I don't think they're suggesting that, rather that the "more eyeballs" quote is a bit flawed (in that not every project gets enough eyeballs). A thing can still be better then another thing and not be perfect.
You can scratch Cisco from the list - they just announced they will re-vibecode all of their codebase! So there will not be any explots for their hardware in the future - one way or the other. ;-)
My hate for hyperscalers is greater than my hate of being SRE.
It's time to leave GCP, AWS, and the rest.
Google and Amazon markup can eat it. Fuck those guys.
Let's not forget that Google and Amazon tried to offshore us, played a role in inventing the labor-displacing models in the first place, and that don't give a shit about any of us.
I hope they ossify and turn into the next IBMs.
They thought AI would lead to growth and a greater concentration of wealth for themselves, but it's actually the seeds of their own destruction and dismantlement.
Only tangentially related, but recently when I was working on a feature using iCloud, I noticed that it's just using Google storage APIs. I read Apple uses AWS S3 too.
Supposedly Apple holds the encryption keys on their own infra, but I still found it interesting how they are just reselling Google Cloud storage here.
It's also harder to explain to your customers why you're the only product they use that has a security problem when an exploit does eventually happen.
You see this already with uptime. If Github or AWS has a major outage, it's in the news and even people that don't understand software realize it's just "something happening today, everything is down".
And, unfortunately, in practice customers don't care about this inverse, when "everyone else is down but not that one product".
Good like trying to explain to your customers that their data is no more accessible because some api key ended up in a public git repo or since you admin panel is exposed to whole internet someone was able to log in.
With the speed of exploitation hitting right now your analysis will be out of date in a few weeks to months. We are about to have very palpable fear hitting all software vendors. It will be seen as irresponsible to use centralized systems
You can't defend yourself from everything, but you can try to make you life easier by reducing the attack surface and make side movements more difficult.
No human can stay on par with 30k pull requests per day ... they simply don't have control on what's going on and rely on AI itself to do the job.
PS: I really want to know what is the churn rate (and the cost per LOC) here. My gut is saying the cost per LOC is insane, and they are basically rewriting over and over the same code.
30k PRs is such a meaningless figure though, you can't make anything of it. It entirely depends what's living in that repo. Adding localized strings, configs, things that change frequently, can easily move numbers like this by orders of magnitude. How big are the PRs? Maybe there's an auto-bug-fixer agent that runs around the codebase making thousands of single-line fixes per day. Who knows. The number means nothing in isolation. We used to scoff at bad managers for measuring the performance of engineers using lines of code, now we're using the same figures to judge AI. We've become the bad managers.
Actually LOC is a decent measurement, it becomes a bad measurement when you use it in the wrong way, like any other measurement.
Agree that 30k PR alone doesn't mean much, but there aren't other details on what's inside. Based on I saw on how LLM programming works, it's hard to believe that there are single-line fixes. If I have to bet I'd bet on 200 LOC on average, that is 6M/day. Even if only a small portion reach production, it's still insane.
It’s kind of ironic how your comment starts with “LOC is a decent measurement” with zero explanation, then quickly devolves into rough estimates, assumptions, and finishing with “6M/day… it’s still insane”
You’re proving precisely what I’m saying. You don’t have any real information and your guess is as good as mine. It’s just as plausible to assume Anthropic runs 50x experiments for every feature they ship and only 2% of the code hits production. It’s just as plausible to assume half or more of their repo is tests. It’s just as plausible to assume there’s as much comments, skills, docs, and context engineering as there is code. It’s just as plausible to assume that there’s 10x more configs, localized strings, and content as there is executable code.
If you add all my assumptions together that leaves us with about 15x PRs worth of shipped executable code. And even with your generous 200 LoC per PR, it’s only 3000 Lines per day. Now that’s insane!
You’re right, mine are assumptions are just as much assumptions as yours.
However, if you’ve worked with coding agents and seen repositories that were mostly vibecoded, you’ve probably also seen how complex they became in a very short time. Even the estimate of 200 LOC per PR was conservative, actual number is very likely much higher.
In any case, even if a large portion of those lines were documentation, tests, or comments, those count as LOC too, and it’s simply not humanly possible to keep up.
PS: They could simply release more data and stop the debate, but for some reason, they don’t.
Are you talking about manual review? Of course it isn’t possible to read that much, I never said it was. The scale of changes requires new approaches to engineering. Some may feel these processes are less rigorous, but in my opinion, when done well, they’re actually more.
I have worked in many codebases using coding agents. Sometimes their changes are large and sometimes they’re small. The better repos have many guardrails to keep the PRs small. I’m not sure why you’d assume why my or your experience working with them would be even remotely similar to working with them at Anthropic though. I think it’s just fine to say you don’t know. They have no obligation to appease to people debating in an HN thread.
I think in general you’re going to continue to struggle to translate your one-off experiences to these 1000x 10000x scales. Most people can’t fathom scaling anything beyond 10-100x.
Zitron complained about a lot of things, one some he was wrong (eg. llm are not useful), on others(eg. "magic accounting" or datacenters ) he has very good points ... but we will see.
He did not say LLMs are not useful, he said they’re valuable for software engineering and could justify a hundred million or billion dollar valuation but not a trillion dollar valuation
This is latests refactor, in older videos he stated more than once that llms are basically crap (and at the time he said that he was probably right, but it was very short sight)
I agree on this part, but what's your point here? Are you suggesting closed source is better?
reply