0) agent gets its own separate git user and ssh key, separate from mine

1) branch protection rules on main, only I can approve merges into main

2) any other ssh key uses (interactive login, direct git access, etc.) are ed25519-sk keys and require a touch on yubikey.

TBH, the biggest hole is that it can be unclear exactly what process is requesting a touch on the yubikey. Apple has a head start here because they can lock down the TouchID UX relatively well, but unfortunately they don’t seem to care about building a polished developer experience for 2FA on sensitive tasks.

They are probably waiting for someone else to build the right solution and then copy/steal it.

Seriously though if you are letting agents do whatever they want without a PR process that requires hardware authentication or proof of presence, you are putting your code and your org at high risk.

Is that inclusive of the entire egg->fry->fish cycle? I wouldn't be surprised if wild fish had extremely high "infant mortality" compared to hatchery fish

I don't know what the political undertones are here, but at some level you need to have actual ground truth, including "this person/household declined".

Publishing raw data though? That seems like shooting yourself in the foot from a national security perspective, not to mention all the other reasons not to do it.

If Gemini seems stupid nowadays, it's only because they're being stingy with compute allocation.

0 - https://en.wikipedia.org/wiki/Piper_(source_control_system)

Ableton and Max are totally separate codebases, and "Max for Live" is just a ~VST interface between them.

I do agree that "scriptable Ableton" would be far better for production and sound design than Max, because they make all the hard parts easy: MIDI, sequencing, mixing, etc.

In Max, you have to build everything from scratch, every time.

However, you're right that most people at these companies are so accustomed to the "free money faucet" from ads, huge margins, etc. that it's incredibly easy to end up totally disconnected from reality. That's probably what frustrates you the most.

I will say - after having left Google just about a year ago now - that there is literally no better time to make money in tech than right now. AI is eroding the moat of all large tech companies, and skilled individuals with passion and drive can make a huge impact on the world with an incredibly small budget.

You'll make it. All of us will.

Margins are incredibly thin unless you're on the bleeding edge. It's not an easy business. You need to move millions and millions of chips to make a profit, and that means your FAEs are working directly with companies who are actually paying you for chips instead of trying to write perfect documentation for the open source community.

the biggest issue is that actually contributing to upstream is an *incredibly* difficult and painful process.