The lack of activity monitoring for traffic egress has astounded me. Anomaly detection should be part of all training and exercises to determine the extent the AI is going through. It really does feel like they just kick off the activity and leave it completely alone until it finishes with a result.

I don’t understand the points attempted to be made here.

> especially in the era of LLM

Using a tool to generate a product in a language that someone isn’t familiar with is not a good idea.

> horrible language from the performance…

Nor is it a good idea to choose a language strictly for its performance when requirements like portability and framework maturity are at the forefront.

> …to the dependencies…

Dependency management isn’t the greatest, but it’s also not awful for a deployed product. Managing dependencies as a developer with multiple projects that each have their own virtual environment may not be fun but it’s not exactly an impossible mess.

> …to everything

   from __future__ import everything

> can’t believe it got popular over Perl back in the day

And I’m sure people can’t believe that the iPod got more popular than the Zune, but sometimes convenience and taste are what drive decisions.

I really wish we could experience at least a single year where our representatives worked to cover the needs of citizens in a collaborative, non-partisan manner rather than focusing on corporate interests and political theatre filled with slander and misinformation.

Unfortunately in the USA, most of the house of representative districts are not competitive and an incumbent is more likely to lose in a primary than in the general. Working to do something with the other side seems to be unpopular these days.

It’s career-suicide to do so in nearly all cases. If your constituents disapprove then you can kiss re-election goodbye. If your party disagrees then you can kiss funding goodbye.

What!?! And leave show business?

Programmers certainly believe that, but they quickly learn not to.

Unfortunately there are also (senior) programmers who believe that their model is correct and it’s the reality (spec, client, user, etc) that’s wrong.

Let’s be clear though: all of those other things are probably wrong too.

> I was referring specifically to the idea that you have to stand by the code that you write.

Any serious entity which has experts handling code will do so, yes.

My employer, for example, has various teams of actual developers and others with a significant number of “not really” devs who found their way into DevOps roles. The teams with seasoned developers hold the author responsible as to the integrity and quality of code, regardless of tools used. They won’t hesitate to call someone out directly for low-quality submissions in Teams channels. The teams that have a lot of “not really” devs will blame the model for issues that surface. Of course, they’re also pushing to not have to write any code directly by FY2028, but instead have models do it as part of an internal AI initiative. Somehow the idea of using AI to generate reports, process reports, write code, test and deploy got signed off.

There’s still levels to it.

“Isolation” can mean the network hardware has no direct connections to an extranet. Data is transferred manually by physical media (USB, DVD, etc.) with logging and dedicated transfer stations.

“Isolation” can mean a VLAN on equipment which has also has extranet access, creating a logical isolation rather than physical (to reduce cost). Data can be transferred manually or through diodes.

And then there’s “isolation” which is a joke: machines technically able to access the internet but require proxy configuration (which isn’t set but can be easily derived).

> I'm surprised there are comments here that aren't impressed about what was accomplished here.

Possibly because some of the elements mentioned are suspected to be vibe-coded (JFrog Artifactory as the proxy cache) and some others have poor cyber hygiene (executing config from a dataset). It feels like an event that wouldn’t have happened if code were properly audited and written rather than relying on models to do the work. There’s also an issue with the ability to trust the source (OpenAI) as they have everything to gain by staging this as something that “suddenly happened” without anyone knowing for several days.

> AI costs aren’t going to stay this high. They will go down.

I hear this a lot and it seems to be far too optimistic. Call me skeptical but plan pricing continues to increase with tighter usage constraints. We’re still at the point in time that companies like Anthropic, OpenAI, and GitHub charge seemingly reasonable prices in order to get people hooked onto AI before raising prices to get their return on investment.

Any plans to let people create accounts to track their scores over time?

It would be very surprising for somebody without a formal software development background and years of experience.

Looking back at 2015 when Python 2 was still supported, there was a lot of confusion for why Python 2 would create a tuple while Python 3 created a generator for the following statement:

  foo = (x for x in [10, 20, 30])

The blog post is trying to help fill in a gap of knowledge for anyone trying to understand more of what goes on behind the curtains.