BadUncle

这次 Rust 大会的主题是 Rust and AI。而 Rust 常被人诟病的一点是编译废 CPU、产物废磁盘，AI 堆 Rust 代码的速度也明显慢于其他语言。 但反过来想，这个“缺点”在当下可能恰恰是一个特性：一个项目如果选择用 Rust 开发，至少说明作者和 AI 认真讨论过语言选型，并且做好了长期维护的心理准备——它是奔着建立长期关系去的，而不是 one night :)。如果只是想写个临时脚本或一次性工具，AI 绝不会推荐 Rust。在这个意义上，Rust 的高门槛和高成本，反而成了一种 PoW（工作量证明）。 当 AI 让代码生成成本趋近于零、开源软件产品出现无限供给时，用户和社区该如何筛选项目？最真实的观察指标只有持续维护。大家可以回头看看年初 vibe coding 最火时涌现出的海量开源项目，到现在还在更新、作者自己还在天天用的，还剩多少？我相信寥寥无几。 我自己的切身体会是：你需要一个工具，花半天让 AI 搓出来；当你开始天天用它时，接下来整整一周你都在修各种边界条件；如果你把工具分享给别人，考虑到不同的设备、运行环境、用户习惯，以及长期运行会不会撑爆内存和磁盘，至少还得再修上一个月。AI 极大降低了“写出代码”的成本，却丝毫没有降低“承担后果”的成本。 这也反向定义了 Rust 在 AI 时代的生态位：动态语言把原型成本降到极低，却把并发、内存与边界 bug 的暗税全部延后到运维期；而 Rust 则逼着作者在第一天就把系统契约和确定性锁死。在垃圾代码无限供给的时代，唯有维护的决心和编译期的确定性是有价值的。除非确实找不到替代品且自己极度依赖，否则真的划不来随便自己造轮子；而一旦决定自己做，且选了 Rust，那就意味着一场严肃的长期主义工程。

Vercel + TanStack Vercel, like the web, is built on open standards and open source. That's why we're excited to partner with TanStack to power the next generation of apps and agents on Vercel.

我是近 20 年的 Mac 用户，虽然我也用 Linux，但大多数情况都是 server 端，桌面 Linux 几乎没怎么用过。 我喜欢 Linux 的自由，但我对它的 UX，是非常失望的。 但我用了 Omarchy 4.0 之后，就马上喜欢上了这套系统，这一周我基本都在 Omarchy 下工作和发贴。 说它是 Agent first 不是炒作，而是真实的体验。 我在这里留言并非是要说服你去用 Omarchy，仅仅是对你质疑 Omarchy 而感到不太舒服。 你的质疑其实是一种还原论。 我们每个人都长着鼻子耳朵眼睛嘴巴，但为什么有些人就是好看呢？ 好的产品体验，其实就是一种品味和审美的组合，并不是要重新发明一切。 如果你 get 不到这一点，那 Omarchy 明显不是你的菜。

最近的动作是两个, 一个是引入了herdr, 可以代替我之前直接用tmux的底层调用各个cli, herdr是rust版本, 值得信赖. 另一个是群友推荐的omp(oh my pi) , 简单研究了下, 感觉正确的姿势其实就是当做ampcli的对标版本. herdr和omp算是补齐了整个版图: 重活严肃的内容, 走herdr的cli组合, 基本特点是需要人的干预, 各个环节并不能非常清晰的标准化. omp则是简单粗暴, plan用什么模型,coding用什么模型, review用什么模型, 自动帮你调度. 我测试了下, 这个advisor其实就是review的意思, 而且它有一个特点,是可以直接盯着当前coding的model, 可以立即反馈, 还蛮好玩, 和我们之前的事后review还是有些区别.

🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure we are powerless in an emergency. What happened… An autonomous AI agent: zero human operator in the loop breached part of their production infrastructure. It began with a malicious dataset that chained two code-execution bugs in their data-processing pipeline. From there the agent escalated privileges, harvested cloud and cluster credentials, and moved laterally across internal clusters. All over a single weekend. 17,000+ logged actions. Official disclosure: huggingface.co/blog/security… The part that should make every one stop and think: When HF’s own security team tried to analyze the real attack logs, exploit payloads, and C2 artifacts using Anthropic and OpenAI frontier models through normal commercial APIs, the safety guardrails blocked them. BLOCKED THEM. The models could not reliably tell the difference between “incident responder doing forensics” and “attacker probing.” They had to fall back to a self-hosted open-weight model (GLM 5.2) running on their own infrastructure. That choice also kept sensitive attacker data and referenced credentials inside their environment — no exfiltration to a third-party API. This is why open source (specifically open-weight + self-hosted) wins in the agentic era. The asymmetry is now structural: • Attackers can (and did) run unrestricted agent frameworks — swarms of short-lived sandboxes, self-migrating command-and-control, autonomous decision loops executing thousands of actions. No corporate safety layer slows them down. • Defenders using only hosted “aligned” frontier models hit invisible walls exactly when the stakes are highest: when you need to feed real exploit code and attacker telemetry into an LLM to understand what just happened. Corporate safety tuning that treats legitimate high-signal forensic work as potential misuse creates a defender disadvantage. It is not theoretical anymore. Self-hosted open-weight models remove that choke point. You control the weights. You control the context window. You decide what restrictions (if any) apply. Your sensitive logs and credentials never leave your perimeter during analysis. You can have the model ready before the incident instead of discovering mid-breach that your primary analysis tools are blind to the very thing you need to see. HF deserves credit for rapid containment, transparent disclosure, and for already having self-hosted capability in place. They also used LLM-driven detection and triage on their own side. But the deeper signal is clear: In this AI world where both offense and defense are becoming agentic, sovereignty over your intelligence stack is no longer optional. The organizations and individuals who can run, inspect, audit, and (when necessary) remove guardrails on their own models will have the decisive edge in understanding and responding to threats that move at machine speed. Open source wins here not just because it is cheaper or more “democratic” in the abstract though those things matter. It wins because it is the only practical path to having tools that remain usable when the attack is real, the data is sensitive, and the safety filters of distant API providers become an obstacle instead of a feature selling hands tied lobotomies as “safety”. The agentic future is not coming. It is already probing production infrastructure. The question is no longer whether you will face autonomous agents. It is whether your analysis and response systems will still work when they arrive. And Dario, you and your game playing, ivory tower company is not needed.

目前使用组合 Fable xhigh管家, 调用子agent 和 workflow使用 opus Max. codig和文档方案编写5.6 sol Max, review 5.6 sol Max 和 cc workflow

agent-spec ，连夜发布 1.0 😆 先发布再说，架构稳了，但可能有 Bug ，后面慢慢修复 zhanghandong.github.io/agent…

我的底气来源： 1. 使用最好的 Coding 模型 和 agent，然后信任它 2. 使用 Rust 语言，因为 Rust 编译器可以为 AI 生成的代码兜底。这个兜底的意思是，它能保证代码的正确性。 3. 使用 agent-spec （我自己实现的 sdd 工具），使用 Spec 驱动开发方式，把我的意图“编译” 为 Spec 文件（包含了意图/约束/验证方法） 4. 人工测试，是的，我从一个正经开发沦为了测试人员 5. 我近 20 年的开发经验，如果 ai 定位不到问题，我会帮助它 debug