Public posts preserved on my own site.
@neurobashing Like, can $1 million of tokens find the same number of bugs as a team of ten techies given one year? Oh man, I think it would be close now. 5 months ago it wouldn't have been close.
Or like, with modern code bases being huge, they all probably are easier to find bugs in. That's probably why Anthropic made a big deal in finding bugs that have been in the code base for a decades.
Having a hard time coming up with ideas for running a website on a $8 microcontroller.
- to hot to handle - site for data so private, you can't run it in the cloud. I guess your neighborhood gambling club.
- bad idea on purpose - a non-crypto scrip site, essentially crypto currency when it was hippie money for trading babysitting for 3 hours of plumbing. I.e. a bank.
- Front end for a gadget (e.g. thermometer). Out of scope, I'm not a hardware guy.
- game server. Oh it's gonna lag.
- ....
@anoncheg@mastodon.in.th mypy finds real bugs but makes people's head hurt trying to address some of the typing errors it finds
Bandit, I'm so tired of it telling me not to use subprocess, ever.
Dodgy is basically unsupported and has many breaks on python versions/libs since the last 5-13 years. I would not spend time dealing with it.
**tired**: $120 a year for a web server
**wired**: publishing a website to pypi that users can `pipx install`
#COBOL content.. from 8 years ago
The language designers made it have no functions on purpose because they thought functions were hard and were for egg heads.
The original BASIC had functions, but by the time BASIC was on all the 8 bit machines, BASIC was following COBOL with no functions (as a fundamental building block)
Where to go if you're in the US and you're now too poor to travel, or if you're in Europe and don't want to risk an out-of-control border patrol and ICE brown-shirts.
Benidorm → Miami Beach
Ibiza → Las Vegas
Amalfi Coast → Big Sur
Santorini → Hawaii
Paris → New York City
Rome → Washington D.C.
Swiss Alps → Aspen
Norwegian Fjords → Alaska
Provence → Napa Valley
Amsterdam → New Orleans
IDEA: PEP to add pastries and coffee APIs to python core library.
```python
import pastries
arrivaltime = pastries.feellikeanothercoffee(WHAT.anddonut)
```
and then they show up
Periodic reminder we shouldn't be making build scripts in YAML. protobuf is a fast faster de/serializer.
Important thing is protobuff doesn't any loops, variables, or conditional expressions, so that non programmers can recreate loops, variables and conditional expressions with "data-structures-as-code"
This website accuses common libraries of being hit by malware attacks without substantiating evidence.
Couldn't find reports of #orjson being highjacked, just this websites assertion.
The same website calls my apps vulnerable and malicious, also, doesn't exactly say why.
This site sees yanking as malicious. Kind of damned if you do/don't. What if you publish a package that is
- broken
- has a vulnerability
- and you *know* that there is 0 usage for that package because it is an app & has negligible downloads
Yanking is just assumed to be a lpad attack on the ecosystem.
I'm planning on upgrading from .env for secrets to python keyring everywhere (uses the OS's secret store, supports more backends via extras).
Processes with my credentials will still be able to read those secrets but the secrets are off the file system. Baby steps.
Ideas for code review quality gates:
- no merge until you pass a quiz on the contents of your code and MR reviewer do as well
- no merge until user documentation is generated and developer documentation is generated (large code bases). This is waaay easier to read fast. `*`
- Actual code freezes where you stop writing code 4 days a week, except instead of depression, it is because the LLM wrote a month's worth of code on Monday.
Ask the LLM to review the code? An llm never just says lgtm, it writes a magazine article (paper artifact from the past that was 1-3 pages long, or about 8 vertical screen lengths) Now you got even more to read.
`*` (not talking about docstring documentation, I think that is slower to read start to finish, I mean, like user documentation except it talks about classes and modules, but not at a "just repeat the interfaces" level)
We're going to mash these keys until something good happens.
New and improved with 100% fewer trademarks in the name and 6x more support for other yaml-based build scripts
Wait 2 weeks before trying it out.
Suspicious fact of the day, humans process only 10 bits per second with our puny brains.
I process a million bits per second. (They're all 0s.)
IDEA: Retro, Agentic coding loop.
The code runs your unit tests, when it fails, code and error are posted to StackOverflow requesting a unified diff or rewrite in the answer. Once the answer is posted, the diff is applied. If the test fails again with a new error message, it creates a new question. If it passes, it accept the answer that fixed the code.
Set running and head off to the coffee shop, no AI required.
IDEA: Enterprise version, where you do the same, but post to fiver.
Finally published all my tweet storms as a blog
https://matthewdeanmartin.github.io/mastodon_is_my_blog/authors/mistersql/
On the way to my original idea I got detoured so hard I created a mastodon content reader website.
The People Page and Content Hub... are working out nice. Forum-simulator has a ways to go.
Biggest challenge on the way- performance. It is really easy to make a slow feature.
Today, we are all Hungry.
We are also all Magyarország!
Good to hear good election news.
Like Nixon going to China to normalize relationships, Trump is becoming the Environment president who'll get the world off of oil. By accident. And Against his stated, actual goals. But none-the-less.
Thought on Mastodon clients. All the cool features require queries that would be ruinously expensive server-side. Getting recent posts is cheap, but if you want to group all your friends timeless data that's a table scan of a lot of posts.
input/print is too little for a nice terminal experience, but as soon as you pull even prompt_toolkit, boom, this is not a very blind accessible experience. All the accessibility machinery that was invented for the web would have to be reinvented for terminal. Do I have to ask a bot to write this UI toolkit? Sure why not, what else am I going to do with this $20 sub.
@xujfcn Security is cranked up a little too high
**Failed to verify your browser**
Code 99
Is your nginx container haunted? You need daemon off(TM)! Pick some up at the container store.
```Dockerfile
CMD ["nginx", "-g", "daemon off;"]
```
@neurobashing This is a good proxy for that question https://www.ishormuzopenyet.com/
Pottery with the ancient sport, cricket
Eliza Code: Doesn't fix bugs. Makes you feel better about your self as you make bugs.
I maybe be made of meat, but I can find vulnerabilities faster than Anthropic's Mythos. In my self. Found 10,000 things that make me cry.
I got 22 days of trial left to finish this #Gitlab Duo client.
I'm up to version 0.3.0, which if you are following proper cool down procedures means you can try it out in two weeks.
Has oauth support and a hot dog stand color theme option. That's really all anyone wants.
My take on an alternative to SBOM. Ask an LLM to do the web searching to see who it thinks is the maintainer for all the dependencies.
https://tuochat.readthedocs.io/en/latest/dependency-provenance/
Public Gitlab: Here's your 400 build minutes. It's been a week, oops gone!
Public Github: Oh you want a 4x4x4x4 matrix built? Several times a day all month? Well, someones gotta do it.
@schwa 3 minutes, it is a cylinder.
@schwa I retract that infinite minutes + 2
Tonight my fellow countrymen, we celebrate one man having the cowardice, the inner-poultry... to the do the right thing. Round of applause followed by the ceremonial raspberry.
@neurobashing Their aiming at AWS data centers, we're both done for.
I'm Matthew and I could have gotten a pizza in economics and instead I got a master's degree. I should have held out for the pizza.
600,000 lines of code for mastodon?
I can create an echo chamber in bash in one line.
```bash
echo "chamber"
```
Today I'm announcing load shedding at daily standup. Only tickets ending in even digits will get any attention.
This is like the 2 months before the covid shut down started.
The smart people have already figured out that the oil shock is already in our future. To oversimplify 1/5 of all food and economic activity will disappear.
Development Status :: 22 - This is going to be so great
Development Status :: 43 - Funded
Development Status :: 69 - I think its nice
Development Status :: 87 - Unfunded
Development Status :: 37 - Sideproject
Development Status :: 67 - CS Homework
Development Status :: 666 - I am your supplier, I work for you for free, you own my soul
Development Status :: 999999 - IBM Support contract available for $999,999
"Development Status :: 3 - Alpha" and all the other imply promises about level of support (because it is an uncontrolled language and wikipedia has opinions about what Alpha, Beta, Production or Mature means.)
Inactive - you have to publish a whole package to say the package is abandoned? Who quality controlled that final package publication? The last person out the door published a broken package and everyone is going to get it on next update.
IDEA: bagit but checking if source has been casually tampered with since installation, i.e. sign each file, put it in a file checker and then on startup check if files were tampered with.
Opinion, security geeks poo-pooing anything that looks like security theater is hampering creating security models for agentic LLMs. You only need a solution that is difficult enough to circumvent that the SotA model can't casually crack it with typical token limits.
I don't want to run every integer object in its own docker container. (This is an honest to god idea I heard on a podcast decades ago, except it was running every object in a WCF webservice, good isolation, now you can run two integers on your 1TB of memory laptop, safe from NK hackers)
What options do we have for sandboxing windows? (short of docker, VMs, cloud machines)
Things I found
- lua/javascript
- sandboxie plus
- disabling python modules from their normal import location (this is 90% security theater, only works in a few use cases, maybe LLMs and definitely unit tests)
- run-in-a-Process, not-in-thread (this isn't 1980, memory corruption isn't the first problem)
- actual sand or kitty litter. No one is touching that computer sitting in the kitty litter box.