I can't wrap my head around the idea that distillation is IP theft but mass training on books, music and art without consent is fair use. The two stances are incompatible. If it is transformative use of a book, it is transformative use of AI output.
I'm glad someone ran the numbers on this. Every single Simon Willison post of an SVG is followed with someone dismissing it saying "I'm sure they train on it by now." This is despite a good blog post with sound logic on how easy that is to catch. [1] Glad to see someone took the time for a quantitative analysis of dumb little animals riding dumb little bikes.
If you remove the word "AI" from your post it also describes the last 20 or so years of US/Chinese economic competition. They are real, serious competitor but also there is a lot of value in that last 10%. Some buyers need the best and you can charge a premium for it.
The speed in which a copier can catch up to a leader is faster than every before, but everything is faster these days. I think the threat is if can these labs catch up and pass American labs while keeping costs low, but I don't see that happening.
It looks like some of that high LoC is because they are vendoring some deps. There readme gives the reason to vendor some but not others as:
> These crates sit on the path that renders untrusted model output (diagram source → SVG). Vendoring gives a full audit surface, pins exact source, and avoids crates.io yanks. Local patches and upgrade checklists live in each crate’s Cargo.toml header comments — treat those as the source of truth when re-vendoring.
Which honestly feels like a misunderstanding of how cargo and yanks work. Each upstream package is locked to an exact version in your lockfile along with a cryptographic hash. The upstream can't change the source without you noticing. Unless you update your lockfile you will always pin to the exact version and source. When a package is yanked, it is still available for download if it is already in a lockfile. It just prevents new packages from resolving it. Crates.io will sometimes completely delete a package, but I've only seen that happen in cases of malware. It's fairly rare and seems out of line with the supply chain concerns here.
There are good arguments for relying on upstream package managers and there are good arguments for vendoring all packages. I've never seen a project mix before.
>If everyone starts applying cooldowns, won't it postpone the problem?
There are still research firms who are actively and aggressively scanning new packages once they are pushed. For example socket.dev pulls new packages across ecosystems and performs automated analysis and runs it in a sandbox. We don't have to have them go boom in someone's production repos to find out there is a problem.
Great article! Thank you. Also in case others walked away with the same question I had, I'll save you the googling: use the utility vrrtest to help validate if VRR is properly configured on your machine.
I think 3? I feel like that's often enough. Sometimes it's nice to do a quick dumb ass gag on a whim. If I am anything I am a man who loves a dumb ass gag.
Can't agree more. I was skeptical that Kagi could be that much better. I felt a little silly paying for a service that had always been free. After using it for a week I can't imagine going back.
Too many times I used to google my vet by name and the response would be some random other vet in next town over. I'd end up calling them and immediately hang up realizing google fed me bullshit again.
Kagi just focusing on a doing a good job. It's their singular focus and its worth ever cent.
That's a minor nitpick that probably worth making in this context. People often casually use free and open interchangeably, like the the person I responded to did. There are times when it does have a real semantic difference in meaning... but here? Not really. The thread is even about a free software project.
I agree with the rest of what you say. Politics, governance and identity are unavoidable in any kind of community. It's just part of it and unavoidable. It's about dealing with it fairly, clearly and with respect.
Oh my God. That's so exciting. I did a prototype a while back for writing UDFs in WASM for a query engine. The fact that everything needed to be copied in and out of the environment killed it. Excited to try it again if/when this lands
Not always. The calculations take its useful life expectancy as an input. If they estimate it correctly you have highly likelihood of it breaking, burning out or being woefully out of date by the end. At the 10 year window you are looking at losing support for security updates.
So if you are lucky you might end up with something that still runs but most folks won't find it particularly useful
GitHub has been basically the default for free public git hosting for a long time. I was curious what bitbucket has and it looks like the free tier is so limited, I can't imagine a lot of people hosting vibe coded open source there.