I should rerun my homelab eval and see what the "is now slopping" ratio is.

(some things I have just pinned at a version foreeeever)

My stack is becoming this interesting (read: sad) jenga tower of projects that do not accept slop that have upstreams which do (Asahi -> Fedora -> Linux kernel) and I am mitigating what I can by carefully managing what deps I accept but gods the landscape is filled with "just a little slop we promise"

Cosmic DE and both Niri+Noctalia work pretty well on Asahi, turns out

Aw dangit, I updated Cosmic to 1.9 but neglected to update cosmic-greeter. No OSK keyboard for me until I rebuild, womp womp.

Okay, I did it, I summarized the OAuth grant types: https://authomnibus.com/authorization/oauth/grant-types/

I realized I don't have a page that just summarizes the different oauth grant types and I...probably should do that given how often I need to explain the difference between authorization_code and device_code (and client_credentials and resource owner password)

Just to elaborate further the idea of automatic upgrade is either:
1. I don't want to be nagged to make passkeys all the time, but I *do* want them, so OS please take care of it for me; or
2. I don't know what a passkey is, and the operating system is going to just take care of that for me, and now somehow I just log into sites magically.

The second one is what leads conditional create being defaulted to "on" in iOS, and I don't like it.

Yay automatic passkey upgrade (aka conditional create!) is doing a discourse again and I guess my only thing to add is "I don't like it when we treat something as magical and just do a thing without the user necessarily understanding what's about to happen, so that option should not default to enabled".

@jenn Swan!

Like, CIBA is useful outside of the scope of "Agents", but "Agents" is the primary case anyone I've heard talk about it so I really don't wanna.

I just don't...wanna...talk about it. Sigh.

Annnyway, I was several months behind on the omnibus's pricing summaries for the vendors I watch, will be pushing that update shortly. No major movement. Clerk has gained SCIM provisioning (for a fee past the first connection per-app) since I last checked.

I may need to fix the omnibus's push pipeline to use bunny's s3-compat, so may be a bit before the changes are reflected on the site.

I've been...loathe... to write a page about CIBA, but I may....just link to other people's docs for it.

Also I keep a general eye on non-OSS vendor pricing, and it's kinda astonishing how Auth0 just up and adopted the "AI Purple" aesthetic:

But hey, at least Cognito's probably slop free because Amazon has likely completely forgotten that Cognito exists.

I should not be surprised that several OSS CIAM projects now have fairly permissive LLM contribution policies but I uhh, really don't like the idea of letting a stochastic text generator touching the login portion of your site.

But what do I know? :shrug:

"AI is Rotting Your Brain - just look at Theo": https://www.youtube.com/watch?app=desktop&v=ZumXpZzDsgo

The Theo in question was / is very popular with a certain crowd of JS developer (I believe he's also been very close to the Vercel crowd - though don't quote me on that and I bet you can see where I'm going with this)...

Anyway, guy went in HARD on LLM based development and watching these clips is kinda wild at just *how* meat proxy he's being in them.

Storytelling Collective (who does not have a native fedi presence) has just published In a Flash Vol 4: https://www.drivethrufiction.com/en/product/585931/in-a-flash-volume-iv?affiliate_id=3026970 (Affiliate link is the publisher's, not mine)

I've got a piece in there if you're into spooky season rhyming stories.

PoD version is not yet live but is coming.

I have seen examples where it did something akin to:

`let string = "this-is-a-string".replace(" ", "-")` complete with hard coded string and a replacement that'd never replace anything. Is the string the correct output? Sure? What's that replace doing there?

(Edit: This was during a code review I was obliged to perform, I do not prompt the slop machine myself)

"These things are good at generating code" is a phrase that makes me think that you do not review the output of the code generating hell machine.

For example, Muse's had a shell script who's usage example is (working from memory of @jonny 's thread) `print_home_dir.sh <default home dir>` that was literally just an `echo /hard/coded/dir`...which is just consumed by several other shell scripts in the environment, and included a big "AND NOTHING ELSE" in it. It's peak stupid.

So to synthesize a ton of threads... 1300+ CVEs were issued, but no one has verified that all of those are *actually* security issues or are just bugs, thus rendering the CVE system meaningless?

Right?

Trying out Niri + Noctalia on my "fedora-immutable-image-pinned-to-a-particular-version" image, and it... works? Pretty well?

I still have Cosmic installed and can switch between them.