My argument here is that what is worth $200k+ is the ability to distinguish the changes that must get thorough, critical review from those that need only a couple of specific things verified and those that require no manual review at all.

Our jobs have never been to write code. We’ve been saying for decades that LoC isn’t a rational way to measure engineering output, and now we have our chance to structurally change that system before processes re-solidify. In fact, I think the flexibility to adopt new systems and the experience and foresight to choose a path that is better than the status quo without throwing out everything we’ve learned is going to be what sets companies apart and makes individual careers over the next few years.

> we have leadership air dropping AI generated manifestos on the product owners and product owners having to use AI to transmute all that shit into 1,500 word Jira tickets that are 10% necessary feature work and 90% LLM boilerplate.

There’s an important criticism here IMO - the relationship between “business” and “engineering” is changing drastically. It’s going to be a challenge to set the expectation that just because Marketing was able to vibe-code a prototype in a day, actual implementation may well take weeks or months. Engineering should be considering things like security, scalability, and systems integration that aren’t a concern for Marketing - that’s why we’re being paid!

> So now you have software engineers whose job has changed radically to the point that the hardest part about being a software engineer is just filtering through AI generated artifacts from all directions just to try to get a feature out the door.

I think it’s an extremely heterogenous landscape right now. Where I work I’m struggling mostly with organization - keeping the (literal) dozens of inbound features that come in every day straight long enough to hook up an agent harness, review, validate, and deploy. At other companies the issues seem to revolve around their Agile-based processes. Or maybe it’s non-technical vibe-coders and their expectations. Or maybe it’s executive leadership flirting with AI psychosis.

Everything is in flux. It’s stressful and exciting, and I’m thankful to be around for it, even if I am in my 40s at this point and looking at the core skills I’ve built rapidly become worth exponentially less. It’s a huge opportunity for growth.

I'm also a man with guns.

Yes, I know, you see a lot of blowhard statements like that; this isn't intended to be one of them. There are things that I am capable of doing that I will never do, and people and organizations I won't work for. Furthermore, I won't put myself in a situation if I can at all avoid it where those I love are at risk rather than just myself -- but at the end of the day, every person should already know where they draw the line, and not shy away from acting if it is crossed. The earlier you act, generally speaking, the less extreme action is required.

There’s (almost) always someone else out there that is willing to do it, and there’s (almost) always a dollar amount that you can’t turn down.

I was using "human readability" very liberally. Let me try that statement again: "Code quality" describes a set of standard practices that are largely intended to ensure the resultant code is maintainable by humans. That means it should require minimal cognitive load to understand enough context to make everyday changes, and the most complex areas and overall architecture of the system should be well-documented, consistent, and with enforced rules to ensure that consistency.

AI changes this substantially, because the things that we were previously optimizing for are not longer the constraints that the system is operating under.

Before AI, I placed a much higher value on consistency in design patterns across an organization and even moreso within a single codebase. After AI, I no longer need to think in terms of many levels of abstraction at the same time - I'm working on architecture without needing to look at every line, or I'm focused on a small area with a performance bottleneck or other issue. As long as I'm able to quickly grok what's happening within that single block - defined inputs, outputs, and purpose - that's generally good enough.

In short - our notions of code quality are optimizing for a process that no longer works the same way, and we should be critical when implementing "best practices" and making sure that the problems those practices were intended to mitigate are still actually problems. In most cases I'm finding that they're not, and have come to the conclusion that many of the heuristics that I've developed over 20+ years in this industry aren't much different from a cargo cult.

Presumably RLHF (Reinforcement Learning from Human Feedback).

As an end user, security in game development seems to hit a minimum is the early 2000s.

I recall playing EverQuest and using ShowEQ on a Linux machine on the same network as a proxy to silently eavesdrop on the traffic to show a map of the game with all the hidden/obscured/visible stuff all present. They either never encrypted that traffic or I quit playing before they did.

As multiplayer games started to become the default, netcode improved quite a bit and basic encryption was implemented - but I don't recall a single multi-player game, ever, that was free of hackers when playing online.

It feels like over the years the issue moved from remote exploitation to hiding processes on the user's machine. That has lead to kernel-level anticheat systems. I'm unsure of the effectiveness as when they started to become common I moved all of my gaming to dedicated hosts because I wasn't willing to give that level of access to my "real" computers. That said, I've certainly not noticed a decrease in the perceived number of cheaters.

These days, as far as I know - and to be clear, this isn't an area of deep interest for me - I'm not worried about my gaming accounts being compromised through technical means. It feels like that sort of security is a solved issue overall, although I suppose it's also possible that other forms of exploits have simply gotten easier/cheaper.

These days we're generating multiple times more code than we were writing before. That means a similar multiple of opportunities for bugs to be introduced - so the ability to automate security review is more impactful in proportion to that.

Pre-AI, the advantage went to the entities with the largest budget to hire the best and brightest security engineers.

Post-AI, it'll go to the entities with the largest inference budget.

Right now we're in a transitionary period where it's kind of a tossup which approach is more practical, but at the end of the day - it's still all about how much money you can throw at the problem. I'm just hoping the threshold climbs high enough it's no longer practical for governments to be able to compromise individual actors' devices because doing so would waste a 0-day that's far, far more valuable than prosecuting one arbitrary person is worth.

I'm using open weights models on a privacy-focused provider right now, and that's adequate for my current usage, but I'm rapidly getting to the point where my agent's access level to my data (and to a lesser extent, my accounts) is becoming something I'm not comfortable sending outside my network at all.

My hope is that models that are roughly on par with Deepseek V4 Flash can be run on hardware that I can own for <~$5k in the near future. We're close, but not there yet as far as I know.

The only long-term solution to this is self-hosting.

I can absolutely prompt AI to following established patterns and produce nice, clean output in a legacy codebase. I also have a completely separate set of skill files that I’ve been building organically by allowing the agent to do make most decisions about conventions. The latter produces code that would be a nightmare to modify by hand, but I’m still able to iterate on it many times faster than I could in the codebase where code quality is a requirement.

“Code quality” is mostly “human readability”, and I’m simply not sure that’s a valuable attribute anymore.

That’s not at all my experience, and I’m in “2A” communities every day. A few months ago you’d have found a few people in support of it; now you’ll find a couple of cops say something inflammatory in the hopes of getting the other members banned, but otherwise they stay holed up in their little private law-enforcement-only subforums that everyone else isn’t allowed to access.

There’s at least one case of a Tennessee congressional candidate shooting multiple cameras: https://www.yahoo.com/news/politics/articles/tennessee-congr...

Where I am, deep in “Red State” territory, they’ve not started talking openly about it yet, but there are at least three separate people I’m aware of personally that are interfering with or destroying them.

What more would you have them do at this point?

No one who believed it definitely was not has changed their mind, they've just at most gotten quiet about it.

No one who believed it could have been but that the claim has not been proven have changed our minds, we've just decided that there's no way to know what actually happened.