Notes

“AI can’t count the e’s in seventeen” keeps doing the rounds as proof AI is dumb.

All it proves is that most people don’t know how they work.

A model doesn’t read letters. Text is chopped into tokens, chunks that are often whole words, and each token becomes a vector: a list of numbers placing it in a space where similar meanings sit close together.

So the model knows “seventeen” belongs with “sixteen” and “eighteen”. It just doesn’t get a look at the letters inside.

Ask it to count e’s and you’re testing the one thing it can barely see.

Give the same model a way to run code and it’ll knock up a three-line script and get it right every time.

If all you’ve tried is a chat box with limited tools, you’ve only seen the model in a cage.

No character means as much to me as Jean-Luc Picard. I realised quite young that religion didn’t work for me, and Picard became my moral compass. Thank you, Sir Patrick, for bringing him to life for me and so many others, and for always respecting what he meant to us.

Worth it for the glowing apple icon. So glad that's back! Shame there's no FaceID, 5G, or an all-around folding display ("tablet mode"). That said, the current design is pretty great, looks like it's been trimmed a bit but otherwise largely the same. That's a good thing. #MacBookPro #Apple

Easy to point and laugh at PHP last week.

But the real lesson isn't about PHP. The same week:

• A bug in the Brotli compression library meant urgent patches for Node.js, Python, Bun and Envoy
• Ruby shipped fixes for regex bugs that GitLab found could be turned into remote code execution
• A poisoned LiteLLM release turned up on PyPI
• Browsers blocked eight eMudhra certificate authorities after their private keys were compromised

Whatever your stack, at some point a serious vulnerability will turn up in something you depend on. It's all but inevitable. Amazon spotted attackers trying the PHP bug four days before the fix was public.

Security moves fast now. Taking precautions still matters, but it's just as critical that you can roll out a fix the moment one drops. That means keeping an eye on dependency updates, staying on the latest versions of your libraries, CI that actually works, tests you trust, and deploys that stay boring even when your site is under load.

I'd argue you should always have had these in place. Now they're a must-have.

Sometimes I worry my AI chat history will one day be used as evidence of exactly how dumb I really am.

Wearing glasses as a disguise only gets you so far.

Disappointing to see Withings charging new users $99 a year just to sync their scale with Apple Health. It's your data. Withings should see its job as getting it wherever you want it to go, not as something to charge a toll on.

As someone who builds on their API for Weighted Down, I hope they rethink this. https://weighteddown.co.uk

There's a good Ask HN thread going: "What is the current trajectory of a senior engineer?" People are split. Some think we all become tech leads directing agents, some think the human value moves to testing, observability and building consensus, and a few think we're turkeys voting for Christmas. Here's roughly what I added.

I've been doing more fractional work lately, and the outreach has shifted. More organisations with almost no internal development knowledge are realising the limits of what they've been building and wanting an expert look at it. There's going to be plenty of that work.

The bigger question is how we upskill people if they're not going through the learning process we did. That problem already exists. Plenty of people have "senior" in their title with shallow expertise, because most of their career was picking up tickets with acceptance criteria handed to them. I'm not talking about the best of the best here. I'm talking about the other 90%.

Inside organisations, there's still a lot of room for the very human back-and-forth on what you're actually building, and for navigating politics and org structures. What excites me is the appetite to build. Companies that couldn't imagine owning their own stack now want to. They're about to learn the ups and downs of that for the first time, and there's plenty of opportunity for us all there, too.

Opus 5.5 and Sonnet 5.5 are sea change level models. Between the increased capability and reduced cost, these things are absolutely insane.

Last weekend, I wanted a project to build while I was out of the house that could really put them through their paces (and didn't seem like my day job). So, for the first time in my life, I asked my computer to build me a game. In fact, the next day, with some tweaks I asked it again. Fair to say I'm absolutely blown away.

I know AI is meant to be the death of creativity, but I think that's nonsense. I can only imagine how fun and creative I would have been if I had access to these when I was a teenager and had all that free time. Now, it's nearly as easy to build a game—your own very specific game—as it is to play one.

If you're spending as much time as me copying screenshots into AI agents and then awkwardly trying to describe your feedback... I've built a free Mac app to help.

https://apps.apple.com/app/shot-and-tell/id6814688859

Handy site here from Cloudflare. I'm not sure you actually need to score 100 on this, but it'll be useful to run through for StayUpfront.

StayUpfront is now open, so here's a snazzy new promo video.

All new signups start with a 14 day free trial stayupfront.com

No team ever shipped faster by keeping its options open. And the cost of being wrong has never been lower — most technical calls are cheaper to make, and cheaper to undo, than they've ever been.

The expensive thing isn't picking wrong, it's the months spent not picking at all. A team that keeps reopening the same argument has no momentum to lose, because it never built any.

Pick a direction, get everyone building, and change your mind when there's a real reason to.

I may be a certified Claude-fanboi, but Anthropic sure do make it hard to love them. Rather than a request they can deny, this should be a simple toggle switch on their platform settings.

Bluesky took a 24-hour DDoS in April, came back with no data loss and a straight account of what happened. That's not a feature, it's a trust signal — and the hardest thing for a rival to copy. Nobody churns over a nicer composer. They churn because you went dark and got cagey.