[-] Kissaki@programming.dev 40 points 2 months ago* (last edited 2 months ago)

I don't think there's a particular need to defuse into a productive discussion. Something like that, with no repro or respect - lock and close, with a comment on why/that onproductive and disrespectful/what it could have been.

Tone should always be respectful. Something like this should have been a respectful, open suggestion, explaining the issues no clear semver causes.

If they don't respond to your needs - you can accept it or leave/fork.

[-] Kissaki@programming.dev 42 points 3 months ago

Their original blog post

My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.

This is just one source code repository and maybe it is much better on other things. I can only tell and comment on what it found here.

So it's mainly about "maybe slightly better, not significantly better than existing tools, at least in the context of this single project" vs "greatest marketing stunt ever".

some more quotes from that post, if you just want these – specifically context about their process and other AI tools

Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean in addition to running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc). Primarily AISLE, Zeropath and OpenAI’s Codex Security have been used to scrutinize the code with AI. These tools and the analyses they have done have triggered somewhere between two and three hundred bugfixes merged in curl through-out the recent 8-10 months or so. A bunch of the findings these AI tools reported were confirmed vulnerabilities and have been published as CVEs. Probably a dozen or more.

but the PR review bots regularly highlight issues that we fix: our merges would be worse without them. The AI reviews are used in addition to the human reviews.

and dug into the details, we had trimmed the list down and were left with one confirmed vulnerability. The other four were three false positives (they highlighted shortcomings that are documented in API documentation) and the fourth we deemed “just a bug”.

The Mythos report on curl also contained a number of spotted bugs that it concluded were not vulnerabilities

All in all about twenty bugs that are described and explained very nicely. Barely any false positives, so I presume they have had a rather high threshold for certainty.

curl is certainly getting better thanks to this report, but counted by the volume of issues found, all the previous AI tools we have used have resulted in larger bugfix amounts. This is only natural of course since the first tools we ran had many more and easier bugs to find. As we have fixed issues along the way, finding new ones are slowly becoming harder. Additionally, a bug can be small or big so it’s not always fair to just compare numbers

Still very good

But allow me to highlight and reiterate what I have said before: AI powered code analyzers are significantly better at finding security flaws and mistakes in source code than any traditional code analyzers did in the past. All modern AI models are good at this now. Anyone with time and some experimental spirits can find security problems now. The high quality chaos is real.

How AI analyzers differ

  • They can spot when the comment says something about the code and then conclude that the code does not work as the comment says.
  • It can check code for platforms and configurations we otherwise cannot run analyzers for
  • It “knows” details about 3rd party libraries and their APIs so it can detect abuse or bad assumptions.
  • It “knows” details about protocols curl implements and can question details in the code that seem to violate or contradict protocol specifications
  • They are typically good at summarizing and explaining the flaw, something which can be rather tedious and difficult with old style analyzers.
  • They can often generate and offer a patch for its found issue (even if the patch usually is not a 100% fix).

We have not seen any AI so far report a vulnerability that would somehow be of a novel kind or something totally new. They do not reinvent the field in that way, but they do dig up more issues than any other tools did before.

I hope we can keep getting more curl scans done with Mythos and other AIs, over and over until they truly stop finding new problems.

[-] Kissaki@programming.dev 47 points 5 months ago

A code leak doesn't give a code and product use license. Any project and product use based on the leaked code is less stable and safe than other solid projects under clear terms. OpenCode is not obsolete.

27

After working on my weird shooter game for 5 years, I realized I'm never going to be finishing this project. In this video I explain why I've decided to quit my game and what is next.

17

From the README:

What is KORE?

KORE is a self-hosting programming language that combines the best ideas from multiple paradigms:

Paradigm Inspiration KORE Implementation
Safety Rust Ownership, borrowing, no null, no data races
Syntax Python Significant whitespace, minimal ceremony
Metaprogramming Lisp Code as data, hygienic macros, DSL-friendly
Compile-Time Zig comptime execution, no separate macro language
Effects Koka/Eff Side effects tracked in the type system
Concurrency Erlang Actor model with message passing
UI/Components React/JSX Native JSX syntax, components, hot reloading
Targets Universal WASM, LLVM native, SPIR-V shaders, Rust transpilation

Example

// Define a function with effect tracking
fn factorial(n: Int) -> Int with Pure:
    match n:
        0 => 1
        _ => n * factorial(n - 1)

// Actors for concurrency
actor Counter:
    var count: Int = 0

    on Increment(n: Int):
        count = count + n

    on GetCount -> Int:
        return count

fn main():
    let result = factorial(5)
    println("5! = " + str(result))
12

By streaming CSS updates/appends through an open HTTP connection

9

Girard's insight was that communities resolve internal conflict through scapegoating: the selection of a victim to bear collective guilt, whose expulsion or destruction restores social cohesion. The scapegoat need not be guilty of the crime attributed to it; it need only be acceptable as a target.

Some dangerous individuals, however, institutionalize such ritualistic practices into what I call Casus Belli Engineering: the use of perceived failure as pretext to replace established systems with one's preferred worldview. The broken feature is the crisis that demands resolution. The foundation becomes the scapegoat, selected not for its actual guilt but for its vulnerability and the convenience of its replacement. And in most cases, this unfolds organically, driven by genuine belief in the narrative.

The danger is not the scapegoating itself; humans will scapegoat. The danger lies in those who have learned to trigger the mechanism strategically, who can reliably convert any failure into an opportunity to destroy what exists and build what they prefer.

The linked article title is “Casus Belli Engineering: The Sacrificial Architecture”, which I didn't find particularly descriptive. I used the second headline, “The Scapegoat Mechanism”. It doesn't include the architecture or strategy aspects, but serves well as a descriptor and entry point in my eyes.

65

There exists a peculiar amnesia in software engineering regarding XML. Mention it in most circles and you will receive knowing smiles, dismissive waves, the sort of patronizing acknowledgment reserved for technologies deemed passé. "Oh, XML," they say, as if the very syllables carry the weight of obsolescence. "We use JSON now. Much cleaner."

21
8

In our previous post “Reinventing how .NET Builds and Ships”, Matt covered our recent overhaul of .NET’s building and shipping processes. A key part of this multi-year effort, which we called Unified Build, is the introduction of the Virtual Monolithic Repository (VMR) that aggregates all the source code and infrastructure needed to build the .NET SDK. This article focuses on the monorepo itself: how it was created and the technical details of the two-way synchronization that keeps it alive.

54

Users are not allowed to create Issues directly in this repository - we ask that you create a Discussion first.

Unlike some other projects, Ghostty does not use the issue tracker for discussion or feature requests. Instead, we use GitHub discussions for that. Once a discussion reaches a point where a well-understood, actionable item is identified, it is moved to the issue tracker. This pattern makes it easier for maintainers or contributors to find issues to work on since every issue is ready to be worked on.

This approach is based on years of experience maintaining open source projects and observing that 80-90% of what users think are bugs are either misunderstandings, environmental problems, or configuration errors by the users themselves. For what's left, the majority are often feature requests (unimplemented features) and not bugs (malfunctioning features). Of the features requests, almost all are underspecified and require more guidance by a maintainer to be worked on.

Any Discussion which clearly identifies a problem in Ghostty and can be confirmed or reproduced will be converted to an Issue by a maintainer, so as a user finding a valid problem you don't do any extra work anyway. Thank you.

39
submitted 8 months ago* (last edited 8 months ago) by Kissaki@programming.dev to c/programming@programming.dev

On January 1, 2026, GitHub will reduce the price of GitHub-hosted runners by up to 39% depending on the machine type used. The free usage minute quotas will remain the same.

On March 1, 2026, GitHub will introduce a new $0.002 per minute GitHub Actions cloud platform charge that will apply to self-hosted runner usage. Any usage subject to this charge will count toward the minutes included in your plan, as explained in our GitHub Actions billing documentation.

Runner usage in public repositories will remain free. There will be no changes in price structure for GitHub Enterprise Server customers.

We are increasing our investment into our self-hosted experience to ensure that we can provide autoscaling for scenarios beyond just Linux containers.

Historically, self-hosted runner customers were able to leverage much of GitHub Actions’ infrastructure and services at no cost.

11
submitted 8 months ago* (last edited 8 months ago) by Kissaki@programming.dev to c/uiux@programming.dev

This talk focuses on that evil little term “UX/UI,” which is responsible for so much confusion and tension in open-source projects. Not only does it unnecessarily pit programmers against designers, but it also limits our vision of what we could be doing.

In this talk, Scott Jenson gives examples of how focusing on UX -- instead of UI -- frees us to think bigger. This is especially true for the desktop, where the user experience has so much potential to grow well beyond its current interaction models. The desktop UX is certainly not dead, and this talk suggests some future directions we could take.

Scott Jenson has been a leader in UX design and strategic planning for over 35 years. He was the first member of Apple’s Human Interface group in the late '80s, and has since held key roles at several major tech companies. He served as Director of Product Design for Symbian in London, managed Mobile UX design at Google, and was Creative Director at frog design in San Francisco. He returned to Google to do UX research for Android and is now a UX strategist in the open-source community for Mastodon and Home Assistant.

They present a bit of history, terminology, and current and alternative approaches to human interfaces.

3

about the new and interesting changes and additions in .NET networking space. This time, we are writing about HTTP improvements, new web sockets APIs, security changes and many distinct additions in networking primitives.

5
[-] Kissaki@programming.dev 37 points 10 months ago

I prefer round[ed].

Think of it as a rounded square with a unique, pleasant shape.

I don't find them pleasant. I find them irritating.

Rounded square makes use of the space it reserves/square-fills. Squircles seem wasteful and confusing. They do not represent any common physical shapes, and waste/discard space they could use. They look like an old CRT.

[-] Kissaki@programming.dev 49 points 10 months ago

These terms included affirming the statement that we 'do not, and will not during the term of this financial assistance award, operate any programs that advance or promote DEI [diversity, equity, and inclusion], or discriminatory equity ideology in violation of Federal anti-discrimination laws,'

Insane. I can't even fathom adding such a condition. And to a well established org with a positive track record.

Toxic offer. Wouldn't even be able to say that inclusivity is a good thing.

[-] Kissaki@programming.dev 43 points 1 year ago

Baffling that the chain did not immediately respond with "we introduced new rules requiring all our stores not to allow smart glasses or other recording devices in their treatment rooms". Seems so obvious, yet we see nothing like that in the article.

[-] Kissaki@programming.dev 48 points 2 years ago

Codeberg published a blog post yesterday. They suspect (or know?) that it's a broadened attack because Codeberg hosts liberal and human projects.

In the past days, several projects advocating tolerance and equal rights on Codeberg have been subject to hate attacks, such as massive spam of abusive messages in their issue trackers. We have been monitoring the situation closely and have tried to clean up the content as quickly as possible.

Often, content remained available only for a few and up to 30 minutes. Due to constrained personal capacities, some rare cases have remained online for longer. We appreciate all your reports to abuse@codeberg.org that help us identify abuse quickly.

On 12 February 2025, an abuser has escalated the attacks to a next level. Instead of targetting individual projects, they have started to create abusive content and mentioned Codeberg users in chunks of 100 each.

(emphasis mine)

[-] Kissaki@programming.dev 36 points 2 years ago* (last edited 2 years ago)

Title: "is finally rolling out to the wild"

Content:

Ahead of Legion Go S shipping, we will be shipping a beta of SteamOS which should improve the experience on other handhelds, and users can download and test this themselves.

So, neither that product is rolling out yet, nor the SteamOS beta is rolling out yet?

(This quote is from Valves announcement, but meaning-equivalent to the linked article sentence regarding it.)

[-] Kissaki@programming.dev 47 points 2 years ago

CrowdStrike ToS, section 8.6 Disclaimer

[…] THE OFFERINGS AND CROWDSTRIKE TOOLS ARE NOT FAULT-TOLERANT AND ARE NOT DESIGNED OR INTENDED FOR USE IN ANY HAZARDOUS ENVIRONMENT REQUIRING FAIL-SAFE PERFORMANCE OR OPERATION. NEITHER THE OFFERINGS NOR CROWDSTRIKE TOOLS ARE FOR USE IN THE OPERATION OF AIRCRAFT NAVIGATION, NUCLEAR FACILITIES, COMMUNICATION SYSTEMS, WEAPONS SYSTEMS, DIRECT OR INDIRECT LIFE-SUPPORT SYSTEMS, AIR TRAFFIC CONTROL, OR ANY APPLICATION OR INSTALLATION WHERE FAILURE COULD RESULT IN DEATH, SEVERE PHYSICAL INJURY, OR PROPERTY DAMAGE. […]

It's about safety, but truly ironic how it mentions aircraft-related twice, and communication systems (very broad).

It certainly doesn't impose confidence in the overall stability. But it's also general ToS-speak, and may only be noteworthy now, after the fact.

[-] Kissaki@programming.dev 52 points 2 years ago* (last edited 2 years ago)

no no no, this is the wrong way around

because sales and marketing sell it before it even exists

[-] Kissaki@programming.dev 35 points 2 years ago

Is it because c++ devs need half their day for recovering from the trauma of reading and writing c++? /s

[-] Kissaki@programming.dev 43 points 2 years ago

The site name’s a play on “The Onion” so it’s gotta be satire, right? I couldn’t find an about page to confirm.

Yes, it's satire.

The page is run by one author https://www.theolognion.com/about and no description or goal described

Runs on "substack" platform (standard software)

The story reads like a story, and the mentioned company does not exist

view more: ‹ prev next ›

Kissaki

0 post score
0 comment score
joined 3 years ago
MODERATOR OF