn difficult if you stop doing them for a long time. So I'm curious to see how these things will turn out.
Replying to
@ckipp@hachyderm.io I think my main gripe is that it pushes the effort to figure out what changes are relevant to the user. Maintainers are often in a better position to judge the impact. If you update the deps, you hopefully take a quick look at the changes to see what is impacted. If it's functionality you use, you can mention it in release notes, if not it would be noise for the user.
And for those that want more details- the git log is at least for open source still available if needed.
Since the last update the Bluecode Android app crashes on Murena /e/OS. Based on some comments it's due to lack of the full Google Play Services.
A bummer, I was pretty happy with it so far - never had any issues before. And a bit ironic that the "Pay European" payment alternative no longer works with an european Android variant.
The sampling profiler coming in Python 3.15 looks pretty interesting.
Been a while since I've been looking forward to a new feature in Python.
https://docs.python.org/3.15/whatsnew/3.15.html#whatsnew315-sampling-profiler
Github notification emails for PRs or mentions now include a tracking token in the "View on Github" link.
Besides the tracking being a bad thing, the URLs now also no longer fit into one line on my screen, which breaks the URL detection of my terminal.
Glad I already moved some projects off.
The legal dispute between Unknown Worlds and Krafton is almost better than the Subnautica Below Zero story
https://courts.delaware.gov/Opinions/Download.aspx?id=392880
I had been sleeping on qutebrowser's userscripts. So far I used a little custom tool to download and convert web pages to epub and send them to a Supernote Nomad for later reading. One issue with that were sites with lots of JS or where I'm signed in to see the content.
The qutebrowser userscript mechanism calls a process with some QUTE env vars set, one of them contains a path to the HTML of the current page.
Changed my script to use that - so now I can use :spawn --userscript nomad
I might have to reconsider how I feel about CLA requirements. Looks like it's a stepping stone for people spamming repos with LLM generated PRs
Replying to
In big companies, such tasks are not considered high value
A bit sad. At least to me it communicates a "We don't really care"
I sort of wish source forges like Github wouldn't have encouraged this by making changelog generation from git log so easy.
Received a survey from the Austrian Institute for SME Research. One question was asking for reasons that AI isn't used more/sooner.
Options were things like costs, lack of know-how, regulatory concerns etc. but no option to say that it doesn't work as advertised or that you haven't seen productivity increases, or concerns about quality.
Goes to show how biased the people making the questions are when they don't even consider that as an option.
To give some credit: Ethics was an option
Do you read the changelogs of dependencies whenever you update them?
(Chose what's the rule, even if it's not always)