I’ve been trying something recently on platforms that support emoji reactions for countering trolls: using Poe’s Law against them.

Poe’s Law says that, without clear expression of intent, extreme views and satire of those views are indistinguishable. But reaction emoji let other people provide a hint about that intent.

When someone writes a rage-bait troll, they want engagement. If you reply, they’re happy. If you put a thumb-down or angry-face reaction, they’re less happy but they know they’ve got to you.

But what happens if you do a laughing-face emoji? Minimal engagement (one or two clicks) and they haven’t upset you.

And then the next person seeing the post sees it framed by the laughing reaction. So their reaction is likely to be ‘oh, I guess this is meant as satire’ and they either add a laughing reaction or they just decide it’s satire in poor taste and ignore it. And no one engages in the comments because they’ve seen the laugh reactions and don’t take the post seriously.

And, after a while, the trolls get bored and go somewhere else.

I’m quite surprised at how well this works.

One of the patterns I’ve seen with people using Claude for programming is:

A programmer in the past looked at a tradeoff space and decided to make a common operation fast and an uncommon operation slow.

Claude lacks proper context of the use of the software but spots a pattern that looks like things it’s training set has flagged as slow and so points to the slow path as a bottleneck.

The user asks for a test case and Claude provides a simple microbenchmark that triggers the slow path.

Now that it’s confirmed as slow, the user asks a ‘agentic’ harness to explore the design space and optimise for the benchmark. The swarm of Claude instances makes plausible changes to the code and reports back with a modified version that passes the test suite and improves the microbenchmark.

The test suite doesn’t exhaustively cover all possible race conditions and so the new version may include subtle concurrency bugs. It also probably makes the common case slower and so is a regression overall.

I don’t know if other LLMs encourage this flow, but I’ve seen it several times from people using Claude.

I suspect Linus’ recent embarrassing interaction with his kernel’s virtual memory code may have been an example of this pattern. It’s very easy to do with an LLM because each step appears to be a demonstrable improvement. It comes with an objective benchmark, it passes all of the tests. Unfortunately, software often depends on a load of extrinsic knowledge that the LLM is trying to infer from a load of likely misleading data points.

RE: https://mastodon.world/@Captain_Jack_Sparrow/117452220340776725

It looks like Anthropic is learning that, when you spend years publishing nonsense ‘annualised’ revenue figures[1], showing growth becomes increasing hard. And it’s unfortunate when this happens just before IPO.

[1] Pick some day/week/month when you had a lot of revenue, scale it up as if you got that revenue for each time period in a year.

RE: https://mastodon.social/@urlyman/117438341700524123

I can’t help wondering if this is a deliberate attempt by someone in the FAA to get ‘AI’ banned for federal procurement. One plane full of legislators having a serious incident that can be directly blamed on ‘AI’ would do more to force a hard stop in ‘AI’ rollout in government than anything else I can think of.

I just fixed a bug where someone had sent an LLM-generated fix. At first glance, the LLM fix was mostly right, except for a redundant atomic fence (LLMs seem to love __atomic_thread_fence in this codebase, no idea why).

But then I went to fix the bug. The problem was that a lock was initialised too late and so could end up being initialised twice. Ooops, locks are not meant to introduce concurrency problems!

And the LLM fix moved it earlier, so that's fine.

Except... there's another way that the object containing the lock might be reached via a global pointer and that didn't have any guards. I don't think it's possible to trigger the bug that way, but some of the future changes that I'd considered might introduce that as a path.

And there's no real reason for anyone to want the object without the initialised lock, so moving the initialisation to just before the point where any other thread might reach the object is a simple fix.

But that isn't what the LLM proposed. Instead, it fixed the immediate issue without any reference to the long-term impact and maintainability of the codebase.

My fix was a fairly simple change: one new line of code, four new lines of comment, and six deleted lines of code (so worth doing for code readability even if the bug hadn't been real). And even a change that small, if you accepted the LLM recommendation (three new lines of code, no new comments, and six deleted lines), would have made the code less maintainable and more subtly broken.

And that's why I refer to these things as Technical Debt as a Service.

Wow, the bugginess of Dune Awakening is amazing. Finished the last (maybe? The story doesn’t conclude but the Internet suggests it’s the last?) story mission and I’m teleported back from Arrakeen to the main game map. Only the Ornithopter I used to fly to Arrakeen is gone. The one I had just collected everything I needed to build and had flown for the first time to start this quest.

When I search for this bug, I find a Steam thread reporting it from June. 2025. So it’s been a known bug for over a year and the developers still can’t be bothered to fix it.

Oh, and the most recent autosave was an hour ago, back before I started the long story mission. Apparently the work around is to hire someone else to fly you to the final bit of the mission. Ugh.

The game is full of things like this. Sometimes when you arrive at Arrakeen, you spawn below the floor and fall forever. There are a bunch of places you can fall through the map, including one that you will encounter every time that you try to go around the back of the cultist’s area.

If this were a game that had just been released, I might cut it some slack, but though the console port is new, all of these bugs appear to have been there since the start. They’ve had a year to fix them and just haven’t bothered.

Oh, and there’s no pause button, which is just rude. I guess it’s aimed mostly at multiplayer, but there’s just no attention to detail.

They also made a weird choice to base a load of plot elements on the awful prequel books. Casual Dune fans will know about Dune mostly from the films and so won’t know any of this nonsense. Almost everyone who read the books loathes the prequels. So the only people who will understand the context will hate it.

#DuneAwakening

RE: https://mastodon.sdf.org/@netbsd/117396625341557692

Hey #FreeBSD folks, NetBSD hit more than double their funding target after adopting a strong no-LLMs policy. Something to think about while you draft yours, perhaps?

Then I was at the University of Cambridge, I did their harassment training. It was excellent though, sadly, not mandatory for anyone except as a result of disciplinary actions. I was one of only two men who had chosen to be there.

One of the most important things it covered (and the reason it absolutely needed to be mandatory) was the legal aspect. If you are informed of a crime and discourage the victim from talking to the police then you are part of a cover up and can be charged as an ‘accessory after the fact’. In particular, being an accessory after the fact does not require that the original crime is successfully prosecuted, you having sufficient evidence to reasonably be assumed that it happened is enough. If someone tells you that they murdered someone and you offer to provide an alibi, it doesn’t matter if the body is ever found, if the alibi is shown to be false then you can be charged. The same principle applies. If you direct people to an internal process without making it clear that they have the option of going to the police, you are an accessory. If you even imply that going to the police may result in retaliation from the organisation or that the organisation will not protect you from retaliation by individuals, you are an accessory.

When I went to Microsoft, we were given the same harassment training as the US org. If followed, the advice in it would have landed managers in legal trouble. I flagged this with HR and I believe it was subsequently fixed.

But this appears to be a key difference between US and UK law in this regard: if someone in an organisation reports a crime to someone in authority in that organisation, UK law requires that the alleged victim must be informed of their legal rights and supported if they choose to prosecute the perpetrator. The US appears to have zero consequences for institutional cover ups. That really seems like something the USA should fix.

This is a post about Cornell.

Periodically I try LLMs to see if they actually are useful for programming. This week I was writing an AsciiDoctor plugin. I’m not particularly familiar with Ruby (I struggle to imagine the mindset that believes Smalltalk, or, indeed, any language, can be improved by adding Perl syntax) and I find the internals of AsciiDoctor to be very poorly documented and hard to follow. So this seemed like a great task for LLM assistance: I know the problem domain very well (I’ve written other document processing tools) but not the details of the codebase I’m working on.

GPT-5.6 repeatedly sent me down misleading paths and wasted time, and gave suggestions that looked right but were completely wrong. It kept going back to the same thing that would cause a later phase to infinite loop. It eventually gave me a solution that was so convoluted that I couldn’t believe AsciiDoctor wouldn’t have a better way of doing it (I didn’t try it: if that was the only way of making it work I’d rather ditch AsciiDoctor than apply it, so I have no idea if it actually worked).

I actually solved the problem by finding a bug report from someone trying to solve a similar problem, which linked to their eventual solution. Reading that, I was able to find the missing conceptual bit in my understanding of how AsciiDoctor worked. And I finished the thing.

In total, the time spent with an LLM did not advance me towards the solution at all. None of the code that it suggested that I write ended up in the final plugin.

If I had used an ‘agentic’ setup, where I had given it my document, the desired output, and told it to keep trying until it did it, it would probably have got something that worked. The last throw looked like it would have ended up working, but it would have been an order of magnitude more complexity than I actually needed. And would have been completely unmaintainable: if all of the surrounding justification text had been comments, it would have looked like entirely plausible code, but with deeply fragile connections between the different phases.

Importantly, if I hadn’t solved it myself, I would not have really understood the gap between the complexity of a good solution and the LLM-generated one. I might have accepted it was the best available option, in spite of it being terrible. And this was fairly low-stakes code (processing a document for internal consumption), so that might have been fine. But doing that for anything used in production would be an absolute long-term disaster: you’d acquire all of that technical debt without knowing that it is technical debt, you’d just think the feature was done.

RE: https://universeodon.com/@georgetakei/117363062318327919

The america.gov thing is an embarrassment but the middle of the rant about US government web sites being worse than the private sector reminded me of how much I appreciate the gov.uk infrastructure.

It’s designed to work well with low-bandwidth devices. It works well on large and small screens. It runs in ancient browsers. It has a consistent interface. The buttons are big and clear. It doesn’t use colour contrast that’s problematic for colour-blind users. It works well with accessibility tools. It has its own extended markdown variant that captures semantic markup for common things so that they can be usefully exposed structurally to other tools.

Private-sector web sites could learn a lot from it.

I have a lot of sympathy with the lawyer charged with contempt in this story. He used an LLM to summarise a proceedings and it made up nonsense.

Most of us know that this is a risk, but I routinely talk to people who think an ‘AI summary’ of a document is going to be a distillation of information in the information in the source text, rather than some statistically probable sequence of words that would follow a request to summarise the source text. And that’s entirely because that’s precisely how these things are advertised.

Butterfly is much less fun to say than papillon so I am using the standard process in the English language: deprecating a common-usage word and replacing it with a foreign word that I like better. From now on, all uses of the word ‘butterfly’ shall be deemed archaic.

Thank you for your patience during the transition.

Please stop enforcing mandatory time limits on credentials that are trivial to revoke!

The point of mandatory expiration is that revocation happens eventually. In the case of a compromise and leak of that credential, an attacker has a guaranteed sunset when their stolen credentials will stop working. This is sometimes a useful property.

For example, checking certificate revocation lists on every TLS session is slow. It's common for clients to skip this and rely on revocation sets that are pushed out during software updates. Short lifespans here serve to optimise the performance of revocation lists / sets: if your certificate lifetime is five days and you revoke it, after five days it can be deleted from revocation lists. Scale this to the number of certificates issued across the entire Internet and that's a big saving.

But the big down side of requiring frequent generation of short-lived credentials is that the credentials needed to generate that credential (which, by definition, are more privileged) are frequently accessed.

If I am generating a token to go into some release flow and I can do it once via a cumbersome process that requires multiple rounds of authentication and then put it in some secure credential store where it's accessed only from an ephemeral VM doing my release flow, then I don't care about the effort of generating the token. I do it once and, in the happy case, forget about it. If there's a trivial mechanism for revoking it, we're done: if there's evidence of compromise, revoke it and go through the slow process again.

But if that token expires every 30-90 days, I need to automate generating it. Which means that some automated process that is likely to be as vulnerable as the token itself now has access to the credentials required to mint the token. And that's introduced additional complexity without introducing additional security.

TL;DR: If you have an expiration policy for credentials, make sure that you have a threat model that it is intended to address and that you understand the operational complexity that you're introducing and any security weaknesses that this is will cause.

I am trying a new thing:

Only boosting posts that make me happy or have something actionable for readers. It's good to be informed about depressing issues, it's not good to be constantly bombarded with things about them.

Not posting about things that annoy me unless I have an actionable proposal for how to improve them. Grumbling can be cathartic but is not especially helpful.

I don't promise I'll be good at this, but I'm going to try!

The kittens were just sitting on their porch roof, taking it in turns to stare in at me through my office window.

So, OpenAI admits two things in disclosures presented to the court:

• That their products are utterly dependent on work ingested without compensation.
• That their derived product is directly substituting for this work, removing the economic incentive to perform that work in the first place.

Meanwhile, the EFF filed an amicus brief in the case claiming that this use is exactly what was intended by the ‘To promote the Progress of Science and useful Arts’ justification for the existence of copyright in the US Constitution.

Journalists:

A Ponzi Scheme is not a generic name for an investment scam. It is a very specific investment scam. It is misleading to refer to NVIDIA’s circular financing scheme as a Ponzi Scheme.

They are booking payments as investment and then having that same money come back to you as revenue, which drives up their share price. Because NVIDIA’s P/E is 30, $1 of money moved in this way translates to a $30 increase in NVIDIA’s market cap (possibly more, because this shows growth, which pushes up the P/E). This allows NVIDIA to issue more shares and repay the current investment.

This has some similarities with a Ponzi scheme: it relies on new investors putting money in and it allows early investors to cash out using money from new investors. But it is a different mechanism and a different-shaped flow of money.

In the interest of accuracy, please refer to it as a Huang Scheme.

It's fun to mock Canada, but any country that has a Strategic Maple Syrup Reserve (this is a real thing, look it up) clearly has a set of priorities that the rest of us can learn from.

For people who still believe the GPL influences corporations in a meaningful way:

When I was at Microsoft, I worked on a product that used Linux. The product was cancelled for largely unrelated reasons before it shipped, so the exact details are irrelevant but anything that links Linux needs to loop in lawyers, so I spent a lot of time talking to them.

Maybe 10% of the total time was spent with the technicalities of the GPL. The fact that the GPL is ambiguous and poorly written and the Linux syscall exemption is even worse made me expect long discussions about the legalese. But instead the conclusion of the GPL-focused discussions was basically:

No one really knows what the GPL can actually enforce and half of the stuff that's done with Linux is technically in violation. Microsoft ships Linux images for Azure that come with a click-through license that prohibits running them on any other cloud and no one cares. We can make a convincing argument that this is okay. Only a handful of companies can afford a protracted legal battle with Microsoft and none of them are sufficiently motivated to take us to court over this, so it's unlikely to come up.

The remaining 90% of the discussions were around how the product would be perceived by Linux maintainers, the wider Linux community, and the broader F/OSS ecosystem. Microsoft had put a lot of effort into the 'Microsoft <3 Linux' marketing things. The Ballmer-era alienation of the most active developer communities had cost the company a lot of ecosystem market share. The risk of pushing developers away from Microsoft products and platforms was something that the lawyers regarded as a huge risk. If two of the senior Linux maintainers had said 'we think this is not an acceptable use of Linux' then that would have torpedoed the project instantly.

The moral of this story is that, if positive engagement with your community is perceived as valuable, you have an enormous amount of leverage over big companies. At the time, Microsoft was (by market cap) the largest company in the world. The legal text, in contrast, isn't worth the paper it's written on when your adversary can afford to outspend you in court by six orders of magnitude. When they happen to be aligned, the legal text may look as if it's working, but that's a coincidence.

Don’t you hate it when you write a long post, proofread it, post it, see it in your feed, and immediately spot a typo in the first line?

(Fixed now, it said ‘firms’ when it should have said ‘forms’)