Posts tagged with "ai"

2026-08-10 / tags: projects, security, quick reads, sidebar updates, ai, housekeeping

Scenes from my inbox over the past month:

July 10th: [Constance Bello's Blog] Your site has been updated to WordPress 7.0.1
July 17th: [Constance Bello's Blog] Your site has been updated to WordPress 7.0.2
August 6th: [Constance Bello's Blog] Your site has been updated to WordPress 7.0.3

I had my blog running on a managed WordPress site run by May First, a technology cooperative I'm a member of – and their staff have been busy. I'm far from the only person having to deal with frequent updates for my software of late. And WordPress is far from the only affected software. Though 7.0.1 was a maintenance release to follow up on non-security bugs from 7.0 a month and a half prior, 7.0.2 and 7.0.3 fixed critical- and high-severity security bugs that are being discovered at a rapid clip thanks to advances in frontier LLM capability combined with more and more researchers pointing them at software projects, intentionally or not^[1]. You may have noticed that your operating system, web browser, or other important software has been needing updates more than usual lately – this is why.
The most secure code is the code that never runs, so I've decided to switch to a static site generator-based website. Instead of a WordPress process running on a server at all times to give you access to my posts, this setup spits out a folder that contains static files that make up the website, which can be served by a variety of service providers and HTTP servers with ease. This trades off a bit of functionality for users (like the ability to comment on posts and subscribe to a mailing list without going to another website) with lots of upside for all parties (better security and a more privacy-respecting posture for users, and the same for me, plus less maintenance overhead and more customizability). If you're interested in all the gory details, I might put out a technical writeup at some point, but for now feel free to look at a mirror of the code.

Personally, my life has been a hot mess the past couple months, between moving (twice... ask me about my Airbnb experience when I was between apartments) and continuing to look for work. I've only recently had time to settle back into projects and getting back to the blog was on top of the proverbial priority queue. I'm bundling that with an update to my #branding; that logo in the top left of the screen^[2] is also in my wallet now!

I'm looking forward to giving some of these out at the New Yorker Hotel, where I'll be next weekend for HOPE!

And, as per usual, sidebar additions:

• The Casual Finance YouTube channel tackles the AI bubble from an economics perspective, explaining how fucked everything is in the ✨capital markets✨ that allocate resources in the systems we exist within.
• Simon Willison's Weblog has lots of insights on the day-to-day use of LLMs for software engineering. I resisted for a long time, but I finally bit the bullet and started using LLMs in a very limited way for my projects, with Zed's built-in AI features hooked up to Ollama running models locally. This way, I won't need to worry about what might happen to my model access when the bottom falls out from under OpenAI and Anthropic, since I'm not using any of their tech anyway, and by using open weight models I'm not propping up their business model predicated on extraction.

Until next time, friends...

2026-06-25 / updated 2026-06-25 / tags: ai, anthropic, openai, spacex, quick reads

Elon Musk (SpaceX), Sam Altman (OpenAI), Dario Amodei (Anthropic), and a whole bunch of their buddies in and around the billionaires club are in the final stages of pulling the rug. The AI bubble has worked like every other bubble has: convince a lot of people that something is worth way more than its actual value; rake in a lot of money promising unlimited future growth; and make sure someone else holds the Beanie Babies before everyone realizes they're not going to autonomously cure cancer or end civilization.

If your bubble gets big enough, and you have enough insiders in on the racket, then you get to [rewrite the rules to the Nasdaq index](rewrite the rules to the Nasdaq index) to force passive investors to buy those shares of a company from the egomaniacal grifter who brought us the wildly successful Hyperloop whose official stance on its path to profitability is "we are going to launch data centers into space".

Uh huh. Sure.

A lot of people have been suckered into believing that this technology is as revolutionary as the three men I named at the beginning of the post, and countless AI boosters on LinkedIn, are claiming. Well, sure, if you can get past the fact that the AI companies have been navigating diminishing returns for nearly two years already, they've started charging you to use the models based on how much they actually cost to run, and as a result everyone is flipping out about how much money they're lighting on fire. The simple fact is that the fundamentals are not there.

Speaking as someone who worked at a financial firm: Wall Street does not know better than you. They are being conned like every other C-suite exec that gets a call from an OpenAI or Anthropic rep, getting pitched a miraculous technology that replaces 90% of their workers (who they'd love to fire and keep all that sweet, sweet salary money for themselves), and is accurate enough to increase the business' productivity. Meanwhile, actual, real businesses that invest heavily in AI just end up wasting more and more of their own resources trying to justify the sunk cost, and on and on it goes.

People want to believe the hype and bury their heads in the sand. This has proven throughout history to be a wildly ineffective strategy for accomplishing anything other than getting run over. We must be clear eyed about what is coming, and prepare and protect ourselves to the extent possible, dominant narratives of "too big to fail" be damned. Right now, in my humble opinion, one important piece of that is being very careful and thorough about zeroing out exposure to SpaceX (and, when they IPO, OpenAI and Anthropic) stock, including via funds that hold shares in those companies, and minimizing exposure to the tech sector more broadly.

Large language model technology is useful. It is interesting. It is categorically not useful and interesting enough to warrant OpenAI, Anthropic, and SpaceX to be currently valued at what is likely upwards of $5 trillion combined^[1], a number I expect to show a further rise before a precipitous crash. We are all going to suffer when that basic truth can no longer be avoided. A sinking tide lowers all boats; make your plans accordingly.

Update 6/25/2026: I got feedback on this post that inspired me to add some clarification. I do not mean to say that anyone should sell all their stocks and hold cash, which is also called "timing the market" and "a bad idea". What I am saying is that it makes sense for folks to consider reallocating their equity holdings to funds that track a different index, like the S&P 500. In a retirement account, selling holdings is not a taxable event, but in a regular brokerage account it is, so keep that in mind as well. At the end of the day, I am not a financial advisor or fiduciary, just someone who can see the cracks crawling up the foundation. If you have someone to help you navigate your personal financial situation, absolutely trust them over me with those matters.

2026-05-14 / updated 2026-06-17 / tags: big tech, data sovereignty, github, microsoft, sidebar updates, ai

The open source software ecosystem collectively putting all its eggs in one basket may not have been the best decision.

I'm going to start with a brief timeline of events.
June 29, 2021: GitHub launches Copilot Technical Preview (Wayback Machine link).
June 30, 2022: The Software Freedom Conservancy launches their Give Up GitHub campaign, in response to GitHub and Microsoft's refusal to engage with critiques of their use of publicly available code uploaded to GitHub for training Copilot models regardless of how that code is licensed.
August 11, 2025: GitHub CEO Thomas Dohmke resigns, and Microsoft folds it into its CoreAI group, eliminating GitHub's independence from Microsoft management (paywalled link).
April 28, 2026: GitHub CTO Vlad Fedorov apologizes for serious issues GitHub had on April 23 and April 27 that brought usage to a complete halt twice in one week.
April 28, 2026: The same day, HashiCorp cofounder Mitchell Hashimoto says GitHub is "no longer a place for serious work" in his blog post announcing the migration of the Ghostty project to another hosted git platform. Damningly, the decision to migrate Ghostty was made before the April 27 outage.
May 4, 2026: dayswithoutgithubincident.com is posted to Hacker News. When I first saw it, it showed 0 days since last incident; as of writing, it shows 1. It's also got a neat little "High Score" widget, showing the longest streak of days in 2026 with no incidents (6, from April 2 to April 9).

You might notice a trend here, which is tied together by that word Cory Doctorow coined and I've included in the title of this post^[1]. Priorities undoubtedly changed for GitHub once they were acquired by Microsoft back in June 2018, first slowly, then quickly. The AI bubble has needed significant engineering effort to sustain itself, which Redmond was more than happy to allocate when GitHub was all upside; seemingly limitless access to training data for AI coding models, vendor lock-in for thousands upon thousands of widely used open source projects, and a breezy talent pipeline to push engineers from GitHub enthusiasts to Azure DevOps professionals.
So much for "embrace, extend, extinguish"; right now it looks more like GitHub has exploded and everyone else is sprinting away.
The downsides to the world's reliance on Silicon Valley for critical services are making themselves more and more apparent over time. When Karim Khan, a prosecutor at the International Criminal Court, was blocked from accessing Microsoft services following the Trump administration placing sanctions on the ICC, a lot of people all over the world took notice. Digital sovereignty isn't a pie-in-the-sky ideal anymore – for many organizations, it's a base requirement urgently needing to be met.
I recently came across this post entitled "Why I'm leaving GitHub for Forgejo" that makes a lot of salient points related to these topics. I encourage you to read it and come back here when you're done. I'll highlight a specific idea pointed out by the author, Jorijn Schrijvershof, that isn't getting enough airtime:

The reliability story is downstream of the AI story. GitHub is not slowing down on AI features. It is doubling down on them. The outages are what doubling-down looks like in production.

The AI bullshit is wrecking the actual reason people ever came to GitHub in the first place: to come together and make software. These sort of antics were telegraphed in 2018, but decision makers were not listening to pundits in comments sections ranting about how it's time to move off of GitHub. Those network effects are strong, and concerns about espionage, software supply chain attacks, and managerial trust that were voiced in HN comments didn't reach the ears of decision makers. Now that organizations' bottom lines are being hit, whether their attitudes will change remains to be seen, but it seems clear now that to know who will burn you tomorrow, you should investigate who smells smokey today.

Speaking of Cory Doctorow, my initial sidebar had some glaring omissions. These have been rectified, as I have now added:

• Pluralistic by Cory Doctorow
• Addie LaMarr on Instagram and YouTube
• Good Work by Dan Toomey and Morning Brew

I could say a lot about Cory Doctorow and how much he's influenced my thinking and action, and I likely will at many points as I get further into this blogging thing.
Addie LaMarr's YouTube channel contains plenty of useful resources for folks wanting to get up to speed on seeing past cybersecurity hype and getting to the real heart of the matter.
Good Work just won a few Webby awards for their disgusting(ly hilarious) videos drilling down into such topics as "why is oil still such a big deal?" and "what does {Meta,Palantir,Oracle} actually do?" Oh, and peptides. Being in New York, a lot of the tech industry happenings I interact with get exported from the Bay Area, so having Dan and co help me recognize that, no, I'm not insane, everything really is that ridiculous is super helpful.
While I've got my sights on Microsoft, maybe next time I could talk about their irresponsible security posture, evidenced by a newly revealed exploit that unlocks any BitLocker drive by copying some files to it. Until then...

Addendum 6/17/2026: It was reported two nights ago that Microsoft is now buying compute from Amazon to keep GitHub afloat. So much for GitHub being a strategic asset to acquire...