Yitz Willroth™

@fuelventures Having as much time as I want to sleep, gym, leisure, etc. *is* success.

@nicksdot For instance, I've never worked on a project/team that had any real semblance of stress testing -- six months ago I hadn't even heard of k6. 🤷‍♂️ Now, nothing hits production without load, stress, spike, and soak.

@nicksdot Absolutely could have, but typically teams were too busy shipping features to create guardrails robust enough to trust fully.

When I say that I don't review AI generated code directly, that doesn't mean that I trust AI generated code any more than you do. It means that I trust my ability to review it less than you trust yours.

@JTagHoops How do they stay under the 1st apron hard cap and add ~$8m?

Agree with this If the #Sixers are in need of another big around the deadline, Deandre Ayton & Jaylin Williams (both making around $8m AAV) are two names that could make sense financially

@grousehaus @esidery You’re correct. I’d expect Walker would get the preferential treatment as a Klutch client.

@coderabbi @esidery Don't they already have 2 guys on 2 ways? I think you can only have 3.

Nick Richards is a potential free agent option to monitor for the Sixers. With Philadelphia soon acquiring wing Kentavious Caldwell-Pope via buyout, Richards could become the primary backup big to complete their second unit: Labaron Philon Anfernee Simons KCP Dean Wade Richards

@grousehaus @esidery If they cut Terry & Walker, and trade Broome (packaged with picks), they have enough to add another vet minimum contract, and re-sign Terry & Walker to 2-ways, while remaining under the first apron hard cap.

@esidery 1. Nick Richards is not particularly good; and 2. Assuming they cut/trade 2 to 3 players to pay bron and KCP, they have no money and no roster spots

Code review is largely dead. We are now doing architecture reviews. Low level → high level.

The (software) factory is the product. Your product is only as good as the agents you set up to autonomously maintain it. This is what @elonmusk figured out about Tesla, and it's now true for the software world.

@nicksdot Nick. You know that there isn't a "big boy company" on the planet that's going to do that.

@coderabbi Nah, not my intention to be disingenuous. Then make your company make me sign an NDA - I’ll either find you where shit breaks for free or I will have a big aha moment for free.

Thought experiment for the "I don't review AI code" crowd. Your agents were running in their cloud environments. Unfortunately, setting up the environment pulled in a compromised package that wrote malware into app code. What you gonna do? 👀

@nicksdot Now you’re just being disingenuous. You realize that isn’t possible — I’m not an indy-maker, the code is not mine to share.

@coderabbi Let's go, anonymise your secret sauce and put up a repo.

@nicksdot Oh, it is one hundred percent the latter. Have been doing it that way for ~1500 PRs over 90 days w/2 regressions, neither of which would have been caught by human code-review. I review plans and summaries thoroughly, but not code.

> No one said that humans are completely out of the loop. > Still no line-by-line reivew. Where does my post say line-by-line? You are the one claiming you would not have done nothing. In this situation you *would* have been fkd without review. Either you actually still review but say otherwise in public or you are playing actual Russian roulette. I am calling it: the latter playing out over the next few months will be fun to watch! Already having my many "told you so" ready to spit. 😆

@nicksdot CI gates deployment; gate it on dependency drift (allowlist).

@coderabbi Read the other comments. Show me your secret sauce! Otherwise I am not buying it. In theory I can also make everything sounds nice. 🫡

@nicksdot "So you are now saying you *have to* control and review each dependency. Glad we agree!" No one said that humans are completely out of the loop. Decide the allowed change up front (control), update the allow list, and let CI block drift (review). Still no line-by-line reivew.

> registry proxy + quarantine window Would not have helped. Literally a zero day; CVE I reported is even still not public. > SBOM + built-binary scan in CI SBOM locally? So the agent *cannot* do anything with your review? Or you mean locally it can do it and CI would catch it? If the latter, helps a lot when malicious code was added before it reaches CI. > lockfile CI: block on new package or hash change Now we are talking. So you are now saying you *have to* control and review each dependency. Glad we agree! --- Either I am bloody dumb af and don't get it or y'all not-looking-at-code-because-we-found-secret-magic-guardrails people close your eyes and sing la la la. Honestly, dunno. But as long it all is Twitter "trust me bro" I will not be deciding which it is. Show me your finished setup *right now* and I will *right now* admit that I am just too dumb to understand things. :)

@nicksdot So the guardrail is an allowlist and a CI gate, no? You decide to add a dependency, it gets added in a discrete PR. Everything that follows in a second PR. If there is drift, CI blocks.

A Go binary. > dependencies are part of the conversation up front It had clear instructions to never pull in anything without discussing it. Did it anyway; locally. They *do* "just" pull in things. If you now wanna tell me things I experience all the time don't happen, it's about getting absurd (no offence!).

@nicksdot I’m not trying to be obtuse, but here’s where you lose me: "Yes, the project has commands for building dev and and production. And yes, it did *not* use it.” What belongs to Codex and what belongs to CI here?

You are speaking in unclear, abstract language. What are these magic guardrails that cannot and are not bypassed? It is not skills, and it is not command wrappers for every possible command it could run. Because it bypasses those whenever it feels like. Yes, the project had clear instructions to always run `govulncheck`; and how to treat pulling in new dependencies. Yes, the project has commands for building dev and and production. And yes, it did *not* use it. It's me who had to do it manually, and who asked it whether it did. And when I did, it admitted that it ignored its clear instructions.

@nicksdot Also, what exactly does "pulled in a dependency" mean here? Admittedly, probably simpler in the PHP ecosystem than in JS, but new dependencies are part of the conversation up front -- the agent doesn't have latitude to just pull something in.

See below. Codex pulled in a dependency that itself was depending on an outdated, bundled, vulnerable binary. Only because I: A) don't allow it to run all kind of commands without approval, and B) review each dependency my environment was not at risk, and it did not end up in production. Now tell me again my carefulness "wouldn't have helped". 🤷‍♂️ x.com/nicksdot/statu…

@nicksdot - registry proxy + quarantine window - npm ci, --ignore-scripts - deny-by-default egress - SBOM + built-binary scan in CI - lockfile CI: block on new package or hash change

@nicksdot You review, or a scanner reviews? Because "scan the built binary" isn't you. I may be missing something, but I'm just hearing an argument for establishing/maintaining the guardrails that make "humans for judgement & taste, AI for everything else" possible.

@nicksdot Better plan: guardrail ingress and egress, establish containment, provide forensics, and keep mashing the merge button.

@nicksdot Honest answer: nothing, on the day of, and reviewing the diff wouldn't have helped, either (nobody reads a minified postinstall payload).