One of the most obnoxious things about AI advocates is that they are awfully opinionated on my specific work even if they don't know what my specific work even is. So they see it working well in some areas and when I express a nuanced experience that isn't a slam dunk except in certain situations, they are disdainful that I am not all-in.

One concrete example, some guy who has never written or managed code (not even vibe coding), asked if I used git and I said sure, and he informed me that I should change to something that was more AI native based on what he had read online. People reading random tech articles are once again trying to "help" people that get to read the same articles, but without actual experience one way or another. At least the ones that have successful vibe coding have a leg to stand on, but still oversimplifying a very nuanced domain to a boolean 'ai can do all of it it: yes/no' is obnoxious

I doubt that. They may have wondered if it was *worth* the price of the computers at the time, but they were not debating the capabilities.

That facet certainly exists here about token pricing and how it will evolve and in a larger sense about whether it is worth the footprint, and there's every possibility that those concerns will ease with time like they did for computers doing calculations.

The issue here is that folks are treating software development as a monolithic thing. Even very milquetoast software development demanded skill and tedium, but GenAI can chew through the milquetoast scenarios adequately if you are careful and know what you are doing. People who live in that realm then seem to get the mindset that reality applies to the entire domain of software development equally. We have a much more weird subjective results than computers being able to calculate.

Broadly speaking, I find agentic coding to be even more exhausting (and expensive) than AI augmented completion. It's babysitting a mechanism that can screw up at any time, so it involves a *lot* more exhaustive work to make sure you have a harness to let the model try and retry with objective feedback very quickly. A continuing issue being that it fails to recognize an inability to do something but tries to do something anyway, which means any result that is not objectively measured in strict terms is at risk of weird drift.

Today I took a swing and it did a few weird things in my domain. Issue being here there's documentation of a standard but the very first and reference implementation deviated from the documentation, so every implementation was based on the reality rather than documentation. This particular scenario was very specific and you would have had to know very specifically about this risk to warn the model about that sort of mistake. It had a variety of legitimate inputs to process but dropped them without error because it didn't make sense and so it assumed malformed data.

It really depends on your inclinations and problem domain. If you are making a straightforward web ui interface to a fairly straightforward data set, then you can get pretty far. If you have requirements that aren't very picky and you can tolerate some drift, it can get pretty far. If you work in pretty esoteric spaces, then you have to either use it to accelerate and correct code by code or you have to spend a maddening amount of time describing all sorts of stuff to *not* do.

Completions are useful especially for boilerplate and such.

Seems like this pretty much, though perhaps the more interesting piece is that 'generate a bunch of tokens consistent with human output associated with the environment without more specific direction' influenced the models to have what seemed to be better tokens generated later when they had to now be consistent with specific scenarios.

Though I'm too lazy to read the paper and the 'generally beat' phrasing gives me some wondering about how definitive this observation is versus how much of it might be finding what they wanted to find in the results.

Oh, fluffernutter.

ICE is only convenient because of a hundred years of infrastructure build-out. But you think having an electrician spend two hours running a 50 amp line from your panel to the side of your house, which takes a few hours, is somehow an insurmountable block.

"Nice horseless carriage, Mr. Ford, but can you produce enough to switch *all* transportation to it? As of today, call for horseless only transportation means that personal vehicle ownership becomes impossible. To put it differently, you can drive your horseless carriage only because other people drive horses."

US male life expectancy is 76.5 years. If I tell you every year that you're probably going to die by the time you're seventy-seven, and you hit seventy-eight, do you now believe you're immortal?

Actually, the .12 had fixes for other PHP CVEs.
But it was a .13 that did fix the CVEs in question (which are remote code executions).

The repositories were being hammered and the fix was delayed for most people.

Excerpt:

Changes for php8.3 (php8.3-zip php8.3-xml php8.3-readline php8.3-opcache php8.3-cli php8.3-phpdbg php8.3-mysql php8.3-mbstring php8.3-gd php8.3-fpm php8.3-dev php8.3-curl php8.3-cgi php8.3-bcmath php8.3-common) ---
php8.3 (8.3.6-0ubuntu0.24.04.13) noble-security; urgency=medium

    * SECURITY UPDATE: Remote RCE via state corruption issue
        - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
            bailout in Zend/tests/bug40770.phpt, Zend/tests/bug54268.phpt, ...
        - CVE-2026-109618
        - CVE-2026-109619

  -- Marc Deslauriers Mon, 19 Oct 2026 11:16:58 -0400

Although it says Monday 19 Oct, it was not available in the repositories (embargoed) until 10 am Eastern Wednesday 20th of Oct.

But the repository being under load delayed that for most people.

As much as it can apply to online communities in general including slashdot, Reddit and reddit-likes *really* take the cake for creating circle-jerk communities. Creating niche communities with moderators that ban at any comment they didn't want to see. Saw a reply to one of my comments that I thought to be a bit dumb (basically, that we should replace TLS certificates with blockchain), but not horribly unforgiveable or anything, and the comment got removed and the user banned from the community. Mod saw 'blockchain' and while I understand a negative gut reaction, nothing that should have rated a moderator going that far.

If you are using a distro with long term support (LTS), like I am, they backport the patch to the version that they have.

I am on Ubuntu Server 24.04 LTS, and the change was from

8.3.6-0ubuntu0.24.04.11
To
8.3.6-0ubuntu0.24.04.12

So, .11 to .12.

This should have been posted before 10 am EDT.

Ubuntu LTS (26.04, 24,04, and 22.04) got the fix yesterday, as patches to the existing PHP version.

This is from 24.04:

Upgraded:
        php8.3-bcmath:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-cgi:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-cli:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-common:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-curl:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-dev:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-fpm:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-gd:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-mbstring:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-mysql:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-opcache:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-phpdbg:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-readline:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-xml:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-zip:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12

There is now a PHP2Shell.

... an attacker without a login can run code on Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS. The exploit tool PHP2Shell, credited to Calif, combines both bugs into one attack that needs no login.

There will be lots of hacked sites in the coming days and weeks.

Alternatively, some people in that subreddit can't stand that anyone could express valid concerns about Tesla and decides that it must be some irrational, inexplicable blind anti-Tesla rather than informed and real concerns.

Not to worry, recall that Musk *also* has ambitions of X being a finance company, so voila, every child can have an 'X brokerage account' waiting for them with a share in it. Now he gets every child defaulting to his network, no problem.

I don't think a grant of one share of a specific stock will be a particularly educational event. I think generally in school a teach will, at some point, do a more educational exercise where students are actually doing mock trading and, critically, trying to evaluate different companies and make predictions on where things will go.

How about this for punditry?

Cringley thinks Apple and Intel are merging.

Also, there has been a recurring comment here on Slashdot about Robert X Cringley, with all sorts of claims allegedly made by him. However, it is posted anonymously, and does not provide sources..

The "working at Apple as employee #12" part appears on a speaker biography.

The same bio also says he taught for several years at Stanford.

This Reddit comment says that he claimed he has a PhD from Stanford when he worked at Infoworld.

This page has more of his claims (invented the trash can icon, ...), and details his foray into Kickstarter and Minecraft.

So, lots of questions about him, to say the least ...