Software Engineer. Bioinformatics & AI teacher and researcher @ @eseiuvigo. I know how to code by hand, among other hobbies
Ourense
Joined March 2009
- Tweets19.3K
- Following2.2K
- Followers3.5K
- Likes10.4K
Daniel Glez-Peña 🇪🇺 retweeted
Justamente escribí ayer sobre esa y otras derivadas del impacto de la IA en la salud mental de los programadores.
Comparte si crees que le puede ser util a alguien.
aicode.academy/blog/es/psico…
El vendaval de la IA está despeinando incluso los cerebros más engomindados.
No había visto el impacto psicológico que puede tener la IA en los trabajadores hasta anoche, hablando con un amigo.
Un tío muy inteligente que en los últimos años había virado hacia la programación (desde el mundo del VFX) se encuentra con que el trabajo de meses lo ha sacado adelante otra persona del equipo en un día, reemplazando su trabajo previo.
La sensación de sentirse obsoleto de golpe lo dejó tiritando. No es solo el miedo a perder el trabajo, sino el sentir que años de esfuerzo por aprender se han ido por el retrete.
Y como guinda del pastel, perder algo que tanto placer intelectual le daba como programar.
Se me ha quedado el pobre hombre más vacío que una cáscara de pipa.
To invalidate "software engineering", you have to challenge it's two parts:
- software (there were be no software in the future)
- engineering (software will be built without following any professional practice to fit it into restrictions)
None of these are threatened.
The software engineering profession will disappear.
I spend a lot of time thinking about the future, and observing trends. Here is my take on what will happen:
1. In 5-10 years from now AI will fully re-write all the technology layers we have now and create a more efficient paradigm. Something a lot more efficient, but not legible by humans. No more Python, Javascript, Java, etc.
2. We will no longer be looking at code at all. We’ll no longer know what code is.
3. The focus will only be on creativity and creative problem solving. Domain expertise and knowledge will still be key to know in which new directions to steer AI to develop novelty.
If you are in software engineering, and not thinking about some domain in depth from all angles (marketing, commercial, financial, legal, etc.) then it is time to make a change now.
Daniel Glez-Peña 🇪🇺 retweeted
No hay señales que la IA esté mejorando la economía de ninguna empresa del S&P 500, según un reporte.
Excepto de 7: Apple, Google, Microsoft, Amazon, Meta, NVIDIA y Tesla. ¿Y qué pasa con las demás?
El revenue por trabajador, margen de beneficios y mejora de la productividad está plano, según un estudio de Apollo.
Tengo bastantes lecturas de esto. Primero, que hacer cosas muy rápido no significa monetizar más.
Eso lo veo todos los días, la gente crea muchas cosas, pero pocas realmente con impacto real.
Luego, que también hay muchas empresas que el cambio tecnológico todavía ni se ha asomado por ahí.
¿Cómo ves estos datos? ¿Cómo lo llevan en tu empresa?
El reporte de Apollo es este: apollo.com/insights-news/ins…
ALT Gráfico titulado Revenue per worker moving up for tech but not for the rest of the economy. Compara el ingreso por empleado de Magnificent 7, en verde, y S&P 493, en gris, entre 2019 y 2026; la línea verde sube con fuerza y la gris se mantiene casi estable. Ambas escalas están ajustadas por inflación.
A ver si la falta de proyectos con impacto nunca fue principalmente por la programación como cuello de botella, sino por la falta de ideas con impacto.
Daniel Glez-Peña 🇪🇺 retweeted
Después de unos 4B de tokens gastados con DeepSeek 4.1, he conseguido crear una suite de laboratorios vulnerables. Entre máquinas virtuales ocupa unos 600 GB aproximadamente.
¿Por qué lo hago? Quiero un entorno de investigación para entrenar y hacer benchmark de mi nuevo orquestador + harness. Durante el proceso del pre-laboratorio me di cuenta de que todos los benchmarks están alterados: en el corpus de los LLMs actuales están prácticamente todos los CTFs complejos que se usan como laboratorio. En pocas iteraciones el swarm empieza a reconocer los patrones y se sesga, contaminando el resto del experimento.
Tuve que poner agentes auditando la Chain of Thought para detectar trazas como "Wait, this seems like X CTF…" y casos similares. Siempre aparecían, así que empecé a montar mi propia "mazmorra".
Se compone de unas 8 máquinas Windows con Active Directory y 4 Linux, cada una con diferentes servicios y propósitos específicos. A partir de ahí, ¡dejaron de aparecer las trazas por completo! El swarm empezó a encontrarse problemas, gastar muchos más tokens, turnos de iteración e incluso fallos (anti-comportamiento del harness) que antes no ocurrían. Justo lo que buscaba para tener un dataset más variado.
Ahora mismo el swarm se está peleando para pivotar de las máquinas de AD a las de Linux, y les cuesta un poco. Es divertido ver cómo piensan. Y por cierto, todos los agentes son Deepseek v4.1-flash 1017.
RogerKernel
Daniel Glez-Peña 🇪🇺 retweeted
The em dash vanished from machine text because it annoyed readers, and from human text because writers kept getting mistaken for bots. Now the detector punishes the human for writing like a machine and rewards the machine for writing like a human ↓
No tengo problema en adaptarme a los nuevos tiempos y asumir que no se programará a mano.
Pero cada día me interesa más la pregunta (por estar más abierta) de *qué* software se hará en el futuro y no tanto *cómo* se hará.
Clonar productos, o hacer lo de siempre no es el futuro.
Pienso igual: al final va a ser otra adaptación más. Será tortuoso, pero llegará un equilibrio. El software tendrá un nivel de seguridad adecuado a los nuevos tiempos.
Daniel Glez-Peña 🇪🇺 retweeted
This is it.
Everyone is excited about AI.
I'm not.
AI is the biggest commoditizer of human capability we have ever built. Doctors earn more than cleaners because expertise takes a decade to acquire and judgment to apply. AI is going to make most of that expertise available to anyone, at marginal cost.
The gap doesn't go to zero. But it shrinks. And the same thing happens in almost every knowledge profession. Programmers. Lawyers. Analysts. Traders. Designers. The taxi driver replaced by a robotaxi is the easy case. The harder ones are people who spent twenty years training to do something a model can now do in a second.
The one corner of human life I don't see this hitting is sport. Nobody pays to watch a robot beat a human. The whole appeal is humans competing against each other. That's why nobody watches Deep Blue play chess anymore.
From an investing perspective, the next decade plays out in three phases.
Phase 1 is the buildout. Hundreds of billions in capex on chips, data centers, and energy. This is what's driving today's market.
Phase 2 is the deployment. Productivity rises sharply, then deflation sets in as the cost of knowledge work collapses. Jobs disappear faster than the economy can replace them.
Phase 3 is the social adjustment. Capital becomes more powerful than labor. The biggest winners are likely to sit where AI cannot reach. Real assets. Energy. Commodities. Precious metals. Scarce land.
And there's something deeper than the economics. The Japanese have a word for it: ikigai. The reason you get up in the morning. Your vocation. Your purpose. The work that makes you feel needed. AI is coming for that too. Nobody has yet figured out what a healthy society does when most of its members no longer feel needed by anything.
I might be wrong. I hope I am.
If I'm not, the world is about to change faster than most people are ready for.
Daniel Glez-Peña 🇪🇺 retweeted
php-rust: Francesco Tinti’s Rust rewrite of PHP 8.5 now runs full WordPress core tests at near-parity on real MySQL.
Vibe coders:
Linus Torvalds uses Claude for Linux, but doesn’t want your AI code if you don’t understand it.
He wants “competent people to use AI as a tool” and criticizes drive by patches from people who don’t understand their submissions.
Newcomers are welcome, as long as they’re willing to learn and understand the code they submit.
Linus also identifies another problem. AI is finding real bugs, adding work for already overloaded maintainers.
His position is clear. Use AI, but understand the code you submit.
Full story: theregister.com/columnists/2…
Daniel Glez-Peña 🇪🇺 retweeted
Linus Torvalds uses Claude for Linux, but doesn’t want your AI code if you don’t understand it.
He wants “competent people to use AI as a tool” and criticizes drive by patches from people who don’t understand their submissions.
Newcomers are welcome, as long as they’re willing to learn and understand the code they submit.
Linus also identifies another problem. AI is finding real bugs, adding work for already overloaded maintainers.
His position is clear. Use AI, but understand the code you submit.
Full story: theregister.com/columnists/2…
Ya lo dijo @unclebobmartin, que más o menos dijo en una reciente entrevista: "cuando salieron los compiladores, al principio, algunos desconfiábamos de qué código ensamblador generaban; queríamos mirar; decíamos que nosotros lo hubiésemos hecho mejor. Eso fue un tiempo".
Llevamos décadas construyendo software con código mediocre, bugs ancestrales, hacks sobre hacks, tests a medias, TODOs olvidados, parches temporales que se volvieron permanentes y código que nadie se atreve a tocar.
Y ahora resulta que nos preocupa confiar en código que no entendemos porque lo escribió una IA.
Como si lleváramos décadas entendiendo perfectamente el código que escribimos nosotros.
Daniel Glez-Peña 🇪🇺 retweeted
Some good news on the PHP front: various WAF and content distribution network providers have chimed in, reporting millions of attempts to exploit exposed servers worldwide, but none successful so far. In fact, exploit attempts seem to have started days before the vulnerabilities were disclosed and ramped up through the hours before and after.
This reiterates several points I made in videos I posted after the Mythos hype from earlier this year: discovering a vulnerability, even an exploitable vulnerability, does not mean you can compromise a vulnerable target to any measurable impact.
Time will tell, but the indications are again that this had more potential than actual impact.
But the narrative will probably win the day anyway.
Daniel Glez-Peña 🇪🇺 retweeted
We protect over 5 million PHP sites and when we find a major exploitable vulnerability, we always see site cleanings. We have seen exactly zero hacked sites from php2shell. Zero. Across a population of 5 million PHP sites that our product protects. Draw your own conclusions. #php2shell
Daniel Glez-Peña 🇪🇺 retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Vale, bien, me pueden ejecutar código arbitrario en mi máquina... comprendo... y... qué código? grepear buscando claves? encriptarme el disco?
No: soltarme un agente con prompt: "quémalo todo!" (--yolo), conectado a un LLM open-weights sin guardrails.
Buenas noches.
Hoy se supone que iba a poner las preguntas de un examen, no pasarme el dia inventariando apps con PHP, poniéndolas offline por si acaso, y poniéndole una vela al santo que sigue compilando PHPs viejos con parches de seguridad
El de la vela del PHP (sigo aquí porque también tengo gitlab): teapawt.net/jackmcdade/status/2112…
