Vouch for an Open Source Web of Trust  ## Document Notes ## Highlights - **Super Bowl Ad Triggered Costly Outage** - AI.com spent massively on domain and ad and got overwhelmed by traffic that caused an expensive DDoS-like failure. - The incident effectively served as free advertising for Cloudflare's gateway timeout page. Transcript: Jerod Santo So, the folks at AI.com apparently spent $70 million on the domain, then another $15 million on a Super Bowl ad, then failed to prepare for the resulting flood. The end result? One of the most expensive,-inflicted DDoS attacks in tech history and free advertising for Cloudflare's standard gateway timeout page. ([Time 0:00:14](https://share.snipd.com/snip/78bad7db-c738-40dd-aca0-48359fe220fb)) - **Adopt Explicit Vouching For OSS Trust** - Use explicit vouching to manage trust in open source projects and block bad actors proactively. - Require vouches for contributors and allow denouncements to maintain a safer contributor community. Transcript: Jerod Santo Here's ghosty creator Mitchell Hashimoto. Quote, AI eliminated the natural barrier to that let OSS projects trust by default. People told me to do something rather than just complain, so I did. Introducing Vouch, explicit trust management for open source. Trusted people vouch for others. End quote. The idea is simple and it mimics real life social constructs, so I think it has a chance of succeeding. Quote, Unvouched users can't contribute to your projects. Very bad users can be explicitly denounced, effectively blocked. Users are vouched or denounced by contributors via GitHub issue or discussion comments or via the CLI. End quote. Mitchell is rolling out this vouching process in Ghostie immediately. ([Time 0:00:44](https://share.snipd.com/snip/43f29168-0ad8-4973-95ff-a0c6db3e5cb1)) - **Agent Teams Produce Scale But Not Reliability** - Autonomous agent teams can produce complex artifacts but still miss crucial correctness checks. - The Anthropic experiment built a compiler that compiles Linux yet fails basic programs, exposing limits of current agent systems. Transcript: Jerod Santo Clods build a C compiler. Alongside the launch of Opus 4.6, the Anthropic team published the results of Nicholas Carlini's experiment with agent teams. Quote, I tasked 16 agents with writing a Rust-based C compiler from scratch capable of compiling a Linux kernel. Over nearly 2,000 cloud code sessions and $20,000 in API costs, the agent team produced a 100,000 compiler that can build Linux 6.9 on x86, ARM, and RISC-V. End quote. It was a fascinating journey, which produced some new techniques in designing harnesses for long-running autonomous agent teams. The resulting compiler can build Linux 6.9, but isn't a fully functional C compiler. ([Time 0:01:31](https://share.snipd.com/snip/adf73d94-e8af-4e3b-9d3a-8b962497d24c)) - **Tools Haven't Eliminated Developer Demand** - Repeated cycles promising to replace developers reflect a persistent need, not tool failure. - The constraint is problem complexity, so new tools increase developer demand rather than remove it. Transcript: Jerod Santo We've tried to replace devs every decade since 1969. Stephen Schwab recounts the history of the sentiment that, this time, we'll finally make software development simple enough that we won't need so many developers. According to Stephen, quote, understanding why this cycle persists for 50 years reveals what both sides need to know about the nature of software work, end quote. In brief, the history looks like this. 1969, the dream was born during the Apollo program. 1970s, COBOL, business people will write their own programs. 1980s, case tools will generate everything. 1990s, Visual Basic and Delphi, drag, drop, done. 2000s, web frameworks, low code and no code. And today, AI, the latest chapter in a long story. So far, every advancement has not reduced the need for developers, but increased it. Steven says AI will do the same. Quote, the pattern continues because the dream reflects a legitimate need. We genuinely require faster, more efficient ways to create software. We just keep discovering that the constraint isn't the tool. It's the complexity of the problems we're trying to solve. Understanding this doesn't mean rejecting new tools. ([Time 0:02:23](https://share.snipd.com/snip/e25fbfce-bc5f-4eb4-9a22-2de33233534d)) - **Choose Simplicity And OS Isolation For Security** - Prefer simpler, auditable systems with OS-level isolation when security or explainability matters. - NanoClaw favors minimal code, container isolation, and forking for features over large opaque frameworks. Transcript: Jerod Santo Quote, OpenClaw is an impressive project with a great vision, but I can't sleep well running software I don't understand with access to my life. OpenClaw has 52 plus modules, eight config management files, 45 plus dependencies, and abstractions for 15 channel providers. Security is application level with allow lists and pairing codes rather than OS isolation. Everything runs in one node process ChangeLog News. Shared memory. NanoClaw gives you the same core functionality in a code base you can understand in 8 minutes. One process, a handful of files, agents run in actual Linux containers with file system isolation, not behind permission checks. ([Time 0:04:52](https://share.snipd.com/snip/5bfaf71f-57b7-40ca-98df-a553e44ac2ad)) - **Keep Human Judgment Over Generated Code** - Don't outsource critical thinking to LLMs; validate and reason about generated code yourself. - Use models as accelerants, but keep human judgment for design and production decisions. Transcript: Jerod Santo Sophie Kuhnen explains why she's unsettled by so many people going so hard on LLM generated code in a way that she can't wrap her head around. Quote, I find it hard to justify the value of investing so much of my time, perfecting the art of asking a machine to write what I could do perfectly well in less time than it takes to hone The prompt. You've got to give it enough context, but not too much, or it gets overloaded. You're supposed to craft lengthy prompts that massage the AI assistant's apparently fragile ego by telling it, you are not. You are an expert in distributed systems, as if it were an insecure, mediocre software developer. Or, I could just write the damn code in less time than all of this takes to get working. End quote. I shared this position with her until recently, but I don't do any of the fancy prompting or massaging that other devs talk about, and I've been getting excellent results the last few Months. Back to Sophie, quote, my worry is more around people thinking they can vibe code their way to production-ready software, or hand off the actual thinking behind the coding, end quote. I'm 100% with her on this last bit. We cannot off the actual thinking and produce anything of lasting value. ([Time 0:05:50](https://share.snipd.com/snip/8750fbcb-3714-422b-a868-3dcd2e18ecf4))