Leonid Bugaev

Have become top 3 trending developer on Github, with @mitchellh right behind me 😱

If you need to write an RCE Kimi is your best friend 😀

Semantic check for restricted tasks is too brutal. It fails on the basic debugging tasks, saying that it requires a cyber security approval, even on my own small personal projects. At least make it fall back to the smaller model in such cases. Especially annoying that it allows the sub agent to do this job, then the sub agent returns with some response, and it gets replaced by this badge that I'm not allowed to see.

What should we improve on Codex to improve the everyday experience? Nothing too small

@thsottiaux The current context window limit on the subscription plans is way too low, 256k. Make it 1 million like in the Claude. On complex tasks, even with orchestration, it compacts too frequently, losing the grip on the original goal.

My OSS project jsonparser turned ten this year! I wrote it in 2016 because I wanted real-time analytics from plain files and encoding/json was too slow. Somewhere along the way it ended up inside Grafana, Tyk, Keybase, Docker and Itsio, and many others. This summer I went back in. Six releases. 50 open issues down to zero. Twelve real bugs, some ten years old. But most importantly it regain the title of the "fastest" json parser for with a formal proof along the way! People keep saying AI is killing open source. But it let me clear a decade of backlog in spare time. The win is not that the work got cheap. The win is that expertise and a clear idea of what should exist are now enough to ship it. Link to full story, including every failed optimization experiment in the comments!

@SharadRegoti Parenting in the process helps a lot to develop multi-tasking as well 😂

@SharadRegoti Yes, I think I work on at least five completely different tasks in parallel, but this is the kind of skill which you get while working in IT on complex projects for 20 years 😅

People keep asking what the heck I'm doing with 30 billion tokens a month. Simple: an inhumane amount of work. Think about it — the whole point of the new agentic era is leverage. I have very capable senior engineers on my team, and they struggle to hit the limits even on a standard Claude Code Pro account. Not even talking about the $200 one. Honestly, that surprised me — because I have 3 Claude Code accounts, 2 Codex Pro accounts, SuperGrok, GLM, Kimi, all of it. And I consume every one of them until it hits the limit. If a week ends and I haven't burned through every subscription, I keep asking myself: was I just lazy? How can I push it more? What else could I automate? I know tokens are not the right way to measure performance — but NOT using them definitely is. And when I do hit all the limits, I just turn my brain off and enjoy life. Why aren't these engineers doing the same? Because they're trying to do what they did before, just with AI now. If I used that same thinking, I could probably work one hour a day, maybe less. Sounds plausible — but for me, it's not the answer. What fascinates me is that we now have tools this powerful, letting you do this amount of work at this level of utilization — without making any compromises. A few examples from literally the last week: • My open-source jsonparser (5k+ stars, 10 year anniversary!): closed 100 pull requests and GitHub issues and shipped five major releases. All while drinking coffee, essentially, in a matter of a few days. • rsync: I'm one of the people driving the next rsync release. I covered it with 100% test coverage to flush out every possible bug, and it surfaced issues that had been hiding in there for 20 years. • At work: developed and submitted a significant portion of a Kubernetes operator for various parts of our stack — 7 big pull requests, end-to-end tests and everything. • Proof: kept pushing my own product forward, on top of everything above. How? I run five agents in parallel. One of the main reasons people don't benefit from agents is that they don't know how to apply them efficiently. Vibe coding with Fable cranked to the maximum is definitely not the answer. Sometimes it is — but it's a small, teeny part. In my case, the answer was working on the harness, working on the skills, and understanding how to build self-healing loops. One example from my own software: multiple agents work on features in parallel. When they find an issue, they file it in GitHub automatically. Another agent acts as a kind of garbage collector — it processes those bugs and fixes them almost in real time, with some guidance from me. And my agents don't stop when I do — they work 24 hours a day. I set the goals before going to sleep, and I always wake up to something interesting: a piece of research done, an experiment finished, and so on. It's freaking amazing. And if I had 10x more tokens, I'd spend them all just as efficiently. So many ideas, so many experiments I need to do!

To be frank, not really. You can replicate how quickly tokens get consumed using a very simple workflow. Try to clone some big projects. For example, I am working on Tyk API Gateway. Our API gateway is open source. Run a simple prompt in the Claude Code. "Using the workflow tool, split it into small batches per middleware, per component, and analyze for all of the test gaps. Use the code coverage. Use the deterministic flows. Try to cover it with 100% test coverage while documenting all of the found issues in the process. Always validate yourself multiple times. Rerun the tests. Follow the common sense."

@buger 300亿听着像是在给地球跑单测

@danialranjha I have personal machine, and then home server, which i use via tmux

@buger How do you switch between them?

Just got a Claude Max for free, for 6 months, as part of their Open Source program. It is my third active claude account, which makes my subscriptions in total: 2 claude MAX account, Claude pro, 2 codex PRO, SuperGrok, Kimi, GLM 5.2 😂 I have spent like 25B of tokens in last 30 days, and I feel that only the start. If I do not spent enough I feel lazy, and it kind of acts as a motivator. Tokenmaxxing!

@adammcarter I would say it is about scaling what I have built.

@buger What have you actually built with all that?

Unfortunately, the new "Fable" re-release is unusable. For all of my tests, it was falling back to the opus because of the violation of usage, and it was just some arbitary bug hunting.

LOL, I was rate limited Google Bug Hunting because I have submitted too many high level issues in short period of time 🤣 Time to switch to other projects I guess 😅 . This is the fun part of building Proof: it is not just “security scanning.” The goal is to turn requirements, correctness assumptions, and security boundaries into executable evidence, so bugs become reproducible instead of debatable. If you want Proof to stress-test your project for security and correctness issues, let me know. reqproof.com

@tankots @WisprFlow Lately a lot of latency issues, my biggest favorite feature you had is speed

Calling all haters of @WisprFlow - give me your biggest issue with Wispr. Yes I will personally read through each and every comment and have our team right some wrongs.

@yoheinakajima + Time traveling debuggers (plus tools like undo.io), clojure immutable data structures

other terms i’m learning: blackboard, DDD, CQRS, Akka, Kafka, BASE…

You can't have such rules. The only thing you can do is to harden the product as much as possible, so it will not matter if someone see your code. We have a bunch of OSS examples, like k8s, which are backbones of the enterprise architectures, yet oss, and secure enough. And basically you can afford the same level of pen testing for your app now, with AI. However, even in this projects, new AI models starts finding new security issues.

@buger Rules against the use of AI? How can it even be stopped?

Imagine your source code goes public tomorrow. How would you feel? GitHub lost 3,800 repos last week to one poisoned VS Code extension. AI now reads codebases faster than you can. Security by obscurity is dead. What will be our answer?

blog.reqproof.com/p/death-of-sec… Read the full essay in my weekly newsletter