|
💻 platform alternatives | 🤖 "AI" and its regulation | 🔒 user #privacy | 🗺️ digital sovereignty
|
Today we have an interview! $5-and up patrons and YouTube members got the unedited version of this on Monday.
Nik’s advice when your boss loves Claude a little too much:
‘Just let the money run out, it’ll be fine in two years’
The video and podcast are up now! The rough transcript is on YouTube, the readable cleaned-up transcript is on the Patreon. [YouTube; podcast; Patreon]
When you write a computer program, you will often want it to access private things, like a database or a service you’re paying for. A human, you could ask for a password. But a program needs an access secret so a human doesn’t have to press a button each time.
There are ways to do this without just putting the password into the program code. They’re sort of convoluted, but any competent programmer should be experienced in them.
Chatbots aren’t competent programmers. So the way coding bots keep doing this is to put the access secret right there in the code!
And if your program’s code repository is public, you’ve just told the world!
GitGuardian published its “State of Secrets Sprawl” report in March, summarising credential leaks in 2025. AI secret security is a trash fire: [GitGuardian, PDF]
In 2025, we found 28.65 million new hardcoded secrets in new public GitHub commits. This is not cumulative. That was just the number of secrets added in 2025. This marks a 34% increase from our previous report, which covered 2024, marking the largest single‑year jump we have ever recorded.
GitGuardian firmly blames AI coding:
Eight of the ten types of leaked secrets showing the sharpest increase year over year are tied to AI services. LLM infrastructure … is leaking 5x faster than core model providers. Despite AI guardrails, developers who rely on Claude Code to produce code and co‑author commits leak secrets at 2x the baseline rate.
The greatest quantity of leaks came from Claude Code and OpenClaw.
Internal repositories, private to your company, have about six times as many secrets as public repos. That’s tolerable until something leaks — say, you pull a malwared NPM package onto your developer laptop.
Worse yet is when you get a consultant in. When Red Hat was hit by the Crimson Collective hacking group last September and they got access to the Red Hat Consulting GitLab instance, Red Hat didn’t mention in their disclosure that the attackers got a pile of credentials and secrets belonging to Red Hat’s customers. Because Red Hat Consulting had just committed the customer secrets to the repository. [Red Hat]
Detecting the leaked secrets isn’t enough. Nobody seems to fix the leaks:
64% of secrets leaked in 2022 remain valid and vulnerable today.
What do you do about this? First, you understand the local problem. Then you set up your processes to make it hard to commit secrets and make sure the developers understand the problem.
Trouble is, AI coding is breeding so-called developers who literally can’t work without the bot. The chatbot is a magic box. When Claude had a day-long outage, these were the guys who couldn’t do any work at all.
You can make the devs sign something taking full responsibility for all commits, but that piece of paper doesn’t do any security work.
The only actual fix I can see coming is that AI coding becomes too expensive and the AI devs have to learn to code again.
But also, your company has to give a hoot about security over convenience. Good luck with that.
Google’s AI overviews are accurate 91% of the time! Which means 9% of the time, the AI is just making stuff up. [NYT, archive]
That’s not good enough when the AI hallucinates that someone’s a crook.
Two publishing houses in Munich sued Google for defamation when the AI overview made out they were involved in scams, subscription traps, and other dodgy business.
The companies sent cease-and-desist letters, but Google didn’t do anything about the false statements. So the companies took Google to court — and they won. [Decoder, in German; ruling, in German, PDF, archive]
Germany has case law that plain search results with text snippets, even tab autocomplete suggestions, are not defamatory if they’re just presenting what web pages say.
But the AI summary isn’t doing that — it’s a synthesis that Google generated and published.
One key point was that the AI overview contained statements that weren’t in the cited sources at all.
The judge also said the AI overview is in no way necessary to search results. The AI overview is an extra thing Google put on top. So that’s another way the AI is not covered by the search engine exemption.
AI output doesn’t even get protection as freedom of speech — because it’s not a person writing, it’s just output from an algorithm.
The judgement applies across Germany.
The publishing companies won most of their case — so Google pays 80% of costs and the companies pay 10% each. Google said it would be appealing the ruling. [DW]
TRANSCRIPT OF CARTOON
This cartoon has six panels, each of which shows a different scene. The first five panels all feature cheerful robots in office environments.
PANEL 1
A shiny golden robot talks to the viewer.
GOLDIE: Good news! Here are just some of the ways AI saves you time and makes your job better!
PANEL 2
A robot – which seems to be a suit and tie with a smartphone sticking up out of the collar – talks to us. He’s carrying a huge stack of papers.
PHONE: Good news! Because your new AI agent is expected to save you so much time, the company is providing you with extra work!
PANEL 3
A tiny robot that looks like a ball with hands is bouncing on a desk.
BOUNCY: Good news! The AI agent makes lots of mistakes, so you get to do proofreading and debugging! Yay!
PANEL 4
A robot with a head shaped like a Telsa Cybertruck talks to us. A bunch of other robots are in the background.
TELSA: Good news! The company has determined you’ll get more work done with more AI agents doing more bad work for you to check and correct!
PANEL 5
A coffee machine with a screen with a happy face on it talks to us.
COFFEE: Good news! More of your colleagues are letting AI do their jobs, so now you get to fix that work, too!
PANEL 6
A human with a shellshocked look is walking on a sidewalk, carrying a cardboard box full of desk stuff in classic I’ve-just-been-fired iconography. A caption is shaped like a memo on paper.
CAPTION: Good news! We’ve determined that bad work done by A.I. is more cost-effective than better work done by humans.
CHICKEN FAT WATCH
“Chicken fat” is obsolete jargon for what we now call “Easter eggs.”
PANEL 1: A poster on the wall says LESSER EVIL INCORPORATED. “If it’s not lethal, it’s a lesser evil.” A rat sits reading a book, Charlotte’s Web.
PANEL 2: A gigantic ant is climbing a skyscraper in the background.
PANEL 3: A picture of an adorable toddler is inscribed “I heart you Mommy! Always remember if u quit ur job I’ll starve.” A “to do” list says: “-Work -Work -Work -Labor -Toil -Lunch -Drudge -Slog -die.” A coffee mug, decorated with Charlie Brown’s zig-zag shirt line, has a mouse wearing glasses peering out of it.
PANEL 4: One of the robots is a toaster. The robot puppy has left poo (a steaming pile of nuts and bolts) on the ground. The cybertruck robot’s head is on fire, and if you peer closely at the passenger window you can see a screaming person trapped inside.
PANEL 5: The coffee cup has a picture of Bender from Futurama on it. There’s an electric outlet with two “faces”; one of the faces is the standard, the other one is smiling and winking at us. A poster says “NOTICE: Cups must be cleaned after death.” A cannister is labeled “82% real Sugar,” with an adorable granny mascot saying “What you don’t now won’t kill you, probably.”
PANEL 6: The box of stuff from the fired employee’s desk includes a coffee mug; the mouse from panel 3 is still in the mug. A jar on the sidewalk says “Background Juice” on the label.
And there’s graffiti! “BG” (for background) is written in a few places. Someone has written a list of jobs: “Priest Poet Lawyer Marine Squire Grocer Vicar.” (Let me know in comments if you know where that list comes from.) A game of “hangman” is in progress: “A_S_ER.” (You see the answer, right?) More things written on the wall: “Filler.” “Who reads this?” “PP + Marcie 4EV.” “E=M.C. Hammer.” “Mary + Charlie + Frank.” Finally, a poster on the wall is partly blocked by the caption, but I can tell you it says “Secret Hidden Text! Because you can’t read this text: At last, I’m free to say it: Basketball is BORING! Bite me, b-ball fans!”
Microsoft’s GitHub code repository is a central dependency for open source software. Corporate development teams love it too.
But GitHub’s been having serious reliability problems lately — 86% uptime over the past 90 days. [Missing GitHub Status]
We don’t have direct smoking gun evidence that GitHub is dying of vibe code poisoning. But it sure feels vibe coded. Sucks if you work for a company trying to use GitHub for real work, hey.
But GitHub has competitors. The largest has long been GitLab, founded in 2011.
So GitLab has seized the day! And they’ve announced they’re going to shoot themselves in the foot too. With AI!
Yesterday, CEO Bill Staples posted “GitLab Act 2”: [GitLab]
The agentic era affords GitLab the largest opportunity in our history as a company, and we’re making the structural and strategic decisions to meet it.
You can translate that, right? He means layoffs. Announcements like this say “AI” to mean layoffs. You always go into your “largest opportunity” with less people, right.
Staples’ AI excuse for the layoffs is full agentic orchestration with all the salad. His full pitch sounds like Gas Town for Enterprise and should be about as efficient and effective:
Software will be built by machines, directed by people. AI is the substrate on which future software gets built. Agents will plan, code, review, deploy, and repair. Humans still own the judgment that matters most: architecture, deep understanding of the customer problem, the tradeoffs that require taste.
Of course, they won’t. The human in the loop rapidly acclimatises to management demands for 10× productivity by turning into a “looks good to me” machine and accepting anything that passes CI. The management get precisely what they asked for. The human fantasises about getting a physical labouring job.
I don’t believe GitLab is going to do any of the agentic guff in this announcement — it’s just C-level fever dreams. They will do the layoffs, though.
GitLab’s stock price was $52 a year ago and closed at $25.64 yesterday — so it dropped by over half in a year. It closed at $23.08 today — a 9% drop in one day. So the market does not love this clear desperation AI layoff either. And we already know that layoffs don’t boost your share price, they send it down.
This was a very weird and dumb announcement from GitLab, especially when this was the perfect moment to advertise “we’re the one that stays up and works” and tune up their migration tools. But they have CEO brain, so let’s try saying “AI”!
So what do we move to instead? Codeberg is run by a nonprofit and a lot of open source projects are going there.
Business users are mostly holding on and hoping GitHub gets it together. There’s also self-hosting a code repository with Forgejo, the open source software that Codeberg maintains and runs on.
But sometimes, services turn to vibe trash, and you have to rebuild from scratch yourself. You’ll get a lot of practice when the AI bubble’s finished popping.
Log in
