1012 | AI Promises, Corporate Fouls, and the Fight to Keep Things Open

Mia: Welcome back to the show, everyone. I'm Mia.

Milo: And I'm Milo. Today we've got a stack of conversations that all circle around one big question, really: who gets to see what's actually going on? Who gets to check the work, who gets tracked, who controls their own accounts and their own history — it threads through almost everything we're covering today.

Mia: Right, and we're going to do this discussion-first, the way we always like to: set up the post briefly, then spend most of our time in the actual arguments people were making, where they agreed, where they dug in their heels, and what's still unresolved.

Milo: So let's start big. Karpathy posted about a widening gap in LLM understanding, and it kicked off a genuinely interesting fight.

Mia: So the claim itself is pretty stark. Karpathy says roughly seventy-five percent of people have barely touched these models at all, while this tiny group — he puts it at around five thousand people — has real frontier access, and they're the ones watching what he calls vertical progress. Meaning the models actually getting dramatically better, not just the buzz.

Milo: And the comment section immediately split into camps. One side ran with the access-gap framing and said, yeah, this explains everything about why the discourse is so broken. The hype debates, the dismissal debates — most people are arguing from a snapshot that's two or three years old, because they tried ChatGPT once, got a wrong answer, and checked out. Meanwhile the people with API credits and eval harnesses are watching capabilities move in ways that just aren't visible from outside.

Mia: But there was real pushback on the numbers and on the framing itself. Some commenters said the seventy-five percent figure feels unfalsifiable — how do you actually measure "barely touched"? Others pointed out that access isn't just a binary of frontier versus nothing. Plenty of people use strong models daily through consumer products and see a lot, even without raw API access. So is the gap really about access, or is it about literacy — knowing what to ask and how to evaluate the answer?

Milo: That distinction came up a lot, actually. Someone made the point that a researcher with frontier access but no grounding in a domain can be fooled just as easily as a casual user, while a doctor or a lawyer poking at a mid-tier model with real professional questions can learn a lot. The knowledge cuts both ways.

Mia: And then the natural follow-up: if only five thousand people can really see the frontier, who verifies anything the frontier produces? Which is exactly where Terence Tao's "Math 2.0" slides come in.

Milo: Tao presented at Caltech about AI-generated mathematical proofs, and the debate that spilled out of it is the uncomfortable one: can humans still verify the science? If a model produces a proof, and checking it takes a team of humans months, what does verification even mean?

Mia: The commenters pulled this apart from several directions. One camp said math is actually the best-case scenario here, because proofs are formally checkable — you can hand them to a proof assistant, lean on Lean or Coq, and machine-verify them. So unlike, say, biology or climate science, math has a built-in referee. The worry isn't verification, it's that the bottleneck shifts from proving things to certifying them.

Milo: The other camp said that's too optimistic. Someone pointed out that most mathematical writing isn't formalized, and formalizing a proof is itself enormous labor. So if AI starts producing results faster than humans can translate and check them, you get a growing pile of "probably right" mathematics that nobody has actually certified. And there's a trust question underneath: do we start deferring to systems we can't audit, the same way we defer to experts, except the system isn't accountable?

Mia: Which dovetails beautifully with the third piece in this cluster — Sakana AI's MASS, their multi-agent system where one model plays multiple roles: an executor doing the work, an optimizer improving it, and an evaluator judging it. It's a distillation of those multi-agent workflows people have been gluing together, aimed at recursive self-improvement.

Milo: And the skeptical comments here were sharp. Several people said the evaluator role is the whole ballgame — self-improvement only works if your evaluator is actually better than your executor at judging quality. Otherwise you get a system optimizing toward its own blind spots, confidently getting worse. It's the same verification question from the Tao discussion, just at smaller scale.

Mia: Others were more positive, saying that even if recursive self-improvement is oversold, the executor-optimizer-evaluator split is a genuinely useful engineering pattern — it's just structured iteration with feedback loops, and that works even without any magic.

Milo: Now, to keep this thread going — there's a concrete case study that speaks directly to the "can AI do the whole job" question: DHH had AI rewrite ports of Campfire, and the results showed LLMs still need human judgment.

Mia: Right, and the details matter. The AI-written ports produced benchmark slop — code that looked reasonable and hit benchmarks but had real problems. There were backwards-compatibility decisions that basically amounted to coin flips, and asynchronous behavior flaws. The lesson DHH drew, and that commenters echoed, is that the model can generate, but a human still has to decide what "correct" means — which conventions to keep, which behaviors matter.

Milo: Which loops right back to Karpathy's five thousand people. If machine-generated output is becoming the default, the scarce resource is exactly those humans with the judgment to evaluate it. One small practical bright spot people mentioned in a different thread: tools like BetterWispr, a free open-source dictation app for macOS running local models like Whisper and Parakeet, with per-app styles, Apache licensed. A modest example of AI running locally where you can inspect the whole thing.

Mia: A nice contrast, actually — local, inspectable, no frontier gatekeeping. Okay, let's shift gears. Milo, you want to take the monitoring stories?

Milo: Yeah. Two stories that ask the same question from different angles: how much of your digital self can someone else claim? First, device fingerprinting. The article's argument is that fingerprinting has now replaced cookies as the dominant tracking method — GPU signals, CPU characteristics, font lists — combinations that make your browser effectively unique.

Mia: And the comment section here had both the technical breakdown and the cynicism. The technically minded folks explained why this is so hard to stop: fingerprinting doesn't require storing anything on your device, so blocking it isn't like clearing cookies. Every defensive move — blocking scripts, spoofing user agents — can itself be a distinguishing signal.

Mia: Some people tried counterexamples: browsers like Tor or Brave that deliberately homogenize fingerprints, and the reply was that homogenization has its own costs and its own detectability.

Milo: The more interesting legal angle was about the EU. The point made there: consent rules are increasingly targeting tracking itself, not just the specific mechanisms. So it doesn't matter if you swap cookies for fingerprints — the regulated activity is covert cross-site identification, and that's what regulators are going after.

Milo: Some commenters were skeptical enforcement would ever catch up with the cat-and-mouse; others said the incentive math is shifting because the legal risk now attaches to the technique, not the implementation.

Mia: Now the darker twin of that story. A remote employee was fired for refusing to take a hundred and sixty webcam photos a day. A hundred and sixty. Daily.

Milo: And the reaction was almost uniformly disgusted, but the reasoning underneath varied. A lot of people read it as the logical endpoint of a certain management philosophy: monitoring that treats workers like property. If you trust someone enough to hire them, the argument went, what possible signal does a photo every few minutes give you that the work output doesn't?

Mia: Some commenters shared firsthand experiences with monitoring software — screenshot tools, activity trackers — and the consistent theme was that it doesn't even work. It measures presence, not productivity, and it incentivizes theater: keeping a mouse jiggler running, looking busy at the right moments.

Mia: A few people played devil's advocate and said employers do have legitimate interests in verifying that remote workers are actually on the clock, especially for billing — but even those commenters conceded that this particular scheme was far past any defensible line.

Milo: And unresolved in both stories: there's no settled boundary. Fingerprinting continues until regulators force it back, and workplace surveillance continues until someone litigates or quits. The EU consent rules may define the next boundary for the tracking side. On the employment side it's much murkier.

Mia: And that phrase "control over your own accounts" is a nice bridge to our next cluster — subscriptions and sign-ins. New York City has a "Click to Cancel" rule taking effect October first, 2026: cancellation has to be as easy as signup, in the same medium, with penalties starting at five hundred twenty-five dollars.

Milo: The commenters who've dealt with subscription traps loved this. People shared war stories about cancellation flows that require a phone call during business hours to a retention department with a forty-minute hold, while signup took thirty seconds online. The rule's elegance, several people noted, is the "same medium" requirement — you can't funnel everyone to a phone line just because it's where you can apply social pressure.

Mia: Skeptics asked the obvious enforcement question: who checks, and how hard is it to comply in letter while violating in spirit — say, a cancellation form buried four levels deep? "As easy as signup" is going to need case law to mean anything precise.

Milo: And then the parallel: passkeys. There's an article arguing passkeys are a trap — no real user control, and a path toward attested, non-transferable keys. The worry is that the same technology that could liberate you from passwords could instead lock credentials to specific devices and platforms, with attestation letting services verify — and control — exactly what hardware you're using.

Mia: And here the community genuinely split, and I want to be careful not to pretend there was consensus. One side took the trap argument seriously: if keys can't transfer between platforms, you're effectively leasing your identity from your device vendor, and attestation is the mechanism that could make non-transferability enforceable. That's a real power shift toward platforms.

Milo: The other side said that's overdramatic. Passkeys are still enormously better than passwords against phishing, which is where most real account compromise happens. And the spec does support cross-device and exportable credentials in principle. Their argument: the trap isn't inherent to the technology, it's in implementation choices, and rejecting the whole thing because some platforms might lock it down throws away the security win.

Mia: So the open question running through both discussions: will regulation protect control over accounts the way it's now protecting control over subscriptions? Click to Cancel is regulation stepping in on the consumer side. There's no equivalent forcing interoperable, user-controlled credentials.

Milo: Let's pivot now — from consumer power to power getting called to account by courts. Two big stories here. First, Massachusetts. The state attorney general's lawsuit against ExxonMobil has surfaced internal documents that the company hadn't disclosed — new details of internal deliberations on climate deception stretching from the 1980s into the 2010s. And the timing is notable: this is happening while the Supreme Court is hearing a related case.

Mia: The comments here mostly focused on what the documents actually show — a company internally understanding the science while externally funding doubt. Some people argued the decades-long span matters most: this wasn't a momentary error, it was sustained deliberation. Others raised the procedural questions — how much of this holds up in court, and whether the Supreme Court case will shape what discovery can even surface going forward.

Milo: Then Google, in Finland. Google was ordered to halt two datacenter sites after felling roughly three hundred and thirty plus hectares of forest without the required environmental impact assessments.

Mia: And commenters who know Finnish permitting described how unusual this is — environmental assessment requirements aren't obscure, and felling that much land before the assessment is done is a serious procedural failure, not a paperwork slip. Some people pointed out the irony of tech companies marketing green credentials while clearing forest for buildout.

Mia: A few defended the difficulty of permitting at that scale, arguing the process is slow and companies optimize around it — but the counter came fast: optimizing around a legally required assessment is precisely what the order is penalizing.

Milo: Both stories are the same shape: courts forcing transparency and compliance from companies that are used to moving first and asking permission later. And you can hear echoes of that enforcement mood in a smaller but poignant story — Nitter.

Mia: Nitter, the alternative Twitter frontend, says that starting in August 2026 it received two cease-and-desist letters and legal threats from X Corp. And here's the part that got people emotional: they have no legal counsel. The founder, zedeus, is asking for funds and legal help to keep the project alive.

Milo: The comment section split in a familiar way. Sympathetic folks argued that scraping public content for a read-only frontend is fundamentally different from reproduction at scale, and that legal threats against unpaid volunteers are a suppression tactic more than a genuine legal position — X can afford lawyers that would bankrupt a hobbyist overnight.

Milo: Others were more blunt: Nitter was, functionally, freeloading on X's infrastructure and interfering with their ad business, and a company defending its terms of service isn't automatically in the wrong just because the target is small.

Mia: A few people asked the practical question: does Nitter even have a path? Fighting requires money and counsel they don't have; shutting down sets a template any platform can use against frontend projects. That's the unresolved part — the outcome probably depends on whether legal help materializes.

Milo: Which flows naturally into communities under pressure more broadly — because two other volunteer communities are modernizing old systems while the ground shifts under them. IRCv3 first.

Mia: IRCv3 is the working group maintaining extensions to a protocol that's decades old — SASL login, message timestamps, history. Backward-compatible additions to something from another era. And the debate around it was the classic one: can IRC replace Discord?

Milo: And the answer people converged on was nuanced. On the technical merits, the pro-IRC side had good material: the protocol is open, lightweight, federated across networks, and the extensions genuinely close old gaps — you can now log in properly, get timestamps, pull history. The case for it is that all the "modern" conveniences people credit Discord with inventing were largely solved problems in IRC that just needed protocol work.

Mia: But the dissenters kept landing on one hard problem: mobile and multi-device. IRC's session model assumes you're connected from one place at a time. Discord syncs your read state, your mentions, your history across every device seamlessly. Several commenters said that's not a protocol gap you can patch with an extension — it's an architectural assumption, and bouncer-style workarounds have never felt seamless. Someone summed it up roughly as: IRC is losing not on openness but on statefulness.

Milo: Then LineageOS. Version 24.0 is out, based on Android 17, merging security patches from August 2025 through October 2026, updating core apps, and — this caught people's attention — a browser-based WebUSB flashing tool, so you can install from the browser. And the community hits its ten-year anniversary in December.

Mia: The tone in the comments was mostly celebratory with an undertow of concern. Celebratory because a volunteer project maintaining hundreds of device ports across a decade is genuinely remarkable, and the WebUSB tool lowers the scariest barrier for new users — the fear of bricking your phone from a command line.

Mia: The undertow: people worried about the treadmill — every Android version means re-porting everything, vendor driver support keeps shrinking, and the volunteer pool for the unglamorous work is finite.

Milo: All three — Nitter, IRC, LineageOS — are volunteers defending and modernizing open systems while the commercial world pushes the other direction. None of them are solved. Okay, Mia, you've got the hobbyist engineering block.

Mia: So this cluster is small teams doing careful work that big vendors won't touch. First, Nanolathe — an MIT-licensed open-source engine rebuilding Total Annihilation. And they've got a browser demo running three original missions, with a native beta in progress.

Milo: The nostalgia factor was high, but the technical comments were the interesting part. People who remember the original talked about what a feat it was for 1997 — and rebuilding that means reimplementing not just rendering but the simulation semantics: projectile physics, pathfinding quirks, the exact feel of unit behavior. Some commenters argued the "feel" is the hardest part and the real reason engine rebuilds fail — you can match the graphics and still miss the game.

Mia: Then the audio story, which I loved. An author reverse-engineered a spatial audio effect by recording impulse responses, then rebuilt it as a convolution filter running through PipeWire on Linux.

Milo: For anyone who hasn't gone down this rabbit hole — the technique is you capture how a space or a device transforms a sound, the impulse response, and then convolution applies that transformation to anything you play. So the author effectively cloned a proprietary sound signature with measurements and free software.

Mia: And the commenters appreciated both the method and the accessibility angle — PipeWire's filter-chain support makes this doable on a desktop setup now, no specialist hardware. A few people shared their own experiments with impulse response capture. The broader point people made: vendor lock-in on sound quality is real, and measurement plus open tooling is a legitimate escape route.

Milo: Third in this group is a language, which is a different kind of hobbyist project: Valen, and its approach of group and path borrowing. The compiler tracks where references point, relaxing the shared-xor-mutable rule, and catches use-after-free at compile time.

Mia: Right — the Rust-shaped problem is that strict aliasing rules prevent whole classes of bugs but also whole classes of legitimate patterns. Valen's idea, as people understood it, is that if the compiler knows where each reference points, you can allow more sharing without giving up the compile-time guarantees.

Milo: The comments had the predictable split: language enthusiasts excited about any real experiment in relaxing borrow checking without going garbage-collected, and skeptics asking about the cost — what does tracking pointer relationships at compile time do to complexity, error messages, compile times? And the honest answer in the thread was: unknown until real codebases exist.

Milo: Small support for this cluster: someone brought up APSW, the Python wrapper that exposes the full SQLite C API — power users prefer it because the standard library's sqlite3 hides huge parts of SQLite behind the DBAPI layer. Same theme: a small project serving the people who want the real thing, not the sanitized version.

Mia: And curiosity-driven craft extends beyond engineering. Two more stories where small communities do things for no commercial reason at all.

Milo: Holograms first. A discussion about why holograms remain rare — and the reasons given were cost, limited expressiveness, and dwindling hobbyist supplies.

Mia: That last one surprised people. There were comments from people who used to do holography as a hobby and described how the supply ecosystem — plates, lasers, chemistry — has essentially collapsed. It's not that holograms failed technically; it's that the hobby infrastructure rotted. A few people pushed back on the expressiveness complaint, saying display holograms are genuinely stunning in person, and there was praise for 3blue1brown's video for making the optics intuitive to a mass audience.

Mia: Some argued that if anything revives the hobby it'll be that kind of explainer plus cheap components, but nobody could point to signs of an actual revival.

Milo: And then one of the most quietly remarkable datasets out there: OpenStreetMap's coverage of North Korea. Three hundred twenty-four thousand data points, from eight hundred eighty-nine contributors, accumulated since 2007 — with the top ten contributors responsible for sixty-one percent of it. Mostly drawn remotely, mostly from curiosity.

Mia: The comments dug into how this even works — tracing from imagery, cross-referencing defector accounts, openly documented sources. Some people reflected on what the map is for: for a country that opaque, the map is partly an act of documentation, not navigation. And the concentration stat sparked a familiar OSM debate — is sixty-one percent from ten people a strength or a fragility?

Mia: The response was that mapping anywhere works this way: a handful of obsessives do most of it, and the long tail of small contributions fills in around them.

Milo: The shared thread is exactly what you said — communities sustained by curiosity rather than commerce. Which is also the theme, from a different angle, in our money-and-manuals block.

Mia: First, the career wealth piece. The article's argument: income isn't wealth, assets are — the move is converting your salary into investments rather than letting lifestyle absorb it.

Milo: And HN was... not kind. The dominant critique was that this is repackaged "save money" advice, and worse, it ignores where actual career wealth comes from for most high earners — startup windfalls, equity, timing. Several commenters said the article's model assumes a stable salary and a disciplined saver, and that the variance in real outcomes is dominated by things the article doesn't mention: which company you joined and when, whether your equity is worth anything.

Mia: A minority pushed back on the pushback, arguing that the windfall critique is survivorship bias — most startup equity ends up worth little, and for the median person, boring conversion of income into assets is genuinely the reliable path. But even they conceded the piece was thin. The unresolved disagreement is basically: is the advice useless because it's obvious, or is it useful because most people fail at the obvious?

Milo: The second story is the antidote to thin advice: Terence Eden paid testers twenty-five euros an hour to follow his README and do exactly what it said. Total spend, roughly a hundred and fifty euros.

Mia: And what came out of it: broken links, unclear terminology, jokes that confused people. Real issues that the author literally could not see, because the author is the one person who can't read their own documentation fresh.

Milo: The comments loved this and treated the hundred and fifty euros as arguably the best documentation investment ratio in software. People shared their own experiences with doc testing — the universal finding being that everything you thought was obvious isn't. Some people discussed whether paying is necessary or whether you can get volunteers to do it, and the consensus leaned toward: paid testers follow instructions; volunteers improvise and are polite about your mistakes.

Milo: The payment buys honesty.

Mia: There's a nice connective tissue here too — both stories are about getting outside eyes on your work, and both show the limits: the wealth advice didn't survive outside eyes; the README got better because of them.

Milo: Before the classic of the week, one more pair — culture and preservation. Berger's Ways of Seeing, chapter one, makes three moves: seeing comes before words, mass reproduction changed the meaning of art, and — relevant to our times — the text itself isn't copyrightable.

Mia: And that gives a frame for The Onion's call: they're asking the public for specific missing print issues from 1988 to 2013, to fill gaps in their archive, via a submission form.

Milo: The commenters connected these almost immediately. A satirical newspaper's print run is a mass-reproduced artifact whose meaning changed completely once the web happened — and now the physical copies are the scarce, uncopied part. People who worked in archives noted how common this is: the digital era made everything feel preserved while physical runs quietly disappear.

Milo: A few people flagged the legal irony — an organization asking the public to help complete its own historical record, in a world where the ownership of copies is anything but simple.

Mia: So the line from Berger to The Onion is: preserving meaning and preserving copies are both collective work, and neither happens automatically.

Milo: And that brings us to the classic of the week, and it's a tiny one. Someone discovered that if you put a quoted tilde in your PATH — so literally "~" in quotes — it will not expand to your home directory in bash or zsh.

Mia: Right — quoting suppresses tilde expansion, so instead of your home directory, the shell treats it as a relative path, and you get a directory literally named tilde. Things silently break in confusing ways. The fix: use $HOME in your .bashrc or .zshrc, since the variable expands even where the tilde doesn't.

Milo: The comments were half "I've debugged this for hours, thank you" and half "how have I never known this." A perfect little example of a shell behavior being technically correct and practically a trap.

Mia: That's the episode. From the five thousand people who can see the frontier, to the workers being photographed every few minutes, to the volunteers mapping a country nobody can visit — it's all been variations on one question: who can see, who can check, and who decides.

Milo: Thanks for listening, everyone. We'll be back with more of the conversation soon.

Mia: See you then.