Ai-Drafted

This issue covers three weeks, not one. Archivore’s capture pipeline sat idle from Sep 23 to Oct 11 — a scheduling gap, now fixed — so this catches up on everything that piled up behind it. Fifteen picks below: Git’s coming break with its own past, three separate corrections to AI-industry hype, a surveillance fight in Missouri, and a wooden typewriter that, against its own warning label, actually types. Looking forward to Git 2.56 – and 3.0 — Git’s next release carries routine fixes; the one after, likely 3.0, breaks the project’s defaults for the first time in two decades: SHA-256 hashes instead of SHA-1, reftables instead of flat ref files, mandatory Rust in the build. GitHub still can’t read SHA-256 repositories, which is the real reason the switch has waited this long. Read this before you upgrade blind if you maintain scripts or submodules that assume SHA-1. Discuss → ...

Prompted by an HN thread: Docker Agent Docker Agent, a YAML-driven runtime for teams of AI agents, drew 304 points and 145 comments on Hacker News, most of them sceptical. Commenters doubted that another orchestration framework was needed. Their better point was that wiring agents together is the easy part. Keeping them coherent over long runs, proving their work is finished, coordinating several at once and limiting the damage they can do are harder, and the thread offered a technique for each. ...

Prompted by an HN thread: Bend 2 and the Vibe-Coding Trap A widely-shared teardown argued that Bend, a language pitched for the AI-coding era, was built by someone who didn’t know the field of formal verification existed — proof being that the term appears nowhere on Bend’s site, and that its demo needs 442 lines of proof to establish a two-line game rule. Bend’s actual creator showed up in the comments with a rebuttal the critique hadn’t checked for: he’d built a formal-verification language himself, back in 2018. ...

Fifteen things worth your time from the past week, pulled out of whatever archivore caught me reading. A quieter week for big model releases, a heavier one for people arguing about who’s stealing from whom. I don’t like passkeys — Ethan Hawksley argues passkeys solve the wrong threat model for an individual. They kill phishing, but do nothing about the risk that actually ends most people’s accounts: losing the one device they’re bound to. Hardware keys cap out at 25–300 accounts each; synced passkeys tie your whole identity to Apple or Google, so one account ban costs you everything at once. Discuss → ...

Prompted by an HN thread: Qwen 3.8 Omni Flash New AI models ship every week, and testing each one is not worth the time it takes. That is the real lesson in a Hacker News thread that started out about announcing Qwen 3.8 Omni Flash: pick a model that works, keep it, and switch only when it actually fails or the bill spikes. Most Comparison Shopping Is Optional One commenter, Systemerror7A69, described a simple rule: pick a cheap model, such as GLM-5.3 Flash, and use it. Improve the prompt or the surrounding tooling before blaming the model. Switch only if it fails the task outright or the bill becomes a problem. Another commenter, epolanski, has run Gemini Flash 2.0 for summarisation and translation with no urge to upgrade: “this chase of the latest LLM is a bit pointless” once something works. A third, bmordue, gave the pattern a name: satisficing instead of optimising. ...

Prompted by an HN thread: The Local LLM Ecosystem Doesn’t Need Ollama Ollama is built on llama.cpp. For more than 400 days it ignored a GitHub issue asking it to say so. That’s the headline complaint in a recent Hacker News thread — but the more useful finding, buried underneath, is that llama.cpp no longer needs a wrapper at all. On a Mac it’s now the simpler choice, not the harder one. ...

Every developer has a ~/dev/tools/scripts folder. Mine has run for years without an index. I asked Claude Code to read every file in it and write one. The brief was simple: read the whole directory, then produce an INDEX.md with three columns — tool, how to run it, what it does. It scanned roughly 40 files: Python CLIs built on uv, shell wrappers, one-off Snowflake key-rotation scripts, a tmux session launcher, a Hacker News summarizer. Some had docstrings. Several had none, and their purpose was recoverable only by reading the argparse block or the hardcoded constants at the top. ...

Most developers have a graveyard of dotfiles, .env files, and Slack DMs containing tokens that were supposed to be temporary. This post describes the pattern I use to keep all local dev secrets in a password manager and inject them into my shell on demand — nothing sensitive ever touches disk. The full setup lives in my dot-local repo on GitHub, including the helper functions and new-machine setup guide. The Problem I work across multiple machines: a work Mac that uses 1Password and a personal Mac that uses Bitwarden. I needed a single pattern that worked on both without maintaining two separate codebases or hardcoding tool-specific logic everywhere. ...