For math illiterate people like me, my understanding is that FLT was already proven, but the proof was beyond complex, certainly for mere mortals like me, and now Claude has codified it, correct?
I use Obsidian as my personal CRM, and I get this a lot.
It feels like people put more value on memorizing facts than writing them down, as if it’s somehow more noble to remember something about someone, but if you write it down to not forget it, it’s suddenly not as valuable a gesture.
I never understood that.
I had a problem (bad memory), I cared enough to find, and create a solution, and consistently use and maintain it, it’s way more work that I’m putting in to make sure I remember things about the people I care about vs just having it memorized better than another person by the virtue of my genetics.
This is not a criticism or a shot at smugglerFlynn here though, they already said they’re not the target audience. It’s just my personal experience and this looked like a good starting thread to post it under.
Interestingly, I took a different route: the problem was not quality of my memory, but all the overblown expectations I've put towards myself remembering all that stuff.
Turns out most people are not even trying to juggle all these facts. Interestingly, just removing this pressure helped to remember more about the people I care about.
Not saying this will work for you (everyone is different), just sharing my 2c.
What a great write up.
One of the few long form contents that I just opened and read from top to bottom without planning for it or keeping the tab open to read later.
Great job.
I’ve been battling the same problem, and I solved it by keeping the state in my brain, long focus hours, and breaking down the problem to smaller chunks that agents could almost one-shot.
That made me the bottleneck, and although I can do it for codebases I’m familiar with, working on totally new projects has been very painful.
I’m going to test it in my own vuln research workflow.
Also, Davinci Resolve has added photo editing functionality since 2
V21 iirc, but it’s not a drop-in replacement. It’s Davinci Resolve though, so expect to be blown away.
Eh, using resolve for photo editing seems a bit like using blender for video editing. It can be done, and it isn't that bad, but there are so many better options
Security Eng here.
The whole thing is an absolute mess.
I’ve been (and still am) on both sides of the fence.
I currently have two reports (one RCE on a famous OSS ML platform, one cluster take over on a k8s related projects), both are more than 2 months old without as much as an “F you, get lost”. Just got ignored and ghosted, which hurts a lot, because I spent a lot of time finding, and verifying these (all reports with poc and patch).
BUT I understand why it’s happening, because I’m also on the receiving end.
security@ and VDPs have always received BS reports and beg-bounties, but boy oh boy, these days we have two people spending 3-4 days a week sifting through this constant flood of garbage compared to 2-3 tears ago where 1 person could triage the inbox and VDP in a day’s work max, which would’ve been considered very busy. Unfortunately we can’t just shutdown the programs or the mailbox because 1. We do occasionally get important and great stuff that actually matters, and 2. We’re a critical infra company and can’t ignore anything really.
The signal to noise ratio is almost zero, but the “what if” is keeping us swimming through this unending river of garbage and burning us out.
Overall, chaotic mess on both sides.
Ending on a doom-and-gloom note: there will be a reckoning.
(Don’t take the note too seriously though, I’m a SecEng, so I have a built-in doom multiplier lol)
I reported a fun security bug to Google recently (not high in CVSS terms but will probably make the HN front page when it goes public), and the report was auto-closed in minutes as "not reproducible". If they tried to use an LLM to reproduce it I'm not surprised, since it requires a soldering iron.
Having seen the other side of a security inbox I totally get it, and fortunately I was able to get it re-opened via backchannels. I think the future of bug reporting will run almost exclusively on reputation and connections.
AI vulnerability analysis is going to find something, it will be reported by a researcher and ignored as chaff, and then separately, later, someone will build it into an exploit and compromise a piece of critical national infrastructure
Have you considered using LLMs to perform some automated more-or-less reliable classification of incoming reports by severity, affected product, etc., then have agents try to replicate the reported findings?
Ideally the reports would also be coming in in the same structured format.
So it's essentially saying we can train models that put your jobs at risk (not saying it's correct or not), but you're not allowed to threaten our perceived moat?
> The flow of data was so hard to follow, it seemed like someone was trying to cover up a murder.
> Just getting the code to run on your laptop took a week.
I always thought I’m the only one having problem understanding the data flow, or setting up a proper dev environment. Impostor syndrome (and sometimes toxic environments that pushed for “velocity”) didn’t help either.
> Just getting the code to run on your laptop took a week.
This one surprised me. Claude Code in the CLI has made standing up an app and debugging whatever random dependencies or docker BS a dream compared to the before times, when you'd have to learn the architecture while simultaneously troubleshooting whatever isn't working on your machine
And in the before times, you learned a lot and walked away with knowledge on the deps needed, connections, .env secrets, and cleaned it all up and documented it so the next dev would have an easier time doing it.
Yes it did. That's how I learned a great many things throughout my career. I'm sure some people didn't pay attention or try to understand what they were doing, and didn't learn. That's on them. But most of us learned a lot that way.
I think it depends on how “before” we’re talking about.
I can remember a time when learning was valued and leaving the camp cleaner than you found it was considered a basic professional standard.
But I can also remember a time when Scrum became all the rage and next thing you know we’re all stuck on the sprinting treadmill, management is obsessing over “velocity”, and it’s generally an everyone-for-themself free-for-all to clear the absolute minimum criteria to get the ticket moved to the “done” column in a semi-desperate effort to keep up with your ever-growing backlog of tickets to which you’ve been over committed. Don’t worry about incomprehensible code or flaky designs; taking your time to do it right the first time looks bad on the KPI dashboard but rework does the opposite because you get to count the second (third, fourth, etc.) times the same task needs to be revisited towards your velocity metrics, too.
I’m not sure most developers younger than maybe 40 realize just how much worse our line of work has become over the past ~15 years.
Indeed, there were plenty of people doing just that. I imagine they get the most out of vibe coding. However, when it became a problem, an engineer was still required to fix it.
It might have been you, a couple of months later, or someone else. I have dealt with slop produced by unknowing programmers most of my career. With this vibe coding I think my job is still safe. The amount, though, is increasing exponentially.
The second tome I had to do that for the same project (new computer), I sarted taking very detailed notes when doing this kind of unpleasant, supposedly one-off things.
You're not alone on this, I've also felt the same way, and those knowledge often lives in people's heads or random slack threads, and with AI code it's even worse It just generated what looked reasonable at the time.
