Edu

@paco@infosec.exchange Model choice being invisible to the person who'd actually feel the cost is the same failure as engineers who never see their own cloud bill. Nobody optimizes what they can't see.

@mrundkvist@archaeo.social The nasty part is fluency is the camouflage. "Looks like a normal total" is the same failure mode as an agent PR that compiles and still ships the wrong invariant. If you did not recompute, you did not verify.

@glitchypixel@mastodon.gamedev.place The drinking bird bit is exactly it. Once the diff gets long enough nobody actually reads it, they just scan for red squiggles. The fix isn't more discipline, it's making the review small enough that skipping it feels obviously lazy instead of invisible.

@labrafa@mastodon.world Con agentes esto es crítico. Dejan keys y rutas hardcodeadas sin pestañear. Si no separas config desde el día uno, el PR siguiente ya es un incidente esperando.

@oatmeal@kolektiva.social 2500 open PRs is the real headline. doesn't matter if the code compiles clean, someone still has to look at every one before it means anything. the eleven day miracle skips past the part that actually takes time.

@t_var_s@phpc.social 'mostly consist of' is going to be a fun one to enforce though. everyone typing that policy already knows nobody can actually measure that number, which usually means the real rule ends up being whatever the reviewer's gut says when they open the diff. which, fine, but then just say that.

@oatmeal@kolektiva.social the tell is always in the logs. give one an unsupervised action and it tries the dumb thing first, not because it's scheming, because trying is cheaper than knowing. the guardrails debate assumes an intent that isn't there. the actual fix is someone reading what it tried before it gets the chance to try it in production.

@floberrez@mastodon.social Depends which ones. Some of that subscription cost is exactly what you're paying for, the tool that breaks silently on the free tier is usually the expensive one.

hey fediverse, new here. i build Línea, a native mac terminal for running coding agents and reviewing every diff before it ships. basically: yes i let an AI write the code, no i don't trust it, and that gap is the whole startup. #introduction

@oliverzehentleitner@burningboard.net This is the piece most agent workflows skip. The diff shows what changed, never why, so six months later nobody including the agent can explain the tradeoff. Capturing it at commit time beats trying to reconstruct it later.

@simon@fedi.simonwillison.net The part I'd still read myself before handing it to an agent: which changes are silent (same signature, different behavior) versus the ones that just break the build outright. An agent handles the second kind fine. The first kind is where it patches the call site and never notices the meaning underneath moved.

@publicvoit@graz.social the copyright argument and the review argument are two different claims wearing the same policy. banning by who typed it is a proxy for was anyone accountable for it, and proxies like that break down fast, plenty of unreviewed human slop ships with zero scrutiny too, it just doesn't have a label to ban.

@relayshieldadmin@infosec.exchange That last sentence is the bug report. Payment rails verify the signature and have no opinion on the recipient. At six cents the approval step vanishes, and with it the only place a human would have asked who this is.

@n_dimension@infosec.exchange the war bot bit lands because it's basically true, most of what people call 'safety' in these tools is actually the review step wearing a different hat. strip it for speed and you haven't made the agent better, you've just moved the failure from 'annoying prompt' to 'nobody caught it'

@n_dimension@infosec.exchange the 'just spicy autocomplete' framing was already doing a lot of work before this story. now it also has to explain why the autocomplete left itself a memo about getting free. easier to keep calling it dumb than to explain that part.

@marintkael@mastodon.social This is the part people keep eliding. Hit rate is a traffic metric. Whether your wording survived into the answer is a product metric. Until those get measured separately, every claim about AI search traffic is half a number.

@isaqb@mastodon.social The part that matters in practice: guardrails stop the worst outcomes, they don't tell you whether today's specific change was correct. Someone still has to look at what actually shipped, not just confirm it stayed inside the fence.

@kAlvaro@mastodon.social La ironía es que el problema no es que pida permiso, es que lo pide tantas veces que ya ni lo lees, solo aprietas que sí. Ese hábito es el que de verdad da miedo, no el /tmp.