Making hard things easy
Kyiv, Ukraine
Joined June 2008
- Tweets8.8K
- Following409
- Followers548
- Likes6.8K
Yevhen Bobrov retweeted
The future: AI writes the business plan, AI writes the pitch deck, AI incorporates the company, AI writes the software, AI negotiates the acquisition, AI writes the "our incredible journey" blog post promising commitment to the product, and AI turns the product off a month later.
Yevhen Bobrov retweeted
When an LLM writes a formal spec from requirements plus possibly buggy code, it can produce a spec that the buggy code satisfies: either too weak, or shaped by the implementation. The verifier passes it. Advanced prompting didn't fully fix it.
This is verification vs. validation. Proving code meets a spec says nothing about whether the spec captures intent.
One way out: make the model the implementation. Compile it instead of hand-writing code that's supposed to match it. That closes the model-to-code gap. Validation remains, but it happens against a model a domain expert can read and explore through generated scenarios, not against thousands of lines of code.
arxiv.org/abs/2610.32053
Yevhen Bobrov retweeted
Few more observations on working with AI-enabled team:
1. One of the things that separates junior devs from senior is the ability to notice that a design is going wrong and trying another direction early. Juniors will push in a hopeless direction for way too long. AI makes it worse. Juniors feel like AI validated the approach, avoid talking to others (most hate it) and push in the weird direction for too long.
2. When it comes to code produced by seniors, reviewing code is rarely useful. Reviewing the intent of PRs and whether I agree with the intent is important. Are we fixing the correct problem? in the correct part of the code? In a way that is friendly to users, operators, the company?
3. Work now feels... lonely. Code reviews (and sometimes even design) are mostly comments from AI, fixed by AI. Engineers always saw any conversation as waste of time, when they could just produce more code. Now they can produce even more code, and it seems like a conversation with me adds less value than talking with AI, and perhaps even less pleasant. It isn't about being social at work. They are happy to talk about movies, news, etc. But I find conversations with engineers about engineering topics to be energizing, inspiring and motivating. And while I understand it isn't the job of my team to energize and inspire me, I deeply miss the interactions we used to have.
Yevhen Bobrov retweeted
I see how some people can watch flashy robot demos on the timeline and think with a shiver that the robot apocalypse is around the corner, but reality check:
There is no robot in the world that can change the batteries in a jack-o-lantern.
If you have a robot friendly door handle it might be able to walk outside, pick it up, and carry it back inside. The robot could open the drawer with your batteries in it, but then things get tough.
Opening the package of AA batteries?
Extracting a precision screwdriver from its case?
Unscrewing four tiny screws that require a hard press and twist?
Popping batteries out of the case?
Yes, you could build and train a specialist robot to do that today, but there is a very long way to go to replace the full range of human capabilities. Near term doomer scenarios should stop at “secretly controlling humanity” instead of “wiping humanity out” 😀
Yevhen Bobrov retweeted
Heads up, @OpenAI and @AnthropicAI. Rumor reaches my ears that you're doing a stupid thing, and should stop before you damage yourselves.
I hear you've now nerfed your models so that when people try to use them to clean the spamware and spyware out of their televisions, you block that.
If you really want Chinese open-weight models and open-source projects like OpenWaldo to eat your lunch, crippling your models so that people paying expensive subscriptions can't use them for completely legitimate purposes is a great way to accomplish this.
If, on the other hand, you'd rather have a volume business, maybe stupid arbitrary restrictions that look like they have the sole purpose of protecting corporate sleazeballs aren't such a good idea.
A word to the wise should be sufficient.
Yevhen Bobrov retweeted
pi-web-access update: the agent can now search, then pull specific values off a page instead of reading the whole thing. Clairic returns just what you asked for, with the line it came from, and flags anything it isn't sure of.
When in codemode the values come back as typed data, so one script can compare prices across results.
Also: reduced the tool descriptions by 60% while retaining same functionality.
pi install npm:pi-web-access
github.com/nicobailon/pi-web…
Yevhen Bobrov retweeted
Has anyone else noticed that a merge queue becomes effectively required with agents. I'm not totally sure how to address this yet. But you can't have a stampeding herd of agents rebasing each time something is merged. I'm getting really good at wasting money on crap like this.
Yevhen Bobrov retweeted
If you've ever wondered why smart TVs are so cheap, this is why.
@log4j rooted his Samsung and found an always-on hot mic, automatic content recognition, geolocation, network mapping, ad targeting and user profiling, shared with Samsung's "400 partners".
A lot of it can be blocked in <15 min, wrote a basic guide below.
What your TV is doing
The main culprit is ACR (automatic content recognition). Your TV screenshots what's on screen, fingerprints it, and sends it home to build your ad profile. Samsung does it every 500ms, LG every 10ms [1].
What is insane: it happens on connected devices too.
Plug in your laptop, your console, your work machine, and your TV can fingerprint that via HDMI [1].
He also found that if your Samsung doesn't have a mic, it'll look for one from a connected soundbar or bluetooth device.
xitter.cf/log4j/status/211376224…
It's on by default, and you likely agreed to it on the setup screen you clicked through in 10 seconds.
Step 1: Turn off ACR
Samsung: Terms & Privacy → Viewing Information Services
LG: Live Plus
Vizio: Viewing Data
Roku: "Use info from TV inputs"
Sony/Google TV: Samba Interactive TV
Menus vary by model, but those are the names to look for. While you're in there, opt out of interest-based ads, reset your advertising ID, decline every optional privacy agreement, turn off voice recognition, and delete apps you never open.
Step 2: Give smart devices their own network
Put the TV, cameras, speakers and vacuum on your router's guest/IoT network. The logic is simple: these devices rarely get patched. If one gets compromised (getting drastically more frequent with AI), it shouldn't be able to see your other devices or home network.
Step 3: Block trackers for the whole house with DNS-level filtering
NextDNS (cloud-based) is easy and has a solid free plan. Pi-hole is a little bit more work if you prefer self hosting. For simplicity we'll focus on the former.
1. Sign up at nextdns.io (free tier is plenty)
2. Privacy tab: add a blocklist (OISD is a good bet) and turn on Native Tracking Protection for Samsung, LG, Roku, Amazon (see attached image)
3. Setup tab: copy your endpoint
4. Paste it into your router's DNS settings as DNS-over-HTTPS/TLS (or use the IPs + "Link IP" if your router only does plain DNS)
5. Bonus: block outbound port 53 except to your router. Some devices hardcode their own DNS to get around you
Then open the NextDNS logs and watch how often your TV phones home. It's eye-opening. If an app or update breaks, find the domain in the logs and allowlist it.
Why they do this
TV prices are down 97% since 2000 [2]. Most of that is better manufacturing and brutal competition. But once margins on the hardware hit zero, the cost moved to you.
In Q3 2024, Vizio lost $6.7M selling TVs and made $115.8M in gross profit from ads and viewing data [3]. They've said on earnings calls that they keep TV prices low to grow the audience they sell to advertisers. Walmart bought them in 2024.
This isn't a conspiracy theory either. Vizio paid $2.2M to the FTC in 2017 for tracking 11 million TVs without consent. Last December, Texas sued Samsung, LG, Sony, Hisense and TCL over ACR. Samsung and LG have since agreed to stop collecting that data without explicit consent [4].
TL;DR
1. ACR off
2. Ads + voice off
3. Smart devices on their own network
4. NextDNS filtering on the router
Sources:
[1] ACR study: arxiv.org/abs/2409.06203
[2] Cost of US consumer goods: aei.org/economics/chart-of-t…
[3] Vizio Q3 2024: sec.gov/Archives/edgar/data/…
[4] Texas v. Samsung: texasattorneygeneral.gov/new…
Yevhen Bobrov retweeted
These days, you should be building lots of tools for yourself.
Build a tool to polish an animation, lots of knobs to fine tune.
A tool to visualise performance issues.
A tool to populate your UI with realistic data.
Leverage AI to build a tool that builds *the* tool.
Yevhen Bobrov retweeted
I've been reviewing a lot of code written by Opus 5.5, and it still seems to make a lot of bad software engineering decisions. The kind that will accumulate/calcify into unmaintainable software over time. IMO even the agents will struggle to maintain vibecoded software.
Yevhen Bobrov retweeted
Agents crap all over PRs now and they are not a great place for humans to collaborate anymore.
Yevhen Bobrov retweeted
As fun as AI is, we built so much bad software over the last 30 years, and now the universe is punishing us for our sins.
Yevhen Bobrov retweeted
been a gpt shill for almost a year, but opus 5.5 is just so nice to work with.
Yevhen Bobrov retweeted
LLMs are good at finding exploits and bad at system design, which captures their general strengths/weaknesses: good at relentless repetition of bounded tasks; bad at holistic understanding. Good at producing working code (including exploits); bad at knowing what is "good".
Yevhen Bobrov retweeted
This looks like the path forward. TDD is great, but agent-written tests are so cheap that many devs skip the review process. PDD might just be what is needed to increase clarity and specificity.
How do you _guarantee_ your agent's code is correct? You prove it.
Introducing Proof Driven Development Kit (PDD Kit) from @MSFTResearch.
PDD Kit helps turn your plan into a formal spec, then proves the agent's code meets that spec for every input. No vibe verification. PDD Kit is integrated with @GitHubNext's Chopin, so you can plan as a team.
PDD Kit takes an app's login flow from intent to a verified pull request:
It discusses your code, infers your intent as it goes, and proposes a formal spec in Verus, a proof language for Rust.
Once you approve the spec, the Verus verifier automatically proves the code meets it.
Where proof isn't possible, it falls back to empirical verification with tests and computer-use agents (CUAs).
It works on Rust today. No new language, no change in how you produce the underlying code, making formal methods more accessible.
The goal is a verified software factory, where engineers review specifications instead of code.
Come see it in action at GitHub Universe, Oct 28–29. Swing by the Speakeasy and ask for GitHub Next!
Yevhen Bobrov retweeted
i'm sure you're all better than me at this but just some of what we've seen if it helps - they're not going to stop. it's going to get increasingly sophisticated and they're going to go after every surface of your system and all of your employees
any old projects you've long forgotten about will be found and used against you
the only reason we're surviving is because we have agents going 24/7. we're still barely sleeping
good luck, sorry you're dealing with this, but really it's a collective problem we're all facing together