Hacker Newsnew | past | comments | ask | show | jobs | submit | codemog's commentslogin

I think the OP is in for a rude surprise when the task is “finished”.

It will go somewhat like this:

“You're really not going to like it," observed Codex.

"Tell us!"

"All right, said Codex. "The answer to your Great Question..."

"Yes...!"

"Is..." said Codex, and paused.

"Yes...!"

"Is..."

"Yes...!!!...?"

"Forty-two," said Codex, with infinite majesty and calm.


I bet you've asked Codex for that joke :p

You’re going to make this a gender and party issue huh? Surprised skin color wasn’t brought up too. Yep, we deserve what we get.

What other reason is there for an otherwise unremarkable character to become the public face of the issue for years?

Chuck Schumer is the whip of the party, as mentioned she isnt even top 10 in performance, her party didnt legalise the activity, other members are aggresive in their pursuit of insider trading information (MTG was part of the most committees during her tenure, but she skipped almost all votes after that, she just wanted the scoop adn then bolted) ...

So why her?

The most common excuse is "well people demand more of dems because everyone knows republicans are crooks", which doesnt explain why more senior leaders, ex presidents etc are the ones hounded instead of her.

how ever surveys by lobbys like the ones owned by the Koch brothers show which politicians people find unlikeable. Unsurprsingly many are unremarkable women, just like Nancy, which makes them easy targets for public campaigns in favour or against.

If you name the most talked about politicans of the past 20 years, outside of the pres (Obama, Biden, Trump) you get mostly women (Sarah Palin, Kamala Harris, Nancy Pelosi, AOC, MTG, Kristi Noem, Laurent Bobert) that is not a coincidence and it explains why no one could pick Schumer, who is senior leadership, in a police line up but can tell you the many dogs Kristi killed


This are exactly the sort of facts the hn crowd hates but which they can't rebuke.

Ah yes, also known as C++ enjoyers.

And the Kimi team broke the Anthropic ToS by training off Opus outputs and… nothing happened?

Nobody cares, nor should they. Anthropic broke nearly every ToS of every website that they scraped data from. The AI robber barons just want to monopolize intellectual property violations, and I'm gonna cheer on any robin hoods that take it back from them.

Are you kidding me? Who’s going to align synergy and hold accountable KPIs and vision plan the 3rd quarter and.. and.. other MBA talk. Certainly AI could never.

large language models are great at language tasks like "bullshittify this message"

I'm noticing one major early effect of them is making extensive, visually consistent, very impressive slide decks accessible to individual workers who need to actually do real work and wouldn't ordinarily have time to make those.

The result is an explosion of pretty bullshit-heavy documents flying around our org, which management loves but which is definitely, so far, net-harmful to productivity.

This comes out if you start asking questions about the documents. "Which of a couple reasonable senses of [term] do you mean, here?" they'll stumble because that was just something the LLM pulled out of the probability-cluster they'd steered it to and they left in because it seemed right-ish, not because they'd actually thought about it and put it there on purpose. They're basically reading it for the first time right alongside you, LOL. Wonderful. So LLM. Much productivity. Wow.

Anyway, since a lot of what managers and execs do is making those kinds of diagrams and tables and such in slide decks, and their own self-marketing within the company is heavily tied to those, I expect they see this great aid to selfishly productive but company un-productive activity as a sign these things will be at least as big a boon to real work. Probably why they still haven't figured out how wrong that is. I suppose they're gonna need a real kick in the ass before they figure out that being good at squeezing their couple novel elements into a big, pretty, standardized, custom-styled but standards-conforming diagram padded out with statistical-likelihoods doesn't translate to being similarly good at everything.


Jail time for execs. Only way things change.

Just update the codebase, much easier, 10 minutes.

That entirely ignores and excuses the chain of decisions that lead to this problem. Removing it from the codebase today does nothing to dissuade them from doing something similar tomorrow

That's why webXray (https://webxray.ai) has perfected forensic privacy auditing - we catch every code change that has visible traces. I'll catch the same thing any way you do it - cookies, local storage, js obfuscated network payloads...no sweat. I'll go all day long.

A lot of this advice is good or at least interesting. A lot of it is questionable. Python is completely fine for the backend. And using SQLite for your prod database is a bad idea, just use Postgres or similar.


There’s a lot to be said about his approach with go for simplicity. Python needs virtual environments, package managers, dependencies on disk, a wsgi/asgi server to run forked copies of the server, and all of that uses 4x-20x the ram usage of go. Docker usually gets involved around here and before you know it you’re neck deep in helm charts and cursing CNI configs in an EKS cluster.

The go equivalent of just coping one file across to a server a restarting its process has a lot of appeal and clearly works well for him.


Yes. It strikes me as odd how many people will put forward Python with the argument of "simplicity".

It is not. Simple. It may be "easy" but easy != simple (simple is hard, I tend to say).

I'm currently involved in a project that was initially layed out as microservices in rust and some go, to slowly replace a monolyth Django monstrosity of 12+ years tech debt.

But the new hires are pushing back and re-introducing python, eith that argument of simplicity. Sure, python is much easier than a rust equivalent. Esp in early phases. But to me, 25+ years developer/engineer, yet new to python, it's unbelievable complex. Yes, uv solves some. As does ty and ruff. But, my goodness, what a mess to set up simple ci pipelines, a local development machine (that doesn't break my OS or other software on that machine). Hell, even the dockerfiles are magnitudes more complex than most others I've encountered.


I am not following the difficulties you have mentioned. Setting up a local dev environment in Python is trivial with UV.

The only major downside of Python is its got a bit poor module system and nothing as seamless as Cargo.

Beyond that the code is a million times easier to understand for a web app.


Again, "easy" is not the same as "simple".

"trivial" falls in the "easy" category. So it may not be hard to do. But what UV makes "easy" is managing something very complex under the hood.

Better example:

FROM python:3.9-slim

WORKDIR /app

COPY requirements.txt .

RUN pip install -r requirements.txt

COPY . .

CMD ["python", "app.py"]

While "easy" it is nowhere near simple. Aside from the entire complexity of the stack of docker, that `python:3.9-slim` it itself is very complex. It installs over 20 "dev" packages (from bluetooth via tk to xz), it downloads source files, builds a python runtime, (patches that?), installs pip, setuptools, does some (to python people probably familiar?) "wheel" stuff, etc¹. Point being: what you end up with, while easy to get, is very complex.

uv manages a runtime, some virtual environment to hot-swap that with other runtimes, it hooks into a package manager, manages additional tools (linter, typechecker, lsp, etc) and so on. What lies under that is very complex.

¹ I am well aware that node, ruby, php are quite similar.


Python will take you a long way, but its ceiling (both typical and absolute) is far lower than the likes of Go and Rust. For typical implementations, the difference may be a factor of ten. For careful implementations (of both), it can be a lot more than that.

Does the difference matter? You must decide that.

As for your dismissing SQLite: please justify why it’s a bad idea. Because I strongly disagree.


What a load of nonsense.


Why is it nonsense? Sounds reasonable to me.


> its ceiling (both typical and absolute) is far lower

If you plan to remaining smaller than instagram, the ceiling is comfortably above you.


There are a myriad middle states in-between "frupid" (so frugal that it's stupid) and "Instagram scale".

Python requires much more hand-holding that many don't want to do for good reasons (I prefer to work on the product unimpeded and not feeling pride having the knowledge to babysit obsolete stacks carried by university nostalgia).

With Go, Rust, Zig, and a few others -- it's a single binary.

In this same HN thread another person said it better than me: https://news.ycombinator.com/item?id=47737151


This is a post about keeping your infrastructure simple, so Instagram is not a good ceiling to pick. People do all kinds of hacks to scale Python before they hit Instagram levels


I plan to remain smaller than two VMs


The context was explicitly single machine.


Why is SQLite bad for production database?

Yes, it has some things that behave differently than PostgreSQL but I am curious about why you think that.


For read only it can be a great option. But even then I would choose D1 which has an amazing free tier and is sqlite under da hood.


But then you don't get the benefits of having the DB locally, with in-process access.


It's local to the worker? I don't understand what you mean.


Unless your Cloudflare worker and the DB are scheduled onto the same physical server, they are not local to one another. I don’t know much about D1, but the overwhelming majority of cloud infra makes no such guarantees, nor are they likely to want to architect it in that manner.


Cloudflare's Durable Objects puts your Worker and SQLite DB on the same physical server (and lets you easily spawn millions of these pairs around the world).

D1 is a simplified wrapper around DO, but D1 does not put your DB on the same machine. You need to use DO directly to get local DBs.

https://developers.cloudflare.com/durable-objects/

(I am the lead engineer for Cloudflare Workers.)


Very cool, thanks for the response!


I think the point is that your Python webapp will have more problems scaling to let's say 10,000 customers on a 5$ VPS tham Go. Of course you can always get beefier servers, but then that adds up for every project


At 10,000 paying customers I don't think it is frivolous to move to a 10/month vps, or maybe a second 5/month one for fail-over.


I love the small few who take the time to do crazy stuff like this. Very entertaining.


Stupid regulations are why we have an idiotic cookie banner on many websites.


No, that's malicious compliance. If the owners of those websites would just stop ignoring visitors' right to privacy they wouldn't be showing those banners (yes, I know the website of the EU also has such a banner, lazy devs are lazy).


I would guess OpenAI Codex and Claude Code are well into the millions subscriber range at this point. I would venture to guess the majority of them run in yolo mode. I have only seen a few horror stories on reddit. The same way any time you drive a car you can crash and die (many times through no fault of your own).

All that said, no way in hell I’m giving either access to production databases or environments.


I have heard of more than a few horror stories including filesystems lost and force pushes done.

These tools have only been in use for a short time and the current harnesses/system prompts are quite limited. Claude code is mostly limited to your codebase where you have version control. Excel is different.

I foresee that once people hand over more power to full agents there will be some nasty surprises. Im sure there will eventually be demand for some kind of limits


Think it’s still wise to containerize it somehow just so that it can’t nuke anything.

Being worried about escape from isolation etc in a person dev context seems like overkill though


Yeah, I was thinking about simonw's lethal trifecta[0] and how to solve it and my conclusion was "you cannot", i.e. you just accept a certain level of risks for the rewards it offers.

The "agent never sees keys" approach prevents key exfiltration, but it doesn't prevent agent from nuking what it has access to, nor prevent data exfiltration.

The best advice I heard to protect against prompt injection was "just use Opus" ( ... which was great advice before they lobotomized it ;)

But even without injection, most of the horror stories are from random error, or the AI trying to be helpful (e.g. stealing your keys or working around security restrictions, because they trained or to really want to complete a task.[1])

tl;dr yolo

[0] https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

[1] https://www.reddit.com/r/ClaudeAI/comments/1r186gl/my_agent_...


Codex 5.4 medium couldn’t figure out how to run tests in my staging Cloudflare so it went ahead and ran those tests against prod. Mission accomplished.

Yes, agents.md yells not to mess with prod.


> Yes, agents.md yells not to mess with prod.

Probably what nudged it to run on prod in the first place


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: