Except this time it’s “if I can just figure out how and pay for the Claude API usage”.

This is one of the sadder things about AI usage getting more standard that I haven’t seen discussed much—-the barrier to entry is now monetary rather than just knowledge-based, which will make it _much_ harder for young people with no money to pick up.

Yes, they can still write code the manual way, but if the norm is to use AI I suspect that beginner’s guides, tutorials, etc. will become less common.

Agents are a boon for extraverts and neurotypical people. If it gets to the point where the industry switches to agents, I’ll probably just find a new career

Often there's as much to be learned from why it doesn't work.

I see the AI hype to be limited to a few domains.

People choosing to spend lots of money on things speculatively hoping to get a slice of whatever is cooking, even if they don't really know if it's a pie or not.

Forward looking imagining of what would change if these things get massively better.

Hyperbolic media coverage of the above two.

There are companies taking about adding AI for no other reason than they feel like that's what they should be doing, I think that counts as a weak driver of hype, but only because cumulatively, lots of companies are doing it. If anything I would consider this an outcome of hype.

Of these the only one that really affects me is AI being shoehorned into places it shouldn't

The media coverage stokes fires for and against, but I think it only changes the tone of annoyance I have to endure. They would do the same on another topic in the absence of AI. It used to be crypto,

I'm ok with people spending money that is not mine on high risk, high potential reward. It's not for me to judge how they calculate the potential risk or potential reward. It's their opinion, let them have it.

The weird thing I find is the complaints about AI hype dominating. I have read so many pieces where the main thrust of their argument is about the dominance of fringe viewpoints that I very rarely encounter. Frequently they take the stance that anyone imagining how the world might change from any particular form of AI as a claim that that form is inevitable and usually imminent. I don't see people making those claims.

I see people talking about what they tried, what they can do, and what they can't do. Everything they can't do is then held up by others as if it were a trophy and proof of some catestrophic weakness.

Just try stuff, have fun, if that doesn't interest you, go do something else. Tell us about what you are doing. You don't need to tell us that you aren't doing this particular thing, and why. If you find something interesting tell us about that, maybe we will too.

> Claude was trying to promote the startup on Hackernews without my sign off. [...] Then I posted its stuff to Hacker News and Reddit.

...I have the feeling that this kind of fun experiments is just setting up an automated firehose of shit to spray places where fellow humans congregate. And I have the feeling that it has stopped being fun a while ago for the fellow humans being sprayed.

I've tried to explain it to other devs that it's like dumping out a 10000 piece jigsaw puzzle and trying to put it together again.

it's just fun.

https://hub.docker.com/r/linuxserver/kasm

*EDIT* prominent close button and closing on back navigation added (probably people will complain about hijackng the back button now)

Not the point at all, but I have found it quite common among younger professional engineers to not know SQL at all. A combination of specialization (e.g. only work on microservices that do not directly touch a database) and NoSQL has made the skill of SQL more obscure than I would have thought possible as recently as 5 years ago.

I use claude code quite liberally, but I very often tell it why I won't accept it's changes and why; sometimes I just do it myself if it doesn't "get it".

I'm exaggerating of ourse, and I hear what you're saying, but I'd rather hire someone who is really really good at squeezing the most out of current day AI (read: not vibe coding slop) than someone who can do the work manually without assistance or fizz buzz on a whiteboard.

This is so funny. Thank you for sharing :)

    env IS_SANDBOX=1 claude --dangerously-skip-permissions

> 1) Have faith (always run it with 'dangerously skip permissions', even on important resources like your production server and your main dev machine. If you're from infosec, you might want to stop reading now—the rest of this article isn't going to make you any happier. Keep your medication close at hand if you decide to continue).

But I think I'm getting to the point where "If I'd let an intern/junior dev have access while I'm watching then I'm probably OK with Claude having it too"

The thing that annoys me about a lot of infosec people is that they have all of these opinions about bad practice that are removed from the actual 'what's the worst that could happen here' impact/risk factor.

I'm not running lfg on a control tower that's landing boeing 737s, but for a simple non-critical CRUD app? Probably the tradeoff is worth it.

https://github.com/anthropics/claude-code-security-review

The new command is something like /security-review and should be in the loop before any PR or commit especially for this type of web-facing app, which Claude Code makes easy.

This prompt will make Claude's code generally beat not just intern code, but probably most devs' code, for security mindedness:

https://raw.githubusercontent.com/anthropics/claude-code-sec...

The false positives judge shown here is particularly well done.

// Beyond that, run tools such as Kusari or Snyk. It's unlikely most shops have security engineers as qualified as these focused tools are becoming.

Saw the double bill and contacted them, I had a full refund in a couple days and a nice personal note thanking me for being a max user.

This was a couple months ago so it’s possible they’ve had a huge influx of requests that made it difficult to respond fast lately but I had a good experience with their customer service.

"I wrote this entire article in the Claude Code interactive window. The TUI flash (which I've read is a problem with the underlying library that's hard to fix) is really annoying, but it's a really nice writing flow to type stream of consciousness stuff into an editor, mixing text I want in the article, and instructions to Claude, and having it fix up the typos, do the formatting, and build the UX on the fly.

Nearly every word, choice of phrase, and the overall structure is still manually written by me, a human. I'm still on the fence about whether I'm just stuck in the old way by preferring to hand-craft my words, or if models are generally not good at writing.

"

Either he's lying, or you're wrong.

Agree on the structure part. I mostly read it as a piece from someone who's having fun with the tool. Not a structured article for future generations.

How much of this is buildings versus recalling tutorials in the dataset. For every vibe coded project with 20 lines of requirements, I have a model with 20 different fields all with unique semantic meanings. In focused areas, AI has been okay. But I have yet to see Claude or any model build and scale a code base with the same mindset.

But it's far from perfect. Really difficult things/big projects are nearly impossible. Even if you break it down into hundred small tasks.

I've tried to make it port an existing, big codebase from one language to another. So it has all of the original codebase in one folder, and a new project in another folder. No matter how much guidance you give it, or how clear you make your todos, it will not work.

They even PAY for this privilege.

It truly cannot reason well yet about geometry, visual aesthetics, placement, etc. The performance varies: it's quite good at matplotlib but terrible at any non-trivial LaTeX / TikZ layout or graphic. Why? Not a clear idea yet -- would love to think more about it.

I've tried many things now to try and give it eyes (via text), and this is unavoidably a place where things are ... rough ... right now.

I've had bad results with image screenshotting. More often than not, it has no idea what it is looking at -- won't even summarize the image correctly -- or will give me an incorrect take "Yes indeed we fixed the problem as you can tell by <this part of the UI> and <that part of the UI>" which is wrong.

I typically have to come in and make a bunch of fine-grained changes to get something visually appealing. I'm sure at some point we'll have a system which can go all the way, and I'd be excited to find approaches to this problem.

Note -- tasks which involve visual design which I've run into diminishing returns: * proper academic figures (had a good laugh at the GPT 5 announcement issues) * video game UI / assets * UI design for IDEs * Responsive web design for chat-based interfaces

All of these feel like "pelican" tasks -- they enter into a valley which can't be effectively communicated via textual feedback yet ...

I agree that it's bad. What I noticed using AI was that it tends to introduce gradients whenever you want to make something look nice. Whenever I see a gradient now I immediately assume that it was designed with AI

For example, AI could produce Graphanas design standards, which is fine for the audience.

Which makes me feel early adopters pay with their time. I'm pretty sure the agents will be much better with time, but this time is not exactly now, with endless dances around their existing limitations. Claude Code is fun to experiment with but to use it in production I'd give it another couple of years (assuming they will focus on code stability ans reducing its natural optimism as it happily reports "Phase 2.1.1 has been successfully with some minor errors with API tests failing only 54.3% of the time").

It's so hit and miss in Rust too. When I ask it for help with a bug it usually tries a few things then tries to just delete or comment out the buggy code. Another thing it does is to replace the buggy code with a manual return statement with a comment saying "Returning a manual response for now". It'll then do a cargo build, proclaim that there are no errors and call it a day. If you don't check what it's doing it would appear it has fixed the bug.

When I give it very specific instructions for implementation it regularly adds static code with comments like "this is where the functionality for X will be implemented. We'll use X for now". It does a cargo build then announces all of its achievements with a bunch of emojis despite having not implemented any of the logic that I asked it to.

When the AI company is "policing" your agent by requiring a "human in the loop", it's just CYA (cover your ass) for the AI company.

If your agent goes off and does something illegal, the AI company would be liable unless they have some legal deniability. By requiring you the human account owner to sign-off on what your agent is doing, you become liable for any crimes your agent commits on your behalf. I haven't read their TOS but I can guarantee there is some clause like this in there.

You are still completely free to commit crimes with your agent and suffer whatever legal consequences follow!! You just have to be clear that you intentionally wanted those actions to occur which resulted in the crime. If you repeatedly allow your agents to take actions that could potentially be criminal without any human-in-the-loop, they're going to ban you because it exposes themselves to potential criminal charges.

- Repeat more than 20 times the same response to my prompt rejecting its proposed changes; I just kept prompting to see how far it would go before doing something different. Claude Code would quickly guess there is something wrong and try something else or ask what I'm getting at

- Continually refer to outdated versions of files, even after I've told to re-read the files

- Refer to files in a different session on a different machine that have no relevance to what I'm currently doing, presumably simply because I logged in with the same account.

- Randomly crash or enter infinite loops, sometimes soon after starting

- Refuse to read files in a sibling or parent folder

- Fail to understand simple request.

- Propose empty changes

Claude Code is just far better. I only use Gemini CLI for the simplest of tasks

The biggest pain point I've had is that both tools will try to guess the API of a crate instead of referencing the documentation. I've tried adding an MCP for this but have had mixed results.

https://github.com/d6e/cratedocs-mcp

Just letting a single instance run all the time … is not that bad, seriously.

I think the issue with this conversation is that no one tells you what they are working on, and I suspect there is both a skill gap in usage, but also a lack of capability in the LLMs, both surfacing as the same outcome.

There is definitely stuff an LLM cannot do on its own, at which point is the LLM really achieving the outcome or is it the human just achieving it by backseat driving. Much like a senior telling the junior how to solve a tricky bug, you wouldn't say the junior came up with the solution and therefore you would not say the junior is capable of solving the bug.

Recently my CC subscription ran out, tried 3 prompts with Cursor Agent and then went back to subscribing CC. I still use Cursor though for autocompletion.

I'm surprised it didn't get to the point of blackmailing the author to give it more resources and keep itself running.

That's a critical feature for keeping a human in the loop, preventing big detours and token waste.

The company I work for builds a similar tool - NonBioS.ai. It is in someways similar to what the author does above - but packaged as a service. So the nonbios agent has a root VM and can write/build all the software you want. You access/control it through a web chat interface - we take care of all the orchestration behind the scene.

Its also in free Beta right now, and signup takes a minute if you want to give it a shot. You can actually find out quickly if the Claude code/nonbios experience is better than Cursor.

Recently, I tried using Claude Code with my GitHub Copilot subscription (via unofficial support through https://github.com/ericc-ch/copilot-api), and I found it to be quite good. However, in my opinion, the main difference comes down to your preferred workflow. As someone who works with Neovim, I find that a tool that works in the terminal is more appropriate for me.

I’m just glad we’re getting past the insufferable “use Cursor or get left behind” attitude that was taking off a year ago.

Still not convinced it is not satire.

So now I use a docker compose setup where I install Claude and run it in a container. I map source code volumes into the container. It uses a different container with dnsmasq with an allowlist.

I initially wanted to do HTTP proxying instead of DNS filtering since it would be more secure, but it was quite hard to set it up satisfactorily.

Running CLI programs with the dangerous full permissions is a lot more comfortable and fast, so I'm quite satisfied.

> If you're from infosec, you might want to stop reading now — the rest of this article isn't going to make you any happier. Keep your medication close at hand if you decide to continue...

A couple of weeks ago I asked it to "clean up" instead of the word I usually use and it ended up deleting both my production and dev databases (a little bit my fault too -- I thought it deleted the dev database so I asked it to copy over from production, but it had deleted the production database and so it then copied production back to dev, leaving me with no data in either; I was also able to reconstruct my content from a ETL export I had handy).

This was after the replit production db database wipe-out story that had gone viral (which was different, that dev was pushing things on purpose). I have no doubt it's pretty easy to do something similar in Claude Code, especially as Replit uses Claude models.

Anyway, I'm still working on things in Replit and having a very good time. I have a bunch of personal purpose-built utilities that have changed my daily tech life in significant ways. What vibe coding does allow me to do is grind on "n" of unrelated projects in mini-sprints. There is personal, intellectual, and project cost to this context switching, but I'm exploring some projects I've had on my lists for a long time, and I'm also building my base replit.md requirements to match my own project tendencies.

I vibe coded a couple of things that I think could be interesting to a broader userbase, but I've stepped back and re-implemented some of the back-end things to a more specific, higher-end vibe coded environment standard. I've also re-started a few projects from scratch with my evolved replit.md... I built an alpha, saw some issues, upgraded my instructions, built it again as a beta, saw some issues... working on a beta+ version.

I'm finding the process to be valuable. I think this will be something I commit to commercially, but I'm also willing to be patient to see what each of the next few months brings in terms of upgraded maturity and improved devops.

There are plenty of alternatives for other models like opencode et al, and you can always just set ANTHROPIC_BASE_URL with claude code to have it use another provider. I don't see why they need to do anything in addition to that.

My only request would be for claude code to be a bit more open, less obfuscated and to accept PRs - but I understand the unwillingness of also wanting to manage what would be a very popular open source project.

And of course, not the same, but Aider still exists and is still a great tool for AI dev.

It's interesting how everyone is suddenly OK with vendor lock-in, quite a change from years past!

The last task I tried to get an LLM to do was a fairly straightforward refactor of some of our C# web controllers - just adding a CancellationToken to the controller method signature whenever the underlying services could accept one. It struggled so badly with that task that I eventually gave up and just did it by hand.

The widely cited study that shows LLMs slow things down by 20% or so very much coheres with my experience, which is generally: fight with the LLM, give up, do it by hand.

Wow, this is really extreme. We certainly got to this point faster than I expected.

I use AI, and for some things its great. But I'm feeling like they want us to use the "blunt instrument" that is AI when sometimes a smaller, more fine grained tool/just handcrafting code for accuracy at least for me is quicker and more appropriate. The autonomy window as I recently heard it expressed.

Buuut for some people it just clicks and it becomes their chore to go find trash in the beach everyday and the occasional nickel or broken bracelet they feel the need to tell people and show it off.

Yes it's easy now so its by definition no longer impressive, but that in itself is impressive if you can correctly remember or imagine what your reaction _would_ have been 6 months ago.

I’ve noticed a new genre of AI-hype posts that don’t attempt to build anything novel, just talk about how nice and easy building novel things has become with AI.

The obvious contradiction being that if it was really so easy their posts would actually be about the cool things they built instead of just saying what they “can” do.

I wouldn’t classify this article as one since the author does actually create something of this, but LinkedIn is absolutely full of that genre of post right now.

Do the right thing, sign up for an API account and put some credits on there...

(and keep topping up those credits ;-)

I'm planning to run a local model on a $149 mini-pc and host it for the world from my bedroom. You can read a bit more about my thinking below.

https://joeldare.com/my_plan_to_build_an_ai_chat_bot_in_my_b...

These hosted models are better but it feels like the gap is closing and I hope it continues to close.

                system_instructions = """You will generate an image. The image will be used as the background of a poster, so keep it muted and not too detailed so text can still easily be seen on top. The actual poster elements like margin etc will be handled separately so just generate a normal image that works well in A4 ratio and that works well as a background."""

            full_prompt = f"{system_instructions}\n\nGenerate a background image for an A4 poster with the following description: {prompt}"

            openai_request = {
                'model': 'gpt-4.1-mini',
                'input': full_prompt,
                'tools': [{
                    'type': 'image_generation',
                    'size': '1024x1536',
                    'quality': 'medium'
                }]
            }

            # Make request to OpenAI
            response_data = self.call_openai_api('/v1/responses', openai_request)

You can use these tools in lots of different ways. You don't have to go all the way to the vibe coding extreme. You can go down to individual functions and have it write them and adjust them step by step if you want, approving every diff. Or even just have it on the side to chat with about your code (Aider is great for this in /ask mode). You can guide its behaviour with CONVENTIONS.md / CLAUDE.md and get it to work how you want as well. I find it handy just asking Aider to write comments for my functions.

It's definitely early days but I'm expecting we'll pretty quickly evolve to having standard "profiles" you can apply to work in different ways, and projects will start shipping with them out of the box (a bit like lint config). This will relieve a lot of the friction at the moment where you spend the first hours / days just corralling it to work the way you want.

The problem is that whatever consequences come of it won’t affect just them. You don’t really have any way of knowing if any service you use or depend on has developers running LLMs in production. One day not too far off in the future, people who don’t even like or use LLMs will be bitten hard by those who do.