When we put together this fall update, we were surprised by how much we have done this year.
I wanted to quickly call out a new service we are very excited to release, picd: push to deploy on a docker paas. This is a new paas concept we have been iterating on for years. It's a bootstrapped (no vc$) platform as a service, provisioned on our own hardware (no cloud hyperscaler), with a finite number of spots available.
We are going to publish a blog post highlighting picd and our technical design choices, but happy to answer any questions related to it or any other update in this post.
I think AI is an invaluable tool as well. I also think it’s an addicting tool that dramatically changes how we think, some positive, some negative. For example, outsourcing all your thinking to gen ai has already burned colleagues.
This tool, like anything that has addictive engagement loops, need to be used with discipline.
I’m already hearing whispers of corpos reining in ai spend. What happens when your budget goes from 2k/mo to 200 per eng? What happens when that 200/mo cost turns into 500?
There is absolutely no way that becoming addicted to gen ai is good for the individual or the collective ecosystem.
I’m confident we are in a hype cycle and things are going to level out once we fully grasp its limitations and see it as great for knocking out boilerplate and tedious tasks
I find it slightly mad that people are arguing this. Do you maintain a local datacentre for hosting? Do you store all your data locally? If you're a business of any size, the answer is probably not, because it's inefficient for some random company to manage servers. That is not going to suddenly change with LLMs and GPUs.
The option to self-host is what keeps the cloud companies honest.
Unlike commodities, like electricity or utilities, the cloud companies can change the model without telling you. They can gatekeep certain functions - for example, reverse engineering.
The option to self-host will make sure that such sneaky/anti-consumer tactics are not profitable for them.
> If you're a business of any size, the answer is probably not, because it's inefficient for some random company to manage servers.
any size? At work I’ve been told that our own colocations (not data centres, though) cost a few times less than hosting the same amount of resources in the so called “cloud”. Including salaries of sysadmins.
They must be spending some of those hundreds of billions on trying to convince people to do this. Advertising has to work at least a bit until everyone works out whether or not the product is really that tasty. So it's imaginable that we could be in a hype cycle because there's a gigantic economic engine that has an interest in us being in one.
I hope it pops and gets put on a more organic growth path. Locking up sales for RAM and storage more for monopolizing purposes is a sign that they were overcapitalized to the point that they didn't know what to do with the money. Same with building datacenters but taking community utility capacity. The shortcuts that are enabled are insufferable self-harming strategies that aren't that effective for moving adoption forward faster.
"I’m already hearing whispers of corpos reining in ai spend. What happens when your budget goes from 2k/mo to 200 per eng? What happens when that 200/mo cost turns into 500?"
That's interesting. I've also witnessed the reigning in of AI spend. What if the measure of a good developer becomes one who is an effective steward of tokens?
Are all developers going to have to be trusted to manage spend? I find that hard to imagine from our existing managerial system
And not to mention, the interests aren't aligned: a hypothetical engineer will always want to spend the max to impress: I delivered this project solo (and all it took was $2k per day on Galactos Swarm mode v9.9).
And we must, must consider what the most enshittified era of LLM AI will look like. Will they be holding your codebase to ransom? Yeah you can have an improvement but it will cost you. What are you going to do, read the code yourself?
Of course developers should be held responsible for managing costs and other resources. We do it all the time, from infrastructure spending to client-side memory usage.
There's growth phases, where cost doesn't matter as much, sometimes to a seemingly unreasonable degree. And then after that, it really does.
I guess that differentiates us from "real" engineers, who can't make the bridge they're designing cheaper later, they think about it upfront. But we think about it, too.
It was an incredible bull indicator for AI that, like AWS, it lets engineers spend unlimited company money without advance approval.
(we've already had the $2k/month max imposed, although I was nowhere near that it seems that people who have gone fully agent-brained were using a lot more. But not necessarily for more results ...)
I picked this up earlier this year for the first time ever. The first few seasons were very high quality and the programming references didn’t make me wince at all.
It was produced by Christopher Nolan’s brother right?
This is such a conspiratorial mindset. This very forum thread is packed with people providing code and confirmation of working exploits. Leading security organizations have confirmed RCE exploits with video and provided detailed writeups of how the bug works. The PHP maintainers coordinated the release. The government is involved.
I also think people want to check it with a vanilla install, not with "poorly configured servers" etc.
I've seen a bit too much (early on, ive not checked anything in the last 12 hours) saying "exploit confirmed", no one is disputing that, just its efficacy - specially after the hype and vanity sites.
Is the confirmation of a Google subsidiary, coordination from multiple government security agents and the word of the PHP developers not enough for you? Why not? Why is your bar of proof set so high? The downside of not reacting is far worse than the downside of reacting yet you seem to be suggesting under reacting would be superior?
Talk is cheap, yes. Which is why the working exploits from Wiz, Calif and the PHP team were rather more useful than another demand for a private demonstration.
Some people hate AI so much that they start to deny facts that don't suit their narrative. If this had been found by a human being then they wouldn't be contorting themselves to try and deny it exists. Many people feel incredibly threatened by AI. It seems to inversely correlate with competence in my experience.
I think you're correct that people are trying to deny facts. However, I also believe your assertion of their beliefs is inaccurate.
History proves that new technology makes people twitchy in every direction. My anecdotal memory of X-rays is entertaining (we can use them to beam knowledge into brains!) and apocalyptic (X-ray guns will make warfare terrible!).
I have a rule for everything: the information is valid in inverse proportion to its political value. This is a bad exploit, and it happens from time to time. There's also an IPO connected to AI that is very political for many people who threw a lot of money at it.
See, this is the problem with this post. At this point, and in the absence of a public exploit people can play with, it's more fun to do the truther debate about the vulnerability than to assess the situation soberly, and the First Law of Message Boards thus dictates the discussion will be dominated by truther debates.
You are missing the point. The OP is claiming this vulnerability isn't as easy to exploit, and all the examples rely on a chain of unrelated vulnerabilities to show the PHP vulnerability working.
You asserted without evidence that there is working examples.
Someone asked for those examples, and instead of providing them, you insulted everyone.
Also just to reply to RagingCactus's sibling comment which was somehow downvoted to death (HN users, never change.) for quoting the Wiz post, the two PHP vulnerabilities alone are still not to bypass ASLR.
CVE-2026-109619 is the main memory related vulnerability but it alone isn't enough to break OS level ASLR unless you spam it (brute forcing).
I built zmx because I wanted a simpler session persistence model that also supported remotely running, tailing, and waiting for commands to finish.
It just so happens that it works really well with agentic development as well. I can remote into any shell environment through zmx and tell an agent to execute commands in that environment. `zmx run` executes and waits for the command to complete and also returns the exit code. For humans and agents this is a seamless experience, as if you are running the commands directly.
Agreed. The lack of stored history for every user is a huge blocker for new users. They enter a pretty active chat but they see nothing. They wait 10 mins after asking a question and bounce.
All of our comms for https://pico.sh are on irc and we have tons of users join and leave immediately because the room feels cold / dead even tho we were chatting 10 mins prior.
Every tool marketed as minimal is usually just an excuse to ship something with limited features. Unless there is a strict design ethos at its core [0], it’ll eventually grow its features to no longer be minimal.
Further, pi is now owned by a company which as we all know, tend to explode code with features while chasing product market fit.
I just recently replaced LSP with ctags. I am loving it. I plan to write a post about it but I’m leaning heavily into grep and search tools to navigate code. I do miss some autocomplete and auto import features but other than that I can actually navigate through code better with ctags instead of go to definition.
For linting style errors I’m using entr in a separate terminal which is also awesome.
When we put together this fall update, we were surprised by how much we have done this year.
I wanted to quickly call out a new service we are very excited to release, picd: push to deploy on a docker paas. This is a new paas concept we have been iterating on for years. It's a bootstrapped (no vc$) platform as a service, provisioned on our own hardware (no cloud hyperscaler), with a finite number of spots available.
We are going to publish a blog post highlighting picd and our technical design choices, but happy to answer any questions related to it or any other update in this post.
reply