When you vide-code you don't care about code quality, right?

Personally I review most of the code and I do understand the frustration. I'm leveraging https://orca.virtuslab.com to orchestrate an agent to do the development with a few others to review the code; besides this I also put extra reviewers that focus on specific details/patterns which get launched by Orca.

While this isn't perfect, it is the best approach I have got so far.

Recently I wrote a post about this approach: https://alexitc.com/blog/2026-11-02-trading-speed-for-correc...

> When you vide-code you don't care about code quality, right?

I don't mind compromising on code quality. The part I don't want to compromise on is product quality. So far the two seem pretty closely tied together - like the more unmaintainable code there is, the more you lose track of the big picture and the worse your product gets, with slightly misaligned definitions of the same concept scattered throughout the code/product resulting in an inconsistent UX.

I'm down to have a state where i never have to look at code and worry about it at all. At this point, I think my issue is the fact that we don't have a super clear spec when we begin, since we're "exploring", and by the time the spec becomes more clear, there's too much bad code/product decisions that the agent is taking into context that ruin the results going forward.

I like the way you put it. In particular it seems helpful to let kids make effort and delegate the secondary work to AI.

It makes no sense to do bans when everyone else will grow up with LLMs.

>It makes no sense to do bans when everyone else will grow up with LLMs.

"Everyone else is doing this obviously bad thing to their children, so I might as well do it to my child too!"

> Growing up, games were such a scarce commodity that you'd really suck all the marrow out and spend hours beating your best times, looking for Easter eggs, or messing with custom maps and mods

I can relate to this, today when I play games I do still try to get them 100% complete but new generations do not seem to appreciate that. I see that they complete the game with minimal hours and move on to the next one.

My main relaxation hobby has always been video games.

I finally, about 10 years ago, made the conscientious decision that I didn't need to finish a game if I wasn't enjoying it, when before I'd always just pushed through no matter what. Mainly that there's more good games being made than I'll ever have the time to play, whereas when I was younger it was more the opposite.

I probably spent 18 months almost exclusively on Quake2, with the multiplayer mod scene.

I have to say that this is amazing, a while ago I have tried making web games through AI but the capabilities were enough for simple games but failed for multi-level. Getting something like this with all images+audio is something I wasn't aware that could be doable in one shot.

I definitely need to try this.

> https://www.foldableflight.com/planes/mystic

For half of the video I was thinking this was the airplane I learned to do in my childhood but later on I saw the nice final tweaks, its very nice given the time you put.

An opensource personal expense tracker, I was a happy user from an offline expense tracker which wiped my data when playstore decided auto-updating it,

I'm at the point where I'm finally actively using it to register my activity, it is straightforward to register tickets by sending them to a telegram bot, then, reconcile those by uploading my bank statement.

I'm trying to get the lowest possible usage friction so that I keep using it.

So far the better built pieces related to the data ingestion. Once this is good enough I'll build reports + anything coming to my head as a useful piece.

I'm leveraging AWS textract + bedrock + bda to parse bank statements. I expected this would have been easier but it is still a very complex problem which had required me to put many iterations (so far it works nicely with my own statements)

For ticket parsing, AWS textract + parsing rules has been enough.

I wrote a bit more on my blog https://alexitc.com/blog/2026-10-16-opensourcing-my-expense-...

Repo at https://github.com/AlexITC/expense-tracker/

It happens to me that I keep skipping certain song but no matter what, it gets again into autoplay.

I’m having that problem, right now, with AppleTV.

The new Korean monster movie, Hope, keeps getting jammed into my watchlist, and I can’t remove it.

I don’t want to watch it, and I’ll bet that watching it, won’t make it go away.

Maybe Bono invested into it…

If you long-press on it and choose View/Goto Episode/Show, are there any third-party apps listed as a way to watch it? If so, and you’re using any of those apps, then check each of their in-app wishlists for it as well; it’s possible that (unlike Netflix) they’re actually well integrated enough into the TV app to cause this. If not, in total seriousness, you could open an Apple Support case that might result in them asking permission to reset your watchlist database records cloud-side.

(None of this excuses the annoyance but I loathe leaving something untriaged when it’s a matter of seconds for the dice roll of helping.)

Nope. Doesn't work. It's a zombie. I have watched other movies like it, in the past, and I might watch it in the future, but I don't want to pirate it, and I don't want to pay $25 to watch it now.

Those of us that were Apple users, back when, may remember a certain forced "gift" of a U2 album...

One that was forced on something like one billion people, rather than just one, yeah.

There was a case a few months ago where the App Store was forcing an app reinstall into people’s phones even after they’d deleted it years prior, which I assume ended up being a server-side bug (perhaps a database shard had a defect?) since so few, relatively speaking, were affected.

I had to escalate to a cloud data repair through their support to unbreak my own database entries re: a different service. It took several weeks but it eventually got resolved.

From my social circles I hear many people claiming how amazing are google ads and amazon/youtube recommendations. Which I have never understood, none of the online websites I use tend display anything relevant to me, when they do I bet its kind of random.

When I'm looking to purchase an item, it would be nice to get relevant ads for the kind of specs I'm looking for but like the blogger said, why do I care about getting ads for something I just purchased?

I have saw companies doing social engineering as part of their intrution testing, I imagine fake interviews are (or will become) part of these.

I think it will remain uncommon. I agree it would be a good test, but companies and employees alike get very angry when pentesting gets too close to sensitive subjects.

Anyone who fell for it would not only get in trouble for poor security practice, they would reveal that they were job searching. That opens an entire can of worms that creates problems beyond the pentest. This also angers other employees who see it as a double-trap being sprung on employees.

Another major problem is that responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters. Responsible testers will immediately abort, but some will try to use the personal laptop to pivot deeper which is a huge ick. It’s also really bad if the company is compromising personal laptops of people who are doing the right thing (switching to personal gear for interviews).

The pentesters wouldn't have to actually pwn a laptop, just getting the employee to download and run anything could go in a report without having the file actually be malicious.

Would they have legal right to do that, out of curiosity?

Hired oentest has company permission to do stuff on company property. I do not imagine they have right to do so to personal property.

Absolutely not. There is literally no framework, which would give you the right to exploit an employee’s personal laptop, that’s just cyber crime.

Then that is something the pentesters cannot do, but malicious actors will do.

Game over.

What pentesters can do, should do, and often do is simply start the test from a workstation that is given to them - you assume a successful social engineering attack as the starting point, and test whether your process and technical controls can properly limit the impact of such a compromise without trying to replicate the actual social engineering step and the associated disruption to the targeted employees.

Taking over that first engineer's workstation shouldn't ever have resulted in $6.3B of damages. I would consider it reasonable if those privileges could be abused (by e.g. the same engineer intentionally) to cause $6.3M of damages and the rest would be mitigated or prevented; so for this incident we could say that 0.1% of the impact was caused by the initial compromise of that workstation and 99.9% of the losses were caused by all the other failures - so it's effective for any pentest to focus on the latter part, ignore the social engineering and phishing part (since you can't really eliminate it anyway - unlike many other flaws) and assume initial compromise as a starting point.

Pen testers generally won’t physically assault your employees, bring guns and wave them around or shoot people, or kidnap their family members and torture them until they do what they want. What’s your point? Nothing.

I think my security form said something along the lines of “using personal laptops to access company resources grants implicit permission for my company to audit my laptop.” It goes on to explain that if you don’t agree to it, simply use the company device only.

Compromising employee personal devices is strictly out of scope for any security testing I've seen.

> Though I agree that pentesters going after personal devices is ethically dubious.

It's not just ethically dubious. It crosses a lot of legal boundaries. A company can consent to have their personal devices hacked. An employee doesn't automatically consent to let a company's contractors access their personal devices.

fake interviews might be excessive but lots of companies send tempting phishing emails as part of the secops, then both collect org-level stats and educate (or shame depending on your take) the employee for getting duped.

Companies don't try to set up job interviews to test their employees loyalty?

Everyone has their price. It is foolish to think that most people would not leave for better title/pay/job alignment/whatever.

Well also to test that they don't just casually drop corporate secrets...

Sometimes called "Full Spectrum Attack Simulation" where initial entry can include physical access or spear phishing. They can span months in elapsed time (not effort) so as to be more realistic. However there are still ethical and safety constraints and even phishing may not be able to use the (effective) technique of stressing the recipient too much or of course blackmail or coercing. So I think fake interviews may not be allowed in many cases, to protect the employees.

Is that even legal? Wouldn’t a fake job interview be, in a sense, tricking you into taking time off and working without pay?

I think it would be legal but unethical -- unless you also then gave the employee substantial compensation for their time and opportunity cost.

Legality would be very jurisdiction dependent. It might be illegal in most developed Western countries, depending on the exact facts of the case. I suspect it wouldn't be illegal in China — unless the trick happened to hit a ranking Communist Party member.

And you never, ever, ever install software as part of the interview. Decline and hang up if they're asking you to install stuff. Visiting websites - maybe but even that unless it's a well known website I wouldn't go there but download and install stuff, hells no

I fully agree with this.

If you ever meet with Alibaba for any reason they'll ask you to download their conference software. Unfortunately most people in the China ecosystem don't have the guts to say no and will just gleefully install any .exe thrown at them.

Hmm like building an node project, actually any project can have a dependency on a made up libraries that does the exploitation or even the project itself as made infamous by chrome extensions

"fork this repo and fix this bug" is a common job interview request, isn't it?

For many build chains, that involves implicitly installing software.

Such toolchains are dumpster fires whose use invites supply chain attacks. They should never have gained mainstream acceptance and should never be run outside of a sandbox.

That said I wouldn't trust a compiler to be hardened against malicious input and anyway you presumably need to run the output so all of that should be happening in a hardened sandbox regardless.

It'll be hard to time a job opening receiving interviews to line up with intrusion tests in a way that people would not be on guard against it in a way not normal.

Fake interviews would be a huge time sink and probably piss off your staff.

They don't have to respond. It gives employers an even stronger signal they should be kept right?

Using pentesting to also test employee loyalty is a great way to get the entire company to hate working there.

Which is why it's going to happen.

Only if your manager is an incompetent moron.

Which is also why we, collectively, as an industry needs to not put up with that. It's easy for me to say from the comfort of it not being my job on the line, that if this happens to anybody they should quit and then name and shame the company, but a competent security team is going to have the idea of doing a fake phishing interview and then not do it because of how morale destroying that would be. The security awareness team sending fake phishing emails are embarrassing enough.

This!

I don't know how people are ok using their personal accounts on work-laptops full of spyware.

I've worked for a couple companies whose stance on me having a linux work laptop was "fine, but you have to support yourself".

So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.

I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.

When I work at companies that have MDM set up on my computer, I don't do that.