CVE stands for Common Vulnerabilities and Exposures - this is the reporting system that describes problems with various versions of various software and operating system components / configurations. They generally don’t publish them until a fix is also available. These are the things that tell people: if you don’t upgrade your XYZ an attacker can take control of your system, execute arbitrary code, without you doing anything except connecting to a network the attacker has access to… AI is finding, and fixing, CVEs at about 5-10x the rate that people were finding them without AI 2 years ago.

For me, it’s an example of: if you don’t participate in AI things and make the extra new patches coming out, the attackers who do use AI things are going to pwn your systems with them. Doesn’t matter if you’re a professional developer or not, if you use a computer, you need to apply the patches and updates, if you “opt out of all things AI” you’re just going to be vulnerable.

Stuff like that doesn’t leave a good way to opt out, the environment is changing and if you don’t go with it, you’re going to be victimized by it.

Recent experience, developing in Opus 5.5. Spin up an agent to review the security aspects of the project, write a report. Pass the report to another Opus 5.5 agent and tell it to implement mitigations for confirmed problems found in the report. Implementation agent proceeds to make tests for the described exploits and gets shut down by the guardrails: Opus 5.5 is not permitted to “do that kind of work” had to scale back to Opus 4.8 for the implementation, though 5.5 was still happy to describe the chained attack scenarios, apparently it’s not allowed to develop demonstration code as it was trying to do for the test cases.

This is business.

So was the Opium trade.

By all means, exercise that spine.

Will you also be ignoring the new CVEs if they’re discovered using AI?

What this feels like to me is documentation that should have always been present for all the developers on “the team”, but now that the developers are AI agents they have the bandwidth to be able to write that documentation instead of just shipping the pull request with a terse “it works, check the tests.” note.

As a human developer, I never had the patience to write really good documenation AND keep it in sync with the project as the code evolved through development. I have written good prospective documentation, I have written decent retrospective documentation, but keeping either in sync with the implementation as the implementation evolves during maintenance is a heavy burden - one that LLM agents do without complaint. Yeah, they’re less than perfect, so are the humans on the teams. As long as additional passes invested in making things self consistent are consistently improving the state of things, I’m fine with telling the agent “take another pass at making the documentation consistent with the implementation while I go to this meeting…”

I’m working on Lempi, which is both similar and different - mostly on how the DJ works:

Rufin’s Auto DJ says “more like this track” and trusts the server’s idea of similar. Lempi works like a radio programmer with rules: it decides how often each song may come back, what fits this hour, and what follows well from the last track, then adds a controlled amount of chance.

https://github.com/MangoCats/Lempi

I’ve been off and on developing Lempi for personal use since 2020 - it has other names in the past, most recently changed becasue I was developing under a name somebody else “went wide” with in 2023. There’s a lot of music players out there.

I’ve been making my “the one” for years (off and on) now. I’m getting closer with https://github.com/MangoCats/Lempi - but it’s still got a big cost up front that I’m under-motivated to address because I’ve already paid (segmenting songs, IDing them in MusicBrainz, trimming lead-in lead-out points, etc.)

The thing I like the best about Lempi is that it does “shuffle play” with a reasonable intelligence, auto-selecting a good subset from my collection based on example songs that I want to hear “things like this” during certain timeslots of the day. I can just let it run anytime / all the time like a radio station and not think about choosing my playlist.

https://en.wikipedia.org/wiki/List_of_Streisand_effect_examples

Mirror, keep a clean copy of your setup offline. Make periodic backups. If you ever get into an unpleasant state, nuke it and go back to one you like better.

Echo chambers work best in isolation…

Caveat - I’ve never subscribed to “super Netflix” with HD and all that - we display on 4K monitors, but the Netflix feed is their basic resolution - I don’t know if there’s any problems going up-market.

As of late, I install generic Chrome (yes, I believe free Chromium did - maybe still does - have issues), on generic Ubuntu or Debian + XFCE.

You can run several low power systems with lots of capabilities for less total power than one general purpose system. Now- at some point there are applications the low power systems are either annoyingly sluggish at, or altogether incapable of, but if you’re not getting into that kind of stuff, then a handful of small systems can be the ticket.

I built a wooden box with a filter and a big (200mm) fan and put 4 raspberry pis + a network switch in the filtered airflow, the pi that serves stream analysis on frigate has a co-processing hat, the rest lighter weight stuff like homeassistant, libre elec, and so on. Definitely more work to setup than a single Intel Core NUC - but also about the same or lower power under load, has been rock solid for years, and the filtered air setup has kept dust out much better than my series of dust strangled NUCs over the years have.

I’ve been streaming Netflix on Chrome on Ubuntu without trouble for years and years - maybe 10-12 years ago there was a bump in that road, but it has been smooth since.

Check LibreElec, if it ticks all your boxes, it’s probably the best (simplest) choice.

You can go much more general purpose, but if you don’t need general purpose then all that general purpose capability amounts to (intentional or accidental) attack surface you don’t need.

The concept here is that the USB carries the immutable OS image, you make as many copies of it as you need because it’s a fixed image, boots the same every time, “your data” gets stored elsewhere.

/home and /var are the main targets for persistent storage. Unfortunately, a LOT of applications color outside those lines, so you’re into a bit of case-by-case for what else needs to go into persistent storage, depending on what you run and how you configure it.

Personally, I like the short - punchy approach: Omarchy, the distro also known as Goose-steppy.

I still think that giving it oxygen is a mistake, but if you insist on making that mistake, I’d go for “coloring the air” around it in an easily recognized shade and odor:

Omarchy: the new Linux distro labeled “Goose-steppy” by the community, is being developed based on donations from X, Y and Z… At present, it offers nothing of value vs these established distros: ____, _____, _____. The community is relatively un-knowledgeable and un-helpful, and the technical aspects are less well refined than the established competition. Etc. etc. etc.

Remind the world that the trains don’t actually run on-time any better under Fascists in practice. They have too many conflicting priorities, and ultimately those lead to the trains not running at all.

Honestly, I think it’s a lot of Stockholm Syndrome. I spent a couple of weeks on the recently opened East side in the summer of 1990… the locals’ concepts of economics were - alien - like discussing a summer breeze with an octopus.

The ironic thing there is that AfD supporters come overwhelmingly from the former East Germany… you would think they’d had enough, but apparently somehow it’s their comfort zone.