I think some of these are excited, eager users always ready to hype up the new thing. The same crowd that previously would constantly push for a rewrite from angular->react->svelt->god knows what. Instead now it is on a 6 week cycle and about models/harnesses.

I think most of it is bot driven spam by the various labs. It's hard not to notice 3 month old accounts with very strong opinions about various frontier labs and little else.

Ultimately, I think some of it is legitimate shifts in who's in lead and what is the best. You gotta dig through a lot of crap to get to that, and I don't really know how to to.

Ultimately I'm saying is that I always applied a fair amount of skepticism about what I see in comment sections but these day it is extreme amounts.

https://risky.biz/RBFEATURES27/

I don't think you can put this on Zed. An unprivileged userspace application, even if coded poorly, shouldn't crash the machine.

1. https://simonwillison.net/2025/Nov/13/training-for-pelicans-...

The speed in which a copier can catch up to a leader is faster than every before, but everything is faster these days. I think the threat is if can these labs catch up and pass American labs while keeping costs low, but I don't see that happening.

> These crates sit on the path that renders untrusted model output (diagram source → SVG). Vendoring gives a full audit surface, pins exact source, and avoids crates.io yanks. Local patches and upgrade checklists live in each crate’s Cargo.toml header comments — treat those as the source of truth when re-vendoring.

Which honestly feels like a misunderstanding of how cargo and yanks work. Each upstream package is locked to an exact version in your lockfile along with a cryptographic hash. The upstream can't change the source without you noticing. Unless you update your lockfile you will always pin to the exact version and source. When a package is yanked, it is still available for download if it is already in a lockfile. It just prevents new packages from resolving it. Crates.io will sometimes completely delete a package, but I've only seen that happen in cases of malware. It's fairly rare and seems out of line with the supply chain concerns here.

There are good arguments for relying on upstream package managers and there are good arguments for vendoring all packages. I've never seen a project mix before.

There are still research firms who are actively and aggressively scanning new packages once they are pushed. For example socket.dev pulls new packages across ecosystems and performs automated analysis and runs it in a sandbox. We don't have to have them go boom in someone's production repos to find out there is a problem.

Too many times I used to google my vet by name and the response would be some random other vet in next town over. I'd end up calling them and immediately hang up realizing google fed me bullshit again.

Kagi just focusing on a doing a good job. It's their singular focus and its worth ever cent.

I agree with the rest of what you say. Politics, governance and identity are unavoidable in any kind of community. It's just part of it and unavoidable. It's about dealing with it fairly, clearly and with respect.