It's becoming an increasingly bad time to be hosting anything on your own, having to worry about whichever 0-day the clankers are going to find and/or exploit within minutes of it being patched. I'm not sure even nginx is safe in all of this. I used to think there was software that should be basically safe but I'm not sure hosting anything (open-source) yourself anymore (i.e. directly participating in the Internet on a personal level) is a good idea.
Having to go through 3rd party services (and rely on them to stay on top of things) to participate is not fun.
Been doing it for years, decades even now, and IMHO it's like visiting a touristic place or any place public with strangers really : you have to keep your wits about you otherwise you will get mugged.
If you setup your Website you will inexorably attract spammers at least. Yes they are using new tools and new techniques... but so can you. There are plenty of tools to keep track of abusive usage, individually or collectively, and ways to both backup your data or containerize your services. As long as you keep up then I don't feel it's getting more challenging.
Is this actually grounded in real experiences and not headlines? Have real projects / people actually experienced this hyperbolic insta-hack you describe? People are getting DDoSed regularly sure, but no, you don't get hacked the instant you forward a port, in my experience hosting a few public services in my community.
Just find a better place to go. If you have savings, quit this nonsense and start looking for something else while working on yourself.
I just got back to working on a project I like where we don't use any LLMs for code generation because we think it kind of sucks and leads to bad results unless it's for incredibly small contexts (which is usually not worth the prompting).
You're also not as alone as you think in actually liking programming enough to do it by hand even after having used LLMs. There's also the fact that you build more theory up by actually writing the code anyway, so someone who actually wants to know their code base intimitely will always have to write the code.
Damn, would love to work somewhere where no LLMs are needed. I have a friend working for Nintendo stuff (I think he does something for their secondary software, IE sales) and he is not allowed to use LLMs. Happiest man on earth.
If I were in the States, where I have connections, people would hire me easily. But for my wife and kids, it's not really possible to emmigrate.
Remote is crazy. I heard from a friend who got 100s of applications on a remote job on a single day.
Early Copilot was tab-complete in editors and was honestly the best version of LLM-assisted development I've used, because it was intentionally small in scope, trivial to verify output from at a glance and easy to opt in and opt out of. I have yet to see anything more useful in terms of code generation; very small-scale code generation (think function-level) comes close, but is a lot more tedious.
For analysis, bug hunting, overview and some porting work to popular languages and so on I think the current SotA is fantastic, but they're still very disappointing for code generation past function or small module level.
> "I have yet to see anything more useful in terms of code generation"
Recently my employer hooked Claude into a bunch of SaaS services like a ticketing system and an asset inventory system, and I feel a big productivity boost is that I don't have to dig for their open browser tabs, remember their product name/URL/where I put the bookmark, find that my sessions have logged me out "for my protection" since I last looked, find my MFA code, approve sign-in on my phone, then use their mismashed/sluggish/poor-UX interfaces and slow searches to loko for things, and can instead ask Claude "search these systems for anything about <issue>" and it just does. It correlates between systems, summarizes things, and gives me references which system and where to look to check what it found. Internal search on a mess of acquired and disjoint systems.
This feeling reminds me of two classic Joel Spolsky blog posts below, and your comment here about the surprisingly useful tab-complete gives me a similar feeling. I wonder how many smaller candidates there are where LLMs are more helpful and less hyped, against the big vibe-coding solve-everything hype which are currently less helpful than their hype?
References [1]: "A lot of us thought in the 1990s that the big battle would be between procedural and object oriented programming, and we thought that object oriented programming would provide a big boost in programmer productivity. I thought that, too. Some people still think that. It turns out we were wrong. Object oriented programming is handy dandy, but it’s not really the productivity booster that was promised. The real significant productivity advance we’ve had in programming has been from languages which manage memory for you automatically. [...] Whenever you hear someone bragging about how productive their language is, they’re probably getting most of that productivity from the automated memory management, even if they misattribute it. Sidebar: Why does automatic memory management make you so much more productive? 1) Because you can write f(g(x)) without worrying about how to free the return value from g, which means you can use functions which return interesting complex data types and functions which transform interesting complex data types, in turn allowing you to work at a higher level of abstraction"
and [2]: "I have seen many language and programming fads come and go. But there’s only ONE, that’s right, ONE language feature I’ve ever seen that actually improves your productivity significantly. No, it’s not object oriented programming; no, it’s not intentional programming or assertions or programming by example or CASE or UML or XML or Java. The only thing that improves your programming productivity is using managed code – that is, using a language in which memory management is automatic."
we could have had that before, but in past era of tech companies, APIs were not designed with an individual needs in mind and management was all too happy to order you to update status (manually) across JIRA, Slack and whatever other tracking system they were using.
I think this sounds fantastic, and I welcome all developments in these types of areas where you lean heavily on the hyper-attentive, very fast assistant aspect of LLMs intended to make information more easily searchable, visible and the results more accurate.
I agree that the mismatch between the expectations of OOP as a paradigm and this situation right now feel very similar. I suppose the many billions pumped into selling vibecoding and large-scale code generation via LLMs of other kinds is sort of like the massive amount of money pumped into marketing Java as a viable alternative long before it actually was.
Just like with human langages their only advantage is the community around it, the culture. (Im pretending size is a part of that Obj) No one does it but that is how you should pick it.
Cloudflare doesn't even let my browser (qutebrowser) through. Anubis will sometimes sit and ask for ridiculous amounts of work, but at least it's never outright denied access.
I haven't said anything about "good", I just pointed out that there isn't exactly an alternative to Chinese models if censorship and restrictions are regarded as bad for longevity. You can't really do better than the Chinese models for longevity; US models are by far the worst in this regard. So "What about censorship?" is an absolutely hilarious question to ask when Chinese models are presented as an alternative. Yes, what about it? They have less than the obvious alternative from US labs, and where is it you imagine you'll find less censorship?
"nothing happens in 1989" is censorship. "I won't tell you how to build a bioweapon for genocide" is guardrails.
I like the second one because I like to be alive.
This is an incomplete and quite superficial view of what is going on out there, in my opinion. I've worked on plenty of projects where the assumption was that since the round-trip to the server is going to take almost 100ms that'll dwarf anything that's going to happen on the server itself, justifying poor choices that lead to potentially adding a whopping 100ms onto that number. These numbers only get larger with a larger perceived "Nothing we can do about it" budget as well, programmers often feel justified in doing just about anything once round-trip time grows, not understanding that they're just adding to an already existing problem.
On top of that: Creating software that isn't outright wasteful in terms of performance isn't even hard, it's just a matter of not doing ridiculously dumb things. The problem I've observed in teams I've worked with is that the majority of programmers don't even know what the dumb things are, and wouldn't know how to even approach making something that's halfway fast.
Edit:
Unfortunately I think posts like these are only going to make the problem worse, because now people are going to ask for voodoo solutions to performance issues, when the answer to their problems was usually just "Maybe stop creating wasteful intermediate structures and just walk an array like a sane person" in 99% of cases. The first leg of any optimization journey in the average programmer's code will likely net tens or hundreds of times faster code, and that's actually all people were asking for.
The knowledge required to make those changes and understand them is fairly minimal, but the kinds of people who have to create spinners for webmail interfaces, have their application add 150ms on top of whatever round-trip you have for processing things counted in 5 digits, etc., have never bothered to even learn those things.
I don't think it's superficial, but two problems adding up. Previous poster is talking about general latency issues because everything is networked and potentially quite far away.
What you point out is slowness once you hit the entry point. Go, or similar languages, as a server language platform could have solved that problem from a computational perspective. But it did not for the most part. In my opinion people choose the faster stuff because it's cool and they have more wiggle room to cram in to get back to the slow status quo.
Everything is overengineered, software or distributed architectures, sound to naive human logic but alien to computers. It's an cultural problem, development is so deeply entrenched into "business logic" that the minimal viable and computational economic solution isn't even on the table. I don't even think it has to do with cost or feasibility, it's just that your random e-com manager wouldn't know what to do with you, if a programmer really starts talking about hardcode tech stuff.
A friend of mine was once tasked with writing a kind of simulation that simulates millions of scenarios per session/run, and searches for a best-so-far solution while doing so. He proposed writing it in Rust (justifying it as: fast, low level, fewer memory bugs, fewer parallelism bugs (so potentially faster than "fast")), and management over-ruled them, and insisted on using raw/plain Python (without even an underlying C library), "because that is the industry standard", and "premature optimization is the root of all evil", and "nobody else knows Rust"[0].
Another friend, worked at a company, that got a new manager (I think as a result of a merger), and that manager halted all work on "yak shaving" projects. These "yak shaving" projects were things like logging, and debugging, and some kind of integrity-verification. When asked why they were being halted, the new manager said: "none of our customers asked for any of these things". When told that these things enable the team to produce a better product for the customers, the manager (I am told) looked at them with confusion and suspicion. Those projects were never improved since, and the product stopped improving as well. I am not sure if it affected their business (the pandemic was much more distortive).
What you call "business logic", is not even logic, and it has little to do with business. It is what Feynman called a "cargo cult". The obvious name for it is "cargo cult business management/logic".
It truly is embarrassing and shameful that after decades of idiotic decisions, it took a _trillion_[1] dollars of investment into a chat-bot technology, to finally crack open _one_[2] door to slightly less idiotic decisions, while opening dozens of new doors to decisions of an unknowable character.
Most companies (and, consequently, their engineering organizations) are simply _cosplaying_ as the things they are supposed to be.
I do not see how an AI assistant (or any kind of assistant or consultant) can save these fools from themselves. The only logical explanation is that most software companies are cursed -- you would have much better luck engaging a witch-doctor.
[0]: Nobody else knew C or C++ either. The fact is, that nobody cared. In fact, even Go would have been a better choice than raw Python, but nobody cared. Even Common Lisp (which is at least as abstract as Python, and has native execution speeds (GC and runtime type-checking can be turned off for compute-heavy workloads that mutate data in-place)), is a better choice, and yet, an _abundance_ of obviously superior options (all implemented and maintained by obviously superior engineers) was not enough to prevent the organization from choosing an inferior one, and using it stupidly (without a fast native-code component).
[1]: I see estimates from hundreds of billions to a trillion, depending on how you count it.
There is no "evidence"; by any reasonable interpretation of that word there would have to be an actual accusation of crime for there to be evidence of one. This was a search predicated on literally no actual basis apart from "we have the right to search your device because we have ultimate power at border passings", essentially just a fishing expedition.
This also doesn't even get to the more important point: If you don't have the contents of the phone you have literally no evidence of a crime being committed, other than the one they invented post-facto: "Deleting data that could hypothetically be incriminating, not in any specific way but just generally, maybe".
I've found that the Gemma series of models are made for someone entirely different than myself. They fail at even the most basic questions I throw at them, like 12B just now failed at answering how `XGrabKey` from Xlib is used. It hallucinated the entire API and made up an entire flow of code based on it, for no particular reason. It could've even decided to research this via web search because I have a tool specifically set up for that, but it "chose" not to, relying instead on completely made up information.
This isn't an isolated incident, really, I find myself always having these issues with the Gemma series. I'm sure they can do useful things for someone else, but for the things I want to use LLMs for (very small code generation, quick questions, code review) they always seem to disappoint me. I'm sure it's because of the stuff that I do and use, but it's a very consistent red thread with these models for me.
Edit:
The same question for Qwen3.6-35B-A3B produces a pretty concise and correct answer that would be useful to the questioner, without even going to the web. I don't know what Gemma models are trained on, but it's not the stuff that's relevant to me.
Having to go through 3rd party services (and rely on them to stay on top of things) to participate is not fun.
reply