I personally know about 1 person who I think is good enough at testing that I'd let them make this argument

most test suites are actually not very fine constraints on the system under test; the idea that "any program that passes the tests is acceptable" is nonsense, even more so when you're also generating the test suite

you can't "just have a really good test suite" your way out of this. security issues are caused by violation of properties you never even thought of, by non-obvious and often indirect interactions of things nobody realised were connected. your tests will not catch this

the slide from "C is fine you just have to be extremely disciplined and carefully reason out and review every single line" from "it's fine to deploy systems code nobody has even read" is something to behold

idk it sucks to see analysis like "yeah of course backporting 12kloc patches is hard which is why it's useful to think of other solutions that don't involve 12kloc patches" written off as moral purity testing

"I am concerned this huge patch is a symptom of a lack of design coherence and will just hide further bugs" is not morality policing

"a security patch that is impractical to review is a category error" is not "feeling icky"

the critiques I've seen of the php patch have little to do with "moral purity" and "feeling icky" and are more about the actual approach to mitigating the problem

*including* considering the goals and point of view of people whose job that is, so it's not about making unconsidered demands for human labour either

"pick your battles, e.g. complain that AI is hurting artists" it's also hurting programmers and distorting how programming gets done so I'd consider this relevant

writing source code is not the hard or slow part of any serious software development effort and AI is *actively slowing down* the parts that are actually hard

the amount of time wasting that is enabled/encouraged by AI due to its effect of atomising teams and discouraging them from communicating is absolutely staggering, it massively swamps any speed benefits gained by making it faster to generate code

someone saw the phrase "random IV" and thought it was roman numerals

if I had a penny for every production incident I've seen caused by the number 4, I'd only have 2 pennies, but it's weird that it happened twice

seems like mastodon updated its UI to remove most of the navigation, what the hell

"brute forcing proofs does not help mathematics" and "brute forcing programs does not help software" are, per philip wadler, literally the same statement

software development as a field in general (outside of niche circles of enthusiasts) has never had much of an interest in thinking very hard about the nature of the work, so the appeal of "machine that gives the appearance of doing the work for me" is obvious

to think this stuff is useful you have to have an ontologically fucked idea of what the work actually is. this applies to almost all applications of this technology

that statement saying "actually, dumping hundreds of brute-forced proofs does not help with the practice and advancement of mathematics" is exactly the line software devs should take, but programmer pop culture has always valued short term convenience over most other concerns, so here we are

RE: https://mastodon.social/@Pikapods/117410424142500742

the function of AI is to steal your work, charge you for the privilege, and then rent your own stolen work back to you

there's just a basic lack of transparency in passkeys as actually implemented that makes me not trust them at all

RE: https://digipres.club/@misty/117385398796935055

and again

really textbook example of something being a good idea on a technical level and being a total disaster because of how people have been brought to interact with it