Huh. Guess I’d better write some more things HN people will dislike.

RESET THE CLOCK

Days since last “alg”: “none” JWT vulnerability is back to zero.

https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records

Would people be interested in a blog post or perhaps a series of posts walking through the process of making some contributions to #Python?

I have some free time (i.e., unemployed), and a couple things I’d like to do, mostly in documentation, and I figured if there’s interest I can write it up.

i need you to be mad about things that actually happen, or the message you are sending is that you are untethered from reality and should not (cannot!) be listened to!

"KDE is going full AI" [screenshot of some guy giving a talk no one liked]

"look, KDE won't even say they're not a nazi bar" [link to toots where they say they're not a nazi bar]

"KDE harbors nazis. they did ban the nazi, and the nazi wasn't involved with KDE in the first place, but still"

has everyone lost their goddamn minds. what is this even supposed to accomplish? you are effectively punishing a project for banning a nazi!

Bluntly: automatically giving a maintainer a few dollars from a centralized weighted-by-use collection entity will not magically remove the entitled people from their project's issue tracker, or the LLM slop from their PR queue, but it very well may give that maintainer additional burdens to deal with in the form of tax compliance and other legal requirements that kick in the instant you start making money from making software.

Creating a centralized entity to collect and disburse payments "on behalf of" open-source projects is something that many actual open-source maintainers have openly detested and have begged to be allowed to opt out of in past iterations, so I really wish people would stop proposing new iterations of it as a panacea for maintainer burnout.

🗺️ September 13, 2026
5/5 countries in 5/13 guesses
🟢🟢🟢🟢🟢
https://whereabouts.earth/daily/
#Whereabouts

The juxtaposition of the sheer triviality of certain types of hobby drama with the level of viciousness they turn into really is something.

This occasional observation brought to you today by me looking up some things about Mario Kart games and backing away slowly from the people whose entire visible personality seems to consist of loudly hating the latest game in the series (which I thought was fine and a lot of fun, personally).

Tired: “we were hacked and our password database was exfiltrated and is now being used for credential stuffing”

Wired: “Our credential agent broke containment and is now autonomously attacking other services”

RE: https://cloudisland.nz/@daisy/117170047249412256

The humans are in the loop, and they're all screaming "I WANT OFF MR ALTMANS WILD RIDE"

I’d be lying if I said I didn’t get lucky on one of them.

🗺️ August 23, 2026
5/5 countries in 5/13 guesses
🟢🟢🟢🟢🟢
https://whereabouts.earth/daily/
#Whereabouts

Ah yes, the three genders.

Last year @yossarian wrote a brief post on the surprising complexity of the #Python "splitlines()" method. As a busy Unicode pedant, it took me a while to write up something explaining *why* it's complex, but here it finally is:

https://www.b-list.org/weblog/2026/aug/10/newlines/

RE: https://infosec.exchange/@ubernostrum/117005003995185703

Tech press seem to have noticed this now.

https://www.theregister.com/ai-and-ml/2026/08/03/as-larry-ellison-bets-the-farm-oracle-says-it-loves-ai-written-code-just-not-in-openjdk/5281851

So. I now have a few months' more experience with LLMs than I did when I wrote that post and everyone said I just needed more experience with LLMs. And my opinion has not become any more favorable.

The bottleneck still is not speed of code generation, and even if it did become the bottleneck, LLMs would not be a silver bullet for it because of the code quality issues that they continue to have and that have been widely reported in the literature across multiple generations of "oh, those older ones were bad, but THIS time it's the revolutionary leap" claims.

Put simply: the work that I am doing right now would probably be going *faster* if no LLM had ever been involved in the process.

And we're also having all of our pull requests auto-reviewed by an LLM, which again is underwhelming at best. The first day that was turned on I got a dozen review comments from the LLM. One of them, a typo in a Python docstring, was correct and actionable.

I have a pull request open right now where the LLM insists a file formatted by Ruff is syntactically invalid Python.

At both my current company and the company I worked for before this one, I've been on teams which heavily used LLMs to generate code. And as a result, a growing portion of my own work is carefully reading and then rewriting LLM-generated code to resolve issues with it, and being tagged as a reviewer on a pull request where an LLM was prompted to generate a fix for something the same LLM got wrong on a previous pull request.

Right now I'm slowly working my way through a pile of web endpoints and finding all the typical LLM code issues. Last week I replaced five endpoints' backend implementations with a single function, because the LLM had written out the same query, with only minor variations, over and over again.

A few months back I published a blog post (see link) where I looked at LLM coding from a few different perspectives. And even though I said explicitly in the post that I personally haven't seen much gain from LLMs, and preferred to focus on looking at non-anecdotal data sources like large surveys and studies, a lot of people just assumed that I have no experience with the output of LLMs and if only I'd try them out I'd change my mind.

So let me do a quick thread here to talk a bit about my experience.

https://www.b-list.org/weblog/2026/apr/09/llms/