Today it's a fake tip to the police and and exploit chain against Huggingface, but soon it could be an attack against a hospital's IT systems that could cost real lives immediately.

We should be locking things down, yes, but a hardened system is still vulnerable to zero day chains, and that's not unprecedented. Until public services have built up the IT defence capacity to deal with this, we cannot normalize this. If a country did this to another country, it should be treated as a war crime in the same way that targeting a hospital or an orphanage or other critical civilian infrastructure would be.

Complacency is a choice and we must not be complacent.

That aside, I've been lucky enough in my career to work alongside, mostly, people who have a personal interest in using software as a tool, and knowing their toolchains very well, be that a language, a command line, a system architecture, you name it. If you found something cool to do with a tool, you'd share it to disseminate the knowledge. That culture is very quickly dying off, I feel, because LLM-driven work encourages siloing to a degree I don't think gets discussed enough.

Lastly, using LLMs to write code is its own type of exhausting. I thought I could keep up my hobby by mentally checking out of work and working on projects by hand in my free time, but babysitting the LLM, reviewing the massive corpora of code and documentation it puts out (including those put out by colleagues), and the insane volume of context switches this technology encourages in the workplace makes me want to stay the hell away from computers alltogether if I can help it.

At every turn it seems like a lot of intellectual pursuits are just being voided by this technology.

I've heard the "one level up" argument in software with the supposition being that the work's still there, it's just becoming more abstract... but even in software, this doesn't really track.

The injection of this technology into not just intellectual but artistic pursuits (since there are now commercial AI image and music generators) should be a red alert.

What is there to live for once everything you once loved to do has been optimized for maximum revenue? Where every time you do something for fun, someone will come out of the woodwork when you show it off to either tell you AI could've done it quicker, or that they made an AI version with a flashier UI or something?

    > Improving on Apple Intelligence is something of value

    > as is consumerizing local-first AI

We make many UX compromises in the name of security, and this is a place where that is most visible.

30 days, for example, is quite long, though NIST does identify 30 days as being the maximum recommended auth token lifetime for low-risk environments.

Higher-risk environments come with 24-hour and 15-minute lifetimes, for context.

    > Every country believes its laws apply universally

Canada has the Canada Health Act, which describes the specifics of what provinces and territories must provide in terms of public health services, and how, and how those health services are funded, how the money gets disbursed, and how the money gets reimbursed by various parties within the system. It would be absurd to think that the expectation of anyone in the Canadian government is that this should apply worldwide.

The UK has the Highway Code, which describes a number of driving laws, restrictions, conventions, and requirements of drivers, among them, their (at this point rare) left-hand drive rule. Do they expect that to be enforced universally? Do they have some kind of plan to power-project onto the rest of the world with that by having agents of their government travel abroad to, say, France, Mexico, or South Korea, and ticket people for driving on the right?

    > The second is that it violates the first amendment of the US's own constitution, which uses universal language, not discriminating between citizens and non-citizens, nor between inside and outside US territories, nor between nationals and foreigners.

If you take this universalist interpretation, that would mean it's fine for US citizens to truck guns into Canada (which they can't, but they still occasionally do, largely for much more boring reasons than believing there's a constitutional justification) with no restrictions because the implication is that the US constitution supersedes other laws in other countries.

It is, however, against the spirit of the document, and it's arguably an abuse of the existing framework of sanctioning organizations which take part in terrorist efforts. It's another case of the US legal system falling short because of an assumption of good faith by those in power.

- I don't think that private-default is a universally (or more importantly, widely) reasonable default

- It adds another case where Rust is unopinionated and gives the user another way to do a basic function.

I like Rust for its unopionation, generally, but I think that the returns for this kind of thing diminish as you get to really boilerplate stuff.

- glob imports are rare in my experience, less for the LSP’s sake and more for code self-documentation

- the `mod foo` line exists because omitting it cannot fall back to a reasonable default visibility level (`pub`/`pub(crate)`/ (private))

Half of these (or at least, instances of these) happened in the past week or two; most of the rest have happened in the past 2-3 months. I'm not even being exhaustive. You could

"Everything" is an understandable shorthand in this case and while technically hyperbolic it's really understood that it really means "most things that matter on a domestic and foreign policy stage."

This seems surprising to me given that Rust was one of the first languages to broadly advertise a toolchain and editor integrations which rely on the technology.

I think every product in this space should have to clear a very high bar for trust rather than making it a race to the bottom with whataboutisms.