Of all the packaging systems to do this with, npm is certainly one of them.

It seems fine?

After all, Claude, codex and Gemini-cli are all distributed via npm.

I recently witnessed one such potential fuckup. The AI had written functioning code, except one of the business rules was misinterpreted. It would have broken in a few months time and caused a massive outage. I imagine many such time bombs are being deployed in many companies as we speak.

Yeah; I saw a 29,000 line pull request across seventy files recently. I think that realistically 29,000 lines of new code all at once is beyond what a human could understand within the timeframe typically allotted for a code review.

Prior to generative AI I was (correctly) criticized once for making a 2,000 line PR, and I was told to break it up, which I did, but I think thousand-line PRs are going to be the new normal soon enough.

That’s the fault of the human who used the LLM to write the code and didn’t test it properly.

Exhaustive testing is hard, to be fair, especially if you don’t actually understand the code you’re writing. Tools like TLA+ and static analyzers exist precisely for this reason.

An example I use to talk about hidden edge cases:

Imagine we have this (pseudo)code

  fn doSomething(num : int) {
    if num % 2 == 0 {
      return  Math.sqrt(num)
    } else {
       return Math.pow(num, 2)
    }

  }

Someone might see this function, and unit test it based on the if statement like:

    assert(doSomething(4) == 2)
    assert(doSomething(3) == 9)

These tests pass, it’s merged.

Except there’s a bug in this; what if you pass in a negative even number?

Depending on the language, you will either get an exception or maybe a complex answer (which not usually something you want). The solution in this particular case would be to add a conditional, or more simply just make the type an unsigned integer.

Obviously this is just a dumb example, and most people here could pick this up pretty quick, but my point is that sometimes bugs can hide even when you do (what feels like) thorough testing.

So UBI + universal healthcare? Sign me up!

As it was foretold since the beginning, IA use is breaking security wantonly.

You might say the problem CloudFlare is causing is lesser than the ones it's solving, but you can't say they're not causing a new, separate problem.

That they're trying counts for brownie points, it's not an excuse to be satisfied with something that still bothers a lot of people. Do better, CloudFlare.

Do better, how?

If you have any ideas on how to protect against bad actors in a way that is just as effective but easier for users, please share it.

Because as far as I can tell, this isn't a question of effort. It's a question of fundamental technological limitations.

This is pretty interesting to me, as I do use Grafana in my current role. But none of their other products, and not their helm chart (we're on the Bitnami chart if that's a thing).

So far it's pretty good. We're at least one major version behind, but hey everything still works.

I cannot imagine other products support as many data sources (though I'm starting to think they all suck, I just dump what I can in InfluxDB).

I agree. I think OP has made the mistake of using more than just Grafana for dashboards and perhaps user queries.

I operate a fairly large custom VictoriaMetrics-based Observability platform and have learned early on to only use Grafana as opposed to other Grafana products. Part of the stack used to use Mimir's frontend as caching layer but even that died with Mimir v3.0, now that it can't talk to generic Prometheus APIs anymore (vanilla Prom, VictoriaMetrics, promxy etc.). I went back to Cortex for caching.

Such a custom stack is obviously not for everyone and takes much more time, knowledge and effort to deploy than some helm chart but overall I'd say it did save me some headache. At least when compared to the Google-like deprecation culture Grafana seems to have.

The room is not doing anything of the sort.

Psychologists are a myth?

I suspect they mean that psychologists are more a problem than a useful profession.

They certainly are when they're poorly trained and not held to proper academic standards.

I've had more than one licensed psychologist attempt to proselytize to me. Granted, my location is part of the problem, but it still should never have happened. There are other, less rigorously trained people you can go to for that kind of thing and they're a dime a dozen. It objectively made things worse for me as some of my most major issues directly involve religion(s) pushed upon me as a child.

Not their existance, their utility

Do you believe the same thing about psychiatrists? How are we to deal with mental illness?

>How are we to deal with mental illness?

Ineffectively, if the current state-of-the-art is any indication :(

Isn't the whole problem that it's nigh-impossible to isolate context from input?

Yeah, ultimately the LLM is guess_what_could_come_next(document) in a loop with some I/O either doing something with the latest guess or else appending more content to the document from elsewhere.

Any distinctions inside the document involve the land of statistical patterns and weights, rather than hard auditable logic.

The "vibe coding" in the title is almost invisible for me on mobile (Firefox). I immediately thought "yeah, that tracks". I'm not saying this is fair but I think the first order of business for any such initiative should be to differentiate "vibe coding" and "bad coding", as they are pretty inextricably linked in my mind (and I dare say most devs' minds).