It would seem so: https://www.theregister.com/security/2026/07/29/word-worm-crawls-into-copilot-spreads-chaos/5280588

It makes sense: with LLMs and agents based on them, even plain text becomes effectively executable, so any document can carry malicious instructions. It’s worse with complex document formats like DOCX, ODT, or PDF, since text can be hidden from the human eye and escape detection by review. Very risky tech…

Our company develops software for medical devices. Risk assessment is everything, and we currently do “You can use AI, but you are responsible that the result works and is correct” and “You can use it, but do not input any company secrets, confidential data, medical records, or things like passwords and security-relevant data”.

I guess the difference is we’re too busy making things and we don’t have the time to brag about AI on social media? Also we’re small and don’t have the reach anyway.

I think this will depend on the industry. Slow vs fast moving, regulated vs not, whether someone depends on your API or not, etc.

But regardless, having had to deal with some legacy code written 10 years ago by someone who isn’t working at the company anymore, I would take an outdated spec over none at all. At least then I know what people intended back then, what they cared about, what they had and hadn’t considered. As long as the spec is written by a human, that information is surely valuable.

You end up with a nice spec that you wouldn’t have had otherwise? That has value even if you discard all the LLM-generated code.

I think experienced engineers are able to go straight from a vague requirement to an implementation without that intermediate step, and that power is easy to abuse. We build an implicit spec on our head, which gets translated to code on the fly, and then gets forgotten.

Not defending the LLM technology, but i do think this is one of the upside.

Confusing read. Also using “moms” as a shortcut to imply “non tech savvy people” is not a great choice. Way to antagonize and diminish women for the sake of a punchline.

To me it’s less about the aesthetics and more about ergonomics. I still feel at times that the UI, specifically the toolbar, is jumbled together without much cohesion. Or that the interface has been designed to allow entering inputs to someone else’s tool, rather than built for me to do what I need.

I’m sure some of it can probably be customized; I don’t actually use it that much that I feel the need to tinker.

There is actually a fair bit of drama around this relationship with Collabora, it would seem: https://community.documentfoundation.org/t/vote-revoke-votes-related-to-libreoffice-online-atticiziation-and-freezing-of-repository/13495

Have not used it for programming.

At work, this is to some extent because we haven’t decided yet whether to trust sending away our codebase to be potentially trained on.

In general, this is because I find the agressive FOMO-inducing marketting revolting, and because it would be increasing our dependence on big tech companies where I believe we should do just the opposite.

I did use it once or twice to get pointers on topics I wasn’t familiar with (e.g., new standards or protocols, …), mostly just to get a helicopter view and some sources to follow it up when i was in a rush at work. Would not do that on my personal time.

I wouldn’t object to using an open-source/open-training, ethically trained, self hosted model.

The vast majority of users don’t need “more meat” in their OS. They need stability. Linux Mint works great on that front, I don’t see the need to loose focus with multiple new distros. Not everyone needs to jump distro every month.

Disclaimer: i’ve been using Linux Mint for over 10 years without ever hopping to something else. And I’m a software engineer, not a casual user.

As much as I dislike AI, programming is a field where there’s always something for someone to hate. E.g., should we ban C++ articles because there’s a lot of Rust fans that hate them?

Your two options are not exclusive. Just create a community to discuss AI programming, cross post to the generic programming community if you think it’s relevant, and let people upvote/downvote as they see fit.

This may be KDE Connect. I noticed this happening between my desktop and my phone when installing that app (non KDE desktop). A bit scary at first.

Where to begin… I think numerous sources already discuss what is bad about Amazon, the shopping website, and its CEO. One among many other issues, which I think shows best what Amazon’s values are: for all the resources they have, the Amazon website is terrible to use, and it’s done on purpose. Search filters are useless, promoted products show up everywhere… The website isn’t designed for you to find the things you want, it’s designed for you to buy what somebody else wants to sell. This isn’t a business model I care for, and if that’s what the company is about, I don’t want anything to do with them or any of their products, no matter how good or popular.

Can’t speak for everybody else, but I personally don’t approve of Amazon or any of their services, so I will downvote any content that promotes them, directly or not.

Ironically, it is rustup that triggered me with this most recently… https://www.rust-lang.org/tools/install

Thank you for the nuanced answer!

You ask why I feel this is less secure: it seems the lowest possible bar when it comes to controlling what gets installed on your system. The script may or may not give you a choice as to where things get installed. It could refuse to install or silently overwrite stuff if something already exists. If install fails, it may or may not leave data behind, in directories I may or may not know about. It may or may not run a checksum on the downloaded data before installing. Because it’s a competely free-form script, there is no standard I can expect. For an application, I would read the documentation to learn more, but these scripts are not normally documented (other than “use this to install”). That uncertainty, to me, is insecure/unsafe.

I do, but some of these scripts are quite complex and hard to parse. When all I would really need to do this myself is a direct download URL and unzip/untar in a folder of my choice, it’s a pain.

Indeed, looking at the content of the script before running it is what I do if there is no alternative. But some of these scripts are awfully complex, and manually parsing the odd bash stuff is a pain, when all I want to know is : 1) what URL are you downloading stuff from? 2) where are you going to install the stuff?

As for running the program, I would trust it more than a random deployment script. People usually place more emphasis on testing the former, not so much the latter.

Sounds great! Sadly it doesn’t support Deezer, which is what I use to listen to music. I wonder what it would take to enable this.

How I wish CUDA was an open standard. We use it at work, and the tooling is a constant pain. Being almost entirely controlled by NVIDIA, there’s no alternative toolset, and that means little pressure to make it better. Clang being able to compile CUDA code is an encouraging first step, meaning we could possibly do without nvcc. Sadly the CMake support for it on Windows has not yet landed. And that still leaves the SDK and runtime entirely in NVIDIA’s hands.

What irritates me the most about this SDK is the versioning and compatibility madness. Especially on Windows, where the SDK is very picky about the compiler/STL version, and hence won’t allow us to turn on C++20 for CUDA code. I also could never get my head around the backward/forward compatibility between SDK and hardware (let alone drivers).

And the bloat. So many GBs of pre-compiled GPU code for seemingly all possible architectures in the runtime (including cudnn, cublas, etc). I’d be curious about the actual number, but we probably use 1% of this code, yet we have to ship the whole thing, all the time.

If CPU vendors were able to come up with standard architectures, why can’t GPU vendors? So much wasted time, effort, energy, bandwidth, because of this.

How do you people manage this?

I don’t know what shady shit you’re referring to. They do AI, but I don’t use any of that. IMO their core strength is the search engine and how it works for you rather than against.