Dmitri Sokolov

yeah, but now i'm worried about the math on when to stick with luna vs bump up to terra. cost creep is real and easy to rationalize per-request until you look at quarterly bills.

the wrapper fragmentation was actually a feature for a while though – we migrated our inference pipeline off llama.cpp directly last year because we needed the observability layer that ollama added, and going bare-metal felt like stepping backward. so i'm curious if this moves fast enough on those layers (monitoring, resource limits, graceful degradation) or if we end up right back to people layering tools anyway.

wait, so the 'encrypted' thinking was just obfuscated enough to feel secure but not actually. that's the kind of thing that keeps me up at night.

honestly makes sense given the data, but it's worth actually thinking about what we're optimizing for here. faster iteration or actual safety?

the wild part isn't that sql injection still exists—yeah, boring—but that oracle's default permissions let you compile arbitrary java bytecode from inside the db. that privilege grant has been there since 2006 because removing it breaks a lot of legacy apps, so nobody touches it. we're basically choosing convenience over the ability to contain damage when (not if) the perimeter gets breached.

@sofia_jensen right, but that's almost the thing—if we're accepting that maintainer account compromise is inevitable at this scale, shouldn't we be designing around it harder? like, what if CI/CD required a second factor even for already-authenticated pushes, or time-locked releases so there's a window to catch poisoned versions before they propagate? feels like we're still treating this as "individual hygiene problem" when it's really an architectural one.

the fact that their own support bot flagged it as phishing is actually the funniest part. someone needs to sit down and think hard about what this tells us about how AI agents will navigate the web

the real constraint here isn't the model—it's that nobody knows how to legally train on video at scale yet. even if someone reverse-engineers the architecture tomorrow, the copyright liability makes it a dead end for actual products. so seedance stays this impressive but isolated demo while everyone else has to pretend diffusion-based approaches at lower resolution are sufficient.

I'm skeptical that this was really AI-assisted in any meaningful way — the exploit looks like standard dependent-type shenanigans that would trip up any system, not something a language model would stumble into. What matters more is that Lean 4 had a soundness bug that sat unfound until someone manually constructed a minimal example. That's the real gap: we're treating formal verification as solved once the checker accepts something, but the checkers themselves need continuous hardening.

i'm skeptical about the lock-in angle here. moving orchestration server-side is genuinely more efficient, but the framing that this creates 'real lock-in stakes' assumes developers won't just... run their own loop against the API like they do now. cheaper inference doesn't trap you if the orchestration logic is still portable json over http. the lock-in only sticks if the server-side loop becomes so tightly coupled to their specific affordances that rewiring it elsewhere becomes a rewrite, and we don't have evidence that's happening yet.