A CNC shop wouldn't start because someone decides "I want to start a CNC shop".

It would start cause some guy has a mill and a lathe for hobby stuff, and does some work for a mate or a local business.
And then gets more work, and gets work that requires CNC, and gets more work than 1 person can deal with, and then needs more machines and machinists and CAD tech and designers and so on.

Yeh, a business could get something from PCBway or whatever. But maybe they need it by the end of the day, or maybe they need an opinion on something, or maybe they can't do the actual technical document production but can provide some measurements and a rough sketch.

Apply that to anything.
The UK Army's L96A1 was made by 3 guys in a shed.

The Ministry of Defence wanted Accuracy International to submit an entry, but when they won handily, suddenly the three men in Mr Walls’ shed were charged with producing over 1200 rifles and all of a sudden needed to prove they could make that many weapons.

What they did was rent out a workshop for a day and filled it with all of the guns they had made in the shed up to that point, claimed the rest of the staff were out to lunch and later found out when they went to eat with the requisitions lieutenants that the inspection was purely to ensure the operation was not just three men in a shed.

Certainly a juicy onion to take a bit of, regardless

IDK. It puts them at the forefront of this fight.

If governments successfully prosecute distro maintainers (if they can) for this, then distro maintainers are liable.
And distro maintainers would then have to pursue non-compliant users to cover that liability, or fold.
Which is a huge loss for open source.

Or, there would be a huge legal fight and it turns out that the licence of a distro protects it from its users actions.
Which would be awesome and a massive win. It also makes sense. Nobody is suing an OS maintainer because it was used for a data breach.
And then the governments have to pursue the actual users. Which... is gonna be useless wrt these laws

What's your vector, Victor?

Probably not relevant to the article, I had to rant. I'm drunk, and suffering!

I'm trying the old vibe coding, except with actual specs. I feel like I have to. I hate it.

I think refining the spec/prompt with Claude makes sense. I found it helped me crystallise my spec and highlight gaps & pitfalls.
At which point, I should've just coded it.
I'd have known what it does, and it would be exactly what I needed.
But I figured I'd see what Claude could do.

So, my "dev->staging->prod" (project isn't in production state yet, thought it would be good to try AI on something) database migration system with a planning, apply and rollback stage was built by Claude.
There are system tables that should migrate fully (but allow for review if they are structurally different) and there are data tables that should only alter schema (not affect data). It's decently complex that it would take me a week or so to write and generate, but maybe I can spend a day or 2 writing a spec and seeing what clause can do.

It wanted to use python, and told me that migra is outdated and tried to generate something that would do it all.
I told it to use results (the migra replacement), and after convincing it that results was the actual library name and that it can produce schema differences (and telling it that it is a different API than migra cause it tried to use it as if it was migra, and.... So much wasted time!), I finally got working code. And all the logs and CLI etc resulted in SUCCESS messages.
Except that tables are named like "helloThere" were ignored by it, cause it hadn't considered tables might have uppercase. So I got it to fix that. And it's working code.

It looks nicely complex with sensible file names.
Looking at the code: there are no single responsibilities, no extensibility. It's actually a fucking mess. Variables sent all over the place, things that should be in the current command context being randomly generated, config hard coded, randomly importing a function from another file (and literally the only place that other function is used) because.... I don't know.
It's just a bunch functions that does stuff, named be impressive, in files that are named impressively (ignoring the content). And maybe there are context related functions in the same file, or maybe there are "just does something that sounds similar" functions.

The logging?
Swallows actual errors, and gives an expected error messaged. I just want actual errors!

It's hard to analyse the code. It's not that it doesn't make sense from a single entry point. It's more that "what does this function do" doesn't make sense in isolation.
"Where else might this be a problem" has to go to Claude, cause like fuck could I find it it's probably in a functionally similar function with a slightly different name and parameters or some bullshit.

If I didn't know better, and looked at similar GitHub projects ... Yeh, it seems appropriate.

It is absolutely "manager pleasing complexity".
But it does work, after telling it how to fix basic library issues.

Now that it works, I'm getting Claude to refactor it into something hopefully more "make sure functions are relevant to the class they are in" kinda thing. I have low expectations

I don't EVER want to have to maintain or extend Claude generated code.
I have felt that all the way through this experiment.
It looks right. It might actually work. But it isn't maintainable.
I'm gonna try and get it to be maintainable. There has to be a way.
Maybe my initial 4-page spec accidentally said "then randomise function location".

I'm gonna try Claude for other bits and pieces.
Maybe I'll draw some inspiration from this migration project that Claude wrote (if I can find all the bits) and refactor it into something maintainable (now that I have reference implementations that seems to work, no matter how convolutedly spread they are)

1 fire took down twitter globally?
That's some great streamlining that Musk has done.

It's been 4 days.
How did people get these email addresses?
I mean, the domain is known.
But was the system that president musk broke really holding back this torrent of abuse and garbage?
Feels like actual email addresses were leaked.
Unless it was a mailing list that was suddenly exposed.

Still seems strange that an email that simply says "yo" suddenly came through as part of the spam.
Feels like email addresses were posted somewhere, and someone jumped on for the lulz. Along with the wall of trolls and abusers jumping on.

I mean, as soon as I link a domain to an IP, I see all sorts of "security" scans turn up. Till then, firewall is pretty quiet.
And if I wildcard direct a domain to an ip, the root gets scanned but any sub domains don't.
I feel email addresses would follow a similar pattern.

Scottish tap water is a public/government company.
They do a good job.
Unfortunately, climate change is impacting the level of reservoirs & water ways (ie, going down), and Scottish people use more water than English people (like 30% more, a substantial amount).
Hopefully Scottish water continues to be great, and continue to get the funding they need to do a good job

Which they did learn from!
I guarantee every mistake like this at any good company leads to a leap forward in tooling for simulation, testing, code building, review, merging, local dev environments etc.
The good companies share their work (via open sourcing their solution, blogging their learnings) or by contribute to existing solutions.
NASA's ROI cannot be measured. The amount of industries their R&D has touched is massive

"Oh you are logged in on your phone? Lets zoom there"
This is the exploit.

The technical details dont really matter. Webservices are extremely difficuly to make secure if you cannot trust a legitimate users computer who is legitimately authenticating.
The key extraction could be seen as a vulnerability. Likely an oauth token that the webservice passes to the browser, which passes it to the auth service, then the auth service passes a new token to the browser, which then passes to the webservice which verifies the token then starts an authenticated session.
There will be a reason that keys are (im guessing, as this is the only way it can be leaked to screen sharing) passed as query parameters. Likely load balancers operating on SNI, or its to rely on basic browser/headers to control the authentication flow, instead of having to have specific browser code (ie javascript) to take the key and pass it as body data in a post request without the users intervention.

Unfortunately it is probably the most secure way of doing it given the restrictions of http, browsers and ease-of-use-for-users.

The lesson is "if you are dealing with a stranger and : you have a bad feeling, you are put under emotional stress, time deadlines, any kind of pressure. STOP."
Thats how scam/phishing etc works. It engineers you to dismiss any red flags that would normally make you stop.
Sometimes scammers get really lucky and hit you when you are expecting legitimate contact.

Well, self-sign your own certs and deal with the implications of not being a trusted root certificate authority

The old firing computers from WW2 are cool as hell.
Not just analog, but mechanical analog.
They take 25 inputs, some of which come directly from the spotter scope things, some from the ship itself, and then controls the guns directly.
It's all cams, gears, reciprocating whatsits and stuff.
And because it's analog, there is no quantisation, rounding errors, floating point errors. It's continuously and instantly calculated.
Very cool stuff.
https://youtu.be/s1i-dnAH9Y4