simonw

22 ms·

571.
by simonw 3mo ago
> could you link me to the release / tag on github? https://github.com/oven-sh/bun/releases/tag/canary (I'm not a fan of how they reuse that single tag rather than putting out version-number
572.
by simonw 3mo ago
> If their AI finished it, where's the release? Producing a stable release for their community of code that had been written by AI in 11 days and had not yet been extensively tested in the real world would be grossly irresponsible.
573.
by simonw 3mo ago
This is good: > If you’re under the impression that these models are “glorified autocomplete” or that progress is slowing down, I need to urge you: stop thinking that . The models are very intelligent and capable, they are getting bette
574.
by simonw 3mo ago
> both outputs of Claude Mythos, their (still) unreleased advanced model That sentence gives the impression that Mythos might be released in the future. That's clearly not going to happen - it's already "released" in
575.
by simonw 3mo ago
I liked his note about how before SQL a lot of people were employed as COBOL programmers to painstakingly write systems that fetched and joined data by hand.
576.
by simonw 3mo ago
Or you want to hire the kind of seasoned veterans who want to live in those cities. Often later-career, families, looking for exposure to more than just a thriving tech scene.
577.
by simonw 3mo ago
I really like the bit where he transferred ownership of Ghostty to a non-profit, and is now building this new company on that as an open source dependency: > We will build on libghostty exactly as it was designed to be used: as a public
578.
by simonw 3mo ago
Correction to the above: it should use json_type(data, '$.name') IS 'text' Using = fails because a missing key returns null and in SQLite null = 'text' is null: https://latest.datasette.io&#x2
579.
by simonw 3mo ago
D. Richard Hipp's 20 minute keynote is here: https://youtu.be/R57nUGzo7CA?is=fDMxVTH_AOvPlKR- (starts 1m45s)
580.
by simonw 3mo ago
Don't miss their blogpost about the incident, which is long, detailed, and absolutely fascinating (but didn't make the HN homepage): https://huggingface.co/blog/agent-intrusion-technical-timeli... Thread from
581.
by simonw 3mo ago
The reputation of the writer matters a lot. Recent models seem to be pretty good at evaluating author credibility as well. What's dangerous is treating information from an anonymous author as factual. You gotta check that in other ways
582.
by simonw 3mo ago
Something I've found surprisingly effective is telling ChatGPT to "use credible sources" - you can then watch its thinking trace and see it do things like ruling out random blogs, considering media publications with a good re
583.
by simonw 3mo ago
> 3-classifier ensemble + regex fallback blocks prompt injection in <7ms. DAN jailbreak, system extraction, and role override all detected at 0.98 confidence. Using regular expressions to detect prompt injections is not a credible str
584.
by simonw 3mo ago
> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents. Oh no.
585.
by simonw 3mo ago
A handy trick for column types is check constraints. You can define constraints on a column that ensure it is text that's valid JSON for example: CREATE TABLE documents ( id INTEGER PRIMARY KEY, data TEXT NOT NULL CHE
586.
by simonw 3mo ago
My sqlite-utils CLI tool and Python library offers solutions to both the alter table limitations and the need for schema migrations. For alter table it offers a "transform" command which implements the pattern of creating a new ta
587.
by simonw 3mo ago
I don't like subscription popups - see recent John Gruber rants on the subject: https://daringfireball.net/2026/05/what_is_a_dickover I'm willing to take the hit to subscriber numbers for not having that
588.
by simonw 3mo ago
I stand by what I said. I was offering honest advice: when I read the article I thought exactly that, and so did other people based on the comments in this thread - which I think shows my instinct has value here. There's an easy fix. I
589.
by simonw 3mo ago
I would hope that OpenAI themselves would agree with you. This entire story started with them not taking the necessary steps to monitor their agent while it was executing against the eval suite. I'm very much looking forward to their o
590.
by simonw 3mo ago
... but that's since been refuted by https://huggingface.co/blog/agent-intrusion-technical-timeli... which says: > While the intrusion did reach Hugging Face's internal infrastructure, the only customer co
591.
by simonw 3mo ago
It sounds like the third-party sandbox was hosted by Modal: https://www.reuters.com/business/openais-rogue-agent-comprom... > "We’re aware a Modal customer published an unauthenticated endpoint that allowed an
592.
by simonw 3mo ago
Also notable: we have a timeline now. The agent was active within Hugging Face from Thursday 8th to Monday 13th July. The Hugging Face post about the incident - https://huggingface.co/blog/security-incident-july-2026 -
593.
by simonw 3mo ago
I've not tried that, honestly it's such a quick process already that waiting for some kind of browser automation to copy and paste would likely be slower.
594.
by simonw 3mo ago
This is fascinating - there is a TON of detail in here about how OpenAI's rogue agent exploited Hugging Face. A few details that stood out to me: 1. Having found a way through the OpenAI container network proxy, it exploited an "u
595.
by simonw 3mo ago
The thing where "uv init" now adds this to pyproject.toml is a bit surprising: [project.scripts] demo-latest = "demo_latest:main" What's the rationale for that? My expectation is that few projects would nee
596.
by simonw 3mo ago
What's blocking a 1.0 release at this point?
597.
by simonw 3mo ago
... right, and then I'm responsible for maintaining that infrastructure, and I have to think about email deliverability as well. Plus Substack discovery does carry some value - about 65% of my new subscribers come via the various Subst
598.
by simonw 3mo ago
Ghost would cost $288/month (or $241/month paid yearly).
599.
by simonw 3mo ago
I'm pretty happy with the way I've resolved this. I publish everything to my personal blog first, then once a week I copy and paste it all into a Substack newsletter. I get to use Substack for email distribution (which would cost
600.
by simonw 3mo ago
> Do you think it took OpenAI a week to realize what happened ? Apparently it did take them a while. This report here https://cloudsecurityalliance.org/artifacts/hugging-face-cis... includes extra details from a con

More ›