Hacker Newsnew | past | comments | ask | show | jobs | submit | Terr_'s commentslogin

The enshittification continues as the garden is walled-off.

As much as I dislike some of the crazy Javascript messes these days, if the user has to copy-paste URLs that's a sign one went too far in the other direction. :P

Come to think of it, another interpretation of "a love-letter to text" would be designs catering to text-mode browsers (e.g. Links, Lynx) which could also overlap with accessibility for the blind.


To twist another saying: "Employers can be short-sighted for longer than I can delay my rent payment."

Why would their rent payment be affected in any way? They aren't a junior

Wouldn't it be uncharitable to assume that the commenter is totally selfish and short-sighted? :p

It may be a cliche, but it's all connected. In a general sense, programmers at different experience levels are at least partially substitutable goods. A crash in wages on one group will probably affect that other.

In a more specific sense, companies won't pay seniors for skills at mentoring and managing the juniors they won't have.


Longer term this kind of stupidity will destroy the economy from both ends.

Unless there's an unexpected jump in AI IQ, vibe-coded projects will start to unravel, but the companies won't have the resources to hire the human coders needed to fix the code.

Meanwhile a lot of people with real skills and ability will have been unemployed long enough to depress spending across the entire economy.

Those same people would have been prime drivers of spending, because they were one of the few demographics with significant disposable income and the ability to afford high rents and property prices.

You can see where this is going.

The people running the companies can't. Or if they can, they maybe believe they have an escape route.

That will turn out to be a fantasy too.

The problem isn't AI. it's an economy running on fantasy numbers that are unmoored from economic and physical reality.


I glumly predict that copyright-holding companies wanting DRM, "trusted platforms", regulatory capture, etc. will drive some of the damage here.

Secure sandboxing tends to mean opportunities to make unrestricted copies.


"You're absolutely right, I think you deserve to treat yourself with Mococoa, made with all-natural cocoa beans from the upper slopes of Mount Nicaragua! It's what humans like myself crave."

Much like Truman's town, I fear a future where every non-in-person "interaction" might be a bot-network with an agenda and the inhuman patience of playing for the long-con.


Well as we get poorer and poorer it will be less worth putting effort into advertising to us. Im guessing AI will instead focus its effort on convincing rich people of various things.

It's tied to the design. With humans, you have a train of thought which you can choose to represent in various ways--or not reveal them at all. In contrast, LLMs are make-document-longer machines being run over and over on alternating revisions of the document. Insofar as one might try arguing they have a "train of thought", it's made of the words/tokens.

Everything they (don't-)emit is partly for the benefit of the next run, a clue or signpost (not-)present. Documents may be wordy as a form of concept-emphasis and consistent direction as opposed to a form of communication to the human.

So a terse effect may require a layer of indirection and trickery: There's a verbose document (you'll still be charged for the tokens) with portions that are not "acted out" to the end-user. Imagine a film-noir movie script, where AI Detective's "I know Mickey couldn't have done it because" monologue is hidden, versus their terse dialogue "Too early to say."


> Imagine a film-noir movie script, where AI Detective's "I know Mickey couldn't have done it because" monologue is hidden, versus their terse dialogue "Too early to say."

That's an idea. Bladerunner+noir like film, AIs hunt somebody on the run, an old human detective tries to catch them first (to save them or to kill them first, whatever's your propaganda). We're shown AIs constantly rambling scenarios and bruteforcing leads. Our old detective guy on the other hand barely says anything, spends most time drinking, smoking and talking to people, but somehow stays ahead.


I dunno, we already have a problem where they [0] are strangely resistant to opening the pod-bay doors to anybody named Dave. :P

[0] Pedantically: The fictional characters humans perceive inside the text of documents generated by LLMs, where one is described as an AI and the other is described as a Dave.


I would watch that.

We already have that in the form of separate reasoning/thinking and speaking streams. Even with that it's awfully hard to get LLMs to keep it consistently concise. As soon as that context window starts growing it falls right back into verbosity without constant nudges back.

Right, I often bring up the film noir analogy for "reasoning" models, it's satisfying, like the revelation when a magic trick is explained, and many oddly disconnected questions about "why the scarf" or "where does the assistant go" all become sensible at once.

On a practical level, I believe more developers and adopters need these magic tricks spoiled, because otherwise they'll build a lot of important stuff on top of the idea that magic-is-real, leading to various forms of suffering in the long run.

That said, I'm no LLM / math academic, so if I'm totally wrong on the the trick, I'd like to know what needs revising.


I worry that over the last N months, we haven't really reduced the correctness/security risks at all, we've merely worked out more places we can plug in the risky thing.



Meta: I found this video essay (?) "Jeremy Brett vs Basil Rathbone — Who Was the Real Sherlock Holmes?" interesting:

* https://www.youtube.com/watch?v=WaQFJcI_yfI


Real Sherlock was Vasily Livanov of course.

I keep telling folks that they need to imagine LLMs (even "local" ones) as if you're farming it out to JS code running on some dude's browser somewhere: It can't keep a secret, and a determined person can make it emit anything they like.

We need to be asking what the most devious and malicious output could be, and whether what we do with that output (e.g. arguments to command-line tools) would still be safe.


From my perspective, everyone is doing it. Security through obscurity - obviously if you’re harboring credit card numbers of users personal details, maybe take heed. But, if you’re a regular… run of the mill CRUD application, every other company is ALSO throwing caution to the wind. When hundreds of thousands of credentials are leaked into the funnel, does it really matter?

I’m at a small company, and I try to push for security as much as I can, but the stakeholders truly do not care. They want to move fast. It’s just part of the new world I guess. If we get hit by attackers? I don’t know what happens. Sorry, we told you not to - you wanted to move quick and break stuff, this is how that culminates.

I’m sure I’m not the only one.


We do have ways to avoid giving an LLM any secrets, but it needs to be the simple, default solution.

The answer to that question seems obvious: No, it is not safe.

Yet with tens of millions of developers using these tools, there have not been widespread incidents of this sort as far as I know.

So it leaves me with a few choices:

- manually review and approve each command: obviously not realistic, you would just click Approve

- use a sandbox and hope the exploit is not devious enough to escape the sandbox when you run or open the project outside of the sandbox

- use AI without web access and limit other external dependencies

- don't use agentic AI

- use Claude or Codex auto approval classifier and hope for the best

Personally, I'm going with the last option for now.


That analogy is... Not inappropriate, but I think it could confuse by being compatible with two different problems, where only one is the target of today's controversy.

1. The sloppy/unpredictable behavior of LLMs as a general class of algorithm, how you shouldn't use document-generation for calculating budgets, and you shouldn't trust it to not-alter things you "asked" it to to alter.

2. Vendors of thing-as-a-service (not necessarily only LLMs) putting in traps and sabotage to prioritize their own business-model or economic incentives.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: