I think the seeing the underutilized commands and flags (with real data not just a hunch) would have helped identify where users were not understanding why they should use it, and could have helped refine the interface and docs to make it gradually more usable.
I mean no solution is perfect, and some underused things are just only sometimes extremely useful, but data used smartly is not a waste of time.
Relatedly, I think that success in post-AI business will be about doing more with the same or more people, not the same with less. Like you say, the AI part reduces the value and increases the availability of anything automated, so competing by trying to fire the most people to do keep doing the same job is simply not the game of anyone wanting their business to survive.
You have to provide scale and quality that was out of reach before and is now table stakes (whenever now is for a given industry).
Our clandestine services will spend years getting people into the right places. I mean at at certain point the difference between the two blurs, and the social engineering entirely overlaps.
I took the plunge, I loved my RM2 but about a year ago I fell down stairs and landed on it.
I’ve ordered refurbed Paper Pro and Move.
Things that excited me about the device:
- with significant AI use I feel I need this more than ever. Drafting, thinking, note taking, annotating etc.
- it looks wonderful for todos, shopping lists etc.
- width designed to work with Paper Pro (and the landscape mode experience seems solid from reviews), so I will try the dual device setup
- I didn’t always have RM2 with me, and I’m hoping this will now change to genuinely always.
- I learned to love the constraints and for example I’ve discovered a love of Brandon Sanderson, Liu Cixin, Cory Doctorow, and countless other authors precisely because I went all in on DRM free ebooks, I want to expand that to graphic novels also hence the paper pro.
- I do get random inspiration and obsidian has been my powerhouse for oh the go notes but I’m hoping scrybble.ink will now let me bring remarkable documents into obsidian.
- very un-invasive to take notes in conversations etc.
Sure it’s a complete indulgence, but it helps me to enjoy note taking, being my library with me etc. and I find constraints foster my creativity and exploration and I lean into them.
I’m one of main devs of GitHub MCP (opinions my own) and I’ve really enjoyed your talks on the subject. I hope we can chat in-person some time.
I am personally very happy for our GH MCP Server to be your example. The conversations you are inspiring are extremely important. Given the GH MCP server can trivially be locked down to mitigate the risks of the lethal trifecta I also hope people realise that and don’t think they cannot use it safely.
“Unless you can prove otherwise” is definitely the load bearing phrase above.
I will say The Lethal Trifecta is a very catchy name, but it also directly overlaps with the trifecta of utility and you can’t simply exclude any of the three without negatively impacting utility like all security/privacy trade-offs. Awareness of the risks is incredibly important, but not everyone should/would choose complete caution. An example being working on a private codebase, and wanting GH MCP to search for an issue from a lib you use that has a bug. You risk prompt injection by doing so, but your agent cannot easily complete your tasks otherwise (without manual intervention). It’s not clear to me that all users should choose to make the manual step to avoid the potential risk. I expect the specific user context matters a lot here.
User comfort level must depend on the level of autonomy/oversight of the agentic tool in question as well as personal risk profile etc.
Here are two contrasting uses of GH MCP with wildly different risk profiles:
- GitHub Coding Agent has high autonomy (although good oversight) and it natively uses the GH MCP in read only mode, with an individual repo scoped token and additional mitigations. The risks are too high otherwise, and finding out after the fact is too risky, so it is extremely locked down by default.
In contrast, by if you install the GH MCP into copilot agent mode in VS Code with default settings, you are technically vulnerable to lethal trifecta as you mention but the user can scrutinise effectively in real time, with user in the loop on every write action by default etc.
I know I personally feel comfortable using a less restrictive token in the VS Code context and simply inspecting tool call payloads etc. and maintaining the human in the loop setting.
Users running full yolo mode/fully autonomous contexts should definitely heed your words and lock it down.
As it happens I am also working (at a variety of levels in the agent/MCP stack) on some mitigations for data privacy, token scanning etc. because we clearly all need to do better while at the same time trying to preserve more utility than complete avoidance of the lethal trifecta can achieve.
Anyway, as I said above I found your talks super interesting and insightful and I am still reflecting on what this means for MCP.
Mobile voice call compression sucks so much that about a decade ago, in order to play a live drum audition remotely, I once had to find a space with a landline and printer that would also let me play loudly drums to do it.
As a student I had none of those things.
In the end I concocted a successful scheme where I would buy a series of phone extension cables, convince my university bar to allow me use their landline for a while, book a drum practice room and wire the cables in a long chain carefully to it, using duct tape to keep the cables safe and above door frames etc.
Then I had to join the call, and when it was sight reading time run to the library to print out the sheet music, run back down and play it down the phone.
It was intense, but I got the gig and flew off and sailed around the Baltic gigging for a few months in the orchestra/show band which was awesome.
I really wish that a mobile phone would have worked, it would have saved me a huge amount of stress.
Making publication easy on social media has certainly had an impact on public speech, but private platforms do not offer free speech by design.
Naomi Klein went into this in No Logo with shopping malls replacing public spaces where you also don’t have a right to free speech and can be evicted arbitrarily at the owners discretion.
You’ll find virtually all of social media platforms have moderation, usage policies and user banning practices that go well beyond allowing the fully legally protected free speech you are afforded in a public space (in many countries).
And I think it answers the product vision for it well (why it’s automatic):
> We have used this idea at GitHub with great success, and now treat garbage collection as a hands-off process from start to finish.
GitHub also provides these docs for what to do if there is sensitive data in your repo, which is quite involved and (given the huge amount of knowledge internally of both GitHub internals and git internals), I would trust their advice:
If you feel strongly that a feature you need is missing, by adding your voice, you increase visibility of the request. I think GitHub does offer solutions to this problem though, including eventual GC automatically.
Full disclosure, I work for GitHub, but push protection from Secret Scanning is awesome for this because your nearly leaked secret doesn’t make it to the remote, and it gives you instructions on how to fix your local repo!
Yep, I’ve very much discovered and confirmed this behaviour independently, I was so shocked to learn that it was a known issue.
I know it’s silly but it helped me with imposter syndrome to see such a major OS that prides itself on seamless “it just works” experiences tolerate bugs like this.
That and the fact if you airplay a movie to Apple TV it thinks you want it to cast over the top of it with random advert videos in your web browser, so you can’t watch and browse.
In the worst case you can copy paste a patch into a new local file in the repo and then apply it with git from there. I’ve had somebody slack me patches before and it is not a big lift.
Good induction cookers and electric car chargers, heat pumps and things really do often require the high voltage for best function so this high voltage three-phase is also becoming standard for the energy transition.
I had to upgrade my electricity meter and switch box (even though as mentioned three-phase to the house is already standard) recently in order to accommodate planned environmental upgrades.
Perhaps you’re correct, but I’m not saying don’t take an offer from the company. More an advice to accept a little risk that the exploding offer won’t explode and carry on with your job hunt. My advice above was to keep as many cards in play as you can, and recognise where you have leverage (which includes sunk cost of qualifying you as a candidate to hiring company), and try to maximise that leverage as it normally gives you a better return than any in-role pay rise and promotion prospects once you start new role.
Recognising you don’t have much leverage and have no option but to be exploited is a sad reality to have to accept, but of course if your job prospects are not great then that can be the case, and then maybe at least you can wait until the last day before you accept an exploding offer, where you have more knowledge of how the rest of your interview pipeline is progressing.
> In my last job hunt no company turned down this request and two adjusted their processes to accommodate it.
It’s not that companies don’t want to hire fast (or don’t need to), I’ve worked at startups (in UK too), big tech and worked on hiring.
But if the rush is in their side and they want you, that’s different to an exploding offer in many ways, in that they aren’t trying to pressure you to move fast to improve their negotiating position and worsen yours, they’re the ones on the weaker position, and to get you to move fast for them, that gives you leverage.
You decide if you care about the offer and the company/role etc. and then ask them for a deal that’ll make you cancel your other interviews now in that case.
Never accept an exploding offer. If they won’t give you more time, then let them see you’re prepared to let it lapse. It’s a ploy to create urgency when there is none, as is never in your interest as a candidate. I’d be very surprised if a single offer actually expired, it’s expensive to lose qualified candidates for the hiring company.
By access I mean you can view them in the MuseScore app so you can learn them and play them, but printing and downloading as a PDF etc. are not permitted.
I wanted to print one such score a few weeks back and was very frustrated to discover I couldn’t.
That’s not a glitch. You cannot download all PRO scores. With PRO you can:
- download regular scores
- access PRO scores but only download ones that are not “official HQ” with copyright restrictions.
> The new category of scores called official HQ scores is not allowed to be downloaded or printed according to the copyright owners' requirements. However, these scores can be viewed, played, and used in Practise mode.
ChimeraOS was previously called GamerOS and when SteamOS stagnated it was basically an attempt at a new Linux big picture SteamOS with evergreen distro but with versioned upgrades (it was SteamOS but better at the time). It also uses Arch kernel but with a sort of immutable update approach that I’m certain was the inspiration for the current SteamOS.
Very cool project, could do with screenshots and things, and the rename made it more cryptic but it is genuinely excellent and earlier in the project it was a clear lifeline for abandoned (by valve not releasing new versions) SteamOS devices.
I mean no solution is perfect, and some underused things are just only sometimes extremely useful, but data used smartly is not a waste of time.