Alexander Block

@badlogicgames I assume running tool calls in a sandbox (like you do it in mom) helps to protect against such holes? (One should probably still add the node flag…)

If you don't run your node process with --disable-sigusr1, or a set of --permission/--allow-* flags, node will happily start a debugger on sigusr1. The debugger binds to 127.0.0.1, meaning your agent will also have access to your local env if it can attach to that. Surprise!

@vitobotta This! And tbh, it feels best when it’s my own code that I deleted. Deleting obsolete code means that things got better, that I got better.

There's a special kind of happiness in deleting code. Not just a few lines, I'm talking about hundreds of lines. Whole files. Ancient features that someone built in a hurry years ago and never touched since, held together with sticky tape and prayers. The best code is the code you don't write. But the second best? The crappy old code you can finally delete.

@ibuildthecloud For me it’s not OpenClaw itself that hyped me, but seeing what’s possible in regard do extremely accessible automation.

I haven't gotten on the openclaw band wagon. Why is everyone excited about it? Besides trend chasing, what's the attraction?

For month I resisted looking into agents and didn't even want to understand them because I felt the concept is just crazy and dangerous, where the benefit can't possibly higher then the risk. Well...I changed my mind thanks to @openclaw and now I'm sitting here and trying to understand how pi.dev works and how to make things at least a little bit securer.

People of pi. I have good news. pi has finally found its home on pi.dev, thanks to the gracious domain donation by the wonderful people at @ssh_exe_dev. Check out their niffty VM offerings at exe.dev

@badlogicgames @mitsuhiko Cool, I'll check out "mom" in the next days, should be enough to get some inspiration even if it's vibe slop.

@codablock this one was a vibeslop experiment which I wanted to rewrite eventually. but then pi was more exciting to work on. @mitsuhiko build something similar. You can build a purposeful, minimal version yourself rather quickly.

it's funny, because yesterday, that same master clanker stomped all over the large clawdbot codebase, reverting fixes, breaking CI, because it can no longer grasp how stuff fits together. and nobody would have noticed. entirely fine in the clawdbot context, anything goes. but eventually, we need to stop kidding ourselves and realize, that the "engineering" part in SWE is still a thing, and the only thing that keeps our industry from imploding on itself when everyone and their mom gives in to the clankers 100%.

Reading your posts about the quality of openclaw for the last few days and from the limited amount of code I've seen so far, I agree on most of what you say. My take is: Wait a few weeks and an alternative will emerge that can do most of the stuff Clawd can, while not being fully vibe coded. I wonder @badlogicgames, do you know of any such project that is already in the works? Any tips on which route to go if wanted to figure out how to build my own custom built single purpose agents based on pi?

but if you take 15 minutes to scan the codebase, you'll find that the clankers keep building abstractions upon abstractions and duplicate functionality all over the place, precisely because they can no longer grasp the project in full any longer. both claude and codex suffer from this. it's basically impossible to make changes and know their effects on the whole. testing is "does it compile" and "does it reply". the test suite is largely performative. no shade on Peter here, obvl., he's a machine and did his best to deal with the influx of *everything*. clawdbot works, for some values of "works". but I don't think it's a good idea to oerpetuate this workflow as a working approach. the only way to keep things from exploding is human intervention, and it's a stressful never ending struggle, because you've essentially lost all control. we aren't there yet.

@vitobotta Nope. I assume you mean dboxed.io? I’m currently not sure if I should continue this project tbh. Working on it since a year and not a single user yet and there is no end in sight regarding the amount of work needed.

@codablock Do you have someone to do some security audit for your product?

Unpopular opinion: most founders I see especially here on X are building either launch platforms or tools to ship apps faster. Makes sense I guess. Founders build for what they know, and what they know is launching. But those markets must be completely oversaturated by now. How many "ship faster" tools does the world need? Every week there's a new one. All targeting the same audience - other founders and indie hackers. Snake eating its own tail. Meanwhile entire industries out there barely touched by modern software. Boring businesses with real problems and actual money to spend. Not on X talking about shipping. Just trying to run things without everything breaking. Not saying launch tools are bad. Some are great. But if you're thinking about what to build, maybe look outside the founder bubble. Best opportunities are probably where nobody's posting about them.

@ibuildthecloud Look into @netbird as an alternative. They got their first A round this year, so there’s no guarantee that they don’t go the same route. But looking at them they look like their heart is at the right place.

Tailscale is amazing. We really should just have magic networks all the time. It's kind of a shame that their product is just getting more complicated. I hate the trend of products that start so simple and nice and then turn into a monstrosity. ngrok is a perfect example. Death by VC.

Oh sheeze, the agents fever got me. A friend has just shown me @openclaw. A lot of my scepticism regarding agents has just been blown away today. Time to try it out.

mining could have been done anonymously, so no one would have actually known its an inside operation. In the end profit and (minimal) risk is the driving factor. the issue is that if someone else builds hardware that is 100x more efficient, you're out of business very fast even if you own 50% of the network (no matter if AI or mining). the risk here is just to high for a company like Nvidia that build general purpose hardware. I know that Nvidia (Jensen) publicly argues that CUDA and the ecosystem is the killer feature that will make them stay at the top. But an ASIC that can run some of the most important models at 100x efficiency changes quite some dynamics, and "being general purpose" becomes a less important factor :)

@codablock fundamentally different if they would have done that, they would have owned more than 50% of the network and destroyed itself if you own more than 50% of the network in AI that is super good

reason being is the following 1. right now its most profitable to be in the process of making ore for the shovels 2. when that flips and the process of selling shovels is more profitable, nvidia will own all the ore and deep seek taught us that brain draining is real 3. they would be able to scale up as fast as energy production and their own production allows them at the end of the day i cannot see why companies that create models win, they are a stopping point for those that own the real resource, production of the chips. anywho, just coding and thinking

@ibuildthecloud Beyond Compare is a classic and never disappointed me. Looks like the early 2000s but it does the job very well.

Why are all diff viewers terrible. Diffs are just hard I guess. I have never once found a merge conflict tool that actually made sense too me.

@arvidkahl I fear the day where "pretty good source data" gets completely replaced with "pretty good AI generated source data" because everyone stopped programming (or any other science/art) by themself. But until then, lets enjoy the ride :)

LLMs are statistical remix machines. They’re pretty good at being pretty good, and that’s because they are pretty good at training themselves on pretty good source data.

@popovicu94 This feature also allows to pass open namespace descriptors between processes. Useful if you want to pass a privileged namespace into a sandboxed child process, e.g. to allow some level of control over the host system inside an otherwise sandboxed container.

You can "teleport" live network connections between Linux processes. 🤯 We're taught that processes are isolated. If Process A has an open socket, Process B can't touch it. But with syscall sendmsg (#46 on x86_64), it can. Here's how "File Descriptor Passing" works. 🧵👇

I assume Open Source communities always start with single individuals. Happy to see the first people show up on Github and contribute via detailed bug reports and feedback 🙏

Just released v0.8.0 of Dboxed, allowing you to use Git as the source of box definitions. So you can now write down the box spec inside a file called "dboxed-specs.yaml" and Dboxed will create the actual boxes and volumes from them. Proper docs will follow tomorrow. I'm also at the point now where I should start thinking about development and release processes. For example, releases should now start having changelogs and migration infos/guides.

And while we re-consider it, can we also find a way to reliably run CI jobs locally, without the need to push to Git? I'd like to get away from push-and-pray workflows, pleeeeaaase 🙏

IMHO, the changes in Github Runner pricing does not cry for a full Github replacement. But we should re-consider the approach Travis CI had in the past and de-couple CI from source control again.