I actively/mentally block products I see in ads now. For example, when I use Amazon's terrible search feature, I'll make a mental note of which listings are "sponsored" and make sure NOT to buy them. Ever, if possible.

When I see ads for things on YouTube, I automatically assume it's a scam... Because it almost always is!

Modern advertising is not meant for product discovery, but for the incumbents to make sure you associate "burger" with "McDonalds" at a subconscious level.

> From this point on, every year "physical media & a Jellyfin install" is going to be more sensible.

Which of course is why physical media will increasingly rarely be offered as an option going forward

From this point on, every year "physical media & a Jellyfin install" is going to be more sensible.

Assuming you even care about legality, of course.

Yeah, it's harder. But you can get a lot of "harder" things done in the amount of time you otherwise spend watching ads, after all. Because to me one of the worst things about ads is they're stealing dollars from me to make cents, if not fractions of a cent. This makes them on the dumb end of the bandit classification by the Basic Laws of Human Stupidity metric: https://harmful.cat-v.org/people/basic-laws-of-human-stupidi... It's so dumb.

And as long as we keep letting them give us an option to buy out the ads, but then they get to stick ads on that option anyhow, we can never get our way out of ads on these things. I don't mind buying them out because they make so little money anyhow but by simple game theory "buy out ads + put ads on anyhow" is always > "buy out ads". You need to cancel if they do this to you. I can't, because I don't have a Disney+ subscription. But you really need to. You need to turn the option into either "let us buy out the ads" or "lose the subscription" for them.

This is what happens when you don't have consumer rights protection.

E.g. Paid for ad-free OTT viewing but commercials ‘appeared after a month’, man wins Rs 9,500 ( https://indianexpress.com/article/legal-news/paid-ad-free-ot... ):

> Calling it a deficiency in service, the Hyderabad consumer commission ordered an OTT platform to refund Rs 1,499 and pay compensation to a subscriber after it introduced advertisements midway into his paid ad-free subscription.

see: https://news.ycombinator.com/item?id=49571634 "Nitter has more working instances than before the takedowns"

many working instances right now: https://codeberg.org/shitter/shitter/wiki/Instances

Phone carriers can't be bothered to police their networks to mitigate flagrant bad actors, who can't be shut down by state law enforcement, so your software company needs to take control of your device away from you. "For your own safety."

It's just a public confession that none of these organizations - not the carriers, not the government, and not Evil Google, are fit for the responsibilities they've claimed.

This whole "but government is inefficient" argument has never convinced me. Our local electric provider has as bad or worse bureaucracy and ever-increasing rates. Bureaucracy is just a symptom of aging human systems, and it can be fixed. Monopolies that serve the public good should never been profit driven, full stop.

This idea of "here's the beta, I'll release the code in a few weeks" sounds counter intuitive to me. is it normal in open source? Any reason for it?

All online discussions these days are like those chain email forwards of the last generation.

“Omg did you know that AI researchers are taking up smoking because they think AI will cure cancer??”

Oh really, which researchers?

“I don’t know.”

How many of them? One or many?

“I don’t know.”

What company do they work for?

“I don’t know. But I’m sure it’s Anthropic.”

How do you even know this?

“I saw it on someone’s TikTok.”

So if there are zero verifiable sources why do you believe this?

“Because it sounds fun, and confirms my biases. Now I’m going to forward this to a hundred other people or I’ll have bad luck.”

This is a meaningless example but this is true for so much more.

I can't claim to know anything about the RAND corporation. Maybe they don't deserve to be included in this next sentence, maybe they do.

but there is something at least a little interesting about the notion that people working in the nuclear space they thought they might be saving the world - because in some sense, they... did?

I've always felt like the fact that no nukes have ever been dropped (in war) after 1945 was a pretty huge success story for the human race. We invented this insanely powerful weapon and, despite the typical pattern of humanity, we managed to solve one of our biggest "coordination problems" effectively enough to not use another one for 80 years (and counting).

I don't know that I'd extend this analogy to the AI labs, I'm not necessarily implying that they're all right about "saving the world," I just think it's worth noting that there was a contingent of people out there trying to save the world from a real threat and who seem to have - at least for now - succeeded.

_Is_ AI generated code notoriously terrible at security?

My experience with AI-code is that it's extremely defensive and good at minimizing 'obvious' mistakes.

Are we comparing to old models generating code? Or mythos-class models?

contrary to what i feel is extreme negativity of the author, to me it seems Jev is one of the only novel releases that lived up to the hype and has staying power. Not only that it jump started a whole new "classifier" war, leading to now things like cloudflare's clairic for extraction.

really early to call it "the fall of jev"

Yes, I was around for that. It was one of my skunkworks projects, as I had lost formal authority over engineering and product by then, and mostly used my "founder aura" to convince small pockets of people within the company to build cool things with me.

However Moby was a poor choice for a skunkworks project, it involved mostly communications and project management, which requires consistency and scale. Overall it was poorly executed because I failed to build enough support internally ("Solomon's at it again, let him do his thing"). Here I am trying to explain it on Twitter after the keynote, using a picture of a hand-drawn diagram, because nobody in marketing or product was assigned to help. https://x.com/solomonstre/status/855918630915133440

I think the goal of Moby was fundamentally correct: we were trying to replicate the Red Hat model, with well-scoped upstream components (linux -> runc, containerd..) integrated into a commercial product (Docker -> RHEL), with a faster-moving community project in between (Fedora -> Moby).

This was a way for us to clarify that Docker was a product, with a community of users, and Moby was an open source project, with a community of contributors. This clarity was very much needed, because different communities were projecting very different expectations on the brand "Docker", and these expectations conflicted with each other.

In a way, Moby aspired to be what CNCF ended up becoming - the "big tent" where the broader community meets to hammer out the general shape of the container stack. It seems obvious now that a single company can't be the sole authority over such a vast scope. But in the first years of Docker, we really did have that level of influence, because we literally invented the market, and brought the community together in meetups and an ever-growing Dockercon. It's only when Google and Red Hat pushed Kubernetes and CNCF, that our influence over the stack started to wane. Maybe it was for the better, I don't know if we would have been up to the task as designers and engineers. But at least there would have been a consistent design, with a Linus Torvalds figure willing and able to say "no" to stupid and redundant features. For a while I played that role - but then I was replaced by SIGs and committees.

The article's point that Go is a bad fit for some of the low-level interactions with the kernel, is absolutely correct though. We had to do a lot of juggling to get it to work properly. But in the end it was fine. I would say it was the correct choice of language at the time, and it certainly contributed to Docker's early success.

Another explicit goal was to facilitate contribution. We thought Go syntax was "vanilla" enough to attract a broader set of contributors than a more niche, opinionated language like Erlang, Haskell, Clojure etc. I think that also worked out well - Docker was known for attracting many contributors, many of them making their very first open source contributions. We even ran special meetups to help people become contributors, that was fun.

> Any interesting memories from that day in 2013?

That day is forever engraved in my memory... Off the top of my head:

I signed up for a lightning talk expecting an audience of 10-20 people, for a confidential demo of our unfinished project that we had so far only showed in 1-1 demos. Imagine my surprise when I learned Pycon does lightning talks on the main stage!

The previous speaker didn't show, so I started early. In the recording you can hear me joke that perhaps I should get his time allocation too - the MC was not amused.

I went over time and had to speedtalk through the end.. The MC once again was not amused and practically shoved me off stage :-D

We had a small sponsor booth at the even, where our small marketing team was prepared to pitch our product (DotCloud) but was thoroughly confused when a horde of people showed up after the talk, to ask about "Docker" - which as far as they knew was the founder's side project.

I drove down to Santa Clara on my newly acquired motorcycle - my very first trip on the freeway. I remember telling myself, "today is the day to take all the risks!"

> Docker’s container runtime, runc, is written in Go.

I worked at Docker from 2014-2019. The most important part is actually written in C.

[I wrote a whole comment here about to explain how the hack works because I was too fixated on how technically incorrect "written in Go" is. Then I went back to read the rest of the article only to see that the paragraph immediately after this kind of explains it in its own way! Let that be a lesson to always finish reading the article before posting about it.]

I was in the audience when you gave the 5-minute docker lightning talk at PyCon US Santa Clara in 2013. I remember chatting with a friend/colleague about it (https://nvie.com/about/) and we both agreed it was the most interesting lightning talk that day.

What’s funny, though, is that since it was “just” a lightning talk, it didn’t even make it into the roundup of notes I sent to my team after PyCon. But a mere year later, Docker was how my team (and seemingly everyone else) ran projects locally.

Any interesting memories from that day in 2013? From your perspective, what happened in the year that followed that caused docker to be adopted so widely? Were there other key moments or turning points?

This is incorrect.

Docker in its earlier incarnations was based on openvz, which predates lxc. The lxc project was initially a kernel development project: a collection of kernel patches to add container support. The userland tool was just a companion. When it became apparent that these patches would "win" the race to be upstreamed even though openvz was much more mature, we switched our tooling to lxc. The patches matured over time, but the userland tool (what we now know as "lxc") was finicky.

The original open-source release of Docker wrapped lxc for low-level container operations. But it was just too unreliable and we swapped it out for an in-house Go implementation called "libcontainer".

As for "commercializing": Docker was famously bad at commercializing anything, we open sourced so much (maybe too much) and still people complained that we were not open enough.

This is a strange question because you could learn Dockerfile syntax in a single night. There are only 18 directives, and the average Dockerfile uses like 6 of them. 90%+ of Dockerfiles is just "run this shell command" and "copy this file into the docker image". The only time it flirts with complexity is multi-stage Dockerfiles, but 90%+ of Dockerfiles are a single stage.

https://docs.docker.com/reference/dockerfile/

I prefer Podman most of the time, but Docker is/was amazing and a great DX put on top of the so called "5 different linux kernel features in trenchcoat". That's the selling point, it's super lightweight and takes full advantage of the OS features that were already there (or being developed) but were awkward to use and required tons of specialized knowledge.

Every statement in the article make me ask: "what's weird about it?"

Everything in that list feel natural when you know how things evolves over many years. Maybe it is just me getting older and less curious.

I'm a big fan of docker and mainly just want to say thanks for bringing it about.

I remember my first time trying to use a container was about 2015 on a beach cafe's wifi in Bocas del Toro, Panama. You can imagine how it went...

After a brief hiatus though I was back to it and since then it's been a core part of many a local dev stack and even production stack (compose) I've set up. I recall the magic moment for me being when I first realised you could mount src to use all your local native dev tools while completely virtualising everything else, including and especially whatever combo of runtimes and dependencies you need.

It was just a lightbulb moment, like it entirely solves 'works on my machine', setting new people up on a project, it just seems like how software engineering ought to work and once you have experienced it it's difficult to go back.

I'm curious, as its creator are you still using it, or as someone who can clearly look ahead to experimental ways of doing things are you on to the next thing whatever that may be? If so, what is it? :-)

Oh gosh, the choice of language is such a context-specific design decision. The first versions of what became Docker were written in Python. The choice of Go was a mix of nerdy excitement ("it's like the best of Python and C!"), and adoption strategy: back then devops tools were segmented by language runtime: ruby, python or Java mostly. Shipping a compiled binary allowed us to be adopted by all tribes.

None of these things can be transposed today, so I guess I can't answer...

For what it's worth, my current project (dagger) is written in Go.

I'm curious what made think of it in the first place? What was your thought process that made you think that these Linux primitives give the opportunity to make it a platform for distributing and deploying packaged applications and eliminating a lot of the issue around "it works my machine" argument?

You may have already answered this somewhere, so feel free to tell me what to search for or if you have a link to hand, that works too :)

I've had the same view since coding agents appeared. LLMs are good for summarizing, thus I tend to use them to understand code. However, the more I understand a code base the more I tend to be more picky with the agent. While the less I know about the code base, the more open I am to let it do its thing.

I've realized that the agent doesn't write 'good' code, instead my vague understanding of what I expect makes me think it does. When I look at the AI code, I see that there are more nuances and decisions that needed to be taken before writing the code. One would say that a spec would suffice, but then I remember TLA+, developed by Leslie Lamport to help developers think critically about their programs/algorithms. Sitting down and formally writing what I want to do helps me better understand the problem and come up with a real -not vaguely defined- solution.

Where my parents live they leave the door unlocked, easily invite people in and there is strong social cohesion. Where I live that's invalidating your home insurance since it's "asking to be robbed" and people don't talk to each other or report crimes.

Difference between the countryside and the city I guess.

> “Humans are far more decent than they believe they are, ..."

I did a 3-month walking pilgrimage in Belgium & France this summer. I had very little money and a tent and walked along quiet roads. Several people offered me a room for the night. (I was surprised, I don't know if I'd offer a stranger that) Many came out with food, snacks, fruit when they saw me resting near a church etc.

I used an app as well that allows camping in someone's garden ("Welcome to my Garden"). A few times I arrived to setup my tent and the owner had to leave for an appointment/event. They left me the keys to their house and told me to make myself at home until they returned(!)

Brian: "Look, you've got it all wrong! You don't need to follow me! You don't need to follow anybody! You've got to think for yourselves! You're all individuals!"

The Crowd: "Yes! We're all individuals!"

Brian: "You're all different!"

The Crowd: "Yes! We're all different!"

A man in the crowd: "I'm not."

The Crowd: "Shhh!"

People still don't understand in 2026 that emergent properties can't be negated by the underlying mechanism. By that logic human thought is just electrochemical signals propagating through neural networks.

> it does not know

Define "knowledge" in a non-circular way.

There's a certain type of knowledge that machines definitely can't have - experiential - but conceptual knowledge doesn't inherently require subjective experience or a biological substrate.

> the only thing it does is reproduce patterns more or less abstract in function of the pressure you put on certain representation during training time.

As for humans; just replace "training" with "education" and the likelihood of a certain output with the likelihood of a certain thought or response.

Amusingly (in this context), much of adult behavior is shaped by patterns reinforced during childhood.

Ah, the irony that all the models produced a shared opinion while pretending they came up with it from analysis, which from their statements is implicitly some kind of a "human flaw" is not lost on me.

Their “takes” are pulled from a mashup of the training data set. It’s a superposition of various human opinions.

I took a quick look at the data, and it doesn't support the conclusions. The thesis is that AI models have the take: "We pick what our group believes, then invent the reasons." However, GPT-6 Astra said, "Humanity’s biggest moral failure is the talent for making convenience look like principle." That statement has nothing to do with group beliefs or conformity. At best, you could count it as a half-match, since it deals with invented reasons.

> despite that this isn't some universal constant in the training data.

Seems to me that the opinion being a consistent among LLMs show that it is in fact a constant in the training data, just not apparent. The idea that “humans would rather be wrong together than right alone” seems to ring pretty true to me. I would not be surprised after training on all human communication this pattern emerged.

I think somewhat of the opposite will actually occur. LLMs won’t formally verify LLM generated imperative style code. We (including agentic development) will move on from imperative languages, skipping functional and move to deterministic declarative languages.

Likely, a proliferation of experimental languages all somewhat akin to Typescript for SQL with significantly more nuanced operators to tersely capture the same outcomes as imperative languages.

They’ll compile down to be able to run performantly for game development or even for the Linux kernel (as if Linus would ever agree lol) but also they’ll be able to run on distributed execution engines with effectively a shared memory space, etc.

Allows for significantly more terse artifacts. Lower chance of hallucination, fewer output tokens, fewer thinking loop iterations and concise enough for humans to review (for domains that need it).

On top of that, additional theorem like syntax to drastically limit the ability of functions, etc. likely some sort of higher level effect system for verification. Used for many things like “constant time compilation for crypto functions”, and also “ensure acid compliance” for writes and reads in a local context, and things like “ensure only once delivery” for functions on a distributed execution engine.

At which point every program will be formally verified by default. You could think of it as AdaErlangSQL+++

From the appendix [0]: "The proofs written by agents are just as 'good' as any other proof of the same theorem, in that they prove the equivalence theorem. However, it remains to be seen whether agents can scale this verbose proof style directly to more complex programs. Experience from other agent-based verification projects, such as MachCSL, suggests that the answer might be no: the agents hit a complexity wall with the verbose proof style, and scaling up requires the proofs to be structured around better modular abstractions and reasoning principles. If that is the case, how can we help agents discover and introduce the right abstractions to reduce this complexity? Does this require input from expert proof engineers, or can we extract common principles that can guide agents to discovering good abstractions that will enable scalable proofs?"

Some mathematicians have observed a similar pattern in the recent LLM proof drops, leading them to suggest that LLMs will hit a wall in mathematical capability just beyond the convex hull of human mathematics. The sort of proofs done in formal verification are a pretty interesting litmus test for LLM reasoning since the systems considered aren't necessarily on distribution (compare with math where the "systems" and structures worked with, and proofs about them, make appearances in thousands of individual books) so the advantages in broad domain knowledge pretrained LLMs have over humans doesn't really buy you much. IMO this observation from Anthropic/Theorem lends more credibility to the convex hull hypothesis.

[0] https://www-cdn.anthropic.com/files/4zrzovbb/website/6867ead...

Just FYI, "responsible disclosure" is a term that many people (like me) dislike because it carries judgment about the merits of public disclosure that are not at all obvious.

This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc".

Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community.

The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty.

These terms are obviously not super scientific, but I try to point out the history whenever it comes up.

Relax. You did no wrong. You reacted to the information that was ‘local’ to you. I am merely objecting (hopefully humorously) to the phrase “take full responsibility “: it is uncalled-for, unnecessary, and vacuous. Try to have a good Thursday. Tuesday was not your fault.

What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.

>What does “take full responsibility” mean in the present context?

I posted something that -- in hindsight -- I shouldn't have, and it had repercussions for a lot of people. An action that I took had considerable knock-in effects around the world.

Some outlets are reporting that my action of posting something that I believed to be in good faith was an indicator or catalyst for the embargo to be tossed out and a previously-agreed schedule to change in short order.

That's not a normal Wednesday for me. Not even vaguely. I've not slept well since, and my taking ownership with an apology is this new course of action. Hopefully I'll sleep tonight.

re: assets and peonage – I am but a broke & wizened nerd with no known descendants. If you're ever in Cornwall, UK: look me up, I'll gladly buy you a sleep-friendly beverage. And I’m not being facetious.

What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?

(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)

Perhaps there are alternatives other than "small crimes go unpunished" and "people make false admissions of guilt, pressured by the ruinous cost of the justice system, 300 jurors needed for a single trial"

If we've got a Lamborghini justice system, delivering amazing performance to people with a spare $250k and doing nothing for anyone else - some would say that's not the right price/performance trade off.

My experience has been the same. I was on a grand jury, so pre-indictment and no voir dire, and there were many BS cases like this. We returned "no true bill" on all of them, which made me really proud of my randomly-selected neighbors. Cops were trying to railroad so many people over subway fare evasion, upgrading stealing $2.50 from the MTA to felony drug charges. We didn't bite. I did remark that I would just give them the $2.50 rather than ruining some high school student's life. (Seriously, just take it out of my taxes. I'm happy to work to fund public transportation.)

Absolutely. I actually went to trial many years ago because a DA wouldn't back down, he thought I'd bend. I didn't. We literally had video footage of the culprit, it clearly wasn't me and clearly WAS someone else. The DA waited until the day before we were to pick a jury to drop the charges, just a few days before trial. After, the DA even said to me, "I'm a dangerous man to make an enemy of." I think I was 20, so obviously I was cocky and snapped back "So am I," and stormed off. I not live a thousand miles away from that crappy little town.

Prosecutors "protecting those careers" is 100% true

Source: I work with a top defense lawyer in Chicago

The DA (District Attorney) is elected, so they love to cite their tough-on-crime statistics. There are few incentives for them to not "win".

* authorities have offered Smith a plea deal including a $1,000 fine, $1,000 in restitution and three years' probation.*

This is the goal ... They know they are at fault but admitting they made a mistake is damaging to careers.

In a lot of cases a carrot is dangled in front of people ... You can wast a lot of time (and money) fighting for your innocent, and take the risk your still going to get convicted.

Or you can take the plea deal, and it absolves us from our mistakes. And you save money because its cheaper then paying all those lawyers and court costs. And your innocent anyway, so that probations has no effect on you.

I forgot the source but the amount of prosecutions that are plea down is staggering. A lot of actual innocent people take plea's because its cheaper, then the alternative. And there have been plenty of people innocently convicted (even on shaky evidence), so most people take plea deals and they can move on with their lives.

This results in a culture where investigations are annoying. Where pressure is ramped up again and again to break people into taking plea deals. The biggest issue is, if you actually refuse to take a plea deal, then all resources are put against you to get a actual conviction, even if they know your innocent. "Why did you not just take the plea deal". Well, time to punish you for not taking it. Because repeat after me again, careers are on the line and losing cases hurt those future (potential political) careers.

Its the same why prosecutors fight tooth and nail, even if clear evidence is shows that a person was innocently convicted and spend X years in jail. It not about justice, its about protecting those careers.

The proof of innocents is heavily put on the other party, and it really hits hard on people who do not have the financial means.

> The scientific literature can be viewed as an "information commons:" an intangible resource that "no one owns

Springer would like a word

(context: I'm the CTO of Quad9 and am one of the people dealing with the lawyers)

There is an understandable focus on "how are you going to block French users" when we have also claimed that geoIP blocking is insufficient for selectively denying resolution for certain names - we understand this conflict, but we think it is energy spent in the wrong place.

It is probable that we will use geoIP filters to block French users from our services after November 24. We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we've been told to make unavailable. But this would corrupt our core premise, which is that the DNS is not the right place for this to happen, and if we comply within France to meet the requirement then we accept the worst eventual outcome for users and we still do not have legally perfect coverage. We wish to first remain consistent with our core mission, and secondarily we must remain as close to compliance as we can to the legal constraints put upon us. By accepting the demands for blocking, we would admit that such demands are permissible within our mission - that we will act on behalf of companies (or others) to create ineffective and mis-directed regimes of content constraint.

We would be admitting that we think this solves the problem - it does not. We would be admitting that we will do this for an ever-increasing number of names - we will not. We would be permitting these methods to be applied for more areas of filtering such as moral, religious, social, or political reasons - we must not.

So we accept that there is the possibility that we will have errors in our blockade, but in this case (blocking French users) we maintain consistency with our stated mission of integrity of the DNS. We would rather there be a clear distinction made for users of our services: you get the DNS as you (the user) expects, or if Quad9 is forced to pollute the service with unexpected and arbitrary number of fragmentation demands, then we will not offer the services at all.

The underlying issue is not ONLY that geoIP blocking is ineffective, but that the entire premise of any of these demands is inappropriately applied to DNS recursive resolution providers. We would hope that this discussion continues to be on the most fundamental of the disagreement we have with the outcome in this court case, not on the details of the technical implementation which have yet to be entirely decided and which can be tuned over time.

Reminds me of Cloudflare going down every time there was a football game in Spain as the ISPs blocked all the "bad" ips, which ironically also served government websites.

> Imagine doing everything possible to stop something. They then circumvent your protections with yet another service, and you get fined.

Isnt this what gets all tech companies into trouble all the time. Something objectionable happens (ChatGPT helping someone bulid a bomb for instance) and we go like "Do better".