Kris Coleman retweeted
theyāre calling it āBlack Octoberā and i donāt think people realize how serious this is
in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours
any ONE of these would normally be the biggest story of the year
PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10
Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26
Java: also compromised. three of the most used programming languages on earth hit at the same time
GitLab: a perfect 10 out of 10 severity hole in every version since 2014
Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed
Signal: a bug that could leave your mic and camera on after you hang up
WordPress: hackers stole a plugin makerās keys and planted backdoors on websites
LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
and thatās not even half the list
thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock
security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet
if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected
update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you havenāt already
this is not a normal week on the internet. this is something different
I will be at Kubecon Salt Lake City next month with @replicatedhq , stop by to talk about on-prem and air gap software delivery, as well as some other exciting news!
It took me a couple weeks to get self-healing in my factory right. With dozens of agents all working on bespoke systems, they didnāt seem to care about the big picture, theyād just throw their hands up when things in the factory went wrong.
What is this random notification I got from muse? š I named my muse āBroā and modeled it after Macho Man Randy Savage and got this message from it today. Bravo š
The problems with Software Factories in OSS are interesting. Ex: maintainers will need their factories to never act on comments from authors that arenāt themselves maintainers, otherwise its a huge exploitable surface
Heres my take on why having an engineering bg is so important if youāre vibe coding: 9/10 times the ai makes decent decisions. That 1/10 time, it doesnāt. And thats when knowing CS yourself makes all the difference.
Agents adept at product comprehension, that help read and review (and even approve) prs are going to sweep the market š
AI-generated code creates a funny problem.
Writing code gets faster.
Reading code doesn't.
And eventually someone still has to understand:
āWhat exactly is this doing?ā
The bottleneck may shift from code generation to code comprehension.
#AI #Coding #SoftwareDevelopment
Kris Coleman retweeted
two days to replace a ~$100k/yr agent contract, at ~25% of the cost
agents are becoming infrastructure, and teams want it in their own cloud, on their own models, with their own data. that's the bet behind @omnaraai
So I know Cognition doesnāt care about Little Oleā Me, and this is just my story, so take it with a grain of salt, but hereās why I donāt think all these crazy scaling revenue numbers by coding agents are going to stick:
Weāve been happy Devin users for a while. Really like the product, and like the company. Still do! This isnāt shade at Cognition, and Iām not upset with them, just a sample of why I worry about the competitive landscape for these cos.
Anyway, our usage grew to >$100k run rate or so. I think one or two of our users even received an email congratulating them for being Top 200 users of Devin.
As usage grew, we added more capabilities and needed a BAA (laymanās terms: an agreement that says they are HIPAA compliant). This required an Enterprise contract (why a piece of paper requires extra money is a topic for another discussion, but itās very normalā¦) so we started talking to their sales team.
Basically, we were going to ~1.5x our spend in order to get the BAA. Honestly, that was fine with us. We like Devin!
Our only request was to pay quarterly (already a big concession from our existing monthly payments, given our relatively small size). They declined, unless we committed to EVEN MORE usage.
Before responding, I decided to see how difficult it would be to set up Hermes to do the equivalent work as Devin, and to see what the costs were. Iād host it in our infrastructure and only use providers we already have a BAA with.
Two days.
Thatās it. Itās functionally 100% equivalent. Maybe slightly better in some ways, slightly worse in others. We spend a little bit of time futzing with it, but we did that with Devin, too.
The cost is roughly 25% of Devin.
So, two days for $100k or so per year savings. All because they didnāt want us to pay quarterly.
At some point, other companies are going to catch onto this, too. So congrats on this milestone, but keep finding more ways to provide value and keep customers happy. Itās hard to compete.
Three times as much sol tokens for the same cost as opus? Am I turning Codex?
Not quite.
There's a couple of things going on and it's way more nuanced than X would have you believe. Strap in.
OpenAI have a problem: no one is willing to pay for credits when they run out of sub. Their margin on credits and API is way too high. It meant paying extra feels like throwing money away.
Having the sub linked in some way to a dollar amount at API costs means there's an incentive to keep API prices high.
So, instead they made Sol unbelievably cheap at the API and in credits. You're getting 3-4x as much Sol tokens as you would Opus, for the same price. And Sol is more efficient per token.
If you're a heavy Sol user and light Astra user - you will get more. If you're a heavy Astra user - you're getting about half. I'd put money on this changing with Astra 6.1. API/Credit prices will get cut in ~half.
So what you get is about the same. But when you run ccusage the $$$ amount shown will be less.
I think there's something quite egalitarian about 1x = $20 and 10x = $200. It means your incentive to upgrade is purely about how much your using. And the smaller plans will get more Sol usage now. Encouraging more people to do more before needing to upgrade.
TLDR: Sol users - get about the same, more on lower plans. Astra users - get half on the $200 plan.
I haven't formed an opinion on Sol 6.1 just yet. So hard to say.
Kris Coleman retweeted
Not quite.
There's a couple of things going on and it's way more nuanced than X would have you believe. Strap in.
OpenAI have a problem: no one is willing to pay for credits when they run out of sub. Their margin on credits and API is way too high. It meant paying extra feels like throwing money away.
Having the sub linked in some way to a dollar amount at API costs means there's an incentive to keep API prices high.
So, instead they made Sol unbelievably cheap at the API and in credits. You're getting 3-4x as much Sol tokens as you would Opus, for the same price. And Sol is more efficient per token.
If you're a heavy Sol user and light Astra user - you will get more. If you're a heavy Astra user - you're getting about half. I'd put money on this changing with Astra 6.1. API/Credit prices will get cut in ~half.
So what you get is about the same. But when you run ccusage the $$$ amount shown will be less.
I think there's something quite egalitarian about 1x = $20 and 10x = $200. It means your incentive to upgrade is purely about how much your using. And the smaller plans will get more Sol usage now. Encouraging more people to do more before needing to upgrade.
TLDR: Sol users - get about the same, more on lower plans. Astra users - get half on the $200 plan.
I haven't formed an opinion on Sol 6.1 just yet. So hard to say.
Otherwise you will make mistakes. Absolutely. And they will be big ones. Even a calculator needs the operator to understand basic arithmetic.
With the rate of code generation today using ai, pr review is becoming a bigger bottleneck. Would you be comfortable having a specialized review agent review and possibly even approve your prs? What would it take for you to trust this model?
Kris Coleman retweeted
We just raised an $8M seed round to kill AWS, GCP, and Azure.
Introducing instacloud.com, the agent-native serverless cloud.
Your team is shipping code like never before. But you're getting caught up in manual, tedious DevOps work trying to deploy it.
InstaCloud provides the serverless compute that lets your services autoscale, with all the infrastructure managed for you.
Agents branch into complete replica environments when working, keeping prod safe and iteration speed high.
And of course, it all works seamlessly with agents through MCP/CLI.
Get off the traditional, legacy cloud.
Start deploying your services on InstaCloud today.
Kris Coleman retweeted
Adversarial agent reviews are the right next step 100% Then we provide so much more context to the review agent, and find things a human never would have found.
This is the moment ai review becomes better than human review
Maybe someone should build a rly good review agent to review the code of our coding agents and then use Jev to decide when to merge
