I really do think coding using AI tools is a bit faster, at least it seems that way to me. As most of the morning but lengthy work can be done faster by AI.

But I am also pretty sure it's VERY easy to rapidly incur technical debt, especially if you are telling AI to review its own work. Yeah it will do some stuff but who is to say post review fixes it's really better?

More than ever I think the right approach to coding with AI is to build up carefully crafted frameworks that are solid (maybe use AI to help but review and tests very carefully) then allow AI to build on top of solid fundamental structures that you know are solid, and do not let the AI modify those - maybe let it ask for feature requests.

Google, Microsoft, Apple, Facebook, Amazon, or another one of the big software development companies could easily fork ffmpeg itself, fix the open CVEs, provide their own (likely incompatible) features, and become the new standard - leaving the original developers out in the cold. Google did this with Blink (forked from WebKit, which itself was forked from KHTML). They took a fork of a KDE backed project, put it into what is now the #1 browser in the world, allowed Microsoft, Opera, and others to then use it in their own browsers — and now Google owns the entire narrative and development direction for the engine (in parallel to, and controlled to a lesser extent by Apple which maintains WebKit). The original KHTML developers really couldn’t keep up, and stopped maintaining KHTML back in 2016 (with full deprecation in 2023).

That is the risk for the original developers here. You’re right in that there isn’t really anything out there that can do what ffmpeg does — but if the developers don’t keep up on CVEs then organizations are going to look for new maintainers — and a year or two from now everyone will be using the Google/Microsoft/Apple/Facebook renamed version of ffmpeg instead.

That’s the shitty truth of how these things work. We’ve seen these same actors do it before.

Yaz

Look — I’m a developer. I get it. I’m personally all for having organizations do more to support the OSS they rely on. But the people in the C-suite are more worried about organizational reputation and losing money to lawsuits. If a piece of software they rely on has a known critical CVE that allows for remote code execution and someone breaks in and steals customer data — that software either needs to be fixed, or it needs to be scrapped. Those are the choices. Our customers in the EU are allowed to request SBOMs of everything we use and pass it through their own security validation software — and if they find sev critical CVEs in software we’re using there is going to be hell to pay. And the people in the C-suite can’t abide that level of risk.

Most software development companies (outside some of the biggest ones) don’t really have the kind of expertise in house to supply patches to something as complex as ffmpeg. But a company like Google has the staff with sufficient experience in this area that they could fork the project, fix the issues, and redistribute it as their own solution to the problem — and now Google is driving ffmpeg development. Organizations that need a security-guaranteed version will simply switch to Google’s version, which will likely slowly become incompatible with the original. They’ve done it before — Chrome was Google’s fork of WebKit, huge swaths of users flocked to Chrome, and now Google has over the years made enough changes that their patches often aren’t compatible with WebKit (and, of course, WebKit itself did similar when they forked KHTML).

Now forking like this is great for the community, but it can be tough on individual developers who see their work co-opted and then sidelined by massive corporations. And that’s really why the ffmpeg developers need to be very careful about ignoring CVEs like this. They do so at their own peril, as anyone can fork their code, fix the issues, and slowly make it incompatible with the original. And a big enough organization can ensure they’re fork becomes the new standard, leaving the original developers out in the cold.

Yaz

That, or your project gets sidelined. Which is where the danger lies.

I work for a big multinational software company that uses a lot of Open Source Software. We have a security office that audits all of our products several times a year. If any piece of our stack shows any open CVEs we have a fixed amount of time to fix the issue, with the amount of time varying from a few days (for CRITICAL severity issues) to roughly half a year for the lowest severity issues. A lack of a fix for a published CVE isn’t an excuse for not fixing the issue on our end — the software still has a security flaw in it, and the organization is so incredible security averse (thanks in part to having contacts in the defence industry) that they don’t want to risk expensive lawsuits and the loss of reputation if a vulnerability is exploited.

A lot of bigger organizations now work this way. We’ve all seen what has happened to organizations that have had significantly security breaches, and it’s not pretty. Our customers are big corporations and government entities — and if they even sniff a risk there are going to be problems. So if there is an unpatched exploit, we’re expected to either switch to something comparable, or DIY a solution (either replacing the library in question, or potentially patching it ourselves).

If ffmpeg allows known and published vulnerabilities to languish, the risk here is that organizations that use their code will simply stop using it and will look for other solutions. That’s a tough pill for an Open Source Software developer to swallow, especially when they make it as big and important as ffmpeg. You might wind up in a situation where an entity like Google forks your code and takes ownership, and eventually gets everyone to migrate to using their version instead (like what they did with WebKit to Chrome), leaving you sidelines. Or maybe someone else jumps in with a compatible solution that works well enough for enough users that they switch to that instead.

Now in an ideal world, the Google’s of this world would not only submit a CVE but would also submit a patch. Having been an OSS developer myself I’ve always encouraged my staff if they find a bug in a piece of software we use to file a bug report and ideally a patch if they know how to patch the issue correctly — but I know that is hardly universal within our organization, and probably even less so elsewhere.

TL;DR: a lot of OSS success relies on having lots of users, or at least some big and important users. But you risk losing those if you leave CVE’s open for too long, as company policies may require scrapping software with unfixed CVEs. That loss of users and reputation is dangerous for an OSS project — it’s how projects get supplanted, either by a fork or by a new (and similar) project.

Yaz

as long as the topic is not controversial and political.

The problem is that the Wiki mods are VERY VERY biased. Not just a little. I have run into this personally just trying to make very simple edits. They would not accept simple facts that I had backup sources for.

This was just for movie credits for an actress that at some point had turned conservative...

So for anything political, Wikipide will be factually wrong, sometimes (or often) egregiously so.

But that's ok if it's only for political content right???

But there's the trouble you see. It affects what is political TO THEM in ways you cannot comprehend, so ANY page might be touched by the corruption of the Wikipedia moderator biases. I wouldn't think a simply actress filmography would be affected yet it was. No visitor other than that page would ever know it was inaccurate or incomplete.

So you can trust absolutely nothing from Wikipedia without extensive checking of what facts they refuse to list. Which makes the entire body of work garbage - I have not used it for years now.

A more interesting question I think is, does anyone own this AI actress?

That is to say - if a company took her likeness, and used other AI to make porn - could "her" agent sue them?

Or in other words, is a purely AI generated likeness even copyrightable, when technically no human made it?

I don't give a shit if some Russian/Kazakh/Malaysian bot farmer wants to take over my phone.

So you do no banking on your phone? Unlikely.

For the 99% of people that do in fact use a phone for banking, protection from lower level criminals is invaluable. For most people there is real financial loss possible from a phone being taken over, at the very least to monitor banking access mechanisms.

Unless Trump was the one who personally built all these models that companies are trying to replace workers with, I don't think he's much of the reason there are so many more people out of work.

ChatGPT making up things and incorrectly following policy would merely be in line with the current editorial pool, who ignores policy when it suits them and fabricates material if an article has any kind of political content.

What everyone does not seem to realize, is that MNAY of the choices we are making to "save the climate" are equally stupid. They are just less obviously stupid.

Having a wimpy direct path that just goes from Airport - Downtown - Convention center is perfect for a huge number of cities.

So many places it can be really rough to get from the airport to the downtown area any time around rush hour (which in a lot of cities is around a 3-4 hour window).

Some places with rail kind of have this - like the train that goes from Midway into Chicago. But even THAT has a lot of stops and is not great for travelers, even if it's nice for residents.

I also have to say that a system where you are riding in smaller vehicles I am a big fan of because it eliminates the problem where homeless people are just handing up on the train which create danger, nasty messes, and of course awful smells. Though awful smells is not restricted to the homeless of course, that can be any other passengers also so nice to be removed from them too.

If the moon is split in two and we are living through Thundarr the Barbarian I can first shot at wooing the princess!

Being a huge fan of the original cartoons, I was really sad to hear the whole story of Coyote vs Acme being canned. So while I am not sure how good the actual movie is, I'm really glad it gets a chance to exist and I will probably see it just to support the pushback effort.

There's not much other stuff I am really waiting for but am cautiously hopeful about Tron, and actually will try to see Alien: Earth which looks like more fun than a lot of SF Horror has been recently. But I am keeping expectations low for both.

that would 100% be a firing offence.

Honestly, setting an AI you don’t control lose on your production database? Really? That’s just gross incompetence. This is code that a) wasn’t written or reviewed by a human, and b) code that wasn’t even tested on a development copy of the database.

Developers that do things like that are a liability. Unfortunately as “founder” he’ll likely just post something on LinkedIn about learning from his mistakes and “personal growth”, and that will be the end of it. Anyone else would have been shown the door to accelerate their “personal growth”.

Yaz

It doesn't say, but I'll bet he doesn't have backups either.

Dude right in the middle of the summary it says there was a rollback that worked:

  Replit initially told Lemkin the database could not be restored, claiming it had "destroyed all database versions," but later discovered rollback functionality did work.

Still scary stuff that you'd want a lot more manual and separated control of backups I would think.