To be clear, I've made large software and game projects over the years, but no way I'd have found the time to do a remake/enhancement of a game I loved as a kid from 1995 that has zero business case. Not without AI.
It is a robust, reliable cache of apt packages, with the additional goal of still being able to serve packages from the cache even when the upstream is down. This was started shortly after that DDoS of Canonical this past year. We've run apt-cacher-ng and apt-cacher over the last dozen years, but (a) it requires hand-holding about once a month and (b) it did absolutely nothing for us when Canonical was under DDoS.
I've put well over 100 hours of my time into it. Still running into a lot of people knee-jerk calling it "slop", but I've had 200-ish machines pulling from it for 6 months and it has worked way better than apt-cacher-ng.
I'm not really sure what to do with people who dismiss AI-assisted projects, while dehumanizing the 100 hours of my time I've put into it. I fear we're running the very real risk of both sides losing: the people trying to thoughtfully create with AI losing because of the AI, and the people avoiding AI losing because they can't keep pace.
To play devil's advocate, that sounds like the sort of uncomplicated thing that you could've manually vibecoded in 2020 without an LLM. What changed is that the LLM doesn't let you get analysis paralysis.
This isn't just a simple http proxy and checking if the requested URL exists on disc. It's a pretty subtle snapshotting system that fully understands and vets apt repos, detecting when the repo changes, proactively downloading "interesting" packages that have updated, verifying and validating all packages, and then promoting the repo to active when it is healthy. Plus a web-based admin interface.
The core of it is around 20K LOC, with another 40K in tests. The COCOMO model gives that an estimate of around 2 developer years of effort assuming full time work.
apt-cacher-ng, the hand-written C++ version, is 16K LOC for the core. apt-cacher-ultra does a lot more. Seems like a pretty reasonable LOC count to me.
You just write the code, don't stop to think. You only have to implement the very small set of requests that an apt client can make to an apt server. Probably "get package index" and "get package file".
Like za_creature said you can use a language more towards the YOLO end of the spectrum - more Go or Python or JavaScript than assembly or Rust.
Your commit history shows you had an issue of high background CPU use. You probably wouldn't have it in a manually coded implementation.
>You only have to implement the very small set of requests that an apt client can make
Why even write one of those? Just set up an nginx proxy cache and call it done.
But that doesn't even scratch the surface of what this project does. We already have a few simple approaches to this problem: apt-cacher and apt-cacher-ng. Neither of which were any help when Canonical was under DDoS. Both of which have proven unreliable.
As I said elsewhere, apt-cacher-ultra is a pretty subtle piece of software, it doesn't just do a naive cache, it fully understands the apt repo structure, validates the repo, and snapshots it, understands what packages your clients frequently request and preemptively downloads updates to them as part of the snapshot promotion, etc. A DDoS of the package sources, even in the middle of an upstream releasing updates, is something a-c-u will handle no problem. I've simulated this by firewall rules blocking upstream traffic. It's also proven much more reliable than apt-cacher-ng.
I've been in the software game ~40 years, I've seen it time and time again: "How hard could it be" and then when you get into it you realize there are a lot of devils in the details.
> you can use a language more towards the YOLO end of the spectrum - more Go or Python or JavaScript than assembly or Rust
You might want to change the way you phrase this idea. I think you meant that Go/Python/JS are more "YOLO-friendly languages" (you'll get into far less trouble if you write slop in them). My initial reading was the opposite. It sounded like you were saying the languages themselves are the slapped together garbage.
Assembly is most certainly not "YOLO-friendly", but is more YOLO.
> I've put well over 100 hours of my time into it. Still running into a lot of people knee-jerk calling it "slop"
Indeed. The number of hours is my goto defence too. So far I've put in maybe 200 hours of time into design, iteration, playtesting, QA, and balance of my game. Sure - almost zero has gone directly into writing code but this is still a major project.
People who one shot a crappy game have no idea how much work it still takes to get something really good over the finish line.
>I'm not really sure what to do with people who dismiss AI-assisted projects
Mostly I've stopped worrying or trying to convince the haters. I'm having a blast and building great things (lots more than just Asteria).
You may need to brush up on your game theory. It's worth it to spend $1 for a 1% chance to win a million dollars. You don't need to be certain the key is there for it to be worth it to do a supposedly trivial exploit.
Your giving away the exploit though so it's not really only $1. How much is having it actually worth, probably more then that, probably more than $500 too.
The exploit is supposedly so trivial that everyone needed to take down their services until they could patch? There should be nothing to give away here, which I think is the point. Either it’s trivial and you swipe the $500 or it’s not and you save it (assuming you have it). In the latter case you shouldn’t really be worried, since they won’t burn an exploit on you either.
lol the exploit is patched, why are people acting like it's a a zero-day? anyone you attack with this, in any case, has to be someone who hasn't yet upgraded their PHP version. it's worth nothing to hide/sit on.
Why do they need to be sustainable as a business..? The best museums are a service that the public funds (or not). Side note: the museums in America generally suck and are just capitalist activity centers for kids, in my experience. You can't manufacture a good museum's exhibits. I don't think many Americans even know what a museum is, based on their reviews of some I've been to.
Museums are worthwhile to fund instead of throwing them to the wolves of the private sector.
I don't get upset. I just know that you have no idea what you're talking about. Talk to some tech native, smart, practicing lawyers for an hour about this.
"I'm right until you get me a conversation with Terence Tao".
Sorry, a random stranger on the internet is not going to spoonfeed you. You need to do the work to enlighten yourself.
You don't need a lawyer "well versed in metamath". You're being elitist and dismissing perfectly competent experts who know more than enough to demolish your ideas.
There exist voluntary paths towards formal verifiers as judges: arbitrage.
Parties can agree to some contract and settle any potential future issues in a predetermined specific court of their choice.
Tech companies might prefer the legal certainty formal verification systems provide vis-a-vis human-run courts.
As their use expands, the necessary definitions and normative axioms evolve, until normal companies and then normal people start using it.
The act of formalization from natural language law to metamath database, could probably be done by swarms of agents, resulting in multiple competing formalizations from which competing human subfactions select and promote.
reply