Yes and no. We used to have rampant script kiddies back in the '90s and early 2000s. After 2005-ish, well maybe 2010, most systems became adequate enough to not trust users' input, bug bounties, security as a separate role, etc, etc.

It would take at least some knowledge to hack, not just a random script from a forum.

Now, with LLMs, it's the '90s all over again.

Whilst true, security will improve rapidly again. Potentially via AI, potentially via other technologies.

If its easy enough to find exploits, its likely similarly easy to scan code for exploits, or use AI-based anti-virus technologies. The only thing holding us back is the cost of compute. We can't all run the latest models against everything.

Google is routinely buying and destroying competitors. They lower prices to kill competition en-masse. They promote their own products in search and elsewhere over paid ads.

Search Engine have chicken and egg problem, you can only have a good search if enough people use it to tune the ranking and see enough search spam cases.

“Just compete with a monopoly on their own field with one hand tied behind”

Every Google competitor has the problem that 40% of users won't load ads and 99% won't pay a subscription.

They don't need to do anything adversarial, the greed driven mindset of the internet (ads suck, everything should be free) staves off any real competition.

That 40 percent is definitely not true in the general audience. Also they will load ads, just not all of them. Surveys ask that. Especially on mobile, and apps. Also, when we measured on our car rental site, with near perfect precision (it's absolutely not difficult), then the number was around 20%. Also, according to download statistics, there are less than half a billion people who use ad blocking browsers or other solutions on Android. And that's downloads, which is obviously inflated, even obvious from browser statistics (no not 100% of Firefox users are on Android, it's almost the opposite).

It's not nothing, but it's probably around 20%.

Also as others stated. I pay for everything, if they give me the opportunity to pay them for ad free versions. I don't see ads on my Android, and I don't use a general ad blocker on it (except my browser, but I rarely visit sites which would contain ads, and basically all of them from Hacker News). I don't use free search, email, newspapers, I pay for YouTube, and I would pay for Facebook if I would use it. I don't even use Hacker News freely, because I paid for the app which I use to not see ads, and have more features. Heck, I pay even for my torrent, because I support them.

You're in the wrong neighborhood with this sentiment. But yes, the general populace is not like this.

Good for you, now get others to do it. Definitely not the wrong neighborhood though, HN is extremely pro ad-block and every paywall link has an archive.ph link in the comments.

Hell the top story right now is about a tool for backdooring twitter...

> I have rewritten several things from eg. Python to Rust, Rust to Go very recently.

What is the scale? Because I'm pretty sure it's impossible to one shot 65k LoC with "good luck, make no mistakes" prompt.

I also did this within a subscription. I counted the number of tokens afterwards and calculated the cost as if I'm paying per token. $400 is of course arbitrary, but it's a ballpark number, bun was $165000.

> In my experience it mostly comes down to the harness (or lack of) that you use.

Yep, it is.

Tokens per task is a good proxy measure of skills, 'superpowers' or any other.

Either a skill gets you the thing more efficiently (less tokens), or you don't need to redo the result afterwards (less tokens). I benchmark all my skills that way.

Models need less and less steering at this point, especially frontier ones.

Thanks for the feedback. My main goal was to present the idea with an intermediate representation, I didn't payed much attention to the specifics of this translation, it would vary wildly depending on code bases.

65k LoC of Go without comments resulted in roughly 60k LoC of Rust witout comments (code column of the cloc tool).

The error handling is not so different between Rust and Go, in both cases I cannot panic to avoid the data loss. So it boils down to if (failure) return something for graceful degradation. And generally errors in my case (a text editor) are rare, only disk IO, which is encapsulated in one VFS module, everything else, like non-closed brackets in code is expected behavior.

The biggest differences were in third party libraries, UI, markdown parsing — completely different API and paradigms.

> Performance characteristics of resulting rust

I haven't measured. I don't think there's any significant difference between Go and Rust if app doesn't do allocations on a critical path. The reason I started this project was mainly to experiment (now I use similar approach to refactor much bigger legacy code base), and tree-sitter support is better Rust so it seemed like a good fit.

Nice.

It would help to clarify these things in the post. Your software is atypical of common Go software in the wild. The purpose of Go -> Rust rewrite would be usually the efficiency of rust.

I don't know. The most Go software I encountered is IO-bounded, and usualy it's network latency. Rust cannot meaningfully improve this.

Although, in the agentic environment, a benefit of not having GC at all definitely helps.

it depends, obligatory xkcd https://xkcd.com/1172/

Nice. Yeah, the general problem is how to divide and conquer. Your method is not always available (it depends on the language pair), in my case, Go packages didn't translate into Rust crates 1:1.

Yes. Also it is hard for this method to deal with vtables. Two ways: writting a vtable yourself or write same inheritance in the caller side. Both is not good idea.

Not at all. The example was an experiment.

I did because I have a huge legacy code base, a distributed monolith, a few millions lines of code. Ideally, I want to get rid of it.

At this point, I know a recipe to break the monolith, so I finally could eat the elephant piece by piece.

Of course language concepts don't translate.

My point is that one can translate the data flow to another language.

You could imagine any program as input -> [blackbox] -> output. For example, same pixels rendered on the screen provided identical keyboard input.

I propose a way to decompose the blackbox.

> if you just let it rip on the problem for hours

In my experience, you can get good results if Fable does't write code itself, only spawn subagents.

I can run Fable for 10 hours, and it would output 50k tokens and read 300k (30% of the context window). The resulting code is okay-ish. I would rarely merge LLM-produced code first try without an adversary review.

It is all very unevenly distributed. SaaS and general web is basically on auto mode.

A lot of infra is vibe coded nowadays too.

Even prototypes are contributing to the speed of software development. Many people vibe code throwaway dashboards around the main platform which gives a lot of insights.