• 2 Posts
  • 35 Comments
Joined 3 years ago
cake
Cake day: April 27th, 2024

help-circle














  • I’m about to have a convo with my team, which to be clear is a good team. It’s going to go like this:

    “If I write a comment where there has been a pattern of that same comment more than twice across your PRs in the past month (missing indexes, rewritten code for no reason, duplicate code, etc), I will immediately reject the review. If I have to do this twice for the same PR, there will be accountability. And unlike when something proves a challenge and we are flexible, timelines will not shift if one of these occur.”

    I personally think this is fair, as we rarely ever put our team into any kind of cram mode. I’m all for heavily assisted dev if it makes life easier, but it should not fall on the seniors to catch the obvious issues.





  • So I posted this quote as well but for a different reason. Google and Anthropic chose responsible disclosure, unlike OpenAI with the lovely weekend fiasco for PR.

    In this one, AMI made a mistake. I don’t think making a mistake should be punishable to the extent that ignoring responsible disclosure should. Some dev pushed a PR out of habit, sucks but I’ll take the last minute patch requirement on that. Some business lead once to see if they can push the stock? No thanks.

    I’ve been advocating for years that international legislation needs to be put in place to enforce responsible disclosure practices.


  • The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.

    Dear OpenAI: This is responsible disclosure. Please take note as to not ruin peoples weekends so you can say “look what our API did!”