jcoglan

he/him : you may know me as @mountain_ghosts on twitter : I wrote some books you can buy from https://shop.jcoglan.com

Public Key

npub1ucfeu24zsz6cc60gwprjtjfafkzhcrdtwanmuz4th6ww3dp9990ssp8th2

NIP-05 Address

Profile Code

nprofile1qqswvyu7923gpdvvd858q3e9ey75mptupk4hwea7p24ma88gksjjjhcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsaearrv

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1ucfeu24zsz6cc60gwprjtjfafkzhcrdtwanmuz4th6ww3dp9990ssp8th2

Show more details

Last Notes

2026-07-23 08:35:04 GMT

somehow I only recently learned that LLMs need the whole conversation fed back to them on each prompt so their i/o cost scales as O(n^2), something that would be considered completely unacceptable in almost any other production network-accessible software

2026-07-19 17:37:22 GMT

- reply

you can't actually make a computing system that is anything but a large graph of these operations. you can make it as big as you like but it will only ever do those 3 things. therefore you need to show that those 3 things and nothing more can give rise to consciousness

2026-04-10 07:44:05 GMT

this is about where I am, it's like a ton of people decided to forget how anything works and become helpless on purpose
#nevent1q…ada4

2026-04-09 16:37:31 GMT

learning that freeagent, the accounting software recommended to me most often by tech contractors, is steaming garbage. creates ludicrous amounts of busywork "explaining" sales transactions and gets the dates of said transactions wrong

2026-03-27 12:02:07 GMT

from now until the end of april, I'm running a 50% discount on my book "building git", just enter voucher code BGAPR2026 https://shop.jcoglan.com/building-git/

2026-03-05 17:21:22 GMT

me 3 months ago: £100+/mo is an unjustifiable expense for what claude does for me
me now: not sure I could live with myself knowingly giving £100+/mo to the "blow up a random school" machine

2026-03-05 09:15:45 GMT

is there a critique of that Knuth article? lots of people are gushing about it just b/c it's him, but I'm not familiar enough with its subject matter to tell if it's legit. however, stuff like this feels really off:
"Filip Stappers tested Claude’s Python program for all odd m between 3 and 101, finding perfect decompositions each time. Thus he concluded, quite reasonably, that the problem was indeed solved for odd values of m."
like, that's not how maths works

2026-02-25 15:52:58 GMT

it is astonishing to me that this (i.e. security under an untrusted server) is novel research to these systems. ever since I started developing vault (2012) my model has been: I want to sync my secrets with dropbox, and I do not trust dropbox either not to look at my data or to preserve its integrity. these are ideas you would get from any basic introduction to cryptography
#nevent1q…hlv7

2026-01-19 22:23:25 GMT

tried reporting a bug in this python project but the author says it's working as indented

2025-12-11 17:42:40 GMT

is github having ongoing outages or is it just like that now

2025-10-17 14:05:47 GMT

the ruby ecosystem, in particular the people running the package repo, have set a precedent that if you make something and it becomes important, it can be taken from you with no due process

2025-10-09 11:46:15 GMT

an operating system by the guy whose web framework actively ignores how databases work? I don't think so

2025-10-03 17:31:38 GMT

even the "I write 90% of my code with AI" posts are saying the output is bad. like sure, you could generate a ton of garbage and whittle it down to something you're actually happy with, or you could just do good work yourself to begin with, which you're perfectly capable of
you aren't chiseling a block of marble, you're constructing logical proofs, act like it

2025-09-16 06:00:53 GMT

it is past time for the rails project and community to sever ties with dhh

2025-08-22 15:06:52 GMT

ah right I'm seeing why I don't like the layout of any of the keyboards I can actually find online: they match apple US layout, which puts backtick in the number row, and has a single-row-high enter key. y'all live like this?

2025-08-19 15:47:14 GMT

LLMs could still have the same set of algorithmic capabilities without being presented as a simulation of a person, and it feels increasingly important that they stop being presented in this way

2025-08-18 13:58:34 GMT

I'm actually surprised that this legal problem doesn't render LLMs unusable in most organisations https://mastodon.social/@[email protected]/115023464780783895

2025-08-12 14:30:35 GMT

don't suppose anyone knows how to get an apple keyboard working on fedora? I never had a problem with them on ubuntu but can't find any way to select the layout in fedora

2025-08-12 09:04:50 GMT

reminder to back up your github! I use these shell functions to clone/update every repo I have access to into a local directory. it uses `clone --mirror` to give you a complete copy of the remote repo, including pull request refs https://gist.github.com/jcoglan/511c770b8709ec8e211683310243f01a

2025-08-11 08:26:55 GMT

- reply

@nprofile…vdjy is json also vulnerable to canonicalisation attacks? I was wondering if this was a possible weakness of jwt on top of all the stuff introduced by its "agility" features

2025-08-09 11:24:16 GMT

emailed my MP this morning and the auto-response includes a "many people are already emailing us about gaza" bit followed by a long list of exculpatory "here's us feeling really bad about a situation we actively helped create" references. actually astonishing

2025-08-09 10:59:58 GMT

idk what is going to stop this government's awful direction but the least that needs to happen is MPs hearing from cis people that this campaign of transphobia being waged by them and the EHRC, supposedly for our benefit, is not actually something we want, and that it is hurting our friends

2025-08-08 19:27:43 GMT

part of my resentment towards LLMs is to do with them crowding out anything else we could be talking about. there are so many things I could be reading to get better at my craft but I'm presented with "you should actually get worse at it on purpose because nothing matters any more"

2025-07-29 12:40:28 GMT

the median website can't keep passwords safe, and the blast radius of a site-specific password is, well, just that site. the blast radius of having your driving license or passport stolen is, quite a bit bigger than that

2025-07-13 15:49:44 GMT

the thing everyone seems to be missing about age verification is that demanding ID from people amounts to a real-names policy, which is terrible for social media for very well documented reasons

2025-06-22 17:51:30 GMT

- reply

years of insisting that volunteers owe things to huge companies that aren't paying them has, empirically, not worked out, you need to try a second idea

2025-06-22 17:50:39 GMT

we have got to stop talking about open source software this way man. someone who published work with an explicit label on it saying "this comes with absolutely no warranty" and is not being compensated is not part of a "supply chain" https://abyssdomain.expert/@filippo/114723318068853623

2025-06-22 11:29:26 GMT

20 years ago you at least had the pretence that a war could be illegal, and that you had to come up with an argument for it. now we just get bounced into backing whatever horrors america wants literally overnight

2025-06-17 09:50:31 GMT

- reply

a previous job used it as a retrospective notes board and it was like "try to find where everyone is hanging out on this colossal open world map where you can't read anything and also your laptop is overheating"

2025-06-17 09:48:27 GMT

miro is a genuinely baffling product. what if the output of your entire design process was one massive fractal image https://tldr.nettime.org/@tante/114698031270325359

2025-06-13 11:42:14 GMT

ai companies: the computer can think
me: literally my first attempt at a basic logical inference puzzle does not work
ai defenders: nobody can actually define what "reasoning" is and nobody has ever tried

2025-06-09 17:42:32 GMT

at this point you're going to need to switch to linux to get away from mandatory passive AI use

2025-06-09 10:19:33 GMT

seen an argument that goes: yes LLM agents take many minutes to produce a result, but you can do something else in the meantime. you could have a bunch of agents doing different things for you at the same time

2025-06-05 09:08:07 GMT

- reply

*however* what we are currently seeing is IP being dismantled asymmetrically in favour of the wealthy. we cannot have a situation where big tech is allowed to ignore IP while people are serving prison sentences at nintendo's behest

2025-06-05 09:06:02 GMT

thing is, I'm not even opposed to dismantling IP as a concept, and I'm not wild about wielding it to oppose AI, because the same argument is used to shut down the internet archive

2025-06-04 14:53:58 GMT

the issues with the ptacek article are not just questions of tone. its actual content and arguments are lousy, they're just dressed up in the sort of bluster that makes people go "huh good point" without thinking very hard

2025-06-04 11:42:36 GMT

"it doesn't make me more productive but it creates chunks of time where the computer is doing something so I can go get a coffee" is how people used to complain about compilers

2025-06-03 19:25:34 GMT

- reply

@nprofile…ssyg I'm hearing "what's the alternative" a lot recently and if I took that attitude to very many things I would have to stop believing in anything

2025-06-03 19:21:16 GMT

- reply

framing actually being militant about your values and red lines and what you are willing to do for a pay cheque as just pissing and moaning and being a stick-in-the-mud, is just bad faith, sorry

2025-06-03 19:19:56 GMT

- reply

and also deploying arguments like "if you're gonna be a hard-liner about ethics you got into the wrong industry" -- you can recognise this field is full of awful things and *therefore* be very choosy about where you work, not just throw your hands up and go "why bother"

2025-06-03 19:16:04 GMT

zooming out a little bit, it does feel alarming to me that a lot of people whose stated politics are progressive or socialist or both are willing to give huge tech companies an easy ride for fully seizing the means of production for everyone, no matter where you personally work

2025-06-03 07:16:02 GMT

"wow I can't believe my friends don't like AI, they sure are big dum dums! AI is self evidently life changing"
so uh can you show us an example
"no"
alright well being berated as an idiot has made me lose respect for you
"here come the haters and losers"

2025-06-02 16:17:26 GMT

- reply

tests are how you, as the system's author and designer, express what it is *you* want the system to do and how it should be shaped. you cannot generate that information from the cloud

2025-06-02 16:16:09 GMT

regardless of any other factors, I actually think having an AI write tests is so categorically wrong it borders on malpractice

2025-06-01 19:38:32 GMT

LLMs turn your job into mostly code review, a task everyone famously loves to do and is good at

2025-05-27 07:30:15 GMT

a system that looks like github mcp should set off alarm bells even without untrusted input; I wouldn't tell an LLM agent with access to all my source code to go and scan a big corpus for instructions even if I wrote the entire corpus myself, simply b/c I do not know what effect that would have

2025-05-27 07:19:20 GMT

- reply

like it's not even the sort of security flaw you get from people not realising non-obvious properties of their platform and failing to guard against them, it's just ignoring foundational concepts in security engineering on purpose

2025-05-27 07:16:42 GMT

- reply

the way people are deploying LLMs is driving a freight train through the principle of least privilege and being surprised at the results

2025-05-27 07:15:05 GMT

- reply

the category error here is deploying something with unformalisable behaviour with any privilege to do anything at all without the express confirmation of a trusted human operator

2025-05-27 07:14:04 GMT

- reply

this is not a novel or surprising means of attacking systems. of course, obviously, if you give a system with no formalisable behaviour, that may execute anything as an instruction by design, elevated privileges and untrusted input, this will happen

2025-05-27 07:12:28 GMT

- reply

you cannot have an "injection attack" in a system with no formal distinction between data and instructions. what you actually have is an "everything is instructions" model and a failure to isolate untrusted inputs from the elevated privilege of access to private information

2025-05-27 07:04:22 GMT

if I have to hear the term "prompt injection" one more time

2025-05-26 12:06:47 GMT

I can't believe we replaced blogs and RSS with people emailing their posts to you. just a really obviously stupid step backwards

2025-05-22 18:27:56 GMT

becoming the cryptography joker. the cryptoker

2025-04-02 18:58:02 GMT

been trying to write this article periodically for years, but I finally found the time: here's how to sync anything https://neighbourhood.ie/blog/2025/04/06/how-to-sync-anything

2025-03-26 09:42:28 GMT

this pixelfed bug really feels like a design problem at the protocol level to me; it requires way too much unearned trust to expect a network of programs that are highly decoupled and barely trust each other to enforce one another's access controls, especially on the level of individual posts

2025-03-25 10:09:06 GMT

@nprofile…vdjy do you mind if I ask a quick question? in https://soatok.blog/2020/09/09/designing-new-cryptography-for-non-standard-threat-models/ you say that the lengths of components encoded to prevent canonicalisation attacks should be little-endian. the PASETO pre-auth encoding does the same. is the endianness important here, and why?

2025-03-19 18:28:16 GMT

- reply

@nprofile…y4h5 ms and apple bricking perfectly good hardware that open source OSes continue to support is infuriating

2025-03-19 00:04:01 GMT

- reply

@nprofile…vklh twitter had encrypted DMs?!

2025-03-18 15:41:30 GMT

my friend is raising money to help their friend Maher and his family evacuate from Gaza and get medical treatment; they have helped four people evacuate already and it would be amazing if you can help further https://chuffed.org/project/121901-help-mahers-family-with-medical-costs

2025-03-12 22:38:05 GMT

`brew bundle` seems to have removed the `--no-lock` option, which implies it no longer produces lockfiles?

2025-03-05 14:07:07 GMT

a work thing: we were recently commission to do some in-depth CouchDB performance analysis leading up to a AAA game launch, and we did a detailed write-up of it: https://neighbourhood.ie/blog/2025/03/04/case-study-10x-couchdb-performance-gains-for-a-aaa-game-launch

2025-03-03 12:50:07 GMT

for the whole of this month, I'm offering 50% off my book "building git", which teaches you a huge array of software and system engineering topics while learning how git works. use voucher code "SMARCH" https://shop.jcoglan.com/building-git/

2025-02-27 23:04:29 GMT

- reply

their argument would imply that open source authors require a license grant from users of their software to handle inputs to the software, which is categorically false *unless they are exfiltrating user input* which would render their work malware

2025-02-27 22:28:02 GMT

various people been saying this for a while but it cannot be overstated how much using ai art on your podcast/blog/slides/etc visually associates you with fascism https://newsocialist.org.uk/transmissions/ai-the-new-aesthetics-of-fascism/

2025-02-12 00:19:20 GMT

shopify has been allowed to coast for far too long on being one of the "cool rails companies" where you can get a fun job doing open source, and the ruby community needs to reckon with its role in laundering this one company's reputation

2025-02-07 11:07:59 GMT

this chimes with my experience of the type of thing I've been working on the last few years (databases/storage systems, distsys, consistency), where I don't believe you can "incremental TDD" your way to a correct design; you do actually have to think about the entire problem in detail up front before you start writing code https://explaining.software/archive/the-sudoku-affair/