Very subjective, but I'd say the Argon one is the best here. The other two don't quite do LCARS correctly, there are a bunch of lines/curves that are the wrong angle, don't line up, etc. The Argon one looks to me the most like a designer would have done it. Of course this is up to personal taste to some extent.
I'll take this over AI writing any day. Far easier to read. Yeah it could probably do with another edit pass, but it's night and day easier to read than the slop I see from most blogs now. AI is great for many things, but writing engaging long-form content is far from one of them.
For someone with 20 years experience who has written a bunch of books, I think that's a lot. I'd expect someone in this position to not really apply/interview in the normal sense anymore and to be able to hop around via their network.
The 1000s of applications folks are doing on the SWE subreddits are mostly juniors (or over titled seniors) with not much experience.
Maybe this guy is in that latter category, but it seems unlikely. I think this is just an issue of remote jobs being scarce.
the higher, better, more up you go, the fewer jobs there are. that's why big league people at normal (not fang) ask for parachutes. there's not that many XYZ companies in XYZ area that need a CFO, CTO, Head of ABC. Anyone can get an entry level job, but the higher you move, the harder it is.
Also - do people who write ruby books make companies more money?
I wrote 90% of the code that processed multiple billions of dollars worth of payments just last year. By myself to start with, then with the robot once the patterns were established and I could be sure it wouldn’t break anything.
The company charged for each of these payments, netting them something around 0.5-1% per payment. You do the math.
Reading this, I wonder if the problem is AI or the remote market. From what I've heard, here in Sydney the market is pretty hot, at least for experienced folks. My experience matches that. That said I know that remote jobs are uncommon.
> I know I can work remotely effectively because I did it for the last 6 years.
6 years means that Ryan started right around COVID. Looking back I don't think COVID was the remote renaissance that it appeared at the time, I think it was a temporary blip. That sucks, I'd much rather it was permanent, and some things have changed for the long run, but unfortunately I think this is likely a much bigger factor. Remote jobs have always been few and far between, and super competitive.
Remote is absolutely making things harder. From what I've seen in Melbourne, most jobs on paper require you to come to the office 2 or so days a week. Even if in reality people still work fully remote, in the interview process if you want 100% never come to the office written in to the contract they will probably pass you up for someone else.
Lot of people moved out to the regional areas during covid and plentiful remote jobs but those jobs have mostly been reeled back to the CBDs again.
In practice if they are saying 2 days a week do they really care or track that? I know people who are not formally remote but are in the office only a couple of days a month.
And looking forward, LLMs don't need an office. The tactic of demanding RTO to maintain real estate values isn't going to hold up when 8 out of 10 people are replaced by AI.
When 8 out of 10 people are replaced by AI, the offices being burned to the ground in the violent revolt is going to be a much bigger concern than the offices not being full.
I live in Portland and we've recently committed to moving back to Bay Area because of this exact reason. The remote market that made it possible for me to live here is dying. There are also not many, if any, businesses in Portland that I'd work for that pay market rate.
I also think there is a noticeable drop in the quality of the interviews on the employers side. My friends still in the bay tell me there is a noticeable drop in the quality of the people they work with in the office. Look at the languages they are asking for, they are the languages that are cheap to develop for. But software isn't manufacturing, its more like some sort of publishing. And just making something for cheap is the best way to go out of business in publishing. I suspect that will be happening in the future. I know quite a few devs like the author who instead just started their own software business. Some are doing well, others not so much. I suspect this is the future of tech and it won't be in SV.
If you're only willing to work 100% remotely then you are competing with everyone in the world. Melbourne, where OP lives, has quite a few developing markets within a few hours of timezone offset. This is especially true of MNC with a strong presence in APAC.
There was an article like a year ago about how AI was making software engineers unemployable, with a single engineer as their case study. Except the guy lived in rural NY state and only wanted to work remote.
But the remote jobs are the canary in the coal mine.
Return to office (or tacking on an in person requirement to a posting) is just one sign that the market has shifted in favor of capital and away from labor. That's driven by AI reducing the value of developers.
The job market has definitely picked up for us tech sales weirdos. Remote is okay, but travel obligations _feel_ like they're picking back up. I know that pre-sales FDEs are definitely on the road a lot.
Honestly, one of the largest expenses most companies carry that’s optional is occupancy. The next big downturn I suspect the RTO mandates based cultural vibes will look a lot less attractive when the director of finance looking for a promotion proposes to the board eliminating offices. They will point to the productivity gains during remote work, the overhead of facilities, how many people they can not lay off by eliminating overhead. All of this is very easy to wave a hand at mumbling about serendipitous moment when profits are rising, hard to ignore when losses are mounting.
To Ryan, I don’t think your frustration with the tech industry at the moment is lone. I don’t know of any one super happy right now, and I know too many people under / unemployed for long stretches. Even when you land something it’s just a miserable slog of political wrangling to erect enough body shields to protect yourself during layoffs. It’s not what it used to be.
Myself I bailed and started something with friends. We took no outside money and have a slow but growing client base that seems to value what we offer. It’s the first time in a long time I can actually do something worth while. I’ve considered teaching, or even finding a job at the library. I’m lucky enough to have been well employed for a long time now so it’s more about health insurance (thanks US health care work slave system!). But for the moment I’m enjoying building things and solving problems which is what I enjoyed anyways.
> The next big downturn I suspect the RTO mandates based cultural vibes will look a lot less attractive when the director of finance looking for a promotion proposes to the board eliminating offices. They will point to the productivity gains during remote work, the overhead of facilities, how many people they can not lay off by eliminating overhead.
Things could change in the future, but currently and historically commercial office leases tend to have really long terms that aren't very easy to get out of, which has a limiting effect on this sort of thing as a cost-cutting measure.
It’s true, typically 5-10 years. However that means in any year 20-10% are negotiating extensions. Recessions on average are 22 months long. That’s 40-20% turn over potential, and once a trend starts it’s hard to reverse when it comes to cost cutting.
In fact many large companies were already trying to downsize their footprint and adopting hotel seating and we work foot prints, encouraging work from home increasingly. The BYOD move saved a small amount compared to what was being discussed - BYOO - bring your own office. The pandemic led to a reflexive reversal in that trend due to irrational reasons, despite having already approved a decreased footprint pipeline.
I don’t think the hand wavy stuff will carry water post the next downturn. In 5 year planning many companies do for occupancy plans I can’t imagine “serendipitous water cooler moments” is going to be high on the cost cutting agenda.
This is an experienced person that any company should be happy to hire. If this person can't easily land something, remote or otherwise, then their frustration is valid.
It does feel like there's been a big over-correction towards on-site --- or at least the places that want remote haven't felt the need to hire much. What's driving it? I don't get it: now that we have AI for everything, wouldn't real-time collaboration on code matter even less than it did before?
Yeah, and the rise of AI and the huge volumes of code it can create means there is more of a need to collaborate with other areas of the business on what to actually build.
That might be the right tradeoff for some organizations (e.g. you can access to wider talent pool by having hybrid teams), but it is also within the prerogative of an org to bet otherwise.
I suspect it's more that few people, even at "AI" companies, understand how AI works or how to apply it. In an environment of such uncertainty, a certain class of person feels safer physically sharing a room with his colleagues: this person can "read the room" and exhibit "taste" by aligning his opinions with some emerging consensus, picking up on tiny social cues to keep himself on track.
In a remote environment, by contrast, these social signals aren't as strong. Our room-taster is forced into object-level arguments. He might be revealed as ignorant. By the same token, if a company is remote, it needs some established workflow to make progress. Workflow means words written down somewhere. Writing means accountability. Safer to just vibe.
In case it's not clear, remote work is beneficial: it forces a company to develop a level of rigor that helps it interface better with reality.
Every alleged "collaboration" efficiency the in-person model produces comes at the cost of enlarging a pile of accumulating social-technology debt incurred by substituting vibing, room-reading, and charisma for writing, debate, and accountability.
AI doesn't change this. Would I rather use some hobby project or the real tool? Depends on my budget and how much I care about functionality/quality – sometimes the hobby project, often the real tool. How long each took to develop is not a factor in my purchasing decision.
This page isn't new, it's just marketing for a different purpose. This one is about "owned and operated" data centers, as this is basically a careers page. The cloud page is marketing for another purpose – cloud customers. Is there really any lying going on here?
The very last thing, past the conclusion, the very last footnote is:
> Addendum: I feel I have made a compelling case for passkeys in this article. And I haven’t even pointed out one of their best security features: they are (in most use cases) domain-bound, meaning they are resistant to what are called Man-In-The-Middle attacks.
"I made a compelling case... but didn't point out the most important security feature that motivated passkeys in the first place"
Honestly I don't think this post did make a compelling case. There's a lot of assuming bad faith on the part of the FIDO alliance, while completely missing that preventing MITM attacks was a key design feature. The FIDO alliance members deal with stolen accounts all the time, and passkeys largely solve that. Stealing accounts is almost always done with phishing or social engineering, and passkeys solve the former and reduce the surface for the latter.
I sort of started skimming when the article was saying industry solved the problem with text messages and TOTP. I think there are several arguable problems with Passkeys as implemented, but to argue TOTP is equivalent is going to leave lots of people vulnerable.
The protections against MITM you mentioned is probably the biggest one, but the other one in the back of my mind is TOTP is a shared secret. So a compromise of the server side allows impersonation of users undetected, which can be a big problem. Maybe I'm over reacting because no company has ever lost a copy of it's database and they're all super secure. But, imagine trying to argue as a user I didn't do a thing when there is an audit log saying we challenged the user for TOTP and it was provided, was definitely the users fault.
I think it's rather this millenium's "just check the domain really carefully". You can't choose a weak TOTP, write it on a post it or share TOTPs on multiple websites. The main (only?) failure mode is that you type it in an attacker-controlled input.
Highly economy specific. Ease varies by nation state. Social engineering attacks in Australia are far LESS common than they used to be and I believe other economies in Asia and Europe all have less than the USA.
If you aren't talking from a US perspective, where are you that SIM swap is a low bar?
Passkeys are unphishable. It’s technically impossible for someone else to capture your passkey and use it themselves. It’s technically impossible for your passkey to be leaked from a website.
This is what makes Passkeys the superior solution - they bake the security into itself rather than throwing up its hands and hoping all the other weakest links do the right thing consistently.
> Especially considering how easy it still is to do a SIM swap.
Heh.
Several months ago, I found myself in need of a new phone. I even had the means to do an orderly transition, with the old one still in hand and mostly working.
My mobile provider was an MVNO that was also my home ISP. I had enabled "enhanced security" to prevent ev0l hackerz from swapping my SIM without authorization. It turns out that this mode is so secure that it prevented me and the support staff from a normal upgrade procedure.
There were various glitches along the way, and a conversation with certain LLMs indicated that the SIM->eSIM disparity was also causing trouble, and with the online system's rejection of authentication I decided it was expedient to walk into their nearby storefront location.
It turns out that the salespeople in the storefronts are not really empowered in any technical way, except they were quite capable of changing my password without any reason, and wasting my time, so leaving the store empty-handed after mind games from three haughty female STEM dropouts was rather infuriating.
The process eventually succeeded after giving it a little time, space, and grace, but it looks like I'm leaving "enhanced security" disabled if it's so customer-hostile.
That's been my experience, too. I don't remember the store worker's details, though. I'm curious how the gender of the STEM dropouts affected the process.
If the credentials get stolen from a website database, they’re useless for every other website on earth. No matter how poorly they’re stored, it’s just a public key and is not useful. Hell, they can get code executing on the webserver that collects full login information, and it’s not useful.
Passwords always require full transmission. Hashing for storage requires a proper implementation, which we’ve seen does not happen. 100% of the time. There’s a reason hackers are still stealing passwords from websites after three decades.
Passkeys solve that. Nothing else available to the average user does.
We have been trying to get users to use good passwords since passwords were invented, and still haven't managed to get them to use unique passwords. It clearly doesn't work.
You know what MITM is, yes? There are a ton of points between you and that hash algorithm, and any single one immediately and permanently compromises you.
>There's a lot of assuming bad faith on the part of the FIDO alliance
Yeah, it's just a bunch of "big company bad!"
Yes, Google and Twitter and Yahoo are just trying to get your data and sell ads, but I fail to see how Passkeys furthers that specific goal. Even if these companies have bad motivations in certain parts of their business, they all have an incentive to make accounts more secure (to reduce fraud) and improve the user experience (to increase engagement/happiness)
I noticed that too. This also seems like a bit of an insult to the intelligence level of the average person. It’s precisely because attestation is a nuclear weapon that I doubt one of the big three will try it outside of their own specialized credentials. If someone tries to change ecosystems and finds that they’re going to have to reset all their passkeys it’s not going to take long for them to tell all their friends that passkeys suck and not to use them. This instantly kills adoption.
Furthermore, the rest of us are the people at the companies implementing passkeys. I did an implementation recently, didn’t require attestation, and can’t imagine why I ever would.
If we’re at this level of trust for all of FIDO, why aren’t we at legislative centers doing something much more dramatic about it instead of navel gazing about how we’re the smart ones who have recognized FIDO’s next big trick? How is attestation the problem here?
If the spec doesn’t guarantee portability, they’ll boil the frog to make sure you don’t get any.
> If someone tries to change ecosystems and finds that they’re going to have to reset all their passkeys it’s not going to take long for them to tell all their friends that passkeys suck and not to use them.
And their friends won’t care until they’re personally affected.
Why is your grandpa or fictional billions users being MITM’d?
Passkeys are an end run on general purpose hardware largely under your own control, which is a much bigger issue in scale than dealing with customers who can’t access the services they pay for because of some byzantine security or know your customer laws/procedures.
Santander UK sends its 'don't fall for a phishing scam' etc. emails from yoursantander2.co.uk or something stupid like that that's not what you ever interact with.
For their bank accounts, search tech support scam on youtube to see how that goes. Btw passkeys do nothing to stop this, they probably make it easier since grandpa doesn't have to search for a password or unlock a password manager to send his money to the scammers.
And if the bank implements the best form of Passkey (and implements it well) in this case it would require the user to biometrically authenticate before sending money (perhaps based on dollar amount or transaction volume) to a new account. The user would hopefully learn over time that the biometric requirement is aligned with money transfers and would grow suspicious if they were prompted for it during a scam session.
I bought a house earlier this year and the bank froze my deposit I sent to the real estate agent.
I rang the bank straight away and badgered them to unlock it ASAP in case the sale fell through for their BS fraud department to sift it.
They blamed the fact the real estate they’d never transacted with before, I politely told them they’re based in one state while I was purchasing in another.
It took 2 hours of back and forth to get them to send it, even after they did all their security questions.
It’s all a fugazi, they/governments do not want you having large amounts of money - it’s as simple as that.
Actually it's kind of the opposite. Right now the banks know how easy it is for someone to end up getting scammed, so they try to be really strict on picking up on potentially fraudulent transactions precisely because they can't trust endpoint security.
If they have something like this in place, they will have greater confidence in the transaction being genuine and less likely to block it. In this case, for such a large amount of money, relative to the size of your account, they might still be very cautious about it, but it would be less likely to cause an issue.
Several years ago, I wired some money overseas. I saw a way cool idea (some art project that I can't find online any more) for a carpet, and some carpet-making-person on reddit was "yeah, I can have that made".
When I got to the bank, they hassled me a lot, figuring I'm getting scammed. They surrendered when I said basically, "hey, it's only $250 and if it is a scam, he earned the money, so why stop it?"
Apparently a bunch of other people wanted something close (not quite the same as mine, but should give you an idea of it):
I'm not sure I follow this point? A trojan would fail to exfiltrate passkeys (assuming they're stored securely). It would be able to see a valid login and potentially use that session or exfiltrate the session, but wouldn't be able to get persistent account access. This seems better than stealing a password and getting persistent account access, or possibly stealing a TOTP code for the same. It's bad, but I think it's made better by passkeys? Unless I'm misunderstanding your point.
A trojan would succeed in using your session and potentially start sessions from your device in cases where your key does not require your confirmation or where they have found a bug to bypass that (it maybe as simple as providing simulated input events to the system).
My point is the gains are overstated the main weakness is almost always user action. Passkeys will not magically solve all our security problems.
You want corporations to get more into law enforcement? These things are already crimes, law enforcement agencies already go after them. Would I like more public funding for that? Absolutely. When we've solved crime then let's go back to using passwords, or even just usernames at that point, after all no one will hack them.
Users constantly fall for website impersonation, this can be solved by your password manager it just has to check the host and the certificate of the login page.
Now browsers don't let password managers do that, I wonder why.
But lets say you don't like the fact that passwords are sent over the wire. I get that I don't like that either. You could just take a random token and have an hmac signature on all your requests, for most cryptographic hashing functions that would probably be quantum secure as well.
But lets just say you don't want to have a shared secret because you know servers get hacked all the time. Totally legit, I like the way you think, asymmetric cryptography it is.
How could we possibly do it? Like ssh with pki on top.
The spec could be literally these 25 words:
Do what ssh does but request a PKI signed certificate instead of a key signature from the server and validate it against your known CAs.
Passkeys are the consumer implementation of PKI to solve these problems.
There's functionally no alternative for consumer logins, and certainly not one that doesn't require learning what PKI is. "like SSH with PKI" is a bit "draw the rest of the owl".
PKI is already in place for domain verification. SSh with PKI is exactly what it sounds like, "passkeys" without attestation, hardware, corporate bullshit.
This is the entire usability/footgun issue with SSH public keys. For the tech savvy being able to copy and paste id_ed25519.pub into their online account settings would be a dream. But who will train the masses to do that? A lot of people would accidentally paste their private key. Just like how journalists learning OpenPGP emailed over their private key compromising it. For low tech savvy people having direct access to key material is an anti-feature. They can lose it. They can leak it or be phished into giving it up. They don't want to manually sync it between devices or generate per device keys and enroll all of them. Then companies exploit this need for user friendly design to create vendor lock in.
My point is your browser, password manager could do just that, all the attestation, hardware keys, required user confirmation etc, authorized clients etc are all a power ploy from FIDO to own peoples authentication.
> this can be solved by your password manager it just has to check the host and the certificate of the login page
Which is exactly what Passkeys does. And it also has built-in functionality to prevent any kind of "Oops! We changed our login method, just ignore the warning and retrieve it manually." social engineering, which a user would often genuinely see when random services move their login page to a different url.
Because it prevents an attacker from stealing the password. It's both extremely hard to "steal" a passkey, and to phish a login from one. Neither of those are true for passwords, and TOTP only partially solves the stealing part.
Passkeys aren't solving for security nerds who like portability and have 30 character long passwords, they're solving for grandpa who will happily read their bank's 2FA SMS to the "bank" over the phone. The FIDO alliance has literally billions more of these users than they do users who know what hardware attestation is and how it impacts their auth workflows.
The security requirements are generally hidden from users. I have never noticed different behaviour between my passkeys.
But as I said, there are plenty of UX issues with passkeys, those UX issues however don't include getting your accounts hacked, phished, passwords lost in data breaches, etc, which I'd suggest are a lot worse.
We don't need attestation and most of the data bits. Apple consumer devices don't support attestation. Only Apple enterprise managed devices do. It's a paranoia tool for big enterprises with strict device management requirements. Apple has a lot of good reasons to believe attestation is a privacy violation for consumers and seems likely to keep up the good fight in making sure it remains an enterprise-only tool.
So companies can use passkeys and set policies around what hardware they're stored on. IMHO, not particularly useful or desirable for everyday Internet users, but really nice if you have specific requirements.
I think the real issue is that it's all about tracking. It's another level of spying on people, data being mined, people being locked in somehow someway so someone somewhere else can have an increased level of precision in some floating point number in some algorithm that is being used to grind the joy out of human existence in exchange for money being moved from one incredibly rich consortium to another, the animus of cpr on a dead god for a dying race.
I think that's a bit reductive, there are decades of sci-fi novels about how transformative artificial intelligence would be, so I feel like I don't need to explain where the trajectory could go. The applications and "collision with the real world" aren't there yet, but you can't pretend that a machine that's smarter than any living human is on the same level as Amazon drone deliveries.
I agree with you, but to play devil’s advocate: what if it is on the same level as Amazon drone deliveries? Is intelligence really a bottleneck in society? People in MENSA with high IQs don’t often accomplish anything in proportion to their relative intelligence. The most intelligent people are rarely even in charge of making decisions. There are a lot of intelligent people with intelligent ideas that nobody listens to. It seems like the real bottleneck in society is building trust, consensus and constructive incentives between groups of people to do the things we already know are smart, not a lack of intelligence.
Interesting idea, but I'd have to disagree. MENSA is basically a group of benchmaxxed people, they are super good at a set of testing but that doesn't mean they have the ambition or other social skills to make a difference in the world. When you align all those factors, you find the greatest contributors to science and engineering. What happens if you completely eliminate the need for someone to be inherently intelligent? Suddenly, the number of important difference makers in the world increases by an order of magnitude.
I agree with the sentiment though, intelligence is not all you need. We're not going to "solve science" through RLVR, people are still needed in the loop until we get superhuman construction robots and superhuman communicators.
Good points. Maybe a more general version, removing constraints on one resource is usually not hugely impactful because you simply hit the next constraint.
Concrete example, "coding is free" (TBC, but let's assume), and now we're code review constrained. Even if code review becomes free we probably just become product discovery constrained, or something else. Making all software free will just cause us to hit on hardware constraints, and so on. It's still progress, and more progress will bring more benefits, but there's a limit to how much better the world as a whole can get from any one change like this.
MENSA selects for puzzle solving on the basis that those are correlated with "being smart".
Reinforcement learning selects for models that appear to complete tasks, on the basis that appearing to complete a task is correlated with completing a task.
Both have problems. The latter is probably a better correlation, but by no means flawless. If we just take at face value that RL is training models to complete tasks, we're not engaging deeply enough with the process enough to see where it falls short.
MENSA also selects for people who want someone to certify their intelligence. High iq people who have done a lot have much less desire for a MENSA membership. We should be looking at the non-MENSA members with high iqs and seeing what they're doing.
I don't disagree with where AI could go, but I don't think we've actually proven that it's there. My point is that the folks claiming we are there already if only the rest of the world would just recognise it, are repeating the same thing from every previous tech cycle. In many cases it's the same folks.
This project falls foul of the same issues as almost every one of these personal assistants: there's no indication that it works.
Each part of this is very easy to implement, even if writing the code by hand. A chat interface, plus memories, plus semantic search, a little database, some embeddings, cron triggers. It's all trivial to implement... unless you want it to work, and more than that, if you want to know for sure that it works.
Because the harness is key, the prompting is key, the exact wording of the skills matters, the way the memories work, the embeddings used, all of these have influence over how well the system actually performs at being a personal assistant.
I've plugged together the dozen libraries necessary to do this sort of thing, and then it sorta works and sometimes doesn't. I realised that the whole problem is actually one of evaluation. If you don't have evals that say that it recalls memories with a certain performance, if you don't have evals that say that it actually completes tasks some percentage of the time, then you don't know if it actually works.
I've learnt not to bother investing my time in anything like this unless there's evidence that it actually works beyond "on my machine" from the devs.
This is a bit of a paradox. Indication that it works requires some kind of proof. Proof is mostly a byproduct of people trying things. If the rule is “don't try it until it’s proven,” and proof requires people trying it, then any new innovation would be in a little bit of a pickle.
Your worldview requires other enterprising people to try new things, write about them, find the rough edges, help to iterate and improve, and then surface their findings in such a way that it can meet the bar of "working".
There is a kind of proof from lots of users getting apparent value out of it, sure. But we also have automated evals for AI systems, it's a well developed technique at this point, and it would bootstrap that process by providing some evidence.
I think AI/ML systems are unique compared to other software in this regard, because the "how it works" is not inherent in the software itself, and not working once doesn't mean that it doesn't work at all, it could have been luck.
reply