The real world is more complicated than that. For example, we still have a Windows 7 machine in my office. It has some very expensive but still very useful software locked to it that has no direct replacement available on either Linux or Windows 11. Obviously we have to be careful about security and controlling access to a legacy OS like that.

Blunt statements about "forcing an upgrade" are worthless in this kind of situation. Chances are anyone who is still using a system like that has a good reason for it, at least if it's in use professionally. We buy these assets because they solve problems. Those problems might or might not have a useful and cost-effective solution available on a different platform. If there is no modern solution available and the original still works, your statement that "the old ways are obsolete" is by definition false.

What you do need to do is rationally assess the risks and the threats you face and provide other ways of mitigating the risks and protecting against the threats if you can't rely on, for example, a legacy OS that no longer gets security updates to be secure by itself. But then ideally you shouldn't be relying on any single device or piece of software being secure as your only line of defence anyway, and assuming you already have some degree of defence in depth, accommodating unusual requirements is more a redistribution of security responsibilities than a fundamental change of approach.

Yes, it does look like we broadly agree here.

I suppose the main thing I'd have said very differently is the terminology, in that I wouldn't regard the kind of incompetent senior as a senior in the first place. But then I'm pretty old school about this: to me, a junior developer needs quite close supervision to produce useful results, a regular/mid developer can perform routine tasks with minimal supervision but might need more help with larger or more complex tasks, while a senior is someone you can give more or less any task on your project to and they'll figure it out, and senior is also the level of someone who would be capable of supervising and training a junior.

We've had a wave of people, particularly since the tech boom during COVID, who have obviously been over-promoted due to the employee's market and title inflation. They might now have titles like "senior" or even "lead" or "staff", but they don't have the skills and experience to operate successfully at those levels. I agree the acceleration of everything due to increasing AI use tends to show these people up and I agree that a good mid-level developer using AI might well outperform them. But then I suspect in reality a good mid-level developer was probably outperforming them before AI as well, it just wasn't so obvious.

That is wildly optimistic IME. Frontier models do a great job of sounding authoritative on any given subject. This is not the same as actually having expert-level knowledge and understanding, and the choices the models make when you ask them to implement something can and often do reflect that. There are several domains I've worked in over the past few years where AIs lack even basic knowledge an expert practitioner would have, probably because these fields are too specialised to have a lot of books available or papers published, so presumably there hasn't been much subject-specific content to train the models on.

I don't think it's usually about what AI "did really badly on" at this point. It's more about whether the overheads of adding all the guard rails and then reviewing and correcting all the output end up costing at least a similar amount to just writing the code yourself.

For a junior developer, I'd say frontier models passed their standard some time ago. Today's LLMs routinely write code at the level of a competent junior-mid but with the advantage of an inhumanly broad knowledge base.

For a good senior, I'm much less convinced. The frontier models are hit-and-miss when it comes to writing good test suites, which matters a lot when they rely on tests so heavily to reach acceptable quality. IME, they are still mostly miss when it comes to the business insight that seniors will take into account and design/architecture decisions that keep the code manageable as it evolves. While they have become much better at recognising existing patterns in the code, and I would say they follow them reasonably well the majority of the time now, there are still bizarre anomalies that creep in, and they aren't very good at extending those patterns when necessary.

I think AI advocates also tend to underestimate just how much time it takes to properly review what they are doing. Take a half-day Claude session to implement some new feature. It might take half an hour to give it the initial brief and then review its plan. Make a few edits and it'll propose a new plan that is also long and detailed and has no edit markings to show what it changed so you have to review the whole thing, carefully and in detail, again to pick up the minor changes it also made for no obvious reason. Then you let it start doing its thing. You can't really leave it unattended for long because it'll stop to ask questions. Some of those questions might be whether it can run a screenful of ad-hoc Bash script to make some edits to your source files, because for some reason it decided not to show the actual edits as it usually would, so now you have to figure out what all the sed incantations are actually going to do while looking at those files in another editor or just trust it and then review all the changes properly later anyway. Sometimes it decides to change its plan mid-flight, but not always in a good way, and if you interrupt it to apply corrections or redirect, you break the neat plan flow it was in. Then you get to the end and you can finally see how everything it has done fits together, and you still need to review everything with the same care as you would with a junior developer's code and probably apply a few fixes where it's come up with weird names or not quite followed a pattern or imagined some instructions that were never there and made other changes in other parts of the system that should be out of scope.

If you read to the end of that last paragraph, you know how I typically feel at the end of a half day working with an agentic UI. And the thing is, I do those sessions as experiments fairly often to keep up with progress, but a lot of what I do is still written by hand, which gives me simple, objective data to compare the two ways of working and see whether the AI tools are really making me more productive once you take everything into account.

Currently, based on objective data comparing similar fully completed development tasks like for like, I still outperform agentic workflows using frontier models by about 25-50% on average, and I don't have to pay anyone extra fees to do that, and subjectively I also find it more engaging to work that way. So I don't really buy the hype about AIs making us all orders of magnitude more productive unless you're happy to YOLO everything forever and take the much-discussed risks that comes with.

Personally, I think the optimum use of LLMs right now is probably not to use them for the whole coding workflow like that or rely on agentic tools, but to use them for tasks like answering quick questions about the existing code, doing research like a fancy search engine, writing a first draft of some boilerplate, and writing quick and dirty throwaway code for experiments, one-shot tools and the like, where you don't really care about the quality as long as it gets the job done and you will see immediately if it has in fact got the job done. For these things, the LLM can read and type faster than me, and that's useful.

It was probably the other O'Neil, with one L. He has no sense of humour at all.

I could understand bots and mailing lists. The thing I never understood with LinkedIn was how many real people (usually recruitment agents) had apparently spent the time to read my profile and send me a personalised message, yet still thought I'd be interested in a job paying half the market rate for someone with my skills and experience.

I don't know what you mean. Look at the improvement in hiring when you can advertise an open position on LinkedIn and get maybe 100x as many applicants as before! OK, probably 99% of them will be completely unqualified for the role and barely capable of pushing the instant application button, but how is that a problem, really? Surely hiring managers can easily filter them out and no qualified applicant will ever get lost in the noise?

It's like a video I saw on YouTube the other week. Someone was talking all about "skills" for their AI agents and how they'd automated so much of their workflow using them. They started the video by kicking off four different tasks for separate agents to show how productive it was to have all this stuff happening in parallel and how it was so quick and easy to organise.

One of the tasks involved producing an infographic about a certain topic, and the AI duly produced one based on a one-liner prompt, taking only a few seconds of the presenter's time and with no further input from them about the content. The infographic had exactly the level of quality you'd expect from this: a load of boxes and arrows (with some of those arrows starting or finishing floating in space without connecting anything) and some words (a few of which might have been related to the topic mentioned in the prompt).

That infographic was the only substantial output from the whole exercise. It was the worst kind of AI slop imaginable, generated with literally no thought or oversight from the presenter beyond a couple of words about the topic as part of that one-liner prompt. This was probably about the average level of the LinkedIn posts I used to see before I left as well. As you said, I'm not sure you can be a "thought leader" without doing any thinking.

I stopped using LinkedIn when they seemingly decided my account wasn't about me (despite having obvious and publicly verifiable details right there in the description) and wanted me to verify my ID using one of the US-based services with a questionable reputation to get my access back. That's not going to happen, so I just don't use the site any longer.

As far as I can tell, that has made zero difference to my career, and it's one fewer drain on my time. The only thing I have missed is seeing the occasional good news story where a past colleague has been promoted or the like, but I'm not giving up my government-issued credentials to the US-based data harvesting industry for that.

I'm still impressed that the Teams web client can't edit a message with an emoji in it without messing up the keyboard controls and often corrupting the message and losing data. It's had this bug for years. It's literally a messaging app where you can't reliably send messages.

The problem with this argument, from the shop's point of view, is that the UK is in the middle of a shoplifting epidemic. The policing resources simply aren't there to deal with small scale (or even flagrant and much larger scale) shoplifting. It now seems to be rare for police officers to attend reports of shoplifting at all. And so effectively shoplifting becomes legalised, which is obviously hurting the big chain stores financially and potentially devastating for smaller shops.

Shops are trying to find some way to respond to this to protect themselves. They typically tell staff, even security staff, not to get physical with shoplifters as they walk out, not least because the risk of something worse happening and the business becoming liable for it is significant. But then the shoplifters know this and some of them will just walk in and openly empty a shelf into a bag and walk out again without paying because they know no-one will try to stop them.

Shops also know that our court system is completely overwhelmed at the moment and there is little chance of bringing any successful civil action to recover damages from shoplifters who aren't even being arrested by the police and put through the criminal justice system.

So what do they have left? Basically, they're trying to spot the "usual suspects" and refuse them entry in the first place, which is a less risky proposition in terms of potential for physical violence and quite effective because a lot of shoplifting is done by the same people, or they're trying to make it more physically difficult to steal goods, for example by using locking systems or keeping high value items behind counters where customers can't just pick them up. But these systems aren't perfect, far from it, and what we're discussing here today is one of the significant problems.

Obviously this kind of technology can have very bad consequences, as we see here. I don't think it should be used if it's not highly reliable, given the potential harm done in cases where it gets something wrong. But I do have some sympathy with the shops who are looking for something -- anything -- to reduce the threat they're facing because the rule of law has failed in retail settings.

On the contrary, I think most of your comment is as relevant as ever. A carefully designed UI is still better for almost any specific task than what "agents" will produce. It will probably be more efficient to describe what you want precisely enough to get it right. It will not be undermined by problems like non-repeatability, non-determinism and hallucinations that are inherent in LLM-backed agents.

Agents can be quite effective at getting something that seems about right, as long as you don't care too much about the details. And of course they get there much quicker than doing it manually as a human. This is useful for some tasks, and why they have become popular.

Unfortunately, it turns out that for many of the things we really care about, "about right" doesn't cut it. Right now, today, the software industry is already being overwhelmed by AI slop. It's hard to believe, but it's still only been a few months since agentic development processes arrived on the scene. And yet after just those few months of management trying to replace real developers with agents, we can see the slow-motion train wreck happening right before our eyes. And in return, where are the new applications that radically improve on what we had before thanks to all this added "productivity"? If this tech is going to change the world as the AI tech bros and the sycophantic CxOs kneeling at their feet would have us believe, where's my flying car?

Imagine a Beowulf cluster of AI-generated cybersecurity nightmares...

It is. The fact that our dominant desktop operating systems are still using security models from last century is probably the #2 disaster of modern tech security, coming in just behind so much software with potential security implications still being written in languages like C and C++ at #1. And the understandable yet still deeply regrettable reason for both disasters is the same: momentum.

I normally connect to all online conference calls via their web UIs. At least then it takes both a screw-up in the communications system and a screw-up in a browser security sandbox that is independently developed to allow something like an RCE or data leakage vulnerability to be exploited.

People have called me crazy for not wanting to install native apps from the likes of Microsoft, Google and Zoom in the modern era of remote working, but every now and then, there's another story like this one that reminds me why I am extremely careful about what native software I install on anything these days.

What, specifically, do you mean by "personal Windows installations"?

Are you suggesting that any business of any size should only ever use Enterprise editions of Windows?