Anyone who cares about the "craft" and "quality" of frontend or any other domain of programming should LOVE all the LLMs because it actually enables high code quality at very low cost. You can enforce best practices, do full code refactors, write as many tests as you want and you can do it without telling management that you need to stop writing code for 2 weeks for "tech debt". All you need is one guy with a lot of tokens to stay up with a lot of caffeine one night.
This is not the lament of the code getting worse (it's not) but the coders losing the knowledge of how to do it by hand without LLMs. If people really wanted to learn how to do things by hand, they can. In fact the AI is probably going to be infinitely more patient and knowledgable than any senior dev if you really wanna do this by hand. Just turn off the AI's ability to modify the code and just have it give you advice on the side.
The reason why nobody does that anymore is because most engineers work for capitalists not artists. It's the same reason I don't know how to farm my own food or make my own clothes like my ancestors did. Most people do programming because it's a job - not because it's an artistic passion. And that's OK.
Amen. I feel like I live in a different world than many of the commenters here. AI has made it such that most code “vibe coded” follows our root architectural practices by default. I couldn’t be more thrilled, and watching how enabled people are with this in their hands is amazing! I feel for the people in the thread who aren’t getting or feeling that experience.
Imagine only 10% of the white collar labor force were allowed to use AI. In that case, those 10% would be given 2 or 3 days off a week. Easy.
Now imagine if only 10% of companies were allowed to use AI. Those companies would easily be willing to give 2-3 days off per week to their workers. Makes sense since those companies would easily outcompete the others and so they would have enough economic surplus to provide lavish benefits to their workers.
However, because 100% of companies and 100% of workers have access to AI, the competitive pressure on the deployment of capital means that no days off can be given.
New perks are only given to you if you, your company or your country has some sustainable systemic advantage over other employees, companies or countries.
In the absence of those sustainable systemic advantage, any perk given would put you, your company or your country at a competitive disadvantage against some other employee, company or country who are willing to work without such perk.
The only way to sustain such a perk in those situations is with anti-competitive practices: Labor Unions, protectionism, corruption, etc.
Dumbest idea i've ever seen. Complete misunderstanding of how the tech world works.
The idea is: if sufficient consumers banded together and coordinated their spending power, they can drive decisions in the executive suite of the companies.
Nothing could be further from the truth. It's neither the spending of consumer nor even the spending of business that drive decisions. The only thing that drives decisions at that level is capital allocation - not spending allocation. Wealth drives these decision - not spending.
So if all these tech workers want to band together and do something about it, they would create their own ETF or mutual fund, and put all their wealth into that fund and then have the manager of that fund direct that capital based on their mission.
Of course you will see that this won't work because there just isn't enough capital here to move the market compared to the other capital allocators who are just trying to maximize returns.
I'm not sure it's so black and white. Directing capital is powerful, and directing spending is powerful (but probably harder; this is marketing or government). I think it's more that directing spending requires influencing a lot more people than directing capital.
The idea is that one can drive the other. Because if you direct that capital without consumption the investment is worthless. You can do both. You can direct the consumption in exchange for part of that consumption you get equity in a wealth fund that funds product the coop will gain equity in if they use. I think one the obvious ones would be a replacement for github.
We build a replacement for github, the most you personally drive demand to the git replacement and for that demand you gain equity. And for that equity you get a larger say on how the fund is used and increased access to privileges
Also, if you are doing something other than maximising returns then you'll be outcompeted and irrelevant in the long run unless you attract many billions in inflows, or the government tips the scales in your favour e.g. ESG.
This is such a basic take that totally misses the bigger picture of why Google made this move.
Google was forced to do this and it's a miracle of their slow organizational gears that they took so long to do it. So many people have already transitioned to using ChatGPT as a replacement for Google. All of this is driven by consumer behavior and the desire to "just get an answer" rather than having to wade through all the sources and try to figure out what is SEO slop vs what is actual reputable information. Google SERP results have been gamed by SEO slop for economically valuable search terms long before the rise of AI. ChatGPT simply solved a huge problem waiting for a solution.
From the web content creator's POV, there are to paths:
1. If you are merely a publisher and rely on eyeballs on ads to drive your own revenue, you are screwed. AI is going to ignore all the ads and only extract the content.
2. If however you are serving helpful information out of the goodness of your heart or if the content itself references a product or service which from which you will derive economic benefit from, you are still good.
I don't see this as a bad thing. Ads on websites were a necessary evil and will be seen as a relic of the first 30 years of the internet. Ads will not go away but they will just migrate to the application layer (youTube, LLM interfaces etc) that will provide a much more targeted experience. There will be winners and losers from this transition but that's normal and healthy.
>Google SERP results have been gamed by SEO slop for economically valuable search terms
So why not use AI to find the obvious spam and SEO? Sites like pinterest, "geeksforgeeks", stackoverflow clones were notorious for ranking highly on almost every technical search and you didn't even need AI to deal with those. Using AI to provide distilled summaries and making it harder to get the actual links is going to make things even worse for the user, because you have to cut through two layers of slop. And there's also not using the smartest model for the responses anyway.
1 year ago i would have agreed with you. Today, I'm going to take the other side on this. The amount of malicious code embedded in software now is going up exponentially. Yes this is a painful tax imposed on all software, malicious or not, but until they figure out a better system, this system actually will disuade a certain percentage of malicious actors to give up - ESPECIALLY having to pay a fee. As a mac user, i want to know if the developer has paid a significant fee to get this software to me. It a useful signal for me. If they didn't pay and didn't upload their passport, I really want think think hard about the risks involved for myself when I run this thing.
Sure, but the more barriers there are the better because it still reduces the number of threats. That’s why people choose to rent walled gardens. Otherwise, Linux would have higher adoption even among our crowd.
If you really value freedom over everything else, I don’t see value in putting bad bandages over closed platforms. Might as well just switch to an open one.
> because it still reduces the number of threats. That’s why people choose to rent walled gardens. Otherwise, Linux would have higher adoption even among our crowd.
I seriously doubt that's the reason, compared to Linux not being the default and Microsoft having spent years sabotaging it.
MS Office is available for Linux and Linux is an option on Azure. Even some new games from the Xbox division are officially sanctioned to run on Linux.
There is no longer a good reason to stay in a walled garden for your personal machine. The author should just make the switch if staying in the Apple ecosystem, or any other closed system, makes him really unhappy
The $100 isn't the deterrent. It's the having to pay (+ use a new identity/entity) every time you have to sign up for a new Developer account because Apple revoked your cert when it caught you distributing malware.
> 80% of Compliance has always been a performative box checking exercise.
You're making the same mistake as most people do: it's 80% box checking but that doesn't make it performative, the box checking is here so that the dude who checked the box become legally responsible for what's happening if they haven't done what they said they did.
If you didn't check that box you could always claim you didn't know you weren't supposed to do what you did. As soon as you've checked “yes, I'm doing things in the approved way”, this excuse disappears.
Compliance is crazy sucky - I remember there being a case when one of our vendors was harvesting data like crazy, and we went after them. It was grossly in violation of GDPR, like as bad as it could get.
When we reached out to them, they showed us a cert about how they were GDPR compliant, issued by a huge brand-name consulting firm.
In the paper they said they implemented certain standard-mandated cryptographic measures to 'anonymize' the data. Thing is, they implemented them wrong on purpose, so that they could actually identify users by inverting hashes with a rainbow table.
There was a lot of BS legal reasoning in there but the bigname firm signed off on it. Oh and at the bottom, it had a provision, that if the company were to be sued for breach of GDPR, the consluting firm would not be liable any way.
But this was good enough for tons of companies and govt agencies to just use that software.
At least in cybersecurity, there are no certifications that "certify" that you are secure. There are plenty of them that will assess your processes, their execution, etc., but the reality of the risk is next door. This is typically the case for ISO 27001, which has ISO 27002 (the ex British Standard from the 90s) that theoretically governs the controls you should have in place. But it simply does not work.
When you have a major leak, this is usually a company with half a page of certifications, but, hey, mistakes happen. The key problem that these mistakes come from is a fundamentally wrong approach to cybersecurity, but nobody cares.
I am speaking from the perspective of someone who has been running cybersecurity for 30 years in very large companies. It will be different from smaller-sized entities, where both the risk landscape and the capabilities differ.
This is really a two-layered approach: you need to have a mechanism to manage your processes, and a real-life risk assessment. This last part is usually what fails most because there are not many people who can build a comprehensive risk analysis.
The problem with risk analysis is that you either have consultants who read books about risk but never operationally managed cybersecurity (and they provide "high level" risks which as useless without the "low level" part), or tech people who understand their part very well and see it as the most important. Having a very good CISO is what helps.
This CISO should also have politico-socialo-whatever leverage to make things happen. Put them in a position where their words are not the words of god and you fail immediately.
A large company is absolutely not homogeneous - as opposed to what reports will state. There is usually a core that is well known, and then 10 or 100 tentacles of semi-controlled systems where bad things happen. This blindness to the reality of the company is what hits the hardest.
How to manage a complex system is not for a HN comment, this requires time, resources and know-how. And leverage.
Not really, and I kinda envy you that you haven't really worked up close with compliance-related people.
A lot of compliance is basically corruption - while in country A, you might fall out of a window if you don't buy from the right people at 10x prices, but in 'civilized' country B, you have to buy from vendor X (who has the necessary paperwork), at 10x prices, or you wont be able to sell the product - and there are a million ways that they can turn the levers to kick you out of their markets, or at least make you pay protection money to these compliance organizations.
The systems of grift are very sophisticated, and very obvious to anyone but the people perpetuating and participating in them. As they say,iyt is difficult to get a man to understand something, when his salary depends upon his not understanding it.
A lot of compliance software is griftware - Sonarqube is a prime example - most engineers don't think it adds value, and the 'analysis' it produces is incredibly shoddy, but like a lot of cybersecurity products, it relies on a authoritarian company culture, certification TP conditional on using the software and achieving a good score etc and alarmist language with nice dashboards. A classic example, is it tags public fields in Java as a security issue. And then the management see that you are writing 'insecure code'.
And literal mouthbreathing idiots in upper management eat this shit up, or use it as a punitive measure against the devs who by their very nature do all the meaningful work.
I'm not saying all compliance is worthless, but if you approach quality from first principles, a 'compliant' product usually has to clear a very low bar of quality. And compliance usually keeps the quality low, and prices high, by forcing potential competitors out of the market.
And compliance can keep quality low in other ways, I've seen firsthand - by making devs work on BS tasks, or preventing improvements and fixes to codebases, because they're not tracked appropriately by whatever change management system.
I was incredibly wary of doing hacky solutions in these places, not out of a sense of commitment to quality, but the fact that once management sees your hacks WORK (kinda), all requests to clean up the garbage will be stonewalled.
Thankfully LLMs make this busywork very easy, through making this papermill garbage, and nitpicking busywork very easy, which I feel will bring at least some positive change in the world (at least to those who do meaningful work)
Sonarqube did not flag public fields as a security issue by default the last time I used it — however it has found several real vulnerabilities for me before.
It did by default for me, and there are a bunch of other poorly implemented analyses, such as it incorrectly flagging Dictionary keys in C# as mutable, or opinionated stuff like it disliking certain names and patterns, forcing me to make arbitrary changes that often cost performance, readability or API cleanliness.
Or insane stuff like it doing a blanket-ban on security related code in the app (but importing a third party lib that does the same is fine).
The analyses in general are low quality and you can see not a lot of effort or thought went into them.
They are not the product - compliance, and dashboards for boomers is.
I'm curious about what did it detect for you? In my experience it stops very obvious bad patterns like using string manipulation to submit SQL (which in certain circumstances might even be fine, even necessary), but it can't really trace non-obvious security issues (like tracing a value through the code, making sure its valid on every codepath), it just doesn't have the compiler machinery to do that.
> certification TP conditional on using the software
You’re saying auditors are requiring you to use specific software, or something like that? Sounds like your company picked bad auditors. Compliance auditors don’t normally mandate things like that.
A compliance auditor’s job is to ensure processes meet compliance requirements, not dictate specific tools.
- the compliance process that makes sure the company members at all level follow the requirements.
Yes, in many topics, particularly in IT, there's no good requirements being enforced, because the people suggesting them are mostly grifters. But that's not a problem with compliance proper, it's simply a garbage in garbage out process.
> the box checking is here so that the dude who checked the box become legally responsible for what's happening if they haven't done what they said they did.
Maybe so, but how often are small companies actually sued for compliance survey misrepresentations? My most positive look at such surveys, after filtering out all the nonsense, is sometimes they flag something we've missed in our self-directed efforts.
Okay, so who are we supposed to go to for SOC 2 compliance now if any number of the compliance automation companies might be charging 5 figures to do it fradulently?
Pay to play and keep selling. Understand the liabilities and cover your ass, address the biggest risks.
The point of SOC2 is really demonstrate that you have controls. The other fake compliance areas are scarier for sure. You used to see really blatant issues — I recall early SaaS companies pitching to my enterprise with sales engineers showing me customer data.
Microsoft refused to provide diagrams to the Feds detailing how Azure works. They got the FedRAMP High stamp anyway, because they already sold it to half the Fed. That’s more real… as a situation where a Chinese hacker could compromise data in a dedicated “government cloud” by compromising a certificate in an onprem dev environment should be impossible… yet it happened.
If you want to do it right, hire a CPA who takes it seriously and spend the time to complete it in-house and fully understand it. Then engage one of the big 4 to sign off on it. The big 4 don’t offer much for SOC2 above what Delve does, it’s all smoke and mirrors unless you personally take it seriously.
Last time I went through SOC 2 we talked to our auditor about this. His view was that there are and basically always have been auditors/companies that will sign off on anything without verifying it if you're paying them. The rest of the industry knows who they are though. If you are taking things seriously and hire an auditor who does, that's one of the things that they look at when you're reviewing the reports from the services/subprocessors that you use. Ie, you can get a SOC 2 that doesn't mean anything but then any of your customers who know/care will flag it and it won't be worth anything.
> But what do you do when the enterprise you are selling to asks you to show that pen-test report (which you never did despite paying for it, because Delve told you a pentest-tools.com vulnerability scan sufficed)? When they ask for your most recent risk assessment, do you just screenshot Delve’s pre-fabricated assessment and pray nobody will pay attention?
> It was that point where the realization sank in. We knew we messed up. We were unable to answer most questions honestly without jeopardizing the deals we were trying to land. We scrambled to get things done the proper way outside of Delve, in an effort to pretend to know what we were doing, but it ended up simply being too much work to get done quickly enough to save things.
I had a client in the compliance space - they handle detailed product information for Apple, Boeing, BAE systems, Philips, Siemens - you know, nothing important, just literally classified material and incredibly sensitive corporate material.
Anyway. We did ISO27001. We did it well, audited by Lloyds register, reputable stuff all the way down. Built actual meaningful processes.
Anyway, a massive PE entity bought them in a hostile takeover, fired everybody, binned the ISMS, moved to some “compliance” goons.
I saw the box ticking chicanery as it happened - as after firing everyone they of course didn’t follow the off boarding process, so I retained full access to their JIRA. I only lost access a year later when atlassian terminated the account for non-payment.
Not that I want you to, I feel it would open you up to libel exposure. But can we both acknowledge that you didn’t name the entity that coasted through their audit?
That's the case until there is the threat of discovery. The real issue is if the PE firm bought the company for the value of the IP and any damages awarded was included in the 'cost of business', which is why liability needs to be extended to those persons who make that decision, not just the corporate entity.
In practice the only liability you might wind up with is whether you technically met the conditions for checking the box (instead of just checking falsely). But the liability for the overall consequences of not doing the actual job the checklist sets out to do tends to stay where it is.
These days, nobody cares about legal liability, which is the likelihood of losing a lawsuit if there's a lawsuit, either. They only care about actual lawsuits against their company. They have noticed they're pretty rare and if the company's going to go under it's going to go under anyway, so might as well take the extra profits from not worrying about it
If someone checked one box, and the company goes under because of a lawsuit linked to not doing what this box said, then the individual who checked that box becomes personally liable of the damages done to the shareholders asset (the value of the company).
You don't want to be in this position, really. And that's the whole point of compliance.
Maybe. If their boss told them to do it and their boss is the CEO, probably not. It's on the prosecutor to prove the individual employee committed a crime worthy of piercing the corporate veil.
I was asked to work for my employer as an responsible electrical engineer — a specific legal role that needs to be filled if your bosses don't want the liability buck to stop with them.
They fell in the same trap as you did now. You can try to make the libility tree complicated, but in the end the buck will stop with the person in charge unless they put things in place they have to legally put in place. Liability is like water, you can shift it around, but it always has to go somewhere. And if you don't know where it is as a boss, it is likely eating away at your foundation.
In my case they hoped I could just be the responsible electrical engineer on paper and a solve them of their liability. Then I explained them that I could do that, but that legally they would still liable until they provide that role with the time/resources/personal needed to do the job. In my case that would have meant dropping everything I did in my existing roles and reallocating 80% of my work time to that role.
In the end they decided to use an external company that covers that role for real. To them it was just a checkbox in the beginning, but only because they had no expertise in the legal dimension of the whole thing. And sure they could potentially have gone for years without problems, but one wrong electrical fire and they are in jail.
Under GDPR the potential liability we are talking about is 10 Million Euros or 2% of global annual turnover, whichever is higher. But yeah, go ahead, check your boxes.
The analysis here is excellent. However, Groq's success was not obvious or straight forward. It require huge amounts of investment to keep it alive for many years long before any real positive cashflow. It was on its death bed for years before the ChatGPT moment in 2023. It has been over 9 years since its founding. If you know anything about VC funds and exit timelines, you will know that investors in Groq needed an exit by this time.
I'm happy that the investors and founders got a long and well deserved exit. I'm happy that the tech here will continue to see development and investment under Nvidia so we may one day get to use Claude Opus at 500 tokens per second.
Does it suck that certain employees got screwed over? Yes. Does this happen ALL THE TIME in startups? More often than you think. The expected value for employee options for this type of company is very very close to zero. Anyone who thinks otherwise is lying to themselves.
Does it suck that it didn't happen via a normal M&A process? As someone who used to work on tech M&As as an attorney, I would be first one to say that I hope this DOES become the norm. M&A sucks for the employees, the investors, the founders, the acquirers - it sucks for EVERYONE. The only people who it doesn't suck for are the lawyers and bankers who earn more fees the more complex and longer the process is. Best M&A I ever witnessed was the FB acquisition of Instagram that happened over the weekend (my old law firm was part of that deal).
Ask yourself: do you want to spend 2% of your funding round and 2 months on lawyers when you raise a $5m Series A? Then why do you want to do the same when you exit?
Most of the advice here focuses on Claude Code. Since your use case revolves around a very specific frameworks and refactoring workflow, my advice is to use AI tooling that will allow you to experiment with other models.
Opus 4.5 is my fav it simply can't be the best for every use case. My advice is to use cursor and switch between the various SOTA models to see which one serves your use case the best.
I'm not sure if you can also build something using AI that will help you automatically determine if the outputted component matches the Storybook story. That would be the first thing i try.
"Couldn’t we develop technology in a way that serves the human interest in having labor be a good part of life?"
You can go farm rice or wheat by hand - is that a good part of life?
You can ride a horse to go to work - is that a good part of life?
You can use an abacus to do your accounting - is that a good part of life?
We don't want to go back to these things because we simply grew up in a world where were no longer values those activities as 'work'. We valued other things like memorizing ailments and legal doctrine, like typing computer code out one character at a time.
I think this argument about technology removing the joy of work hides the fact that technology has no interest in your joy for your work. It only has interest in the economic value of that work. You can continue to do the same work for joy - the only difference is you can no longer derive economic value from it. Basically if you enjoy being a translator that's great but maybe you will only be able to somehow do it as a hobby. And of course that's deeply unsatisfying for us because humans want to feel needed and useful. But this 'useful work' requires two parties - not just the one doing the work but the one needing the work. By focusing on the needs of the producer, we miss the needs of the buyer who would rather buy the service from a machine. The loss of the producer is the gain of the buyer who can now spend less on the good and buy more of everything else.
Of course we still have classical musicians despite there being Spotify because there will be a niche for them. And so there will always be a niche certain people doing artisanal stuff. And you can always do whatever you want as a hobby. Technology and capitalism doesn't prevent that. It just serves the interests of the buyers as well as the interests of the producers.
A "nanny state" is a government that stops YOU from doing something (which Australia does a lot by Western standards). But what you're describing is market regulation.
This is not the lament of the code getting worse (it's not) but the coders losing the knowledge of how to do it by hand without LLMs. If people really wanted to learn how to do things by hand, they can. In fact the AI is probably going to be infinitely more patient and knowledgable than any senior dev if you really wanna do this by hand. Just turn off the AI's ability to modify the code and just have it give you advice on the side.
The reason why nobody does that anymore is because most engineers work for capitalists not artists. It's the same reason I don't know how to farm my own food or make my own clothes like my ancestors did. Most people do programming because it's a job - not because it's an artistic passion. And that's OK.