> Nasdaq was the first to consider a rule change that would grant mega IPOs like SpaceX early admission to its flagship Nasdaq-100 index. The exchange and index provider began a consultation period in February to assess the viability of and industry response to a proposed “fast entry” rule. The change was approved on March 30 and will be effective on May 1.
There is a difference between a SaaS offer where you are running your code and serving multiple customers on one server/set of servers and running random customer code like Vercel.
This is completely different. While for Uber and AirBnb as the person delivering the service I have to worry about a private citizen either doing harm to my property (more statistically likely) or my person (much less likely), if I am pulled over by a cop carrying illegal goods I have to deal with the law enforcement.
Insurance can take of property damage.
My personal threat model is:
1. Law enforcement with qualified immunity and a “monopoly on [legalized] violence”
.
And then as experience developer you would have to try one of the other tools in your toolbox. Why should someone tie a hand behind their back and not use an LLM out of some sense of nerd pride?
This is a real issue we'll face soon enough. It's less of a problem for senior+ developers that have experience and muscle memory. For people just starting in the industry, they won't develop the ability to research problems and solve them on their own.
I work with some junior level, outsourced developers that write prompts like "fix the tests." The result is, of course, bad. The consulting company charges $200+ hour for them. Garbage in, garbage out. Good thing I hit my retirement number. I can bail out anytime.
Outsourced staff aug contractors have always been mediocre.
From the contracting side, I’ve worked as a staff Aug contractor for six weeks when I was between jobs in 2012 and it was so bad I just walked off with no job lined up within four weeks.
For context staff Aug vs consulting is about who owns the project
Consulting = the customer gives you high level requirements and statement of work and you control the project (or your company)
Staff Aug = the client controls the project and you are a warm disposable body.
hm I don’t disagree with you in principle but there is sooooo much outsourcing (America First and all that jazz people eat up during election cycles lol) that there are many places (worked in two such places just in the last year) where staff aug has been around for decade+ (started with team of 2, now 48). client controls everything, staff hacks shit and does amazing job. from my experience there is a ton of this and work of often anything but mediocre
My responsibility is to make sure my code meets functional and non functional requirements. It’s to understand the *behavior*. My automated unit, integration, and load tests confirm that.
Someone thought I was naive when I said my vibe coded internal web admin site met the security requirements without looking at a line of code.
I knew that because the requirements were that anyone who had access to the site could do anything on the site and the site was secured with Amazon Cognito credentials and the Lambda that served it had a least privileged role attached.
If either of those invariants were broken, Claude has found a major AWS vulnerability.
As written, I do think that's naive. Being sure the person/browser is authorized doesn't mean that the signals you get are actions they intended.
Suppose that in normal use a user can visit a certain URL which triggers a dangerous effect. An attacker could trick the user into performing the action by presenting a link to them titled "click here for free stuff."
There are various ways to protect against that (e.g. CORS, not using GET methods) but backend cloud credential management does not give it to you for free.
And that same user is already trusted to have admin access to the entire organizational AWS credentials - I did say it was an internal management site.
The lambda itself only has limited permissions to the backend. The user can’t do anything if the lambda only has permission to one database and certain rights to those tables, one S3 bucket, etc.
Heck with Postgres on AWS you can even restrict a Cognito user to only have access to rows based on the logged in user.
And the database user it’s using only has the minimum access to just do certain permissions.
> My automated unit, integration, and load tests confirm that.
Do they? Did you write them? If not, how do you know they confirm the desired behavior? If your tests are AI generated (and not human reviewed) then even if you're doing spec-driven development and provide a comprehensive spec, how can you be sure the tests actually test the desired behavior?
Now if you're either writing or reviewing the tests, then sure.
Also, for what it's worth, when I talk about my "responsibility" I'm speaking more from a self-imposed sense of... um, almost a moral responsibility I feel, not something involving a 3rd party like a customer or employer.
I review AI generated test of AI just like I reviewed tests of developers on a team I was leading.
There is no “morality” when it comes to my job. Outside of my feeling morally obligated to give my employer the benefit of all my accumulated skills for 40-45 hours a week in exchange for the money (and in a previous life RSUs) in my account.
I feel accountable to my coworkers and customers to deal with them fairly and honestly.
What other moral obligation should I have besides my employer, coworkers and customers?
> I review AI generated test of AI just like I reviewed tests of developers on a team I was leading.
Cool. Then what you're doing seems totally reasonable to me, for what that's worth. My skepticism would be directed towards people who have AI write the code and the tests, and then don't do any further review. That, to me, is a sure path to "AI slop". But if you're specifying the desired behavior and reviewing the tests, then I don't see any problem with it.
> What other moral obligation should I have besides my employer, coworkers and customers?
No idea. That's up to you. Note that my comment above was intended to be descriptive, not prescriptive. Like I said, I'm talking about something that's purely a self-imposed thing. If you don't feel that same thing, that's totally fine.
Yeah only the first two sentences were actually relevant. The rest was a humble brag that there is no application level security, which is a really weird thing to brag about.
When I use SAML, I still have to check that the user has some sort of attribute that indicates that access was granted to the application. If this access rule is defined outside the application, then why bring up Claude? If it isn't then Claude is responsible for implementing the access rule, which means the comment is 100% wrong.
I have no idea what you are talking about but I just checked the scarface_74 user on Reddit (he not I) last posted 8 years ago and mostly on the r/bitcoin thread.
It wouldn't prevent the admin page from exfiltrating data, though, right? Like, POSTing whatever data is loaded on the page to an arbitrary attacker controlled website.
That would require the logged in user to do something stupid. That’s like saying what’s to prevent the authorized user from emailing his credentials to a random person.
Exactly this, I lead cloud consulting + app dev projects. Before I would have staffed my projects with at least me leading it and doing the project management + stakeholder meetings and some of the work and bringing a couple of others in to do some of the grunt work. Now with Gen AI even just using ChatGPT and feeding it a lot of context - diagrams I put together, statements of work, etc - I can do it all myself without having to go through the coordination effort of working with two other people.
On the other hand, when I was staffed to lead a project that did have another senior developer who is one level below me, I tried to split up the actual work but it became such a coordination nightmare once we started refining the project because he could just use Claude code and it would make all of the modifications needed for a feature from the front end work, to the backend APIs, to the Terraform and the deployment scripts.
Oracle is not fine. They are borrowing money hoping to get paid back by money losing OpenAI propped up by VC funding.
No business is going to run workloads on OCI outside of ones running Oracle. They a
They are a way distance fourth in cloud. I’ve been working in cloud consulting for five years including the first three directly at AWS (Professional Services). No one worried about having talking points about competing against Oracle.
Microsoft, Google and Amazon have both internal products that can benefit from inference and cloud hosting.
You should listen to the latest episode of the Acquired podcast about Google.
Google also has GCP and unlike OpenAI who is dependent on VC funding and Oracle who is borrowing money. Google throws off cash like crazy and self funds its infrastructure which is already better than everyone else’s
https://www.morningstar.com/funds/spacex-ipo-how-index-funds...
> Nasdaq was the first to consider a rule change that would grant mega IPOs like SpaceX early admission to its flagship Nasdaq-100 index. The exchange and index provider began a consultation period in February to assess the viability of and industry response to a proposed “fast entry” rule. The change was approved on March 30 and will be effective on May 1.