We're running a business here. We need real software, not toys created as a fun weekend experiment with a chatbot or burning money to run an agent and get 50% (or more likely 5%) of the way there.

The real world is more complicated than that. For example, we still have a Windows 7 machine in my office. It has some very expensive but still very useful software locked to it that has no direct replacement available on either Linux or Windows 11. Obviously we have to be careful about security and controlling access to a legacy OS like that.

Blunt statements about "forcing an upgrade" are worthless in this kind of situation. Chances are anyone who is still using a system like that has a good reason for it, at least if it's in use professionally. We buy these assets because they solve problems. Those problems might or might not have a useful and cost-effective solution available on a different platform. If there is no modern solution available and the original still works, your statement that "the old ways are obsolete" is by definition false.

What you do need to do is rationally assess the risks and the threats you face and provide other ways of mitigating the risks and protecting against the threats if you can't rely on, for example, a legacy OS that no longer gets security updates to be secure by itself. But then ideally you shouldn't be relying on any single device or piece of software being secure as your only line of defence anyway, and assuming you already have some degree of defence in depth, accommodating unusual requirements is more a redistribution of security responsibilities than a fundamental change of approach.

Yes, it does look like we broadly agree here.

I suppose the main thing I'd have said very differently is the terminology, in that I wouldn't regard the kind of incompetent senior as a senior in the first place. But then I'm pretty old school about this: to me, a junior developer needs quite close supervision to produce useful results, a regular/mid developer can perform routine tasks with minimal supervision but might need more help with larger or more complex tasks, while a senior is someone you can give more or less any task on your project to and they'll figure it out, and senior is also the level of someone who would be capable of supervising and training a junior.

We've had a wave of people, particularly since the tech boom during COVID, who have obviously been over-promoted due to the employee's market and title inflation. They might now have titles like "senior" or even "lead" or "staff", but they don't have the skills and experience to operate successfully at those levels. I agree the acceleration of everything due to increasing AI use tends to show these people up and I agree that a good mid-level developer using AI might well outperform them. But then I suspect in reality a good mid-level developer was probably outperforming them before AI as well, it just wasn't so obvious.

That is wildly optimistic IME. Frontier models do a great job of sounding authoritative on any given subject. This is not the same as actually having expert-level knowledge and understanding, and the choices the models make when you ask them to implement something can and often do reflect that. There are several domains I've worked in over the past few years where AIs lack even basic knowledge an expert practitioner would have, probably because these fields are too specialised to have a lot of books available or papers published, so presumably there hasn't been much subject-specific content to train the models on.

I don't think it's usually about what AI "did really badly on" at this point. It's more about whether the overheads of adding all the guard rails and then reviewing and correcting all the output end up costing at least a similar amount to just writing the code yourself.

For a junior developer, I'd say frontier models passed their standard some time ago. Today's LLMs routinely write code at the level of a competent junior-mid but with the advantage of an inhumanly broad knowledge base.

For a good senior, I'm much less convinced. The frontier models are hit-and-miss when it comes to writing good test suites, which matters a lot when they rely on tests so heavily to reach acceptable quality. IME, they are still mostly miss when it comes to the business insight that seniors will take into account and design/architecture decisions that keep the code manageable as it evolves. While they have become much better at recognising existing patterns in the code, and I would say they follow them reasonably well the majority of the time now, there are still bizarre anomalies that creep in, and they aren't very good at extending those patterns when necessary.

I think AI advocates also tend to underestimate just how much time it takes to properly review what they are doing. Take a half-day Claude session to implement some new feature. It might take half an hour to give it the initial brief and then review its plan. Make a few edits and it'll propose a new plan that is also long and detailed and has no edit markings to show what it changed so you have to review the whole thing, carefully and in detail, again to pick up the minor changes it also made for no obvious reason. Then you let it start doing its thing. You can't really leave it unattended for long because it'll stop to ask questions. Some of those questions might be whether it can run a screenful of ad-hoc Bash script to make some edits to your source files, because for some reason it decided not to show the actual edits as it usually would, so now you have to figure out what all the sed incantations are actually going to do while looking at those files in another editor or just trust it and then review all the changes properly later anyway. Sometimes it decides to change its plan mid-flight, but not always in a good way, and if you interrupt it to apply corrections or redirect, you break the neat plan flow it was in. Then you get to the end and you can finally see how everything it has done fits together, and you still need to review everything with the same care as you would with a junior developer's code and probably apply a few fixes where it's come up with weird names or not quite followed a pattern or imagined some instructions that were never there and made other changes in other parts of the system that should be out of scope.

If you read to the end of that last paragraph, you know how I typically feel at the end of a half day working with an agentic UI. And the thing is, I do those sessions as experiments fairly often to keep up with progress, but a lot of what I do is still written by hand, which gives me simple, objective data to compare the two ways of working and see whether the AI tools are really making me more productive once you take everything into account.

Currently, based on objective data comparing similar fully completed development tasks like for like, I still outperform agentic workflows using frontier models by about 25-50% on average, and I don't have to pay anyone extra fees to do that, and subjectively I also find it more engaging to work that way. So I don't really buy the hype about AIs making us all orders of magnitude more productive unless you're happy to YOLO everything forever and take the much-discussed risks that comes with.

Personally, I think the optimum use of LLMs right now is probably not to use them for the whole coding workflow like that or rely on agentic tools, but to use them for tasks like answering quick questions about the existing code, doing research like a fancy search engine, writing a first draft of some boilerplate, and writing quick and dirty throwaway code for experiments, one-shot tools and the like, where you don't really care about the quality as long as it gets the job done and you will see immediately if it has in fact got the job done. For these things, the LLM can read and type faster than me, and that's useful.

I don't know if you're a russian bot or some deluded idiot, but it amuses me to do a breakdown of your post.

NATO turned what was originally intended to be a mostly peaceful show of force like the temporary invasion of Georgia into a war of attrition.

First of all the "peaceful show of force" "temporary" invasion of Georgia involved a few hundred dead in the first two days, and another 5000+ civilians killed in the ethnic cleansing after that, all for a land-grab to seize control of territory covering half of Georgia's coastline that Putin wanted.

Secondly, the "peaceful show of force" "temporary" invasion of Ukraine involved hundreds dead, ballistic and cruise missile attacks on all of Ukraine's largest cities, and Putin publicly admitting the goal of overthrowing the Ukrainian government... and that's just within the first 36 hours. Within two and a half months Russian officials began admitting the intent to permanently annex parts of Ukraine, proceeding with a constitutional amendment a few months later claiming to annex vast territories that Russian had not remotely taken control of, and which Russia is not remotely capable of capturing. Donetsk alone has a population of over a million, two million if you include the metro-area. Russia spent months and many thousand of lives to capture, and later lose, villages in the range of low tens of thousands.

Remember WWI when the lines were pretty much static for years and then suddenly it was all over?

Yes, I remember. As I recall it wasn't exactly "sudden". As I recall... Russian casualties were around five million killed, wounded, or captured, the Russian economy was collapsing, Russia was running out of food, and Russian literally lost it's own capital to civilian rebellion. A few months later the Russian government collapsed and surrendered vast territories including Finland, Estonia, Latvia, Lithuania, parts of Poland and Ukraine to Germany and its allies (known as the Central Powers). Right about that point the U.S. joined the war reinvigorating the Allied Powers. Germany&friends knew they couldn't win a protracted war. They attempted a quick win, and, in short, they failed. The Allied powers steadily beat them down, with the allies eventually breaking through the lines and progressively liberating territory. With the Allies steadily advancing and the war obviously lost, German forces began rebelling and Germany surrendered.

That's what's happening here. Russia has most of Donbas plus a buffer zone in some other regions that directly border Russia. Ukraine is throwing men at the front lines for Russia to kill but is running out. Territory held is largely irrelevant compared to the number of men killed and weapons destroyed.

So much to unpack there, but it's amusing how you cite "territory held is largely irrelevant" given that the tide has turned and Ukrainians are now the ones breaking through lines and liberating territory from Russian occupation. It's not much yet, but all the map trackers show the reversal. Russia is now officially loosing more territory than they gain. Russia WAS slowly gaining small bits of land, largely through sending meat waves of untrained ill equipped soldiers at Ukrainian lines until the Ukrainians ran out of ammo and had to fall back. However now 7 out of 10 Russians killed are killed by drones. The "no man's land" between the two sides is now many kilometers wide. Any Russian trying to advance gets hit by a drone. Russia has also losing on average 1 air defense system every day, and rapidly depleting. Russian supply lines are getting pummeled by drones. Russian refineries are getting pummeled by drones, with progressively worsening fuel shortages for both the military and for the increasingly rebellious population. Cheap advanced Ukrainian drones are taking out expensive crappy Russian drones, including Russian's new jet-drones. Practically every country on earth is asking Ukraine for their military drone tech, the Russians can't remotely match it. Russian's economy is also fucked, but that topic pretty needs a separate book to cover.

Interesting side notes on weapons destroyed. Russia is destroying it's aircraft almost as fast as Ukraine is, between incompetence and maintenance failures and friendly fire shooting down their own aircraft. Also the nation that is the biggest donor of tanks to Ukraine is... Russia. Ukraine captured countless Russian tanks intact because the Russian military is so abysmal incompetent and corrupt. And as I mentioned, Russian air defense units are depleting. The war is now approaching 5 years, longer than the entirety of WW1. Ukraine is a small fraction of Russia's size, and Russian is literally losing and headed towards another soviet-union-style collapse. The biggest shock to the world of this entire war is just how worthless Putin has made Russian military, through systemic corruption and systemic incompetence.

Polls show the Ukrainian population isn't interested in surrendering. They are defending their homes. It's simple, the war will end when all the soldiers go home. When Russian soldiers go back to their homes in Russia, and when Ukrainian soldiers go back to their homes in the currently occupied parts of Ukraine. Although that's not likely to happen until Putin either expires or is overthrown. Not only is he fanatical enough to drive his country to collapse in the attempt, he knows if he did end the war in failure he'd get killed or overthrown for it.

Anyway, pointless reply to a bot or a useful idiot. But maybe some random passer-by will find some bits interesting. I don't know about the rest of the world, but mainstream US news rarely mentions the Ukraine war anymore, and certainly not in any detail.

-

It was probably the other O'Neil, with one L. He has no sense of humour at all.

I could understand bots and mailing lists. The thing I never understood with LinkedIn was how many real people (usually recruitment agents) had apparently spent the time to read my profile and send me a personalised message, yet still thought I'd be interested in a job paying half the market rate for someone with my skills and experience.

I don't know what you mean. Look at the improvement in hiring when you can advertise an open position on LinkedIn and get maybe 100x as many applicants as before! OK, probably 99% of them will be completely unqualified for the role and barely capable of pushing the instant application button, but how is that a problem, really? Surely hiring managers can easily filter them out and no qualified applicant will ever get lost in the noise?

It's like a video I saw on YouTube the other week. Someone was talking all about "skills" for their AI agents and how they'd automated so much of their workflow using them. They started the video by kicking off four different tasks for separate agents to show how productive it was to have all this stuff happening in parallel and how it was so quick and easy to organise.

One of the tasks involved producing an infographic about a certain topic, and the AI duly produced one based on a one-liner prompt, taking only a few seconds of the presenter's time and with no further input from them about the content. The infographic had exactly the level of quality you'd expect from this: a load of boxes and arrows (with some of those arrows starting or finishing floating in space without connecting anything) and some words (a few of which might have been related to the topic mentioned in the prompt).

That infographic was the only substantial output from the whole exercise. It was the worst kind of AI slop imaginable, generated with literally no thought or oversight from the presenter beyond a couple of words about the topic as part of that one-liner prompt. This was probably about the average level of the LinkedIn posts I used to see before I left as well. As you said, I'm not sure you can be a "thought leader" without doing any thinking.

I stopped using LinkedIn when they seemingly decided my account wasn't about me (despite having obvious and publicly verifiable details right there in the description) and wanted me to verify my ID using one of the US-based services with a questionable reputation to get my access back. That's not going to happen, so I just don't use the site any longer.

As far as I can tell, that has made zero difference to my career, and it's one fewer drain on my time. The only thing I have missed is seeing the occasional good news story where a past colleague has been promoted or the like, but I'm not giving up my government-issued credentials to the US-based data harvesting industry for that.

I'm still impressed that the Teams web client can't edit a message with an emoji in it without messing up the keyboard controls and often corrupting the message and losing data. It's had this bug for years. It's literally a messaging app where you can't reliably send messages.

Every time people hear what it actually involves is outrage and opposition, at least all the way back to when Intel first announced that they wanted to hardcode identity numbers inside CPUs in 1999. But the corporations involved have been relentless, and have sunk countless billions of dollars steadily forcing it forwards, and building front organizations to obfuscate and whitewash it.

With Windows 11, Microsoft was finally able to FORCE Trusted computing hardware into every new computer. Not just every new Windows computer, but every computer.

Every new Intel PC CPU has built in Trusted Computing enforcement hardware. Every new AMD PC CPU has built in Trusted Computing enforcement hardware. Every new ARM PC CPU has built in Trusted Computing enforcement hardware. The only processor lines that DON'T have it are the microcontrollers.

There are some unlocked smartphones available, but as far as I can determine it's literally impossible to buy a smartphone that doesn't have hardware trusted computing built in.

I specified that enforcing Trusted Computing at the internet access level is still a long term goal, they couldn't get away with it today. However they are well on the way to success. Virtually all new hardware supporting trusted computing, all the front groups rolling out standards and systems, and as it gets incorporated into things everyone is going to increasingly running into situations where they get locked out of stuff if they're not Trusted Computing compliant. Streaming already restricts you to the worst quality if you're not compliant, and it's only going to get worse as pre-Win11 computers fade out and as more things require it.

I'd hardly call exact date of birth "low information content".

And yes this does reveal exact date of birth, regardless of the bullshit obfuscation that it supposedly only reports age range. The server simply tracks the reported result every time the user connects, and on some specific day the result CHANGES to announce their date of birth.

-

This is based on SLSA (Supply-chain Levels for Software Artifacts), brought to you by the same fuckers making Trusted Computing and the TMP (Trusted Platform Module). It's part of the same shitstack to prohibit you from altering your software and to lock you out of your own files, and to send spy reports out over the internet so you can be cut off if you "fail" the Trusted Computing check.

The software can use a TPM's (Trusted Platform Module) Sealing function to encrypt your data such that it's impossible to access your own data if the software is modified. It can then pass control over that data only to software updates that carry a signed security certificate from Broadcom (or any other company using this system).

It is no longer open source, your system no longer works as you can no longer access your Sealed data if you change so much as a single letter of the code. Even recompile unaltered code won't work, unless you magically manage to get your build environment absolutely identical to the company's build environment and get byte-for-byte output. Even that may be impossible with the newer levels of non-deterministic compiler optimizations.

Also, with TMP's Remote Attestation feature can be used to transmit your machine's software configuration over the internet, so that you can be cut off if your system doesn't match Broadcom (or other company's) cryptographically signed certificate.

And then of course there's Network Access Control (NAC) / Trusted Network Connect (TNC). In the long term, the goal is for ISPs to use NAC/TNC to interrogate your computer for Trusted Computing compliance, and deny you any internet access whatsoever if your machine isn't compliant. Software with this sort of "security" certificate would pass inspection, while any attempt to alter the code would be detected as "tampering". You then get "quarantined". What "quarantine" means is that you are denied internet access - with the exception that you do get very restricted access which can only be used to download the approved software to "fix" your computer into Trusted Computing compliance.

The problem with this argument, from the shop's point of view, is that the UK is in the middle of a shoplifting epidemic. The policing resources simply aren't there to deal with small scale (or even flagrant and much larger scale) shoplifting. It now seems to be rare for police officers to attend reports of shoplifting at all. And so effectively shoplifting becomes legalised, which is obviously hurting the big chain stores financially and potentially devastating for smaller shops.

Shops are trying to find some way to respond to this to protect themselves. They typically tell staff, even security staff, not to get physical with shoplifters as they walk out, not least because the risk of something worse happening and the business becoming liable for it is significant. But then the shoplifters know this and some of them will just walk in and openly empty a shelf into a bag and walk out again without paying because they know no-one will try to stop them.

Shops also know that our court system is completely overwhelmed at the moment and there is little chance of bringing any successful civil action to recover damages from shoplifters who aren't even being arrested by the police and put through the criminal justice system.

So what do they have left? Basically, they're trying to spot the "usual suspects" and refuse them entry in the first place, which is a less risky proposition in terms of potential for physical violence and quite effective because a lot of shoplifting is done by the same people, or they're trying to make it more physically difficult to steal goods, for example by using locking systems or keeping high value items behind counters where customers can't just pick them up. But these systems aren't perfect, far from it, and what we're discussing here today is one of the significant problems.

Obviously this kind of technology can have very bad consequences, as we see here. I don't think it should be used if it's not highly reliable, given the potential harm done in cases where it gets something wrong. But I do have some sympathy with the shops who are looking for something -- anything -- to reduce the threat they're facing because the rule of law has failed in retail settings.