The shift here is that up until now output (code, in this case) required a degree of competence. As such, we socialized that being able to put out the code showed a degree of competence. The act of putting together a PR with working tests showed you had a level of knowledge past "I want X to do Y."
Now, you have a lot of people taught that output (a working PR) is competence. They walk around thinking they are competent because they can produce output.
When faced with criticism on working code, they collapse and flail immediately because to admit they can't explain or defend the code is to admit they are not competent. From there you've hit pretty much all of the problems that the rest of the Internet suffers from: cognitive dissonance, digging in because being wrong threatens your constructed identity, constructing echo chambers of AI Influencers peddling the latest prompt, and so on.
It's not just the status quo, it's a nightmare to enable. Somehow between Google Play Advanced Protection and Google Account Advanced Protection I have to resort to several reboots and adb + USB debugging sideload to get an app loaded. @.@
I feel like we work at the same place. IT Husbandry/Debt Paying/KTLO whatever you call it is being ground into dust. Especially repetitive stuff that I originally would've needed a week to automate and never could get to the top of the once quarterly DevOps sprint...bam. GitHub Action workflow runs weekly to pull in the latest OS images, update and roll over a smoke test VM, monitor, roll over the rest or rollback and ping me in Slack. Done in half a day.
I've got a couple Claude Code skills set up where I just copy/paste a Slack link into it and it links people relevant docs, gives them relevant troubleshooting from our logs, and a hook on the slack tools appends a Claude signature to make sure they know they weren't worth my time.
That said, there's this weird quicksand people around me get in where they just spend weeks and weeks on their AI tools and don't actually do much of anything? Like bro you burned your 5 hour CC Enterprise limit all week and committed...nothing?
No, Claude Code reads the CLAUDE.md in the root of your project. It's case sensitive so it has to be exactly that, too. Github Copilot reads from .github/copilot-instructions.md and supposedly AGENTS.md. Anigravity reads AGENTS.md and pulls subagents and the like from a .agents directory. This is probably why you have to remind it to re-read it so much, the harness isn't loading it for you.
I got an email update for a very adult kink event recently that was entirely written by Claude with emoji bulleted lists and everything. All that was missing was the EXECUTIVE SUMMARY header.
As someone who started out a GenAI skeptic, I’ve found the truth is in the middle.
I write a TON of one off scripts now at work. For instance, if I fight with a Splunk query for more than five minutes, I’ll just export the entire time frame in question and have GHCP (work mandates we use only GHCP) spit out a Python script that gets me what I want.
I use it with our internal MCP tools to review pull requests. It surfaces questions I didn’t think to ask about half the time.
I don’t know that it makes me more productive, but it definitely makes me more attentive. It works great for brainstorming design ideas.
The code generation isn’t entirely slop either. For the vast majority of corporate devs below Principal, it’s better than what they write and its basic CRUD code. So that’s where all the hyper productive magical claims come from. I spend most of my days lately bailing these folks out of a dead end fox hole GHCP led them into.
Unfortunately, it’s very much a huge time sink in another way. I’ve seen a pretty linear growth in M365 Copilot surfacing 5 year old word documents to managers resulting in big emails of outdated GenAI slop that would be best summarized as “I have no clue what I’m talking about and I’m going to make a terrible technical decision that we already decided against.”
The article pretty clearly lays out it's at least functionally B. The problem is Dell doesn't publish the drivers necessary for the Windows installer on it's website. You can only reinstall windows from the recovery partition or via online download via an EFI program, similar to Apple Recovery's online re-installation. Those install methods include all the Dell bloatware and telemetry settings cranked up to 11.
They seem to have the api base url hardcoded in their firmware[1]. The repo seems to have pretty clear instructions for compiling and flashing modified firmware. From there, it's just a matter of writing a decent server to implement the calls documented in BYOD/S[2] and Private API.[3]
Having RTFA: I think it's an interesting take to centralize zoning at the state level. Houston (which has no zoning ordinances) is a terrible place to live, but it's definitely an affordable place to live.
The incentives at a state level around housing might actually balance differently because at that level economic activity, jobs, etc. matter more than property taxes. Something that isn't often mentioned, because the focus is always on California or the US, is that property values are directly tied to the overwhelming majority of municipal budgets via property taxes incurred as a percentage of that value. Not only do constituents vote for more expensive residential property, local governments want expensive residential property even if their voters didn't.
This is exactly why California has been trying to move some of this power to the state level: local governments are fighting tooth and nail to hold on to their tax revenue.
ETA: The property tax thing is more complex, but still applies. States like Florida and California cap how much tax assessments can increase for property you own that is your primary residence.
This still encourages these states to drive up property values because it tempts you into cashing out via selling. Every state with this sort of cap also immediately reassesses real estate to the price it sells at the following year. A high property value versus the tax assessment is just a deferred revenue stream, so it's a driver to encourage consistent turnover in the market. The only real way to do that is to constantly drive prices up, which drives the cost of living up, which turns over the residents faster.
So capping tax assessments like that, just makes the cycle even more viscous, in my experience living in Florida for a time.
Billpay Checks are actually Cashier's Checks and are drawn from account numbers that aren't your account, btw. It's one of the reasons it's far more secure to pay any bill requiring a check this way.
Check fraud is massively on the rise. They don't even need a physical check, just the info. They're printing their own checks now and depositing them electronically. They also hire homeless right off the street to go in and cash the checks for them. Homeless keeps $100, the fraudsters make the rest.
If you're using checks the way you say you are, it's only a matter of time before you have to deal with swapping out bank account numbers.
Aha! That makes sense! Yes that can be a problem. We exclusively use a single (our own) IdP so it's less important for us. But good to know as some future feature work will actually make this important.
That's something that isn't OAuth2 or your end point is accepting something insane.
Are you talking about the PKCE variant of authorization code flow which is what replaces implicit flows in native apps and SPAs? Because those use code_challenge and code_verifier fields, not the state field. If you're doing all that in the state field with signed nonces you really should move to PKCE.
The server generates the auth code and redirects the user agent to your callback. You exchange that code with the IDP (over HTTPS which yeah that's its own nest of wormy trust) to get back a token. They can't inject a token because you don't get the token from them, just the one time code. If it's opaque you introspect it to validate or you just validate the JWT signature after pulling the keys from the JWKS endpoint. Introspection is standardized and an RFC. The state param is just a fucking session identifier.
All these URLs are defined and provided via the .well-known/openid-configuration endpoint. If your IDP publishes that endpoint correctly, most OAuth2 client libraries Just Work (TM) when pointed at the IDP domain.
Do EITHER of you even use OAuth2 outside of just cargo culting something you found off GitHub?
Most of these package systems being attacked run arbitrary code on your system when you install the package in order to allow native extensions to compile. Maven/Java simply downloads a (relatively) inert zip archive that your IDE might do some static analysis on to provide autocomplete.
Along with all the scanning and what not, I think that’s the biggest reason you see attacks primarily on npm, PyPi, and to an extent Ruby Gems.
Now, you have a lot of people taught that output (a working PR) is competence. They walk around thinking they are competent because they can produce output.
When faced with criticism on working code, they collapse and flail immediately because to admit they can't explain or defend the code is to admit they are not competent. From there you've hit pretty much all of the problems that the rest of the Internet suffers from: cognitive dissonance, digging in because being wrong threatens your constructed identity, constructing echo chambers of AI Influencers peddling the latest prompt, and so on.