"It’s making developers dramatically more effective, but it’s also introducing security vulnerabilities, increasing technical debt, and producing code that can be difficult to maintain." is one heck of a sentence that appears to be relying on a rather novel definition of the word "effective" to be in any way coherent. (It's a pull quote from https://thenewstack.io/acm-vibe-coding-ai-agent/ that pretty much brought my brain to a juddering halt from the level of cognitive dissonance it implies)
Remote
Alyssa Coghlan
@ancoghlan@mastodon.social
mastodon 4.8.0-nightly.2026-10-06CPython core developer, Python platform engineer for an Australian retail bank, cognitive science dabbler, secular humanist, charitably mercenary cynical idealist :)
366 Followers
269 Following
50 Posts
Joined April 16, 2024
Blog (mostly idle):
RE: https://mastodon.social/@mshelton/116920794602281891
Is "bots will be bots" the new "boys will be boys"?
Today in "You must be really confident you won't ever be held liable for that", *Docusign* offered to use AI to summarise the agreement I had been asked to sign. (I declined, naturally)
Boosted by @GroupNebula563@mastodon.social
Replying to
@xgranade@wandering.shop This thread reminded me that the "informed vs implied" consent problem isn't new (since even when followed, robots.txt is an opt-out protocol).
Replying to
@nedbat@hachyderm.io With type hinting, the cultural difference became a second technical difference (tuple[int] is a 1 entry tuple, you have to write tuple[int, ...] to indicate arbitrary length, but list[int] is inherently arbitrary length and there is no notation for differing types at specific indexes)
Replying to
@freakboy3742@cloudisland.nz It does make me wonder if some law firm in some jurisdiction will see if they can spin up a plausible emotional distress class action.
Replying to
@nedbat@hachyderm.io @pfmoore@mastodon.social Because "project" has semantic implications which are not correct in the general case, whereas "virtual environment" is a mere behavioural description in the same sense as "virtual machine" (to contrast them with the underlying "real" runtime environments that Python installations provide by default). Many virtual environments ("how they work") are associated with a specific project ("what they're for"), but far from all of them.
Replying to
@itgrrl@infosec.exchange @daedalus@eigenmagic.net That was the policy, but then that policy was declared "nevermore".
Replying to
@benno@eigenmagic.net @daisy@cloudisland.nz This question assumes we actually read the message before cancelling the alarm.
Replying to
@xgranade@wandering.shop @mcc@mastodon.social I do wonder at what point the various Android phone manufacturers decide G have gone too far, conclude they can still sell phones without Play et al, and switch to GrapheneOS (or their own hard fork, since these things can never be simple)
One of the more irritating elements of "CEO with a vested interest said a thing" "journalism" is when almost the entire article is uncritically rehashing whatever nonsense the CEO is spouting before mentioning in the final paragraph "they have an IPO pending", instead of the headline being "CEO spouts desperate nonsense to try to juice up their IPO" (with the lead paragraph noting that the aim is to reach levels that may satisfy their venture capitalist investors)
Random thought: tales of golems often include some kind of motivating script stored in the golem's head. System prompt?
Replying to
@xgranade@wandering.shop @pathunstrom@ngmx.com "Running meaningful surveys is hard, what if we just made shit up instead?"
Sometimes applications have features where I am utterly mystified as to the requirements or past history of backwards compatible updates in the face of changing requirements that could have led to the feature existing. Current example: long lived Artifactory API tokens that explicitly *can't* be revoked without deleting the user's entire account (they still have expiry dates, it's just that the user and admins are actively prevented from revoking them early).
Replying to
@glyph@mastodon.social Law, finance, and other fields (including education and certified engineering) have far more well developed notions of "duty of care" than software development in general, let alone FOSS in particular. It's why conduct that isn't technically illegal can still cost people their ability to practice.
I'm planning to head somewhere down Dubbo way with @prophetkristy@dftba.club for this.
Replying to
@0xabad1dea@infosec.exchange Drawing attention to this is very much appreciated! Up to chapter 14 already :)
Replying to
@daedalus My reaction to needing to replace my devices long ago stopped being "Cool, new toy!" and instead became "Ugh, now I need to rediscover all the various off switches for the assorted user hostile default behaviours". The sheer entitlement of the entire industry just oozes through in the way everything assumes it has a legitimate right to demand our attention immediately rather than on a schedule of our own choosing.
Sometimes I wonder how much of my AI skepticism is fuelled by the fact that a decent chunk of $dayjob is getting tools originally written for Linux to play nice with Windows dev environments, so a significant subset of the documented functionality doesn't work (with no written caveats), and plenty of the publicly available example projects don't work either (since they assume execution from a Linux environment, where WSL itself qualifies, but a Windows client to a WSL service doesn't)
Replying to
@grimalkina@mastodon.social Reading this thread reminded me of https://blog.aurynn.com/2015/12/16-contempt-culture/ (about the use of contempt as an in-group/out-group marker, and the assorted problems associated with that)
Interesting read from @bert_hubert@eupolicy.social last year on what useful things may be left standing when the LLM bubble inevitably pops: https://berthub.eu/articles/posts/an-ai-premortem/
Replying to
@ellie@ellieayla.net @grimalkina@mastodon.social Submerged is one I would also recommend.
Replying to
@joshbressers@infosec.exchange The one case where downstream vendors can still get advance notice? When they're actually directly employing people on the project level security response teams (which is a potentially double edged sword from the project's side, since it means volunteers don't have to do security response without compensation for their time, but risks bringing those dubious corporate incentives you mentioned up to the project level)
Replying to
@glyph @mttaggart "vibe-addled" perhaps? Again by direct analogy to "drug-addled". Might still be too confrontational for the kind of interventional stance you're exploring, but other substance abuse derived terms and phrases may also be helpful there ("vibe abuse", "compulsive vibing", etc)
"vibesick" itself makes me think "seasick" rather than "dopesick", so I have my doubts it will land the way you want it to.
One novel option that fits the times did just occur to me though: "vibe-cooked"
Replying to
@b0rk@social.jvns.ca Yeah, pretty much. There's an awful lot of documentation and code out there that doesn't describe its minimum version requirements or its platform or configuration limitations, so as soon as you deviate from "I'm running the most extensively used and/or documented version on the most common platform in the most common configuration", both LLMs and regular internet searches will feed you a lot of nonsense, but the LLM output often makes the problem less obvious.
RE: @arstechnica@mastodon.social
Dare we believe that the mania is abating?
(I almost used "hope" in that sentence, but that's the wrong word for something that's going to be a frickin' mess when it finally happens)
Having reason to contemplate the differences between "obviously not broken" and "not obviously broken" (this is not an uncommon state of affairs, just especially applicable today).
I was familiar with the original, and concur that this is still well worth the watch :)
Replying to
@glyph@mastodon.social @xgranade@wandering.shop In the default Android client it flips to a "Hide results" button, I hit that, and can then vote.
Replying to
@daedalus@eigenmagic.net A rant on that point from a decade ago (not all the specifics aged well, but the underlying thesis still intrigues me): https://blog.gardeviance.org/2016/04/the-robots-are-coming-for-whom-bell.html
Replying to
@joshbressers@infosec.exchange Yeah, I think it's generally a good thing myself (the responsiveness that's desirable for a good SRT isn't reasonable to expect from volunteers, and involving vendor/redistributor employees is one way of addressing that gap). It "just" needs to be done with awareness of the potentially conflicting interests.
Replying to
@Tattie@eldritch.cafe Duff thwack (cricket ball bouncing on the ground, then hitting the bat).
Replying to
@scollovati @mitsuhiko @swheritage I too opened the reply thread to mention https://www.softwareheritage.org/ and not only found it had already been mentioned multiple times, but also that the project had a Mastodon account :)
Replying to
@hynek@mastodon.social @mwb@fosstodon.org True, interpreting that as a burnout symptom *is* an interpretation rather than a demonstrable fact, but I think it's a defensible one.
Replying to
@hynek@mastodon.social A pillow/PIL-style long term replacement would also be largely fine at the ecosystem level. But yeah, always mixed feelings around the human implications of maintenance situations deteriorating to the point that wholesale forks seem necessary (and that's before the paranoid part of my brain starts pondering the potential impact on supply chain security concerns).
Starting to think I may need to follow a colleague's example and indefinitely set https://nohello.info/ as my status at work.
Replying to
@coderanger @raiderrobert @AlSweigart I can see it working for genuinely local things, but for online communities aiming for global reach, requiring geographic proximity to at least one existing member is a harsh filter to apply.
Replying to
@gdayitsjack I mostly go "It's a trap!" and let it hang forlornly in the ether, an unmade connection
Replying to
@freakboy3742@cloudisland.nz https://thenextweb.com/news/aws-billing-bug-billion-dollar-estimates came up in the "other articles" when I was reading https://thenextweb.com/news/tech-giants-hidden-off-balance-sheet-debt-ai just now
Replying to
@mwb@fosstodon.org @hynek@mastodon.social Aye, your write-up of why you felt a fork was necessary is excellent, and you seem to have a good idea of what you're letting yourself in for :)
It's just frustrating that the overall collective endeavour that is open source still relies so heavily on "maintainer A burns out, maintainers B, C, and D take up the burden" rather than being able to figure out more reliable ways to mitigate the frequency of burnout amongst project founders facing ever increasing user expectations.
Replying to
@cratermoon@zirk.us Yeah, the article structure is very odd in general. That pull quote was the bit that really hurt my brain, though.
Replying to
@xssfox @gdayitsjack I feel like there should be a UDP joke there, but I am unable to recover it.
(Sorry, not sorry 😄)
RE: @bert_hubert@eupolicy.social
I did not expect a wild @gvwilson@mastodon.social to appear while reading this...
Replying to
@mhoye@cosocial.ca And China were hardly slacking with all their "Belt & Road" initiatives *before* the US took a voluntary dive
Replying to
@coderanger@cloudisland.nz Viewing on mobile or desktop? GH are fond of their "actual timestamp on mouse hover" displays, which don't translate well to touchscreens.
Replying to
@hynek @hugovk @davidism I may be tempting fate by mentioning it, but I'm mildly surprised we don't see anyone pointing to the crash bug reproducers we have in CPython's testing folder and saying "security flaws!" (anyone in a position to exploit them is already able to run arbitrary Python code and probably has more interesting code snippets they could be running instead).
Replying to
(This does of course assume that the relevant conference submission process provides such a notes field. Even if they don't have one, though, that's likely a sign to forgo the tantalising hints entirely rather than deciding to use them anyway and risk having your proposal rejected for lacking sufficient detail)