I Don't Think The World Needs Github.

In their article “I don’t think the world needs a new GitHub”: What GitHub’s leaders really think about their new rivals on The New Stack the author is privy to a little spat between two platforms who I just kinda hate. In the long winded treatises these guys give at their talks they go over how "agents are changing the way we build" and "we've added a gorillion gooberbytes and gublion eebeeflops to our compute infrastructure" and it's still not enough to maintain consistent 9s.

Now I know it's a bit unfair to point at the globogigacorp platform and their trillions of serves a month and say "wow seriously 98% uptime?" They are serving many orders of magnitude more individuals than I ever will, so sure. You got me. They are doing a pretty bang up job being pointless and adding to the electrical costs of Northwestern Wisconsin.

But recognize that there really isn't a fundamental need for a platform to host every single repository of code on the planet. I've made it plain that you can read my open source code at my own source forge. I don't have to serve gigglebytes of funnyflops every day because my scope is tiny and my system requirements are small. I can provide very simple read and fork optionality for users, host the systems I want to host, provide them through package providers like Packagist for versioned composer serving, and all for the miniscule cost of my own VPS.

Git is an open source algorithm that is simple to install and simple to run. Ubuntu is an open source hosting operating system that you can very quickly provision and run, even without LLMs or particular devops knowledge. There are some basic security considerations and server management tooling you may want to figure out before you do your own hosting, but why would you allow for the goobercompany9000 to serve your source code? So you can attach to their half-cocked social media system and LARP as a software dev making commits to side projects that you use to impress some HR recruiter?

Or are you interested in actually owning your work? I have projects hosted somewhere on Github. I've contributed to open source and closed source projects on Github. But there really isn't any reason for me or anyone to use these goofy, centralized platforms that can barely maintain their infrastructure under the sheer volume of slop being dumped into their ever-expanding data centers.

Hats off to the guys in the trenches solving the problems, I just think HTTP and a small server is plenty for the vast majority of projects. If the problem is discovery then github operates as a useful central platform you can mirror your code to, but I would not trust them to be your only source control.

Don't even start with me on Entire. It's all just silly.

On Personal Data Tracking

I've encountered a problem at work where I spend a large percentage of my day reviewing code. There isn't a great way to say definitively "I spend hours reviewing the team's work" because what? I'm just gonna write down that I reviewed code for 3 hours? Who's gonna buy that?

So, using Lcaude Code's new modding plugin system, I built a tool for myself. It hooks up to bitbucket, pulls the PR's branch into a worktree for us, and displays the hunks so I can review the work. Importantly, through the mod hooks, I can tie a time tracking system to the mod, so I know specifically how long I spent reviewing a PR.

It was important to me that I actually use it, so one of my requirements was that I wanted to be able to ask questions about code and get sophisticated answers against my own backlog of work, experience, and notes. So when I escape focus back from the pane into the cc session it draws the previous 15 hunks into context for the model, so we share context and I can immediately ask questions and learn what code does. It's very, very nice ux.

And it does, in fact, turn out that I spend 3 hours a day doing code review. Maybe this can make me faster, who knows, it's very fun toying with the mod ecosystem. I can do a LOT of neat things with it.

A fun detail about this is my new data capture process. I'm learning things about my workflow here, which I may want for research purposes and learning, so I store these records into a local sqlite3 database. Realizing this, I thought maybe there were other useful things to track, so now I'm doing personal timekeeping and monitoring using a haiku model to annotate my day. I can then look back on my behavior and see what I did in detail, and have sonnet write up a weekly review for myself.

Borderline dystopian if I think about it. Better yet is I can feed email, chat messages, meeting minutes and timestamps into this in order to detail out who is pinging me, why, when, and how it effects project work.

I built my own panopticon. I'm, uhh, still not totally sure what to do about it, but if the NSA is doing it to me then why shouldn't I also have these records? It is my (company's) data after all!

Anyway, point is that it was easy to do this and I have a true personal reconnaisance system for myself. Pandora opened the box, I'm just taking a peek inside, I guess.

Brief Security Outage

PHP recently had a Major Security CVE that they issued a patch for today, during which there was a brief interim where the vulnerability was unavailable for patching while the Ubuntu servers loaded the new packages. Thus, I took the site down for the moment while prepping the updates.

Thankfully it's easy enough to run commands. Unfortunately if I were not available it could represent a serious threat to my site were I not able to patch it myself. I may need to figure out a way to build some admin kill switch from my phone or something that kills fpm or something. I am not a fan of the new "we found arbitrary code execution faults in your PHP version" trends that have been occurring.

Wanna just thank the PHP team and maintainers for issuing the patch, providing appropriate notification, and a clear directive for this one. From what I understand attackers could gain fpm worker user access to the command line of the website through an OOM fault before the request ever reached application code. Literally a nightmare. Thank you to the many PHP maintainers and contributors, your work is greatly appreciated.

The Cambrian Explosion (of software)

Early in the days of Earth life was mostly single-celled according to geologists and archaeologists. However, a little over 500 million years ago the geological record explodes with multi-cellular lifeforms. The so called "fossil record" tells us that life on earth exploded at this time, and with it the exploration of new genetic combinations and environmental adaptations that brought about bipedal organisms like men (and chickens).

For reasons I won't get into here I am generally skeptical of claims dating back before ~2000-5000 years before now, so I take these stories with a bit of salt, but I won't let the analogy take over here: we are living through this very same microcosm of explosive life in terms of software!

getartcraft.com has recently cloned the adobe suite in it's entirety, in rust, open source, for free. Not only this, but the whole thing has a launcher, it's fast, and they work well! I don't own microsoft office licenses, and now I don't really need to, and once upon a time I paid adobe a few bucks for photoshop (well, my mom did haha) but man it just isn't great to be trapped into predatory subscription services unless you are an enterprise. Even then!

This is going to become fairly common, and I would argue merely cloning is going to become old hat. Far better to build native tooling for agents to do these than to simply provide a free clone of existing work. "Reverse Engineer Anything" is a powerful idea, and I'm not sure pandora will be too pleased with the contents of this box.

I wonder, too, about the money. This doesn't mean apps suddenly become free, it means the necessity of proprietary services hidden behind HTTP are going to have to become the norm. SaaS doesn't die, it becomes the only way to operate.

Needless to say Yegge was right and competent platforms are still gonna win. The best play is to get out of the way and build a road, not a gate.

What Is Verification?

Proof writing in Mathematics is the closest thing I can think of to formal verification of a claim. The logical machinery written symbolically in a series of steps to arrive at a conclusions is, to me, the purest verification of a claim.

Of course, with it comes a specialized understanding of the symbology and language of mathematics, the precursor claims the proof depends on, and the actual communication of the proof. It's a fairly complicated process, one which is tough to learn, tough to use, and tough to actually review!

However, because it's a formal procedure, we can write software that can mechanically verify a proof! This is 1) fascinating 2) unbelievably powerful.

Because software itself is a form of proof (a declaration of steps to accomplish a goal), we can build and maintain formal verification of these operations. Strictly speaking, this is what a compiler does! Clearly, a compiler doesn't go far enough in verifying behavior, because otherwise we wouldn't have UB or bugs in modern software, but it guarantees compiled code will do what it says it will do.

Beyond compilation, testing can bring us closer by isolating behaviors and guaranteeing behavior when provided with a given criteria for operation. However, this can only guarantee what you think to test! In many ways complex testing requires the full attention of the developer, and even still runs into missed behaviors!

And none of this actually tells you if what you wrote is what is actually being requested! Did you understand the requirements? Did the requester understand their own request? How do you arrive at "finished and correct" when the standards for such are often quite loose?

In my eyes this is the field we as developers need to study and apply our knowledge to. There's always been this form of "last mile" problem plaguing software projects, and it's only getting worse. Unfortunately, this is as far as I've really gotten on the problem, there is a ton of work to do towards solving this.

And I think we may be close!