There are lots of people who like python and want to use it for things that where incorrect code has serious consequences. Type checking is helpful in these contexts.

Type checking remains optional for the masses and is not practical in many cases. Still, pushing away people who want to use all available tools for writing correct python only hurts the community.

I wouldn't count that as evidence that AI tooling makes it easy to build useful software without much effort.

I've used agentic tooling at work for almost a year now, to great affect.

Tools are helpful, but in my experience they are not to a point where building things useful software is easy or simple.

Most of the things I have seen or heard described are neat demos that someone might play with a few times before forgetting about.

Of the projects you mentioned above, how long did you spend building them relative to how long they've been regularly used? Are you using them on a regular basis? If so, are they published somewhere for other people to use as well?

But I have yet to see any results? Where is the useful stuff?

Better privacy, good results, no drama, first search engine to include bangs, and its free!

The current baseline workflow is something like agent output -> human review -> agent refinement -> human review -> agent refinement -> ...

But agents are capable of making meaningful improvements to their own output. I'm hoping dynamic workflows move towards something like:

agent output -> agent review -> agent refinement -> (cycle to fixed point) -> final human review

This seems problematic.

Students' success isn't entirely up to the school. Some areas genuinely need more resources than others.

This system punishes areas that need more resources with by removing resources, likely causing a downward spiral.

A generation of kids is left with poor education before the schools eventually close, and then who wants to start a school in an area that has historically struggled when funding depends on them succeeding?

Based on happenings in other states, when public schools close the schools that take their place are from well funded groups who care more about spreading ideologies than running successful or profitable schools.

With things necessary for a dev env, like read/write access to source control, attackers can get access to internal data, and push malicious code that gets run in a prod env anyway.

If you want to make the claim that using react is an insane indefensible choice from a security standpoint, you are being idealistic at best.

Telling people not to use react does not help anyone, and that type of recommendation causes reputational damage to the security industry.

Most of the recent supply chain attacks specifically target stealing secrets from development environments.

> But hey thanks for proving me right about the unhinged complaints.

I'm sorry if I'm upsetting you, but I am not complaining or trying to provoke you.

"Just check in the dependencies and review them" is not a revolutionary idea. It makes sense in many contexts.

But it is not practical in the overwhelming majority of contexts. React's last minor version bump included 100 files and ~5k changes. It also bumped the versions of 6 direct dependencies, which in turn bumped dependencies, etc.

It is not reasonable for a small (or even medium) team using react to manually review all of the changes and all the changes in react's transitive deps each time they need to update. The problem grows exponentially with all of the other common projects and libraries likely being used in a front end project(vite, react router, redux, vitest, etc).

pick a few non-trivial npm projects and try to audit all of the changes (for all transitive dependencies) for a few releases that bumped dependencies.

They are basically describing a public API backed by a private type that they can extend, rearrange, or otherwise modify without breaking the public contract.

If I search topics I am knowledge about, the overviews are almost always at least slightly wrong.

Not all websites are correct sources of information, but I am generally aware of which websites are trustworthy and can cross check.

If you already had left pad cached then you were not affected by its disappearance.

If a package needs an install script to be used, to compile some native code for example, you still need to run the install script before you can use the package.

Manually repeating the actions npm does automatically does nothing to protect you from supply chain attacks.

The only thing that helps is to review code before you run it. How the code got to your machine before it was run does not matter.

It seems like you lose a lot (automatic memory safety, simple language, easy concurrency) and gain very little.

If you blindly copy in changes how is it any different from npm pulling in those same changes, other than being much slower?