Ways I've tried to use LLMs for coding: - Smart autocomplete (dumb, annoying) - Search with poorly articulated queries (really good) - One shot from stupid prompt (random result) - One shot from better prompt (random result) - One shot from plan (random result) - Archon's research/plan/implement with sub-agents (100k LOC broken codebase) - Focused, directed feature implementation (convoluted logic, broken UI) - Focused easy bugfix (mixed results, sometimes works) - Focused difficult bugfix (burns tokens, no ability to debug) - Upgrade dependencies (hallucinations of old versions, usually broken) - Write tests (instead of dependency injection bad mock design, tautological tests) - Write documentation (stylistically poor, did a decent job with something I wouldn't otherwise have done though) - Fix linting errors (useful in a language I don't know, otherwise too slow/expensive to be better than doing it by hand) - Spec-driven development (ended up maintaining the code myself, asked LLM to update the spec) - Generate code in a well-defined context against an API/language I don't know (very helpful if I review/edit it) - Write a plan for me which I implement manually (fails to get design decisions right) - Write boring functions that I stubbed out or just called (works pretty well given enough context) - Help me sanity check plans/implementations by finding edge cases (pretty good, isolated work which I can ignore) So far: LLMs are good for certain categories of search, simple tasks with sufficient context, providing context that I lack (read the docs for me, bringing in skills I lack, helping me think things through). I remember a year ago people saying LLMs were most helpful to sharpen your thinking rather than think for you, but the draw of generating tons of code without thinking was so strong I didn't really see that for a long time. Overall, the net result for me has been that I have moved slower, done worse work, and gotten dumber. But I am slowly coming to a place where I can maybe start using these tools correctly.

The absolute state of agent sandboxing

Everyone wants muh users for nostr but that's a fiat/corporate mindset. Sovereign/sustainable computing is way cooler, and the thing that nostr and AI actually enable. It would be wonderful if schools taught kids what cryptographic identity was and how to write programs to solve your own problems. It would also be cool if we had good programming tools that were expressive and not just dozens of layers of garbage. In an ideal world, lisp/asm > js/swift/kotlin. At the same time, attention/focus/competency/UX comes from money, and money comes from users. Everyone thinks user acquisition is a marketing problem, but it's not. It's a product discovery problem. What is cool about nostr, why might people want it, and what problems need to be solved in order for it to work? This is why I'm perennially bullish about signers, and constantly disappointed by every signer other than Amber (but also Amber) and clients with poor signer support or UX (pretty much all of them — it's an unsolved problem). Anyway, this is why I try to focus. I'm trying to make Flotilla a Really Good Product. Unfortunately I'm just one person who is missing a lot of the skills necessary to do this, funded at level that is dwarfed by my competitors (discord, slack, matrix, etc). The "funding is bad" people do have a point — zero funding would force us to lean into the small computing approach, which could be a good fit for nostr ultimately, and "good" in a zero-reach max-idealism sense. But by the same token that route comes with with a market cap of zero. Funding allows ICs like me to aspire to greatness (although realistically even the most elite grantees will arrive at mediocrity/mere profitability at best). To me, a small business serving real users and helping spread sovereignty is a win. But make up your own mind, do you want users or do you want cypherpunk hobbyist sovereign linux utils? I don't know, don't @ me, send tweet. View quoted note →

New new daily routine: run `osv-scanner` from

OSV - Open Source Vulnerabilities

Comprehensive vulnerability database for your open source projects and dependencies.

View quoted note →

My daily experience on nostr: - open coracle - see stupid take on nostr development/grants/specs - write a response explaining how stupid the take is - delete it

New daily routine: check hackernews for any npm supply chain attacks before doing any development