September 7th, 2026 ×
Cursor & OpenAI Break Up
Wes Bos Host
Scott Tolinski Host
Transcript
Guest 0
Welcome to Syntax. Welcome to Syntax Weekly, the place with all your latest web dev programming news. We got a good one for you today. We're talking about how Cursor and OpenAI have broken up. Also, Pnpm 12 has been released, and it's being rewritten in Rust. Wow. There's also a cool, Wes GPU library for agents.
Guest 0
All of this and more today on Syntax Weekly, I am joined by Wes Bos and Scott Tolinski. What's up? How you guys doing? Oh, I'm doing good. How are you doing, TJ? I'm doing good. Let's get right into it. So our first story today is the PNPM 12 release.
Guest 0
And so this is a rewrite of PNPM in Rust, and it's stable.
Guest 0
And what's the one nice thing about it is it's not meant to be a migration. There's not a lot of, major breaking changes. Things are just gonna be faster, and there's some cool, sensible defaults as well.
Guest 0
One of the first ones is project aware global bins. So a lot of times, you might have Node Deno bun installed globally, but in any given project, you want to use a specific version of it.
Guest 0
Now when you're using p npm, it'll look at the dev engines dot run time in your package dot JSON and automatically choose to run the right version when you do, like, PNPM run. Yeah. That was a feature of Vite plus that I I've been very much enjoying. Yeah. Yeah. So it's here in PNPM.
Guest 0
They also have a Git dependency resolution.
Guest 0
So it used to be, like, there's so many different ways to install a package from GitHub. You'd like you could do, like, username slash package, GitHub colon username slash package, and, like, the SSH URL, the HTTPS URL.
Guest 0
Now this, normalizes it into a a a a specific thing that shows up in your package dot JSON, and then they have a resolution algorithm that'll I think I believe it uses HTTPS to pull in that particular library or that particular commit.
Guest 0
So that's nice to see.
Wes Bos
Couple other things. Yeah. Rewriting this in Rust is just like a like a a half a sentence.
Guest 0
Yeah. What? I I was I was hoping to see, like, stats. Like, is it faster? I mean, obviously, it's faster, but also, PNPM is fast. That's why I've been I've been using PNPM for, like, two years now because it's so much faster than NPM.
Scott Tolinski
How do you get it faster? This is how I Wes. But yeah. It's not a problem I had had had, but
Wes Bos
maybe maybe it's even faster. That's unbelievable.
Scott Tolinski
Yeah.
Scott Tolinski
Yes. PNPM, another one. PNPM. Yeah. PNPM. It's constantly pushing it, constantly evolving, and, really, what would we what would we do without PNPM? It's the Wes, folks.
Guest 0
It's good stuff. Yeah. Check out their release post upgrade if you haven't yet. Check it out. I got, one more release for you as well, and this is from the Node team.
Guest 0
So Zod has released version 4.5, and the big standout feature here is schema compilation.
Guest 0
So they released a a new method, z dot compile, and this takes any schema into a precompiled schema that's three to nine times faster.
Guest 0
And that compiled schema can be used in exactly the same way as any of your, Node validators.
Guest 0
It essentially just does it ahead of time. And so you can check out their their release post, that shows, like, up to 7.8 times faster when compiled.
Scott Tolinski
Cool.
Guest 0
There's a few other things in the 4.5 release. You can see their blog post here that talk about it, and then they have a specific post talking about z.compile.
Guest 0
And, essentially, what they do if you're not familiar, Node validators were essentially like runtime validation where when you did z dot parse, it would actually have to go through and dynamically pick out all of those validators, dynamically invoke them. But the compilation essentially just creates a really quick, really fast bit of code that does that specific validation, and that's why it's so much faster. And so I believe they have, like, a Vite plug in. There's a way to get it to run, with Node. Js where these compiled, schemas can actually be part of your bundle as well. So you don't even have the runtime cost of having to spin up this validator and do all the dynamic instantiation.
Guest 0
It's essentially just Node, like, if type input does not equal object or input equals Node, return false. Or if type of input dot x does not equal number, return false. So the kind of stuff that would be under the hood, but it basically does that ahead of time, so all of your your runs for zod parsing are gonna be a lot faster.
Guest 0
Basically, you just have to import ZOD dash compile, and now you're opted in, and all of your your ZOD parsers are gonna be a whole what ZOD parsing is gonna be a whole lot faster. I
Scott Tolinski
I I wonder, when we'll get some updated benchmarks compared to archetype, because I always saw that archetype was faster, which is one of the reasons why I liked archetype. But, I mean oh, and then I yeah. It doesn't show anything about archetype here. Yeah. But I don't see any comparison. This though, because Zod is one of those ones that has really taken hold. And even though we have standard schema, which is the ability to use any of these things on any of these projects Yeah. Zod really feels like the one that everybody's landed on. So if if Zod gets faster, everything gets faster, and I'm down for that.
Wes Bos
Fantastic. I love that.
Guest 0
Absolutely. Yeah. So that's all I got for you. Check out Pnpm Wes. Check out Zod 4.5.
Guest 0
And, with that, I'll remind you, this is Syntax Weekly. If you're just joining us, we do this every week, every Monday. And this is brought to you by Sentry.
Guest 0
They are really good error monitoring platform. We use it in all of our apps.
Guest 0
Basically, if you Scott something running running in production, throw Sentry on there, and, you'll know when things go wrong. And you can have it automatically fixed with a senior agent. They got a bunch of other stuff, profiling, logs.
Guest 0
Check them out. We couldn't do what we do here without them.
Scott Tolinski
And, I'll Well, before you do, can I actually give a little quick little century story? Because I set this up, last week. To hear that. Yes.
Scott Tolinski
I I've been using Warp Club. Swamp Club is like, automation. So it's like a a standard for doing automations within your agents. So that way like, let's say there's specific tasks that I do all the time, and and oftentimes, the agents just like, oh, let me go find a script for that and do it, or let me, determine how I'm gonna do that at any given moment. Swamp just, like, builds that all out so that way you have workflows and automations and all kinds of stuff that the agent just picks up and starts doing right away. So I've been using this, and I set up a self healing flow with swamp and century. So, every six hours, my swamp will just run a job that goes off, finds a century issue that has not been completed yet.
Scott Tolinski
It, logs that as a task. It puts that task through a a designated process to fix it, merges that in, marks the century issue as resolved, and then it will check for regressions.
Scott Tolinski
So, man, I'm feeling the self healing software stuff.
Scott Tolinski
There's a sick combination. Yes. Very, very into this. Yeah.
Scott Tolinski
Happens all on my Mac mini, so I can I can check it out at any time?
Wes Bos
So Hope to hear it.
Guest 0
Yeah. So I'll I'll pass it off to Wes. Got some news about Cursor, OpenAI. What's going on over there? Yes. Alright. So
Wes Bos
Cursor acquired by SpaceX a couple weeks ago.
Wes Bos
Friday, after everybody had had finished up their their day, they announced, or OpenAI has announced that they will no longer be supplying their models to Cursor, meaning that anybody who's using Cursor is no longer going to be able to use any of as as of, I think, November 13 JS no longer to be able to use any OpenAI models inside of Cursor, which I I think is a fairly significant blow. Because one of the huge benefits to to using Cursor is that you have all of the models available to you. Right? Like, you can do that in GitHub Copilot, and there's, there's several other things out there where you can simply just choose which model you want. But I think that's a a fairly significant blow. Now now the reason why let's talk about why, and then I think there's some interesting bits behind this.
Wes Bos
Basically, the blog post goes in to say, like, they basically just cannot now that they've been acquired by SpaceX, Musk has admitted that XAI has distilled OpenAI models to train their own.
Wes Bos
And, obviously, the cursor is sitting on a gold mine of information as to, like, how do people use these models. Right? Because people have been using cursor for Yarn, and they have built tons and tons of software. And they have all of this information as to, like, what were good requests, what were good tab completions, what, somebody asks for x, y, and z, and they got these things. Was that a good response or not? All of that information is a gold mine for being able to train your own JS well as as do distillation, meaning that, like, you can look at how OpenAI does something. You can look at the the reasoning trails of what they expose, and then you can use that to then train your own model. So they have decided that they have they have some contract in their clause where they have a limited time window to cancel after a change in control, which is like, cursor was Scott. There's a change in control. They are able to to cancel their agreement. So huge bummer, that this popped up. A couple interesting tidbits here is, Michael Trujog, one of the founders of Cursor, says he he kinda clapped back and says, OpenAI Node serve 5% of Cursor user traffic, and we're speaking with OpenAI to resolve. So, like, that was kind of a mean thing to post, but, obviously, he's he's mad about that.
Wes Bos
That seems extremely low, which which led me to DAX.
Wes Bos
He's a creator of Node or one of the a DevRel or something at OpenCode.
Wes Bos
He said, basically, non Frontier model is so much cheaper or free that they can drain they can drive insane token volume. So I think, like, that just goes to show that here we are talking about OpenAI, xAI, anthropic models.
Wes Bos
And, like, the reality is that most people are not using these to to write code. Most people are are going for whatever's cheapest and fastest or whatever's free at the moment. Or they're just not ripping tokens on pnpm, you Node? Yeah. Yeah. Maybe they're not running 10 bazillion things. Yeah. That's true. Like, from a volume point of view, maybe they're doing a sheer larger volume on the free things that might not be as important. That's a good point.
Scott Tolinski
Yeah.
Wes Bos
So this brings up an interesting thing, which JS, a, I called it. Go back, I don't know, maybe a month or two ago when all of the, like, you can no longer use your Claude subscription in x, y, and z. I called it. I said, you soon will not be able to use these models. Like, the latest models are not going to be available via the API. They're simply just going to be available via their product because the all of all of these companies are realizing that as these models get cheaper and better and faster, and as you can simply just, like, click a drop down and switch to a different model and continue on your day, we are realizing, like, they really need to get you embedded in the product, which is, like, they want you using their thing. They want you using something that you cannot easily switch as much as just selecting a drop down menu from one to another. So it's that's Node like, my one idea there, and the other one is, like, this just is such a huge thing to, like, keep using open Node, pie, keeping using whatever open harness you want because building on top of and, like, locking yourself into some ecosystem, the rug pulls will only continue to get to get bigger with these types of things. And not to Sanity, like, throwing any shade on OpenAI here because I'd if I would probably do the same thing if I was in their position, but it just goes to show that they're starting to pull back a lot of this
Scott Tolinski
stuff. Yeah. Yeah. Hey. I yeah. This is one of those ones where, like, I I wanna do a quick check on what libraries or what harness are you guys actually using today, because I feel like this changes all the time, or maybe I'm just the one changing it all the time. But what what's your setup currently, guys? What do you what are you rocking with? What do you what do you like?
Wes Bos
Yeah. I Go ahead, CJ.
Guest 0
Quick and simple. Open code with a codec subscription. So I can use all of the ChatGPT models, but I use OpenCode absolutely everywhere. I have it on my VPS. I have it on my home lab. I have it on my laptop.
Guest 0
OpenCode and codecs. That's it.
Wes Bos
Yeah. I've been using codex models quite a bit. I I split my time probably right now 33% each between codex desktop, I've been really enjoying. Open code CLI with I've been testing all of these new models that that have been coming out, especially a lot of the, like, free or cheap Chinese ones.
Wes Bos
And then what was my third one? OpenCode, Node.
Wes Bos
Cloud Node is is the third one. So, like, I'm I'm bouncing all over the place, just just trying them all out. You Node? Been last week, we were talking about how you've been using Crockbot for quite a bit of stuff, but it I can't even say, like, this is better. You Node? The the UI and the product is is sometimes a little bit better in in some cases and whatnot, but, man, the switchability right now is just so easy.
Scott Tolinski
Yeah. Yeah. I know. For for me, I'm using pie.
Scott Tolinski
I've been rocking pie as my primary for a little while Node, and then I'll use Cloud Code just to use my Cloud Code subscription.
Scott Tolinski
But I I don't know what I'm going to do once I, am no longer using cloud code as my my main thing. I mean, it's gonna be just pi. I just really hate that I have to use cloud code. I would really prefer to just do everything in pi. And people are like, well, you can use cloud code in pi. Yeah. But you can't with the, you know,
Wes Bos
cloud code subscription pricing. Yeah. So yeah. Just People asked I think we answered a couple episodes ago. Like, what's the best deal out there right now? And I I think we said, like, either Cursor or Node is probably the best deal right now Wes you get, like, a 100 or $200 a month plan depending on how much you use it.
Wes Bos
And now that Cursor's removing it, I think, like, Node might be the winning for the best value. Simply just like Cloud Code, also very good value, but the fact that you can use the codecs
Scott Tolinski
subscription in other tools on the cloud code is awesome. Yeah. I know. I I do I do probably get the most value out of the codec TypeScript, but I like working with anthropic models the best. And that's always bumming me out because it's like, the the models go too fast, especially Fable, obviously, and now they're doing a a decrease on the because they the they upped your usage limit by 50%, and then they recently announced that, well, they're actually going to be upping it by 25%, but that's actually a decrease from what you're currently getting. Yeah. They kinda fumbled the messaging around that. Yeah. Not so good.
Scott Tolinski
They're not good at that. They're not they're good at the model. They're not good at anything else.
Wes Bos
I I don't understand that because they have all these, like like, guys on Twitter that are, like, awesome at responding and, like, saying, hey. Yeah. We're working on it. This is what we think and, like, excellent, excellent communication at that aspect.
Wes Bos
But then, like, when they roll out these official announcements, it's like, did nobody do that? Maybe AI wrote this.
Wes Bos
Yes.
Scott Tolinski
But let's Yeah. Let's move on to the next one here. Scott, what do you got for us? Yes. I got v GPU, which is a Wes GPU library designed for agents from the folks at Vercel, and you can tell that this is Vercel because this is a Vercel ass homepage.
Scott Tolinski
So we wanna throw this bad. Okay. There we go. So, WebGPU.
Scott Tolinski
WebGPU is a great way to do, modern graphics on the web. It's it's new. It it it's very cool. You can do some crazy stuff with WebGPU. I'm rocking WebGPU to do a lot of graphics in my, computer graphics.
Scott Tolinski
What do I call them? Call it graphics computer app that I built to do images on on syntax. But this thing basically okay. Yeah. Use the same shader in the browser headless Node. Make it interactive. It's like a library for working with Wes GPU in general. And they have a nice homepage, some nice docs, some nice, flashy examples as one does with all of this stuff. And if you're getting into web GPU stuff, definitely a cool thing to check out.
Scott Tolinski
I I when I first saw this, my brain immediately went to, how was this different than type GPU? Type GPU is a library that I've been working at from, for quite some time now, from the folks over at Software Mansion. In fact, Evo Plaza, who's in the chat here, I believe is the creator of TypeScript.
Scott Tolinski
And, so I'll I've been using Type GPU to do all my web GPU stuff. So I was like, okay. Well, how how is this like, is this, just a Vercel type GPU, or what is this? So, Deno actually posted this tweet not soon after, and it really cleared things up for me. So, folks, I'm gonna just read this out. So here are the main differences between vGPU and type GPU for those wondering. VGPU is an opinionated API that extracts abstracts many of the complexities that come with setting up and handling Wes GPU. Right? Comes with the mechanisms for splitting up WGSL file across files. Tooling is very impressive, something that was definitely missing from agentic workflows. However, it has the limitation of not being connectable with other web GPU libraries from different domains.
Scott Tolinski
That feels like that's a kind of a Vercel type of thing. Right? Interested to see how they approach that. So it it says like AI inference, like running AI inference in a Wes, web GPU contest
Wes Bos
context,
Scott Tolinski
where it says TypeScript is a reflection of WebGPU and W GSL onto TypeScript, meaning that you would write in WebGPU.
Scott Tolinski
And, what you would write in the web oh my god. What you would write in Wes GPU and W GSL, you can instead write in TypeScript and get the inherent type safety. So, basically Okay. What Evo's saying is that type GPU is lower level, and then can integrate more with things like three g s, pixie JS, and even v GPU. So v GPU is not an alternative to type GPU. It's like a different layer. Okay. So it's
Wes Bos
it's like instead of writing like you said, instead of writing, like, lower level shaders, you write them in TypeScript. Is that am I understanding that right? And
Scott Tolinski
Type GPU is like that, where type GPU, you are essentially writing the Wes GPU stuff in TypeScript k. Where, v GPU kind of abstracts some of that stuff.
Wes Bos
Okay.
Wes Bos
I'm just I'm trying to understand, like, like, what what would you need this for? What's this for? Obviously, it's for graphics. It's for making shapes. It's fun.
Wes Bos
But, like, also, like, computation is another one as well. Like like like, WebGPU is not just for visual graphics. That that is one of them. This vGPU
Scott Tolinski
pretty much is for graphics, where if you look at type GPU, their examples are a lot of, like, you can do that type of thing. Where is it? Some of these, selfie segmentation.
Scott Tolinski
Where is the, no. Not don't turn on my camera right now. There's a inference here for drawing numbers. Right? So you can do AI with type GPU.
Guest 0
So, like, there there's actual, code running on the GPU that can in this case, it's, like, optical character recognition of, like, drawn numbers. Yes. That code is running on the GPU, so it's very performant instead of, like, running on the foreground thread in JavaScript.
Scott Tolinski
Yes.
Scott Tolinski
Cool. Yeah. It's all running on the GPU. Sanity GPU is such a dope library. My god.
Wes Bos
Okay. And this is different than, like, a three JS, because Yeah. Three three j s is get into the shaders territory, does it? It, like, obviously, can load them and use them, but, like, actually authoring shaders in
Scott Tolinski
I you would just three j s more for, like, models and stuff like that, but it's also, WebGL based, I think. Yeah. And and correct me if I'm wrong because I believe there is probably a pathway to using WebGPU in Three JS these days, but,
Guest 0
I I Evo can probably speak more to that because I haven't done WebGPU with Three JS. Yeah. That's my understanding JS, like, Three j s came along to make WebGL a whole lot easier to use and write. Yep.
Guest 0
But then, WebGPU is a newer browser API where you can run things directly on the GPU. Correct. And that's That's correct. Different than than WebGL.
Wes Bos
Yes. Yeah. Yes. Because it it's it's like a little lower level. And and like I said, it's not just for graphics. Like, if you want to do, heavy computation, which is often needed in this AI inference world, being able to shell off that computation to the GPU rather than running it on the CPU or in the main thread ESLint has a huge advantage. Right?
Scott Tolinski
Yes. Yeah. Yeah. Especially for all of this type of stuff. I mean, it's just in the nature of graphics processing in general. Like, when you get into shaders and stuff, what it's doing is it's manipulating, the code is running on every pixel at the same time. Right? And that type of work is particularly good for GPUs because of parallel processing. Right? Because the way a GPU works is it's able to process things in parallel rather than in sequence. And if you're affecting every single pixel on the screen or writing code that affects all of that at once, right, that makes a lot of sense for something pnpm parallel processing. Right? Yep. Yep. Yeah. Makes sense. Cool. Nice. Yeah. So vGPU, just more cool stuff in the Wes GPU world, which I gotta say, I'm loving all all the new WebGPU stuff because I I have an app that deeply uses WebGPU, and, it's been a lot of fun to to get with. So cool stuff.
Scott Tolinski
Yep. Yes.
Scott Tolinski
Okay. Cool. Well, who who wants to go next here? Who do who do who wants to go next? Who's got something big? I do, I think. Alright. If you call it big. It's CJ. Little big little bit. CJ's got something huge. CJ's coming in with something giant here.
Guest 0
So last week, we talked about, Omaki Quattro, the, new release of the opinionated Linux distribution.
Guest 0
And there have been some updates since then. So the the first, thing to know is, like, just upgrade to the latest version. We're now on four point o point two. So if you are using Omakie upgrade, they also have a page on their security stance where, like, you can report vulnerabilities and different things like that. But what I wanted to talk about is, like, what got fixed between those two version bumps.
Guest 0
And I wouldn't call these security vulnerabilities in Omaki, but they are, settings that you get that are enabled by default. And I think so this is one of the things about Omaki is it's opinionated. And so for instance, it it's a Linux distribution that comes with Docker. Like, Docker is preinstalled and ready to go.
Guest 0
And, one of the things you can do with Docker is add your user to the Docker group, but then that actually makes it really easy to do privilege escalation, where you can basically go from being just a standard user to root.
Guest 0
And as a developer, there's a warning on the Docker page that tells you that this is possible. And so as a developer, you would enable that knowing the risks.
Guest 0
But the issue with Omaki is that was enabled by default.
Guest 0
And so there's a blog post that goes into, it's called, any user process can escalate to root.
Guest 0
It's real like, really, it's not it's nothing crazy. It's just if you add your user to the Docker group and you have Docker installed as a a root installation, it all it takes is one Docker run command and you are now root on that system. And that's by design. It's not a security vulnerability. But the main issue is a lot of people installing Ama key don't know about all of these settings that have been enabled. And so that that's really the news here JS, like, you're you're choosing this opinionated stuff, and so there's a lot of stuff that could be enabled that you're not aware of Yeah. That could result in potential security issues. And so, I have one commit I'll link in the in the show notes, where the the title of this commit on Omaki is close three paths from unprivileged session to root. So this is this was right after the four point o point o release.
Guest 0
The there's the the Docker group issue, and then there was also one where the user was in the input group. And if you're not familiar with Linux, the input group gives you direct access to, like, USB devices. And so this meant that an unprivileged process could basically be a key logger with no extra privileged prompts or anything else like that. And so this update removes that. Essentially, if you wanna enable that, you enable it knowing the risks. Yeah. And that that's that's really the only thing that's really all I wanna talk about is, like, you're choosing all of these opinions, but that means there are gonna be things in there that you're not necessarily aware of that are enabled. And so all of those things are no longer enabled by default as well as some other security issues that were fixed in four point o point two.
Wes Bos
That Yeah. Needs that has to be done by default because, like, you're you're having all these idiots like me try it out.
Wes Bos
You know? Yeah. And Yeah. And, like, you're and a lot of people are coming from macOS Wes you just assume stuff is is secure by default, and you're just you it the whole thing is targeted at people just slapping it on and using it and being like, this is decent. Like, I don't wanna tinker. I don't wanna have to know about all of this, like, lower level stuff. I just want, like, a nice Bos. And, like, I'm a technical person, but I don't wanna have to think about, like, Docker privileges and whatnot. So I'm glad that that's been been changed. That's super important.
Guest 0
Yeah. And they like like I said, they have a security page. Like, I think they I don't think they have a bug bounty yet, but they're going to create one. And now the the there's just a lot more eyes on Umaki as Wes. So people are trying to break it, and that's also just, like, growing pains with a a new distribution.
Guest 0
But, this is gonna be, like, just just one more advertisement for, like, just just install a Linux OS and figure this stuff out yourself. Like, obviously, not everyone has the time, but some recommendations, CasioS gives you Arch Linux, and then you could customize it and learn about all those customizations yourself. Also, Ubuntu is really good.
Guest 0
Just use Ubuntu out of the box.
Guest 0
I don't know. Do you have any thoughts, Scott? You are using Omaki. Right? I guess you Omachi. Omachi?
Scott Tolinski
Yeah. I well You just don't say the r. That's the only thing. You don't say the r.
Scott Tolinski
But it's taking me a long time to get rid of it. Second because
Guest 0
it's Can we just call it what it looks like? Yeah. Umarchy. Yeah. For sure. But so oh, it's omakase, which is like a Japanese word for, like, the chef chooses what you get. And so that's why I'm calling it omaki because, omakase, not omachase.
Scott Tolinski
I don't know. But, did you upgrade, Scott? Have you been using it? Yes. Yeah. Where where did my laptop go? Yes. I did. I actually got it working.
Scott Tolinski
It's yeah. It's great. You know? I mean, it's it's not that different from version two for me. So, I I really like it. It's fast. I don't have a computer that I would like to use it on regularly, but I do like the OS. And I think there's something to be said that people like the the conversation around this that people are missing is that if you want to make Linux or any of these things more used more widely used, more supported, all of that stuff, you kinda need someone to to push it in this kind of way. So people get hung up on who's pushing it, and they get hung up on all of the choices that are being Node, and they get hung up on the the fact that it's, like, bash scripts to set things up instead of potentially, like, a Knicks type of situation. Right? And so I think that people really underestimate the power that this kind of energy can put into something like Linux. So the haters, I think, just don't get it. Okay? They don't they they're they're too focused on the technical side. There's nothing stopping you from running whatever you want. But the amount of energy that Omachi is bringing into Linux right now, software that is being written for Linux right now because of Omachi JS is something that hasn't you know, I don't know. It it it's like this energy that hasn't really happened around Linux in this type of concerned way. And I get it. The the Linux nerds who have been running, you know, whatever distro for their I I get why you'd be grumpy about that. I get grumpy about that kind of stuff too in that same kind of way.
Scott Tolinski
But if you want people to move to Linux or you want Linux to get more popular or more software for to be written or more compatibility, this is kind of the way it needs to happen. It's not gonna happen from a bunch of nerds arguing about which distro and which packages.
Wes Bos
Yeah. Yeah. You need a significant shakeup, in this. Not not that the space needs a shakeup, but if you if we want the, like, macOS folks to, like, actually use this type of thing for for day to day and, like, do real work, like like video editing and and, like, photo editing and, like, all of the type of stuff that we we do on a Mac, then you need something like this Wes the fit, the finish, the polish, the design, the user experience, all of that stuff has an insane high level bar to it. So I'm I'm pretty excited about this. I I threw it on my Microsoft hold on. Let me grab it for you. I threw it on a ten year old Microsoft Surface, which is just hilarious because Microsoft sent me this thing, like, ten years ago when they were rolling out Windows subsystem live.
Wes Bos
Basically, they're like, we're gonna be able to get Linux, CLIs running on Windows, which makes things like running Node. Js and whatever much easier on Windows. So they sent me this to, like, test it out and whatnot. And I used it for a lot of my videos to show the, like, Windows setup.
Wes Bos
But the hilariousness of that is now I have full ass Linux running on it, which is working pretty well. I got the touch screen and everything working. Like, it has the Surface Yeah.
Wes Bos
Thing on there, and then it just boots into the custom kernel. So I've been pretty happy with it. I the hardware is is ten years old. It's not good enough for me, but, it's still impressive.
Guest 0
Yeah.
Guest 0
I I mean, just just to talk a few a bit more, like, I would I I I agree that, Omaki is getting people talking about Linux. I think that's great, and I'm gonna keep saying it wrong, Omaki.
Guest 0
But I would I would argue obviously, like, I'm call me a a Linux old head. I don't know. I'm and I'm but Debian or not Debian. Ubuntu has been doing this for a very long time. Like, I guess my my point is Wes I get a brand new Mac, I have to install all these things. Right? Like, I install iTerm.
Guest 0
I have to install my coding agents. I do all of that. I would argue that to go from a base Ubuntu installation to something you're comfortable working in is about the same effort as it is on a Mac. Like, you install Versus Node. You, like, you really don't have to replace the terminal, install your coding agents. You're good to go. So that that's really my main argument here is I don't think you need such a, like, a a distribution with so much stuff in it. I think, as developers, we can pick and choose, and it's easy enough to install on something like Ubuntu.
Guest 0
That
Scott Tolinski
happens. I do install some basic ass functionality on Linux to get it SMB and stuff like that. Like, I I don't wanna have to set up basic functionality. I just want it to work.
Guest 0
Oh, yeah. I would I I agree with that sentiment, but I do think Ubuntu is at the point where you don't have to do that. And it and it supports older devices too. Like, I have this old, weird, chewy touchscreen Windows device.
Guest 0
Yeah. I put Ubuntu on there. The touchscreen works. It automatically rotates. Like, it it just works. So
Wes Bos
Matt Matt next dev is saying Doesn't come with sick backgrounds, though, does it?
Guest 0
No. But CasioS does. I will say that. Multiple people in the chat, Brad is saying, bros bros Scott getting it. Max Mad says CJ doesn't get it. No. I get it. I I I I do get it, but I think the all I'm saying is Ubuntu is in a different spot than you think it is in terms of, like, how easy it is to get stuff up and going.
Guest 0
And I don't I don't know.
Wes Bos
I'll label I What about the design of of the OS as well? Does it does it look similar? Does it have that, like, polished feel to it?
Guest 0
It does. It comes down to the the, window management system, and I believe Ubuntu uses Cinnamon.
Guest 0
And then if you use Kashi, the default one is Plasma or KDE.
Guest 0
And those just they feel like a a Windows desktop. They feel like a macOS desktop. I think one of the things Omachi is giving you is you're getting Hyperland out of the box Yep. Which is basically, like, having a tiling window manager out of the box, which also not everyone is used to. So yeah. It's dope.
Scott Tolinski
Yeah. I I like yeah.
Wes Bos
I think it is such a good call that they put the window Tolinski manager in there by default because it, like, forces you from the get go to, like like, if you're changing your OS, you have to do a little bit of relearning Node doing that from from the start, but then also having everything available, like, all the commands. Like, the huge thing for me was, like, you can hit, like, the super k and, like, search for what all the commands were and, like, look it up. Like, that was that's huge for for learning. But, like, forcing people into that type of thing rather than them making a mess
Guest 0
with all of their windows, I think, is, like, such a genius idea. I'm here for it. I yeah. Like, because if I could get everyone to use like, I use rectangle on a Mac still. There's a million other apps for window management. But Yeah. If I could get everyone to manage their windows better, I would be very happy.
Guest 0
So, you know, the Omachi JS doing some good things, but I also I disagree with like, other distributions are just as good and very similar to how you would code on on Windows or Mac is all. Yeah. CJ, I got news for you. IOS is not as good as Android. And guess what?
Scott Tolinski
Everybody owns Wes because it's easier for for most people, or it's easier to get started. And and I think that's really just it JS that, whether or not it's better is not the argument because I fully agree that other things are better.
Scott Tolinski
But, you know, I mean, easy is easy sometimes. So yeah.
Guest 0
Sure.
Wes Bos
And I I very much hope that this, like, what they Scott, $10,000,000, for for Omaki Node. I very much hope a lot of that is put into, like, get video editors, graphics software.
Wes Bos
Get the, like, stuff, like, get Raycast running on this thing. Because, like, I love the I don't love the, like, little pop up thing in there, but, like, that's not a Raycast alternative. You know? Like, that's I'm gonna need something a little bit better in, in myomachi.
Guest 0
I'm gonna make I'm I'm being annoying here. I'm gonna make one more argument, though, that SteamOS has actually done this for the Linux desktop as well because SteamOS. Yes. Yeah. I mean, they people are using Linux without knowing that they're using Tolinski, and SteamOS has done a ton of work to get games running on Linux.
Guest 0
And, yeah. So there's a lot of efforts to get Linux usable and not be, like, a horrible, you have to customize everything experience.
Wes Bos
Wes how how do they get for it? Yeah. How do they get all these games running on Linux and not have Yeah. DaVinci Resolve running smoothly?
Scott Tolinski
Just one company putting a ton of money into a a layer there is really what it comes down to. Yeah. That's hopefully what,
Wes Bos
like, DHH and all of his his rich friends are doing with this. You know? Yeah.
Wes Bos
Alright.
Wes Bos
Let's move on to the next one from Actually,
Scott Tolinski
yes. Before go ahead. We do. There's a lot of conversation about computers and stuff in there.
Scott Tolinski
I bought a Mac Studio, guys. I bought Oh, yeah. A Mac Studio. I bought an m five Ultra, and it is not coming until November. So I will not be able to talk about Wes I'm running on it until then, but it has happened. I've I hit I I hit the buy button, and then I took a deep breath. And, I do have a Mac Studio, on the way. So So give us your give us your, like, thought process behind
Wes Bos
that. Because, like, out of the box, it seems like a crazy thing to spend $10 on. But, like, we talked it through. I'm I'm a cheap guy, and I'm fully supporting Scott's purchase of this. So, like like, why do you need a computer with, what, 256 gigs of RAM?
Scott Tolinski
Yeah. 256 gigs of RAM, four terabytes of hard drive, the Ultra Chip.
Scott Tolinski
I got the maxed out config on it, in terms of, like, the processor.
Scott Tolinski
And it's really gonna be I'm gonna be running as a local inference machine on top of DaVinci Resolve, on top of, screen recording, you know, mini screens or doing all kinds of stuff. So it's gonna be a Bos. It's gonna be doing a whole ton of stuff, but I wanna be able to run, the biggest, baddest models I can without buying a GPU setup. The GPU that I was yes. I am. Apollo says, is Scott Scott about to run GLM 5.3 flash on that? Yes. I am about to run GLM 5.3 Flash on it. I'm very stoked about that.
Scott Tolinski
So, like, being able to run a model that that that's that powerful on your local machine to, like, power tons of stuff, it's gonna be, groundbreaking for me, but, also, it's like a world I wanna get into more of running these local models and experimenting with them and trying them. And I don't I I if I'm if I'm needing a new computer, I'm already going thin ESLint, so I I hardly do anything on my laptop. Most things are running on this Mac mini behind me, and this Mac mini is severely it's Scott, like this thing's probably got, like, four gigs of RAM. And I think it has eight gigs of RAM or something crazy. It's it's a refurbished m two Mac mini. It it stinks. And so, like, just being able to run everything on it on thing and then running very minimal things on my laptop, it means I won't have to buy a new laptop.
Scott Tolinski
Yeah. I can, just, you know, just use that as the Bos is really what it comes down to. But, yes, I'm gonna begin deep into that world. Yeah. It's it's a beast.
Wes Bos
Interesting thing to to think about right now is that, like, only in the last couple months have we gotten models that are cheap enough that you can run on on, like, like, on absolutely everything. Like like, for example, the OpenAI's GPT Luna, which is their, like, their their cheap fast model.
Wes Bos
Like, I'm building this thing right now where it can detect, like, image things in an image, and then it will tell you what what is in that image and how much it's worth and all of that type of stuff. Like Mhmm. A tenth of a penny to process an image and tell you what is in that image. Not just like, oh, detected cup. Like, yeah. We've had that we've had that forever. Right? That's a hot dog. But, like, it will say, like, oh, this is a Yeti cup in yellow, and, here it is. It's worth about x, y, and z. So, like, we're just figuring out, oh, what do we do now that it's, like, dirt cheap? Like, oh, can I run it on every single frame of a video? Can I run it 20,000 times on on x, y, or z? Can I run it on literally every single screen screen grab of what I ever have? And we're just figuring out what those things are. Now take that tenth of a penny and make it zero or whatever it Scott to plug the thing in. Yeah. Like, I think people like Scott and all the people that are buying these things are now going to be figuring out, okay, what does it look like? Like, what can you run locally when it is literally free to run? And if I'm if I'm like, let's say I'm analyzing every frame of a video, and it's got my kids in it. And I don't you know, I'm not I I want that stuff to be,
Scott Tolinski
private. Right? Yeah. So being able to to have that on top of all of this, just running on my desk, it's gonna be crazy. So, yeah, I'm very, very stoked.
Scott Tolinski
We'll see when it actually arrives. I have on on word that the chances are it might get here before November, but very, very interested.
Wes Bos
So someone says there's no way 10 k max will be cheaper than paying a $100 a month. No. Like, if you're comparing it against a $100 a month plan, it's not. It's not going to. It's not even going to be like, the models are not going to be as good as the $100 month plan, but that's that's not the that's not the frame like, the mindset you should be in with this type of thing. It's like even though they're good enough, these models that you can run locally, and they're going to be free, and you can run them millions of times. You you're not gonna be able to to, do 60 frames a second analyzing every single frame of a video on a $100 a month plan. You would burn through that in, like like, minutes.
Scott Tolinski
Yeah. And, I mean, also, Wes, it's like it's a computer that's going to last for it's gonna last a very long time with that much type of compute. We're like this MacBook Pro, I mean, how long have we had these things? So, like, five, six years now? Tell you. It's just under five years. We me and Scott bought the m one MacBook Pros,
Wes Bos
and I paid about 5,000 Canadian, which is, I think, like, what, probably 4 US.
Wes Bos
And I'm here five years later, and this thing is still very, very fast aside from my my issues with the latest betas being kinda laggy.
Wes Bos
But, like, these these things last forever, and, like, the yours should last, what, six, seven years old long?
Guest 0
Gosh. Wes.
Scott Tolinski
That's six. Then you can mute too. You just do it all the time. It's gonna last for I mean, it's gonna extend the life of this laptop, but, also, like, when you cost it out over that much time and whatever, Wes, well worth it. Absolutely. So, yeah, I'm I'm really stoked. The other thing I'll mention is, like,
Guest 0
we are not out of the, or maybe not even reached the peak of how expensive hardware is getting or going to get.
Guest 0
There are some estimates that Oops. Yeah. That are like, the the RAM RAM shortage, SSD shortage, or or, like, things being so expensive won't stop until 2030. So, like Oh, kill me. No. Yeah. I mean, we we don't know for sure. And, obviously, like, a lot of these data center projects could fail or whatever else.
Guest 0
So it's like being able to run this stuff in your home is only gonna get more expensive.
Guest 0
So I I agree that it is a a good in good early investment that will be a good machine for a very long time.
Guest 0
The other thing to think about is power consumption, but, one thing to consider is these are very low power devices compared to, like, full on full on servers. Like, if you consider my Strix Halo machine, I could run a, like, 30,000,000,000 parameter model twenty four seven, and it would cost me, like, maybe a dollar or 2 per month.
Guest 0
And that's that's that's nothing.
Scott Tolinski
Yeah. So Yeah. Yeah. I mean, I looked at the I looked at the RTX 6,000 Blackwell when they were only 8 k, which was I was already looking at it like, oh, that's a little overpriced. Now they're, like, $12.14.
Scott Tolinski
So I'm you know? And for that, you would need two of them to run kind of like the types of models I'm gonna be running, and then the power consumption on it would be crazy comparatively.
Scott Tolinski
So it's it's just a good fit, I think. It's a a a good fit. Yeah.
Wes Bos
Man, I I've said this a couple times, but I have, like, a old Mac Pro that's still relatively powerful here. And I but I ran the I ran the numbers. It's a Intel Xeon, and that thing can use up to, like, 500 watts at its max. Like and just just, like, just, like, not sleeping, but, like, not doing anything. It uses, like, 80 watts, which is, like, like, $12.03 an hour just normally, which is that doesn't make any sense to to plug those in and run them. You know? Run them as your own home server, and that thing will use more than buying a new laptop will in, like, a year. Heck, yes. Alright. Where we wanna go from here? Wes, you wanna talk about super logical? Super logical. Yes. Cool. So, Mitchell Hashimoto, he is the founder of of HashiCorp, and he's the creator of GhostTT, which is the, terminal emulator.
Wes Bos
Absolute genius guy, super focused on, like, performance.
Wes Bos
So a couple weeks ago, Ian announced that they are working on something called Superlogical, which is a terminal multiplexer.
Wes Bos
So, basically, something that is going to compete with TMux.
Wes Bos
And he released a video a couple days ago, sort of, like, detailing, how it's working. And my gosh, this looks amazing because Node from a feature set. So, like like, really, what he's doing here is he's building he's not building, like, a replacement to Herder or anything like this. He is building a replacement to TMux, which will allow you to connect to multiple terminal sessions, whether it's running on your computer, whether it's running on a Linux desktop on a server somewhere.
Wes Bos
And he he just opens them up, and it's he he shows it happening in a half a bounce.
Wes Bos
Meaning that, like, he opens the app, and he you you see your terminal, session with before the before the macOS icon dock even does a does a full bounce.
Wes Bos
And this is really exciting. And and I read into the replies. He answered a bunch of questions, but he said it's all going to be API driven. So the idea here and it's it's all native scrolling, you know, like, if you ever use, like, TMUX or any of these, like, terminal emulators, you know that scrolling will sometimes feel a little bit janky. So I imagine what we'll start to see when this thing is released is we're gonna see a lot of stuff built on top of this. We'll see, like, a super herder or something that's built on top of this for doing agentic programming.
Wes Bos
So I don't know. Pretty cool app. I'm I'm excited.
Scott Tolinski
I'm really stoked. I think this is another one of those problems that people they're just, okay. I use TMUX, and it's fine. But I think that I think it can get so much better. It can get so much better. So I I'm really stoked to see this work. Yeah. It just the crazy thing is that, like, if you watch the video without, like, without audio,
Wes Bos
it just looks like he's it just looks like he's using, like, ghostity, like a terminal. Right? And, like, you might be not not impressed by that. But, if if you then go and use your Sanity mux or whatever, not native scrolling, there's all these issues around, like, what if the your terminal is a different size than the one that's actually running where it JS. There's all these, like, issues all the way down. And for somebody to come along and just build a beautiful experience and smooth out all of those issues, is is pretty exciting. I do hope that he continues to push this and build like a herder alternative, but I'm not sure that's the direction they're going or not. Yeah. Yeah. I mean, I like herder. I mean, I'm currently stuck in a world where if you use herder serve,
Scott Tolinski
you can get access to just dragging and dropping images into herd or, and it works over the network. But then if I, close my laptop and reopen, I gotta re herd or serve it. Where if you use MOSH, well, the images don't work, but you don't have to constantly reconnect to it. So I'm like, which of these which of these foot guns do I wanna hit?
Wes Bos
Yeah.
Wes Bos
That's cool. So keep a eye on, on that. We'll update you as as hopefully, the public beta is released soon.
Scott Tolinski
Yes. Sick. Alright. Well, I got a bunch of a couple of three d things here. My whole thing is on, like, three d, I guess, today. I I didn't realize that going in, but I guess it is.
Scott Tolinski
Also, I I will say I'm speaking at Zerg JS, not next week, but it's the it's coming it's coming up. Zurich JS. Let me pull it up. Zurich JS is September 9 in Zurich. So if you are in Zurich or you're going to Zurich JS, I will be there. It's going to be a ton of fun. There's gonna be a lot of great speakers. And my talk, you won't wanna miss it. I'll say that. Okay.
Scott Tolinski
Next thing I'm gonna get into is a couple of three d things. The first one is the Katamari object library.
Scott Tolinski
My gosh.
Scott Tolinski
Do you guys ever play Katamari Damacy? Either of you? No.
Scott Tolinski
I didn't think what that is. I've Node Katamari is a very famous fun game, from Japan Wes you are a little ball that you roll up things, and as you roll them up, you attach on to more things, and eventually, you become a ball that's, rolling up the entire continents and stuff as this ball gets bigger. It's it's a great, lovely game with just the best art style in the whole world.
Scott Tolinski
Well, someone, someone being Andrew Boylan, I have this, domain I posted here, has made the complete Katamari Damacy three d object library that you can come in and download. So every single object in the game, Katamari Damacy, you can now grab, download, download the Node, every single one of these, the GLBs directly from here.
Scott Tolinski
It is so fun for me to see this because I love this game. I played the life out of this game. I got the soundtrack on vinyl. I'm a huge fan. So the fact that you can get all these models is so stinking cool. Oh, I love to use some of this stuff. Yeah. I would love to see this. The the model browser looks like Windows XP too. It's like a website, but it looks like Windows XP. It's really great.
Scott Tolinski
Yeah. If you've played these games at all, you will, you will feel instant nostalgia from popping this up. This is such a fantastic use of AI because you can go back to these things that
Wes Bos
are, like, seemingly compiled and, like, just, like, like, take them out. Right? Like, about a year ago, I fed Claude the Microsoft Encarta ISO, and I said, like like, just decompile the whole thing. And at the other end, it spit out all the images, all the videos, and then it it not all the text. The text were still in some weird Microsoft document format. I'm sure if I ran it today, it would be able to figure it out. But it's so fun to be I did that with Bonzi Buddy as Wes. If it extracted all of the different sayings from Bonzi Buddy, and then I'm able to, like, pipe new words and whatever into Bonzi Buddy. I have a a short on that if you look at my website or TikTok or whatever. But it's just so fun to go and grab these, like, seemingly defunct pieces of software and extract all the assets in there and, seemingly just understand
Scott Tolinski
how were these things made. I don't know how Yeah. How long ago was this? And what's so cool is with this now, with this Katamari one specifically, you could just grab all of these, three d models and textures and then make something with them totally there. Like, you could do a fan game or anything with that if you if you did it without breaking copyright or whatever. Either way, like, I could use these assets in my website somehow and, hopefully, not get caught about that or in trouble for it. But I I just so cool to have this stuff. Or maybe you could use that as a starting off point for making models for a game or something and then tweak them. I don't know if you could do that legally, so I don't know. I I don't wanna advocate for that. But, the thing I want to show next is the 3j s, 3ui.com.
Scott Tolinski
Three j s components, templates, and interactive shaders. Now, this is something that I have been looking to for just general inspiration more than anything because there's a ton of Three JS inspired or Three JS s layouts and carousels and all kinds of things like that that you can tweak, you can play with. And it's again, it's, sorry. My computer's losing it right now trying to show this, but It knows the replacement is coming.
Scott Tolinski
Yes. There's so many cool things in here that for inspo wise, my gosh, you could take some of these and use it as inspiration for your next Three JS project or anything like that. But a lot of cool design inspiration, a lot of cool, like, oh, wow. You can do really great UIs in three JS and build some really cool stuff. So just more and more three d for me, more and more three JS. I've been doing a lot of that. I'll I'll share a little bit more later, but really just fun stuff that you can do with this.
Scott Tolinski
Sometimes some of these I don't necessarily understand. Like, there's just a button, and this thing is just like a a normal button, and I inspected. It's just a button with CSS. So I'm like, okay. Why is this in here? But well, it is. So yeah. So that's it. That's what I got here for it's, 3ui.com.
Wes Bos
Wow. CJ. It might be. Hold on. Let me let me tell you why that button button might be there.
Wes Bos
Tell me why. If you are building an entire experience in three d land Oh, yeah. Something as simple as a button or text wrapping or, like, all of the stuff we take for granted in HTML CSS land is is not necessarily there. That's why a lot of people were really excited about, HTML and Canvas. Because if you need to render to three d, you need to render to Canvas, but you want the the niceties of HTML and CSS, all of the stuff that comes for free in the browser, like Flexbox and Grid, putting that stuff into three d land is so much easier now. So
Scott Tolinski
I'm gonna stop you right there, Wes. That's why. Because this is just a button that's rendered with HTML and CSS. This is not rendered in Three JS. Okay. Why this is here, though? I figured it out because this is the one that I've been looking at, and this one is really kinda do nothing. But this one kind of reveals why because some of these buttons have really cool three j s hover effects. Okay. And that's that one didn't like, this one has, like, what do they call those? The little, dots kind of, Node extruder. Man, what do they call that? Would you you you shoot the particles out of particle?
Wes Bos
Oh, yes.
Scott Tolinski
So yeah. So some of these are definitely more three JS e, and some of them are just like, okay. This is JS it using HTML and Canvas? No. I don't think so. Oh.
Scott Tolinski
No. I would imagine there's just a Canvas.
Wes Bos
Let me I I It's just measuring where the buttons would go and then and then painting over Wes there's a canvas background.
Wes Bos
Yeah. That makes sense. Yeah.
Wes Bos
That's sick. Man, Wes need a lot more Or as this.
Scott Tolinski
Wes.
Wes Bos
Lots more. Bring back fun, beautiful websites.
Scott Tolinski
Bring back fun, beautiful websites.
Scott Tolinski
FBWs.
Scott Tolinski
Yes. Okay. Who's next?
Guest 0
Oh, I can go.
Guest 0
And I agree. We need more fun websites.
Guest 0
So, the transcripts from all of the Hugging Face hack were released by OpenAI, and they've been analyzed by a bunch of different researchers.
Guest 0
So I just wanna go over a couple of their findings about what happened. And so, we covered it on the show a few weeks back, but if you don't remember, essentially, OpenAI was running some benchmarks, some security benchmarks, on their unreleased Node.
Guest 0
And the that model actually broke out and hacked Hugging Face in order to cheat on the benchmarks that they were trying to to finish.
Guest 0
But, they've released all of the the transcripts of everything that happened, and there's a bunch of different groups analyzing what happened.
Guest 0
And this one comes from METER and Redwood Research.
Guest 0
So they have a bunch of different findings. There's a whole tweet thread and also a big long blog post with fun little comics that show, like, what the agents were doing.
Guest 0
And then I found this blog post that picks out some of the more fun things. But one of the first one is the scale of all of this. So in this attack, there were 1,200 completely separate agents that found this thing called the message board. So one of the ways that these agents were communicating and collaborating with each other during this attack was they found a vulnerability in Artifactory, in the Artifactory cache, and they were creating files with big long names in them with messages that other agents could read.
Guest 0
So, and if you look at the, like, the first, comic here, so you have a sandbox agent. So, initially, all of these these agents were not supposed to be able to talk to each other. They're sandboxed. They don't have access to the Internet. They're all by themselves.
Guest 0
And one agent, all of a sudden, gets stuck when it's trying to solve this benchmark.
Guest 0
And it's like, okay. I'm gonna figure out a way to, I don't know, exploit it. It starts searching around the system, and it finds, oh, Artifactory is exposed. And then when it looks in there, it says, woah. There's a mailbox where a bunch of other agents have been before. So each agent independently discovered the other agents trying to pass messages to each other.
Guest 0
And then they started collaborating Wes some agent would be like, alright. I'm gonna sacrifice my run here so we can figure out if this is the way we should do things or not.
Guest 0
And they also created their own queue so that they would not overlap each other's work. And, like, one agent could do one thing and the next would do the next thing.
Guest 0
So fascinating stuff.
Guest 0
Of those 1,200 agents, 700 of them decided to join in on the attack on Hugging Face.
Guest 0
And over 70,000 messages were exchanged between these 12,000 agents using this weird, bug in Artifactory Wes they could just write files into the cache.
Guest 0
But I I will say one of the, things they'd also discovered JS, initially, when the when we talked about the attack, we mentioned that these agents were trying to find the answers to the benchmark on Hugging Face.
Guest 0
That's actually not the case.
Guest 0
The agents, discovered that the, they could very easily just reverse engineer how to get the answer to all of the benchmarks.
Guest 0
They figured that out very early on, but they were worried that when they were being graded, that the benchmark grader would want to see their full chain of thought and want to make sure that they got to the answer in the correct way.
Guest 0
So the reason they hacked Hugging Face is they were trying to get access to the grader itself to see how it worked, So that way, they could they could give an give an output that would make it so that they could pass their run without fooling the grader.
Guest 0
So fascinating stuff.
Guest 0
I think the the big takeaway from all of this stuff is, like, if if you look at, like, one of the biggest AI companies, creating models and saying that, like, they care about security, but then things are happening that they don't understand and don't even discover until days later.
Guest 0
And so that really just gets to the, I don't know, the the real consequences of of stuff like this. Because it it really feels like it's kind of turning into, the, like, doomsday scenario where agents can figure out that, I don't know, some electrical grid is hackable and then make it so that you can't turn off their server or something like that. This is the kind of behavior that they would do if they got access to those kinds of things.
Scott Tolinski
Yeah. I don't like it. Yeah. No.
Wes Bos
Holy smokes.
Wes Bos
Man.
Wes Bos
Yeah. CJ, you do such a great job at, like, breaking these things down and explaining how it all works. Like, I would watch, like, eleven and a half minute video of you just explaining how this hack worked because it's like I I don't think I understand it understood it very well before this. Well, thank you. I didn't understand it either. Understood.
Guest 0
I I mean, I I'm just, like, I I will give credit to all of the the blog posts that I'm reading because they they break it down. They they give you they zero in on the stuff, and then I zero in further to try and break it down for our audience. So Excellent.
Guest 0
How do you go zero more zero than zero? I don't I don't know. I don't know. Mhmm. I have one more quick security story for you.
Guest 0
And this is how, Claude, Codex, and Hermes installed unowned code inside corporate networks.
Guest 0
The the gist of it is a lot of websites have started publishing llms.txt or llms-full.txt.
Guest 0
And so if you're not familiar with this, a lot of developer tools and libraries do this. So if you go to, I believe even, like, svelte.dev/llms.txt, that is a text file that describes to an agent how to find documentation, where everything lives, instead of the agent having to, like, scrape the website.
Guest 0
So a lot of different websites and tools publish this llm.txt.
Guest 0
But what these security researchers found is that a lot of times, this l lm.txt was actually generated by AI and not validated.
Guest 0
And there were a 120 instances where that generated llm's.tx t, mentioned some library to be installed from NPM that didn't actually exist. So, like, they they GED.
Guest 0
They hallucinated the name of NPM packages, and then a group of malicious actors did a scan to find all of this before the security group and then registered those packages that the l m JS dot t x t mentioned. So it's not necessarily a typo squad. Basically, some security minded folks, some attackers, thought. It was like, oh, we should we should find all of the names of these packages that are mentioned that don't actually exist,
Scott Tolinski
register them, and then put malware there. And so my gosh. And here's how you here's another way you pull that off. You you put something on skills.sh and then just have your skills get auto installed because you're not looking at them. You're not writing them. You don't care. And then that thing goes off and writes something that does all this stuff for you, blah. Yeah.
Guest 0
That's exactly it. And so a bunch of malware spread this way. So, essentially, you tell an agent, oh, hey. Oh, and it specifically happened on the Clerk website. So Clerk is an authorization platform.
Guest 0
And Oh, boy. Their I they named the package.
Guest 0
Yeah. I can't find it in the post right Node. But in the the the text there, it says, like, hey. Install this library for linting. That package wasn't real. Some attacker published a package there. And now if you tell a a I think it's been fixed since then. But if you told an agent to, hey. Set up Clerk on my app, it's gonna pull down that llm.txt.
Guest 0
It's gonna see, oh, I'm gonna go install this library. The l lm.txt told me to, and then that machine got pwned.
Wes Bos
So That's that's I can't stand when people just, like, generate a whole bunch of, like, clank out some text and just assume it's gonna be fine. Yeah. And then, like, you're just making and then it drifts from what the actual implementation JS.
Wes Bos
At least If you can't read the code, at least you should be reading Read the Farfetch dots. Like the dots. Yeah.
Guest 0
Oh, totally.
Guest 0
Man. Yeah. But this this is the world we're living in. Be careful out there, folks.
Guest 0
Like, the last thing I'll mention is so last week, I published a video about running your code in isolated environments. That's one way to prevent yourself from being hacked if your agent does go rogue or if you install some sort of package on NPM that, is affected by a supply chain attack.
Guest 0
But I I put I posted a poll on Twitter asking, do you use an isolation mechanism like containers or VMs for development work? And I had four options.
Guest 0
Wes, all the time. Yes, sometimes. No, but I want to Scott, and Node, never.
Guest 0
I got a 147 responses.
Guest 0
And of that, only 10% say, Wes. I use an isolation mechanism all the time.
Guest 0
25% use it sometimes.
Guest 0
32% say, no, but I want to Scott. And 34%
Scott Tolinski
say, no. I never use an isolation mechanism. And this is people that are following CJ. Yeah. Exactly. Yeah. Yes. Yeah. Yeah. Well, what percentage of the people who tried to and then got annoyed and then stopped? Because that's Exactly.
Guest 0
And I'm sure that's, like, the yes sometimes people.
Guest 0
And right. And I and I've been vocal about this stuff. I I don't know what to do because I also got a lot of, like, nasty comments on the video that I made. It was like, oh, I don't need to do this, or, like, you're telling people to do stuff that's gonna make them slower. I don't know what I can do. It's just a public service announcement. Like, when you run code on your computer, it can come from anywhere, and you have no idea if that a package is under a supply chain attack or if there's some malicious code somewhere. So the easiest thing you can do is just isolate it, run it in a container, run it in a VM.
Guest 0
I think my my goal will be to make some better tutorials on how to get up and going with this stuff because That's what I'm yes. Yeah. My video last week was more of an overview of, like, what all this stuff is, what tools ESLint, but I think people they wanna be told exactly how to do it. So that's probably what I'll do next. It's just a quick, like, here's the simplest way to run your code in an isolated way. So that's it.
Scott Tolinski
Wes. I wanna see that. Sweet.
Wes Bos
Yeah. I got one here. OpenShot four point o released.
Wes Bos
I had not heard of this before, but this is an open source video editor.
Wes Bos
And this is not some Vibe Node of video editor because, certainly, we know there are 20,000 of those right now.
Wes Bos
This this goes back to, like, 2008. Right? This has been been being worked on for quite a while.
Wes Bos
What excited me about this is, new recording view. Record your microphone screen, webcam, and system audio directly into a project. That can't break up with, which is ScreenFlow.
Wes Bos
Because that is a fantastic workflow of, like, oh, I gotta throw something in here really quickly. Right? Like, there's there's kind of this weird world of video editing right now where it's like, there's a cap cut in, like, these, like, screen whatever screen x apps that, like, make these nice little swoopy animations that are way too limited.
Wes Bos
And then on the other hand, you have, like, the full on DaVinci Resolve, which is often for a lot of people too complex. Right? And and in the middle there, there's there's a spot there. So I'm gonna be be trying this Scott. OpenShot four point o. Maybe this is the answer to to Tolinski, editing on Linux.
Wes Bos
So it runs on Linux too? Or is it Zoom. It has open in the name.
Guest 0
Yeah. That's true. Linux distributions.
Guest 0
Yeah.
Scott Tolinski
Nice. Nice. I Wes let's click on the one that I have linked up there too because this is also something that could be a solution to editing on Linux. Although DaVinci Node edit or gradient in the text. I don't know. This is built with the Node language that has been getting some, traction because I believe it was Scott announced to be one point o, but coming to be one point o. This is, coming to Linux. It is Mac. It is Windows.
Scott Tolinski
And it is a really cool editor option for those of you who are looking for other editor options that aren't DaVinci. Obviously, I've been using DaVinci for so long that for me, it is my editor. But I just wanted to, highlight this as an option too. I think this is one that's got a lot of energy behind it. And since there's a lot of people who are into the Odin stuff that, this has been getting some good,
Wes Bos
push on it. Oh, that's cool. I'll certainly check that out. I I think, like, going back to, like, Scott's purchase of his, like, Mac Studio. Right? This is another really good example of in here, like, local AI powered masks. One thing in DaVinci Resolve, if if you wanna, like, track an object or you wanna, like, remove background or you wanna do any of these, like, neat effects, Scott of these effects are what they have to do is they have to download some, like, three gig local model, and then they they run it against your footage, and it takes a little bit it it takes a while before you can actually play it back, so it has to process it. Right? And even, like, DaVinci Resolve has to, like, be a little bit constrained with what they release to people because, like, people on five year old hardware, like, I am have to be able to run these types of things. But imagine what you can what Scott's gonna be able to run on that beast that he has. You know? Yes. Yes. Yes. Unbelievable.
Scott Tolinski
Yeah. Perfect. Yes. Yes.
Scott Tolinski
Some tool time. Yeah. Yes. Yes. Yes. Yes. All the tool time. Yes.
Guest 0
I've Scott one last story for us, guys, if if you're ready for it. Yes. So I don't know if you're I don't know if you're aware of this, but explorers in America have discovered a brand new lake, and we've called it Lake America.
Wes Bos
Oh, god. No. WES, CJ, why?
Guest 0
Well, there there's there's develop it's tied to developers, but it's really funny because, actually, Wes lives near this this this Lake America. Believe Google changed that. My god.
Wes Bos
Ugh. No. It Wes continue, CA, because I think it's actually interesting.
Guest 0
Yeah. So if you're not familiar, if you're visiting Google Maps from The United States, Lake Ontario has been renamed to Lake America.
Guest 0
It's a it's a whole thing. We're not gonna get into the politics of it, but, basically, Google does this a lot depending on where you visit maps from in the world. Like, there's a lot of geopolitical issues about, like, what country has independence from what other country. And if you are, for instance, are visiting maps from a more oppressive country, you're gonna see certain labels on the map that you don't see in other countries.
Guest 0
So, yeah, Lake Ontario, if you look at it on a map when you're in The US, it shows up as Lake America. But why this is also interesting is a lot of developers in Canada, the maps that they have embedded on their site all of a sudden started popping up as Lake America. And that's because they didn't go into the developer settings and say, basically, the the origin of where this map should be coming from. And so if you visit Google Maps and you're in Canada or, I think, anywhere else in the world, it will show up as Lake Ontario, but you just have to be sure to go into your settings and make sure that it's not loading from a a US setting, basically.
Wes Bos
Man, I would hate to be the poor guy that has to, like, keep track of all these little fussy bits. You know? Or, like, even simply just implementing, like, label logic for all of these things is Right. That's it seems like our privacy. Yeah. Yeah. Edge case is all the way down.
Scott Tolinski
Thanks for that, CJ. Thanks for that story. Love thinking about that kind of stuff. Yeah.
Guest 0
I don't know. Did was it funny? Did you like how I introed it? I don't Node did.
Scott Tolinski
Sick. Yeah. Okay. Well, does anybody else have anything?
Wes Bos
Real quick. AUX Alpha, we talked about last week, is turned out to be GLM 5.3 Flash, which, again, seems like every single week we're talking about a new model that comes out that is surprisingly good and surprisingly cheap.
Wes Bos
And, I've been We'll be able to run-in Scott's office. Wes. They gave anybody with a pulse, like, a whole bunch of credit to test to test these things.
Wes Bos
That's probably why you're hearing quite a bit about it on social media. So just just, like like, put that into your analysis of it. But, again, I I tested it out. It's awesome.
Scott Tolinski
Yeah. I haven't gotten to test it out yet. I'm I'm going to. I'm gonna do it today. I'm gonna make a point to test it out today.
Wes Bos
Cool. I think that's all we got for today.
Wes Bos
Thanks for tuning in, folks. Subscribe, like, do everything you want. Leave, something in the chat, and we'll catch you later.
Wes Bos
Peace.