Christopher Phillips retweetledi
Christopher Phillips
73 posts

Christopher Phillips retweetledi
Christopher Phillips retweetledi
Christopher Phillips retweetledi

Anyone and everyone working in security engineering or caring about security have their work cut out for them
We’re so early in AI agents pushing code to prod without human intervention - but prompt injections are already spreading like wildfire. Infecting high-profile projects
Sash Zats@zats
> The attacker got the npm token by injecting a prompt into a GitHub issue title, which an AI triage bot read, interpreted as an instruction, and executed.
English
Christopher Phillips retweetledi

Ahhhh, Codex 5.3 (xhigh) with a vague prompt just solved a bug that I and others have been struggling to fix for over 6 months. Other reasoning levels with Codex failed, Opus 4.6 failed. Cost $4.14 and 45 minutes. Full trace plus includes original issue: ampcode.com/threads/T-019c…
I know this prompt is relatively bad. Honestly, our stable release is in a week, and I was throwing some Hail Marys at the frontier models to see if I could get a clean, understandable fix for some of these bugs. By using `gh`, it grabs much better context from the issue, so its not terrible.
The best thing that Codex did was eventually start reading GTK4 source code. That's where I ended up (see my GH issue), and I knew the answer was somewhere in there, but I didn't have the time or motivation to do it myself. The other models never went there, and lower reasoning efforts with 5.3 didn't go there either. Only xhigh went there. I think that was a critical difference.
The final fix was decent. It was small, all in a single file, and very understandable. It had one bug I identified (you can see in the trace), and then I manually cleaned up some style. But, it did a great job.
Definitely an "it's so over" moment. But at the same time, it feels amazing because now our next stable release will have this fix and I was able to spend the time working on other fixes as it went.
English
Christopher Phillips retweetledi

@unusual_whales You might run into the opposite scenario where debt spending is correct and congress is incentivized against it.
Probably needs more nuance of a time threshold “if it’s ever above 3 percent for some amount of time then they’re ineligible”
The above keeps it more elastic
English

@Andercot Where is my flying car is probably the best discussion on this. It’s not too late, but it’s 99% a political/social problem.
press.stripe.com/where-is-my-fl…
English

@unusual_whales Memories are too short. These kinds of lawsuits are in such bad faith. Thry know how much their balance sheets improve if the test is eliminated. It’s not about the legality or efficacy of the safe guards. It’s just another capital investment to increase their bottom line.
English
Christopher Phillips retweetledi

A very sincere thank you to all the contributors to our open-source projects.
Your work makes a difference every day. 🙏
youtube.com/watch?v=0ciqJx…
#opensource #sbom #vulnerability

YouTube
English
Christopher Phillips retweetledi

We here in New Jersey are at our wits end with the complete absence of answers on drone activity over our neighborhoods. The federal government should either explain if these are our government’s assets in practice or, if these are truly unknown flights, responsibly remove one from sky for examination. Either option would lead us to an answer- and the public is rightfully demanding closure here.
Nothing about what is occurring is acceptable. Governor Murphy and President Biden need to step up right now.
English
Christopher Phillips retweetledi

Very early work but making it so the Ghostty icon on macOS dynamically changes to match your custom color scheme. This icon is rasterized at runtime. If you change your theme it updates in real-time. A diagram of how this works attached. Definitely a terminal first. 👻
This is unfortunately macOS only because macOS has native APIs for changing the icon at runtime. Linux/GTK doesn't have any way to do this right now besides modifying files on disk (that are probably in non-writeable locations and cached anyways).


English
Christopher Phillips retweetledi

We're chatting with @mitchellh tomorrow all about Ghostty! What would you ask him, if given the opportunity? 🤔
English
Christopher Phillips retweetledi

We're seven days into #AdventOfCode 2024! Have you learned anything new about your programming language / tool / editor of choice?
English
Christopher Phillips retweetledi

The only real programming language benchmark is whether your product earns more money than competitors
Ben Dicken@BenjDicken
Over the past 8 days, I received over 100 PRs on the languages repo with additions and improvements. - A bunch of languages were added - Some implementations got tweaks to modify performance - The run script now uses hyperfine for timing Thanks to all the contributors.
English
Christopher Phillips retweetledi

Use SCA tools? @NCState researchers want to hear about your experience!
⏰45-minute interview study on software composition analysis.
💰 $60 compensation is offered.
🙊 All responses are anonymous.
Details: s3c2.org/studies/sca-us… #SecurityResearch #AppSec

English
Christopher Phillips retweetledi
Christopher Phillips retweetledi

This was my tenth(!) year building 25 days of puzzles for #AdventOfCode. You can solve them all for free and in whatever programming language you like. I hope they help people become better programmers. 🌟
The first puzzle comes out in two hours: adventofcode.com
English
Christopher Phillips retweetledi
Christopher Phillips retweetledi

Here is an example of an S-tier bug report. This is a complicated problem and without a reproduction this issue probably would've stagnated for months. But since this bug report was so good, the bug was fixed within a few hours of this being reported.
I really can't stress how much this helps everyone:
- Reporter gets their bug fixed fast
- Maintainer and reporter don't waste time going back and forth trying to figure out what's going on
- Community gets more stable software
- Community benefits from maintainers being able to spend more time on more issues

Mitchell Hashimoto@mitchellh
🌶️ Generally speaking, if a bug report is anything less than a few paragraphs long, it's almost always a bad bug report. (As with all generalizations, there are exceptions, but 9 times out of 10, if I see an issue with a few sentences, I know I'm about to get my time wasted.)
English










