Unlike the more common postinstall-hook supply-chain pattern, this campaign executes at module-load (import/require) time. When any consuming build or application imports a poisoned package, the injected block runs immediately. Because the trigger is an import rather than an install script, the common npm install –ignore-scripts mitigation does not neutralize it.

[–] 2 points 5 months ago (2 children)

I try to stay well read on AI, and I regularly use Claude, but I'm not so convinced by this article. It makes no mention of the bubble that could burst. As for the models improving aren't the improvements slowing down?

More importantly, the long term effects of using AI are still unknown, so that for reason the adoption trajectory could be subject to change.

The other factor to consider is that the author of this article is a big investor in AI. It's in his interest to generate more hyperbole around it. I have no doubt that generative AI will forever change coding, but but I have my skepticism about other areas, especially considering the expensive controversy of Deloitte using AI to write reports for the Australian government.

  • source
  • [–] [S] 1 point 5 months ago

    I find articles like this about agentic engineering both compelling and anxiety inducing. It's staggering what people are achieving with agents toiling away in the background. However, it also leaves me feeling insecure, as I have many ideas that I would love to build, and previously my excuse was a lack of time, and now I worry I have no excuse when an agent could potentially build it whilst I sleep.

  • source
  • [–] [S] 6 points 5 months ago (1 child)

    What I'm saying is the post is broadly about programming, and how that has changed over the decades, so I posted it in the community I thought was most appropriate.

    If you're arguing that articles posted in this community can't discuss AI and its impact on programming, then that's something you'll need to take up with the moderators.

  • source
  • parent
  • context
  • [–] [S] 14 points 5 months ago (5 children)

    In fact, this garbage blogspam should go on the AI coding community that was made specifically because the subscribers of the programming community didn't want it here.

    This article may mention AI coding but I made a very considered decision to post it in here because the primary focus is the author's relationship to programming, and hence worth sharing with the wider programming community.

    Considering how many people have voted this up, I would take that as a sign I posted it in the appropriate community. If you don't feel this post is appropriate in this community, I'm happy to discuss that.

  • source
  • parent
  • context
  • [–] [S] 6 points 5 months ago (5 children)

    Regardless of what the author says about AI, they are bang on with this point:

    You have the truth (your code), and then you have a human-written description of that truth (your docs). Every time you update the code, someone has to remember to update the description. They won't. Not because they're lazy, but because they're shipping features, fixing bugs, responding to incidents. Documentation updates don't page anyone at 3am.

    A previous project I worked on we had a manually maintained Swagger document, which was the source of truth for the API, and kept in sync with the code. However no one kept it in sync, except for when I reminded them to do so.

    Based on that and other past experiences, I think it's easier for the code to be the source of truth, and use that to generate your API documentation.

  • source
  • [–] [S] 9 points 5 months ago (12 children)

    There is much debate about whether the use em-dash is a reliable signal for AI generated content.

    It would be more effective to compare this post with the author's posts before gen AI, and see if there has been a change in writing style.

  • source
  • parent
  • context
  • view more: ‹ prev next ›