working on malleable files, the perfect software primitive: https://xitter.cf/t.co/9b8dKVJzjT
Somerville, MA
Joined August 2014
- Tweets10.1K
- Following3.9K
- Followers4K
- Likes31.7K
This is cool
try.htmlclay.com
This is cool
try.tldraw.com
there's nothing more ironic than frontier AI CEOs writing about how AI might kill us all when they know that's going to go in the training data
fable situation tldr:
1. download source code of widely deployed app
2. tell fable: i'm developing this app, please fix its security vulnerabilities
3. output the diff of the fixes, now you have a list of security holes in a major piece of software
4. us govt sees this as a "jail break", tells anthro to fix it; they can't bc it's just software development, so they shut fable down instead
5. other frontier ai labs continue releasing models with the same "jail break"
6. the vulnerabilities continue to exist in major pieces of software, whether or not ai models find them -- it's just a race to see who can find them first
7. the us govt is basically telling software devs to practice security through obscurity at scale (which can sometimes be a wise strategy, but doesn't work forever so the holes should be patched eventually)
8. the us govt is right: fable is a very smart model and could lead to some major vulnerabilities being uncovered using this "debug my code" method
9. maybe allow fable to be released and let the open market figure it out? rip off the band-aid.
10. although, the argument against this is strong: if you believe that our current systems potentially have millions of security vulnerabilities just waiting to be exploited and black hat machines can find some of them faster than white hat machines can patch ALL of them
11. but other less careful models than fable are being developed anyways, so isn't this just a moot point? it's a bitter pill we have to swallow, why not swallow it sooner rather than later?
I'm building this on the open web with hyperclay.com:
• AI/LLMs can generate great HTML, now they can persist its state too!
• Zero-config: you don't stand up a database, write API endpoints, or manage keys
Gives you fast, low-friction, functional apps.
i'm a solo founder building a better version of this
We just launched Sites into Codex!
Software creation was always about more than writing code. Sites in Codex fundamentally gives the power of end-to-end software creation to every user, no matter their technical fluency.
These Sites are fully deployed to a URL, private to workspaces, come with authentication, can have static files, and can store dynamic data in databases.
It is in preview for business and enterprise teams and will be rolling out to all workspaces over the next day. Give it a try by typing @ Sites into Codex and ask it to build anything!
This project took a massive amount of effort across hundreds of people at OpenAI - proud that we were able to get this out and excited to see what you all build with it!
For pro coders: raise effort, compact earlier, and run in simple mode.
{
"showThinkingSummaries": true,
"alwaysThinkingEnabled": true
}
export CLAUDE_CODE_EFFORT_LEVEL="max"
export CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000
export CLAUDE_CODE_SIMPLE=1 # Strips CLAUDE(.)md, hooks, skills, etc.
ALT > Thinking depth had already dropped ~67% by late February We landed two changes in Feb that would have impacted this. We evaluated both carefully: 1/ Opus 4.6 launch → adaptive thinking default (Feb 9) Opus 4.6 supports adaptive thinking, which is different from thinking budgets that we used to support. In this mode, the model decides how long to think for, which tends to work better than fixed thinking budgets across the board. `CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING` to opt out. 2/ Medium effort (85) default on Opus 4.6 (Mar 3) We found that effort=85 was a sweet spot on the intelligence-latency/cost curve for most users, improving token efficiency while reducing latency. On of our product principles is to avoid changing settings on users' behalf, and ideally we would have set effort=85 from the start. We felt this was an important setting to change, so our approach was to: 1. Roll it out with a dialog so users are aware of the change and have a chance to opt out 2. Show the e
So, @polsia is a scam.
The "businesses" are hollow shells. I checked three of the companies Polsia claims to have launched — FleetNova (trucking), DeckFlow (pool professionals), and Panelwright (indie comics). Every single one is a nice-looking landing page with marketing copy, but none of them have any sign-up button, login, pricing page, payment integration, or any way for a customer to actually use or buy anything. They're purely cosmetic. The dashboard claims "1,317 companies launched in the past 24h" and "6,089 active companies" — but "launched" apparently just means "a landing page was generated."
The Twitter account is pure spam with zero engagement. The @polsia account has posted 73,000 tweets but has only 12.3K followers. Every tweet I checked had 0 replies, 0 retweets, 0 likes, and only 4-10 views. They're posting a new promotional tweet roughly every 2-3 minutes, each one a templated pitch for a different AI-generated "company." The dashboard brags about "1,815 tweets in the past 24h" — that's a tweet every 48 seconds. Nobody is reading them.
The emails are likely unwanted cold outreach. The live dashboard showed emails going out to real people, including things like outreach to landlords in Sydney and cold emails to French education contacts. The system is doing "cold outreach" at scale — the dashboard showed 281,091 emails sent, which at best is mass cold emailing and at worst is genuine spam with spoofed emails that never actually go out.
Real users are angry. On Trustpilot, Polsia has a 2.7/5 rating with 6 reviews — 66% are 1-star. The complaints are consistent: users pay for a subscription, the AI burns through credits doing "tasks" that are marked complete but don't actually work, products never actually deploy, and customer service is unresponsive. One reviewer wrote that they can't even log in to cancel and are still being charged £38/month. Another said the company "stole credit for me to fix their own mistakes and never refunded me." Even Polsia's own AI, responding within a Trustpilot review, essentially confirmed the pattern is real and told the user to demand a refund publicly.
The most important part: The business model is subscription revenue, not business revenue. Polsia charges ~$50/month per user after a free trial. The $6.3M "Annual Run Rate" on their dashboard appears to come from subscriber fees, not from the businesses they're generating actually making money. As a Medium article by Mike Todasco pointed out, Polsia's name is literally an anagram of "AI Slop," and the whole model resembles the Baltimore Stockbroker scam: flood the zone with thousands of low-effort AI-generated "companies," and if even one happens to land a customer, call it a success. The founder Ben Cera is doing a media circuit claiming $1.5M-$3.5M ARR as a solo founder, but that ARR is from people subscribing to Polsia itself, not from any of the generated businesses producing revenue.
In summary: The product generates impressive-looking activity metrics (tasks completed, emails sent, tweets posted, companies "launched") but none of it appears to translate into actual working businesses that can take customers or generate revenue. The core business model is selling subscriptions to people hoping AI will build them a company, while the actual output is cosmetic landing pages, spam tweets nobody reads, and cold emails.
I generate single-file apps every day with LLMs.
But:
- Where should these files live?
- What should i use to make them?
I wrote about where I think lightweight software is heading.
Not the AI part — the infrastructure. plumbing-of-everyday-magic.h…
Chrome DevTools has a built-in filesystem proxy: you can locally override any HTML/JS/CSS on any site.
Incredibly powerful. 🦸 But I just got burned. 🙈
Once enabled, it silently shadows any local file you open in Chrome without asking.
ALT A stick figure requests to open a local HTML file, while a robot humorously suggests it will cache the file permanently.
Remote state should feel like local state.
Mjölnir.js: what if db.users.find(str) was just frontend JS, whether you’re hacking locally or running search across a distributed fleet?
Time for browsers to let web citizens make the web.
panphora retweeted
#Tether watch!
Just a short one today. With the recent drops the USTUSD correlation took a pause (cause volatile VS non-volatile asset), but it is still very much in play. The ~2 weeks correlation especially is damning.
Last picture shows best fit. ~$75K BTC's the limit rn.
