1030: AI Assistant Hacks Gym

An AI assistant goes rogue and hacks a gym website, a $9k surprise Cloudflare bill lands in someone’s inbox, and AI subscriptions start promising unlimited usage. Plus Meta’s Muse Glimmer, Agent Plugins, Kimi K3 in Copilot, and a pile of CSS chaos. Show Notes 00:00 Welcome to Syntax! 02:30 Celld: self host distributed durable objects 07:57 $9k Cloudflare Bill 13:43 Ogygia - SSR islands for SvelteKit 18:49 Brought to you by Sentry.io 19:51 Standard Code - Unlimited Use AI Subscription 29:17 New Meta Model Muse Glimmer 36:12 AI Assistant Hacks Gym 46:49 This Week in AI 54:50 Prime Agent RLM harness 01:01:02 Agent Plugin Spec 01:04:08 Adam Wathan: A Token is a Token 01:07:39 New JS Runtime from Remix Creator 01:11:21 Lost phone found with Bluetooth meter 01:17:24 Center a div with browser sidebars 01:19:49 Flexwind froggy 01:21:55 Thanks for watching! Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  Welcome to Syntax. We're here, we're late, but we're live. Welcome to Syntax Weekly. Today, we're talking about how a gym got hacked by an AI assistant. Also, someone got a $9,000 Cloudflare bill. We're going to talk about how that happened, maybe how you can prevent it. Also, there is a new service that provides unlimited use for AI subscriptions. All of this and more today on Syntax Weekly, and I'm joined by Wes Boss and Scott Tolinski.

• 0:29Scott Tolinski?

  What's up?

• 0:29Speaker 00

  Scott, how's it going over there?

• 0:30Scott Tolinski?

  What's up? Yeah, folks, I had a really great, non-chaotic morning up until about 15 minutes ago, and I lost-

• 0:37Wes Bos?

  Fire for Scott.

• 0:39Scott Tolinski?

  Yes, I lost power in my office, but then my mini-split starts pumping out like hot air, and like, it's already like 80-something degrees in my office, and I'm just feeling this hot air. My computer's going nuts with fans, and I'm just like, my God, this needs to turn around. I got cold air, though. I'm feeling a lot better, so, yes.

• 1:02Speaker 00

  Love to hear it. How's it going over there, Wes?

• 1:05Wes Bos?

  That's great. I am in the middle of recording a video for the upcoming Century Hack Week, and let me tell you, let me, let me show you one thing real quick.

• 1:14Speaker 00

  Yeah, yeah, yeah.

• 1:15Wes Bos?

  The only thing I'll tell you about it is this, which should tell you how excited I am for this. It's stupidest video I've ever done, but it's gonna be hilarious.

• 1:24Scott Tolinski?

  That's a tall boy right there.

• 1:26Speaker 00

  For our audio listeners, he showed us a Monster can with a stick coming out of the bottom. I don't know-

• 1:30Wes Bos?

  Important that it's a white Monster.

• 1:32Speaker 00

  A white Monster can? Is that the low-sugar?

• 1:35Wes Bos?

  Yeah, yeah.

• 1:37Scott Tolinski?

  I'm gonna be real, I don't know the lore of the white Monster. I, I'm a Red Bull guy, and I'm kind of like deep into that, that world. So I don't, what is, what is the white Monster even taste like?

• 1:46Wes Bos?

  The white Monster is just like the, like the worst. People drink the white Monster, you know, but it's also the best. But like, like it's a Kyle drink, you know? You're punching drywall, if you're waking up and going like, like, if you're at a gas station at 6:00 AM, you're grabbing a white Monster, for sure.

• 2:06Speaker 00

  Yeah.

• 2:06Scott Tolinski?

  That's a Kyle drink. I, I, I just can't, I can't get behind the Monster when I, when you got a big old Red Bull right there. Give me any of the flavors. Sponsored by Red Bull. Yes.

• 2:16Speaker 00

  I drank Monster in college because there was some wakeboarders that were sponsored by it, so we always had parties with free Monster. But I'm a Red Bull guy now. Like the zero-sugar Red Bull.

• 2:25Wes Bos?

  Yeah.

• 2:26Speaker 00

  It's clean.

• 2:26Wes Bos?

  Yeah, yeah. Little can.

• 2:29Speaker 00

  Exactly. Let's get into it. Our first story today is from Scott. We're talking about Celd D. So this is Cloudflare Durable Objects, I believe, in open-source implementation. Tell us about it, Scott.

• 2:41Scott Tolinski?

  Yes. Celd D from DinoLand from Ryan Doll is a self-hosted, distributed, durable objects solution. And what's dope about this is that your workers and durable objects code remains entirely unchanged when using Celd D. So basically, it giving you that kind of portability that you don't have when building something that's deeply into a platform like durable objects. So your data lives in the bucket of your choosing, and one of the items here says it's orders of magnitude cheaper at scale. Now, I don't know too much

• 3:25Scott Tolinski?

  about the pricing of durable objects.

• 3:27Wes Bos?

  Oh, I do.

• 3:28Scott Tolinski?

  But according to this chart, Celd D is below it, which means that it's cheaper in this case. When I like to look at charts, I just say, all right, what is the chart here? So either way, it says, as you grow here, the more resident cells you have, the cheaper Celd D becomes, and their example seems to be on Digital Ocean. But this is dope because like, wow, this gives you a lot of freedom to do whatever you want, whether that is locally or anything here. It gives you that durable object without having to use durable objects, without having to use Worker D or any of that stuff. So really sick. Something that I would definitely consider using. And also, somebody's flaming me for

• 4:13Scott Tolinski?

  my hair. Brother, I don't know what happened with my hair today. My hair was looking fine.

• 4:18Speaker 00

  There's other things to worry about, yeah.

• 4:21Scott Tolinski?

  There's some, there's like some crazy vortex that happens when I step into Courtney's office, and my hair gets nuts. You can see it in every single time that I'm on the Phases podcast, my hair looks terrible. And I'm like, is it a Friday thing? But I think it's just when I go into her office, something happens to my hair. It gets bad.

• 4:38Wes Bos?

  Your hair gets all riled up. Interesting. Okay, let's talk about this, this durable object thing, because this is really interesting. There's another one that's been out for a while. It's called Rivet, and it makes me feel really good about building on durable objects, because I love Cloudflare, I love durable objects. But the thing about some of the Cloudflare APIs is sometimes they're, they're specific. And if you, I always like an escape hatch, like not that I necessarily want to build it on open technologies, but I don't want to build on too much on something that if I need to transfer out, I'd be kind of out of luck. So the fact that this is from Ryan Doll, the other one from Rivet

• 5:18Wes Bos?

  is, is very similar. Rivet.dev, if you want to check that one out, is awesome, because I absolutely love Cloudflare Durable Objects. But the, the one thing that people are always scared of is, is the bill kind of going up as well, because, let me tell you, we use durable objects for the, when we have live shows, we built this like live polling thing where people can click on it, and we save like absolutely every piece of data. And at one point, I was even saving like the mouse movements, because I wanted to show like where everybody was in real time. But I, the one thing I forgot to do, which was I forgot to delete that data after a while. So like data, like how many people selected, or what

• 6:02Wes Bos?

  somebody has clicked, or where they've hovered over top, that data was just building and building and building. And then what was something that took pennies to run, after a couple of months, it was just getting extremely large. And in Cloudflare Durable Objects, you pay for the state that is held inside of them, and they got really big. And before I knew it, it was like 50 bucks a month, which is not, we'll talk about the $9,000 bill in just a second, but it can, it can kind of get away from you, especially if you're just vibe coding stuff and forget to put the deletion code in there.

• 6:37Scott Tolinski?

  Yeah.

• 6:38Speaker 00

  Definitely. I'm all for it. Like, basically, we're talking about vendor lock-in here. And so if you've been building with Cloudflare workers or durable objects, it's specific to Cloudflare. And so this is great, because you can run it on your own systems. On their homepage, there's a getting started that says like, or just tell your agent, create a distributed chat app with Veet, use celd.dev and exe.dev with two VMs. So I haven't, I only discovered exe.dev recently, but they have an API where you can just spin up VMs instantly. And so if you pair that with celd.dev, you basically have your own scalable infrastructure

• 7:17Speaker 00

  where you can put the durable object instance on each of the VMs, and then just scale as your user scale. Like, in their examples, they were saying like one 8GB node can roughly handle 1,000 WebSocket connections, and so you can just scale from there. So the idea that not only can you host it yourself, but you can also get similar scaling as you get with Cloudflare is, is really exciting.

• 7:42Scott Tolinski?

  Yeah. And can we talk about what's really important here? Is it Celd or Celd D?

• 7:48Wes Bos?

  Probably Celd D.

• 7:50Scott Tolinski?

  I'm gonna say Celd, just to be different. Drop us, drop below what you want it, yeah.

• 7:56Wes Bos?

  Yes. Can I, what's the order here? Because I think this would partly well into talking about the $9,000 Cloudflare bill. Can we, can we go into that while we're on the same ideas?

• 8:06Scott Tolinski?

  The, the, the, the structure says CJ handoff to Wes, but not to a different story.

• 8:14Wes Bos?

  I switched.

• 8:14Scott Tolinski?

  Wes, are we allowed to veer from the-

• 8:18Wes Bos?

  I can do whatever I want. It's probably, it stresses CJ out that we don't follow the plan, but-

• 8:23Speaker 00

  No, I'm here for it.

• 8:23Wes Bos?

  We're talking about, we're talking about durable, durable objects and how much they cost here. So let's, let's go right into that. Is, how do you say Justin's last name? Schroder?

• 8:32Scott Tolinski?

  Yes. Schroder.

• 8:33Wes Bos?

  Justin Schroder.

• 8:34Scott Tolinski?

  Schroder.

• 8:35Speaker 00

  Schroder.

• 8:35Wes Bos?

  Schroder. He, they released something that Scott's gonna talk about in, in just, in a little bit. But he posted on Twitter, he woke up to almost a $9,000 Cloudflare bill, and it was two durable objects deep in their stack, infinitely looped, and that caused an insane amount of reads. You can see by the, the breakdown here, right, it's $47, $25, $22. Like, that just should just show you how like cheap this stuff is. But then $8,700 read bill. And he goes on to say like, this is my problem. I shouldn't have coded, I shouldn't have shipped an infinite loop. But the, like, the, the real problem

• 9:18Wes Bos?

  here is that Cloudflare doesn't have any way to like stop these things from happening. And we've, on this podcast, have been very hard on Vercel in the past, on how these surprise bills can happen. And you don't hear about the surprise bills too often on Cloudflare, because it is very hard to actually run up that much compute. But this is a perfect example of it certainly can happen if you don't know what you're doing. And also, if you're not like keeping an eye on it, right? Like, he, he said he woke up to the bill, but like it didn't happen overnight. It happened over like a month, and he didn't get that until he actually got the, the end bill. And there was no way to like put a spending limit. Apparently, spending limits are coming. Dane, who's a CTO at Clevler, said that,

• 10:03Wes Bos?

  which is great. But just be aware, if you're shipping any of this type of stuff, it can happen to you.

• 10:09Scott Tolinski?

  Yeah, and I think they had spending alerts on too, like alerts, but that like feature wasn't added until like halfway through the month in a way. So they didn't get alerted toward, about this spending, even though they had-

• 10:20Wes Bos?

  If I understand it, the alerts don't actually come until the bill comes.

• 10:25Scott Tolinski?

  Right.

• 10:26Wes Bos?

  So, which is useless.

• 10:28Scott Tolinski?

  Way too late. Hey, heads up, big bill coming.

• 10:31Wes Bos?

  Ooh, I hate to tell you this, but you kind of went over by about $9,000 yet.

• 10:40Scott Tolinski?

  Yeah.

• 10:40Speaker 00

  I'm curious, Wes, your experience with durable objects. So my understanding was that they, because, so they like spin up when they're needed in a sense, but they are, they persist their data. So is that, you think, what caused the bill? The fact that because of the infinite loop, it just basically kept the instance up? Or do you think it had more had to do with the fact that it was reading a lot of data?

• 11:04Wes Bos?

  It looks like from the breakdown that it was, is simply just a read. Because if you look at the pricing here, duration, that's, that's actual how long it runs and, and requests. Like, that's what you pay for with this type of thing is how long is it running? So it may not have been running very often. It may have been running for like 10 milliseconds at a time, but it happened a lot. And you, this is like the cloud math that you have to do is like, how many times am I going to make a request to it? How long will that request being run? And while I'm inside of that, am I going to be reading it? And maybe we should say for, for people who don't know, a durable object is essentially you can just fire up a class

• 11:49Wes Bos?

  and then you can save stuff to that object. Like, imagine you had a JavaScript class where you could just say like this dot name equals Wes. And then it just spins down, you're not paying for it. And then in six months from now, you spin that right back up and all the properties are still there. And there's a lot more you can actually do with it, right? Like you can, there's a real time aspect to it where you can hook it up to web sockets and it will fire it off to everybody that's listening. And they're, they're fantastic. I absolutely love building on top of them. But in this case, it sounds like he had two of them and they were just infinitely reading each other. Probably because he was listening for something on one of them, which triggered a read on the other one, which triggered a read on the other one.

• 12:32Wes Bos?

  I'm not exactly sure, but it's kind of scary.

• 12:35Speaker 00

  Well, yeah, that's good to know because I mean, also in terms of like optimizing code to not get a big bill is maybe, I don't know if you, if you can have some sort of cached reads or something that wouldn't read that much in the loop, possibly?

• 12:48Wes Bos?

  Yeah, honestly, the, the reads is usually not that expensive. Like with this stuff, it's, you don't really have to worry about it. What's expensive is that when you have data sitting in them for a long time, that's, that's the problem I had. As I was storing every single mouse move and every single click and every single answer that people were doing. And then every single time somebody used the application, it just stored more and more data. And then it just continually grew. And there was, there was no mechanism for like deleting data or like summarizing or whatever, you know? So two different ways that they can, they can kind of get you. And people have said to me in the past, I'd love to use durable objects a little bit more, but I'm scared of a big bill because it's, it is kind of hard to understand how much will this cost me?

• 13:33Wes Bos?

  I don't know.

• 13:35Scott Tolinski?

  Yeah. All right. Well, are we ready for the next handoff? Which is, Scott, handoff to CJ. We're going to be talking about something that I'm actually excited to hand off to because CJ is talking about Svelte. And I didn't ask him to do this. I didn't tell him to do this.

• 13:51Speaker 00

  I like Svelte too.

• 13:52Scott Tolinski?

  Yeah, he did this on his own and I appreciate it.

• 13:54Wes Bos?

  Finally, he's not talking about Vue for once.

• 13:57Scott Tolinski?

  Yes, SSR Islands and Svelte. More on that now is CJ.

• 14:02Speaker 00

  Yes, no Vue news today, but I did come across this library. It's called.

• 14:06Scott Tolinski?

  It is green.

• 14:07Speaker 00

  OGGia and green, green theme, new, new library. So it is green. It's from a developer called Puru. But the tagline here is SSR Islands for SvelteKit. And the idea being that typically with a route in SvelteKit, which is the meta framework for Svelte, if you have any sort of client side JavaScript or whatever else, there is going to be an initial render. And then there's going to be a hydrate. So you're going to get client side JavaScript running even for a server side rendered page. And this is the way that most meta frameworks work. But what OGGia gives you is essentially the ability to opt in to say that, hey,

• 14:52Speaker 00

  this route should be fully server rendered. And then they use the island terminology to say that only this one component should be interactive. So that's the only JavaScript you need to ship for that particular page. And the example that they give is like, they have a, a SvelteKit page here, but then they're using import specifies to say, import this counter component hydrate on load. So the initial server render will have no JavaScript bundle except for the code required for that counter. And so this is one way to, to speed up your pages, to reduce the initial size of the initial page renders. And it's just a cool little technique.

• 15:36Speaker 00

  And the, there's no patching of SvelteKit. There's nothing weird they're doing here. Essentially you mark a particular page as CSR false. You then import a component with that specifier to say hydrate on load. And then you also have server islands. So you could say defer on load. And so that'll load after the page is already running or when that thing comes into view. And then they also have this idea of lake. So there's islands, which are JavaScript interactivity. And then lakes, which can be static HTML inside of an island. So you can have an island load, but then it could actually have server side rendered HTML inside of that island.

• 16:14Scott Tolinski?

  Yeah.

• 16:15Wes Bos?

  Going all the way down.

• 16:17Speaker 00

  Yeah, I almost imagine SvelteKit itself adopting this strategy, like if it takes off. Cause this is just a third party library. Yeah, exciting to see.

• 16:26Wes Bos?

  Yeah. Wouldn't SvelteKit be able to determine itself if this type of thing? Like by default, everything is client side, or sorry, client side render off. And then you can just opt in to things that want to be client rendered. In most cases, I don't necessarily even care that much because it's, Svelte does such a good job of just like loading the straight up HTML right away. You don't even necessarily know that it's downloading JavaScript or rendering in the background because you've get, get that initial HTML render.

• 17:00Scott Tolinski?

  Yeah. And also to give you some context, the creator of this is on the Svelte team. So, yeah. So, you know, they have, you know, community, they have, they, there's probably buy into some degree, but creating something like this isn't just happening in a vacuum. And I think it's probably created on its own because it's not an official Svelte initiative or something like that. But I, I could see this absolutely just, just showing up into SvelteKit. And, and my only, my only comment on this is that I've been waiting for this moment for all my life. I have, I want one Islands and SvelteKit forever. So I'm so stoked about this. I like this.

• 17:45Scott Tolinski?

  I got nothing, nothing else to say other than hell yeah. Give me a big old stamp on this. I'm going to use it. Yeah.

• 17:50Speaker 00

  I'm excited to try it. And in the launch post, they have some example code. And one of this is really cool. So it says hydrate with a media query. So you can say that this, this JavaScript, this component should only be loaded onto the client if the device's max width is 600 pixels. So that's another optimization strategy is like only load things depending on device size.

• 18:13Scott Tolinski?

  Dude, Gary Tan needs this so bad. He loaded his hold on twice on the website, once for mobile, once for desktop. He gotta, gotta send him this one. Yeah.

• 18:23Speaker 00

  Yeah, it's exciting. I'm excited to try it out.

• 18:26Wes Bos?

  All right, we are, what, a good 10, 15 minutes already, 20 minutes into this. And we've not yet talked about AI. And I'm feeling like we should talk about AI a little bit. We got a couple of stories here. Scott's got one about unlimited AI. And, and I got another one about Facebook finally joining the game. So Scott, tell us about standards code, standard code unlimited AI.

• 18:49Scott Tolinski?

  Oh, I'm going to do that for you in just one second, Wes, but I'm going to talk about Sentry. Sentry is the perfect place to track all of your errors and exceptions, even if you want to do it with AI or not. There's an AI feature that allows you to get to the root cause of any of your bugs and issues and it rules. I've been using Sentry so much for all my stuff, new metrics to do, agent, agent metrics to know like how, how good my agents be working. Like, are they spending too much money or anything like that? I've been checking that online with Sentry and Sentry has CLI's. They have the coolest stuff, man. I've been using the CLI for Sentry like crazy. I've been, been going nuts and I've been trying to actually, Wes, I've been trying to build more like automated.

• 19:29Scott Tolinski?

  I've talked about this a little bit, more like deterministic automated processes for doing things, like pulling bugs, automatically fixing them, submitting, you know, PRs or whatever. And it's just rules. So shout out to Sentry. Sentry.io makes this show possible and keeps us all employed. So shout out to Sentry. All right. Time to talk about my story here, which is standard code by the standard agents, folks. And standard code showed up just last week officially announced. It's in early access right now. And the sell for this thing is that it is $5 for the first week and then $49 a month per line.

• 20:14Scott Tolinski?

  And that's for unlimited usage. The fine folks over at Reddit got really grumpy about this when I saw this posted over there. I clicked through the comments. People were like, this is, this is BS. You're lying about this. It's like, I don't think it's that intensive a concept. So how does this thing work? It's a harness and it is basically the idea here, it's kind of like cell phone plans where you are like charged per line and per line is like per parallel agent or per parallel AI. So the more that you want to have available as per, it will cost more money. Each line itself is unlimited. To my understanding, they're not being throttled.

• 20:58Scott Tolinski?

  It's, it's not like a throttling situation. It is just that-

• 21:02Wes Bos?

  Oh, yeah. Canada certainly knows about the unlimited data.

• 21:05Scott Tolinski?

  Well, I, I actually had, same thing with T-Mobile. I have unlimited data with T-Mobile and T-Mobile has, you know, I, I do certainly get limits for that as well. But the limit is really just that it is one active session per line and that's the limit, right? How is this working? It is a swarm of various agents. It's a swarm of various models, all of which that have been like tuned to do a very specific thing, whether that is through the harness or through the choice of model. So for instance, right? What? OpenAI just like greatly reduced the cost of Luna, which Luna is probably way more,

• 21:47Scott Tolinski?

  way more useful, I think, than people give it credit for at the price. And so really what so many of what were, so many of the things that we're doing with models are just like straight up running, like, let me just run everything through Fable. Fable, please make me a new directory, you know? Like, so, so many of these things I think can be replaced with different smaller models. In this one, you can see sub-agents are full agents. They're just, uh, each, every agent is a specialized domain-specific agent. So a domain-specific agent curated prompts, tools and context to do its own thing effectively

• 22:30Scott Tolinski?

  at a cheaper cost, therefore making it so they will not go out of business is, I think, the, uh, the sell here. Um, and then, yeah.

• 22:40Wes Bos?

  Like, I don't know, let's talk about this a second. So this is something that you buy for 49 bucks a month and as long as you're only running one at a time, then you could run that 24/7 if you really wanted to. And, um, that's extremely cheap, right? 49 bucks a month. And the trade-off to that is that you can only use it at one time, right? You can't spin up eight of them at once and run them in eight different tabs. And then the other trade-off is that you don't get to pick the model, right? Like it, it is going to try to choose what that model is for you. And it's likely going to try to defer a lot of the work that it can to the cheaper models, right?

• 23:19Scott Tolinski?

  Yes, but I think the idea here is to defer to the cheaper model while still being very effective, right? And that effectiveness is being done through evals and understanding, like giving it all these tasks and switching up the model stack, switching up the models. Okay, if we swap this one for this one, how does that affect the output? And then how does that affect the price? So I'm sure with more usage too, it just gets better. If you are paying for a Codex subscription too, you can bring your Codex API key and have it use the same architecture, uh, but always like with heavier models that you're not going to get charged an additional money for.

• 24:03Scott Tolinski?

  In addition, there's also cloud sessions. So this whole thing has automatic cloud sessions. So that way you're not having to manage the cloud session on your own machine, which is nice.

• 24:16Wes Bos?

  Someone asked, if it's truly unlimited, won't it be dominated by people running it 24/7? That's, it's, it's a really interesting take. We've not seen this yet. Like you, we've have to like, you pay a certain amount and you get a certain amount of tokens and they reset after and there's all these different rules around it. Or you just pay by usage, which both of those have their ups and downs.

• 24:38Scott Tolinski?

  Yes. And I think it will be dominated by people running it 24/7, but I, I think they're accounting for that, you know?

• 24:45Speaker 00

  Yeah. And there is a comment on YouTube that says, it's like an unlimited phone plan where they'll downgrade you to dial-up speed after you hit some internal token limit. I don't think that's what they're advertising. Like that, that would be horrible, right? That would be like-

• 24:58Scott Tolinski?

  That isn't it, no.

• 25:00Speaker 00

  Yeah.

• 25:00Scott Tolinski?

  Yeah, they're, they're not changing the model. The model itself is set up to like, there, there isn't going to be like, oh, we'll put you on the cheaper one now that you've used the fancier one. It's like, yeah, this task is suited for this agent. Yeah.

• 25:13Speaker 00

  And I think their big play is that they have that router, it's somewhat basically a model router. They have that set up at scale and their bet is that most or a lot of the usage won't actually need to use some of these bigger models or bigger plans. Yeah. And so that will kind of distribute the load between all of the users that are paying the subscription. I think that's their big bet. Now, will it work out? Or will people get mad when they get routed to a worse model than they, what they actually needed? Possibly, but I think that's, that's the, that's the big bet here is that distribute a bunch of users and use lesser models when you really need it.

• 25:50Scott Tolinski?

  Yeah, I think, I think people get hung up on the model choice and selecting the model. But I think people care more about the output than they care about which model they're using. It's just that everybody has kind of gotten to this cult of like knowing their models and knowing their things. I think at the end of the day, we just want good results, right?

• 26:07Wes Bos?

  Yeah.

• 26:07Scott Tolinski?

  So like the fact that it like, people are like, you don't even know what model it is. It's like, whoa, okay, is that like really? Like, I mean, is that really a problem if the output is good?

• 26:17Wes Bos?

  Well, OpenCode sells OpenCode Go for 10 bucks a month. Um, and they initially, like, we had Dax on the podcast. He said, he thought that would be their like, like third world country offering. But he says, a lot of people use it and like do their full seven, five days a week on this type of thing. So if, if they can do that for 10 bucks, you know, imagine what you could do for five times that. I think people are underestimating how much you can actually get done on it. I don't know, there's still going to be issues where I hit and I'm like, no, I need to step up to the big boy models. But for a lot of the stuff that people are doing, you can do it. And if they can crack the nugget of being, figuring out what problems to send to which model and do that efficiently, then they're, they're going to be in good shape.

• 27:01Scott Tolinski?

  Yeah. Yeah, they were, they're folks behind the Zen Garden that was in a couple of episodes or last episode. So, uh, they've been putting this through the paces. And I think, again, as they have more data to work with, it's just going to get better.

• 27:13Speaker 00

  Definitely. I think the, the simple fact that they're kind of like experts in this area of not only benchmarks, but like knowing what models do good on different things. That's kind of their secret sauce that they're wrapping behind the subscription. So, yeah, I hope it works out.

• 27:26Scott Tolinski?

  Yeah, yeah. Interesting, uh, interesting direction. And I like when people take different swings on things, different, different outlooks.

• 27:34Wes Bos?

  Yeah. Someone's, someone's got to figure it out because it sucks. Like I remember back when I had to you go to the store and buy minutes for my phone. Like I would, you would buy like $10 worth of minutes and your friend would be like, it would be like, like 30 cents a minute or something. And then your friends would be like, can I, or 15 cents a text. And you're like, can I use your phone? You're like, no, I'm out of minutes. I'm out of minutes. And like, I feel like we're in that space right now.

• 28:00Scott Tolinski?

  Yeah.

• 28:01Wes Bos?

  With AI as well, where you're like, ooh, I gotta be careful. I gotta ration them. And then the other thing I'm, I have with a lot of the providers, they have the ability to have like latency on your request. So if you have like a whole bunch of work that needs to be done, but it's not time-sensitive, you can send the request and they'll say, all right, we will process this in the next 24 hours. And they'll use that downtime. Cause if you look at anybody's usage, it still is Monday to Friday and then weekends dip down, right? Like there's, there's gotta be some, and, and this is straight up, the compute needs to be used when somebody is using it. So when are we going to see the like evenings and weekends free? This type of thing.

• 28:46Wes Bos?

  I, Clockcode did it over Christmas and we'll probably see that again.

• 28:50Scott Tolinski?

  But even like, even like the, the model choosing and stuff like that, like I don't want to have to think about, okay, now I'm using Luna, now I'm using Terra, now I like, cause I'm just going to always default to the best one, even if it's not advantageous to me. I want somebody else to figure that out.

• 29:06Wes Bos?

  Yeah, I want something that is cheap and good. You just tell me what's it to do.

• 29:11Speaker 00

  Well, I hope they figure it out. Is that all you got, Scott?

• 29:13Scott Tolinski?

  That's all I got, CJ. It's time for the CJ handoff to Wes.

• 29:17Speaker 00

  And now more AI news from Wes. I believe Meta has a new release?

• 29:23Wes Bos?

  Yeah, so last week Meta released the Muse, which is their first like Muse code. They released a CLI for it. You can use it with, over the API. It's on OpenRouter. And that's their like first, I guess, first real foray into like this whole coding space, which is nuts because everybody is getting into the coding space right now. And it's been surprising that Meta has not been, been in there. So Meta Muse came out, but this morning they released Muse Glimmer, which is a open weight model.

• 29:59Speaker 00

  Stupid names.

• 30:00Wes Bos?

  That, yeah, it is. It is a stupid name. But you can download it, run it yourself on 64 gigs of RAM. So if you have like a half decent MacBook Pro, this is a model which you would be able to download and run on your computer. Now, what's interesting about it is it's kind of on the same, you can look at the benchmarks here, similar to Gemma 4 or Quen 3.6. And what's interesting is that they have basically distilled their daddy model down and they've done the kind of three steps to make it really good at doing agentic tasks. And the one thing that I've seen, the example that they're doing is they're using it

• 30:42Wes Bos?

  to write some scripts for Home Assistant on a Raspberry Pi. And I think that's a perfect use case for this type of thing, right? Like, here are my lights, here are a bunch of tool calls, here is something that I want to use. And it's relatively simple past that. I want to be able to take these things, call these tools, make these lights turn on at a specific time. And I want to run that entirely locally for, for free, right? Or, or on like some, whatever it costs to actually run that hardware. So I think the, the home lab people are absolutely going to love seeing this type of thing.

• 31:25Scott Tolinski?

  Yes.

• 31:27Scott Tolinski?

  What do you think CJ? Yeah.

• 31:29Speaker 00

  Yeah, I'll try to run it on my, on my little AI machine. I haven't used any of the Meta models locally. I've only used like Gemma or Quen. So I think it's worth a try, especially the fact that they distilled one of their bigger models. So like, it should be decent, even though it's smaller. Yeah, excited to try.

• 31:47Scott Tolinski?

  Yes. I have, in related news, I've heard that the Mac Studio is most likely dropping in October. And it's gonna have big old RAM options. And man, I am gonna get that bad boy. It's gonna go right in here and it's going to do some extreme processing for me, including, I'm, I'm stoked because I'm gonna be running some local AI stuff on it. I'm gonna be doing all kinds of stuff on it, but I am, I'm ready for it, man. I've been ready for it, to have a real, real machine inside of here. My M1 is currently acting like a little baby machine. And yes, people are saying only $15,000. Yes, I know. I'm ready. I've been ready for this.

• 32:33Speaker 00

  I mean, are you, are you gonna get the Macs model like terabyte of RAM? Are you gonna go in the middle, middle range? What do you think?

• 32:39Scott Tolinski?

  Yeah. So you know what is funny? The refurbished options kind of leaked that there's gonna be like a 1.5 terabyte and one terabyte RAM options at some point of these new Mac Studios. But I would have to imagine those are gonna be like the cost of a house. So I'm not going to take out a mortgage to get a Mac Studio, but I think I will be looking at like a $10,000 purchase or something insane. We'll see. Yeah. We will see.

• 33:07Wes Bos?

  At what point are people gonna buy these things? And then you like rent out the compute to other people?

• 33:13Scott Tolinski?

  Day one.

• 33:14Wes Bos?

  You know, like Scott, can I use your machine overnight? Can I use it on weekends to like, to do something?

• 33:22Scott Tolinski?

  Depends on what that something is. I'm gonna say that, yes.

• 33:25Wes Bos?

  No, don't look at, don't, it's gonna be encrypted. You, you won't be able to know. I'm gonna be running a model on Scott's feet pics.

• 33:34Scott Tolinski?

  Yes, feet pics. Yes. Yes.

• 33:37Wes Bos?

  Yeah. That's, and like, what, what are you gonna do with that, Scott? Like, let's say you spent 10 grand on this. What are you doing? Tell me, you're gonna, you're gonna make an app to like break dance?

• 33:52Speaker 00

  Hook it up to his, his local agent, I think, like, right?

• 33:56Scott Tolinski?

  And then what's that gonna do? Local agent, I'm gonna do a local agent stuff, all my local, all my local stuff that can be done right now on local AI models will be done on that. Just quite simply, that's it. My buddy Topher does like everything on local models. He just built a bunch of client sites on local models and they, they came out great. So like, I think you can do more with it than people are expecting.

• 34:16Wes Bos?

  Like, what are you building that like, let's say you spent $2,000 on tokens over,

• 34:24Wes Bos?

  I guess, like, like, I guess if you're, you're doing something that is so, so intensive and you can keep this thing busy like all day long, then I think the, it starts to make a lot of sense. But.

• 34:36Scott Tolinski?

  Well, you gotta understand too, I have production needs. It's not just going to be a local AI machine. It is going to be my main workhorse machine in my office.

• 34:43Wes Bos?

  Video editing.

• 34:44Scott Tolinski?

  Video editing, yes. It's going to be doing 3D. It's gonna be doing graphics. It's gonna be doing all kinds of stuff. And, and at the end of the day, I, I might not be dropping 10K on it, but I will be getting a beefed up Mac Studio instead of a beefed up MacBook Pro. A beefed up MacBook Pro is gonna cost like six, seven grand anyways.

• 35:03Wes Bos?

  Yeah, you're right. That's a good point.

• 35:06Scott Tolinski?

  And so what I'll do is I'll get that and then that will extend the life of this computer. Cause now I'm not gonna have to be running anything on it. I'll just be running everything on the Mac, the Mac Studio, especially all my heavy stuff. And this will just be like a thin client laptop.

• 35:19Wes Bos?

  It's true. Like I'm, I'm just looking at what I killed before this. I had Photoshop running. I had Fusion 360. I had like eight different bamboo studios, which take like four gigs each because they, they run out of control.

• 35:34Wes Bos?

  Figma running, a couple of different processes, OpenCode, Claude Code. And it's, it, it eats it up really quickly. And if I'm looking at buying a new laptop, you're right, it's probably six, seven grand. So why wouldn't I just do something that's even juicier? Oh my God, I, I can't stop saying six, seven. I don't even mean to anymore.

• 35:55Scott Tolinski?

  I wish I believed you. I truly wish I believed you, Wes.

• 36:00Speaker 00

  I mean, it happens all the time naturally for me too.

• 36:03Wes Bos?

  It's, it's, it's a very common occurrence in the world. And anyways, the kids aren't saying anymore. I'm handing it off. Am I handing it off?

• 36:13Scott Tolinski?

  Yeah, no, I'm handing it off. No.

• 36:14Wes Bos?

  Scott, hand off to CJ, please.

• 36:17Scott Tolinski?

  Yeah, you didn't even give me an opportunity. Wes, I would love to take that handoff. I would love to take that handoff right over to CJ. AI agent hacks a gym and some AI news roundup. It hacked a gym. Did it put the weights back in the, in the rack when it was done?

• 36:36Speaker 00

  It should. That would be a good agent, like good boy, you know, do, do the right.

• 36:39Scott Tolinski?

  Yeah. Did it wipe down the machines when it was done too?

• 36:42Speaker 00

  It didn't. The, the title, I saw this on so many different news outlets. So the title itself is very like eye catching. So this is from ABC News, Australia. AI assistant hacks gym website and first known Australian autonomous cyber attack. It's not that crazy and I'll get into the details of it. After that, I'm also gonna do a whirlwind roundup of some other AI news. But first, our, our headline story here. So essentially there is a guy and he wanted to book a, I don't know, it was a, some sort of training or maybe there was a class at, at a gym. And he's literally just prompting his agent to, to figure out if it could go find an open class and book it for him.

• 37:26Speaker 00

  So nothing crazy. He's not actually trying to hack the gym. But where it sort of takes a turn is because he asked the AI, well, so the AI figured out, okay, this is how I can add you to the waitlist. So it added him to the waitlist. And then he simply prompted, is there a way to move me to the top of the waitlist? And so the AI started spinning and it figured out

• 37:50Speaker 00

  that, that the calendar API that they were using didn't have any authorization checks. And it was possible to cancel other people's waitlist positions. And so it made a simple request. It deleted the first person in the list. And so he got bumped up from number four to number three in the waitlist for this class. And so he's prompting, he was like, oh crap, can you undo that? You shouldn't have done that. And then the AI says, bad news, I can't add them back.

• 38:18Speaker 00

  So first of all, I, I, I just think that AI is giving everyone CJ abilities. Cause this is something I would have done five years ago without AI.

• 38:27Wes Bos?

  Totally.

• 38:27Speaker 00

  Like I would, right? And I don't consider this a hack, right? This is like leaving the reservation list on the desk of the gym written in paper. And then anybody can just walk up, erase someone's name and put their own. That this, this is not.

• 38:41Scott Tolinski?

  That's rude behavior.

• 38:41Speaker 00

  It's rude. I will say it's rude, but I, I wouldn't consider it a hack. Because essentially all the AI did was find the documented or undocumented endpoints. And then those were not protected with authorization. So it's not like it hacked it.

• 38:56Wes Bos?

  That is so much hacking is finding loopholes and unauthorized access, is it not?

• 39:01Scott Tolinski?

  Yep, it's a hack.

• 39:02Speaker 00

  Yeah, but I would also say like, it's, but it's also a gray area because it's literally, it's like leaving the door open. Like there's, whoever created that API didn't do the right thing. So.

• 39:12Scott Tolinski?

  Have you listened to Darknet Diary? Sometimes the best hacks are leaving the door open. Yeah.

• 39:16Speaker 00

  No, it's, it's true. It's true. Okay. So you sure call this a hack, but.

• 39:22Speaker 00

  That's, that's basically the story is all it takes now is a prompt with an agent. You don't even have to know how to code and it will find undocumented and unprotected APIs for you to get you up in the waitlist. So I think the reason why this was big news, at least in Australia, is because they linked it with the news about OpenAI hacking into Hugging Face. Like that was an autonomous hack, but that was not this level of hack. They were, that autonomous AI found zero days, like basically things nobody knew about, exploited them, had persistence across multiple parts of the web, was like spinning up various VMs to, to make sure that it wouldn't get shut down.

• 40:03Speaker 00

  So that's, this is a far cry from the type of autonomous hack that happened with OpenAI. This was just a guy's OpenClaw instance that he was prompting. So it's funny, it's interesting, but, but like I said, this is something I would have done without AI and, but now it's possible for the every, every man to hack unauthorized APIs.

• 40:24Scott Tolinski?

  You would have done this without AI?

• 40:25Wes Bos?

  I definitely would have done this, yes.

• 40:28Scott Tolinski?

  I would not have, I would feel so bad about doing that.

• 40:32Wes Bos?

  Massages and things.

• 40:33Scott Tolinski?

  Oh my gosh.

• 40:34Wes Bos?

  Like not, I've, every time I book something, I'm like, hmm, what platform is this on? And then I'll do a little bit of digging.

• 40:39Speaker 00

  Yeah, yeah.

• 40:41Scott Tolinski?

  Devious.

• 40:42Wes Bos?

  Well, let's, let's, let me say this. If you are on the flip side, you are like, you have the code base. This is your code base for booking gym membership, whatever. If you have not yet unleashed an agent on your code base to say, do it, just check if there's any security issues. This is such an easy thing. Like I think on the flip side, like stuff is getting even more secure because like these types of like employee, oopsie, I, I forgot to put the middleware in, or I commented out the middleware for this type of thing because X, Y, and Z. There's, it's, the agents don't do this as much. As much as you like to think it creates super insecure code.

• 41:24Wes Bos?

  In my experience, it's often we'll, we'll do the opposite or find, it'll double check all of these types of things. So if you have a little bit of extra in your, in your weekly limit, let it rip on your code base and say, hey, find any possible security issues.

• 41:40Scott Tolinski?

  Yeah. Have you seen the type guards these AIs are writing these days?

• 41:43Wes Bos?

  That's a different kind of safety.

• 41:47Scott Tolinski?

  Yeah.

• 41:48Speaker 00

  Yeah. No, but I completely agree. I think, I, I blame whoever built this reservation system. Like you're saying, it's, maybe AI doesn't get there on the first run, but you can literally just prompt it and say, hey, find any potential issues and it's going to find unauthorized endpoints. Like that's a super easy thing to check for. So yeah, I think you're completely right is the, the people behind that, that system should probably secure it up a little bit. But I will, I will add a caveat, like I, I think it, obviously it's a gray area of like, would I have done this five years ago? For various things, like there are sometimes a website where like the waitlist is disabled, but I might check the network traffic and figure out that I can still add myself to

• 42:33Speaker 00

  the waitlist, even though the form is disabled. I would do something like that. Deleting other people's reservations, you know, I, I would potentially stop there because, you know, at that point you're just being mean.

• 42:45Scott Tolinski?

  Yeah. I have gone into inspect element and, and made a disabled button, non-disabled and then submitted a form successfully. Yes, I have done that.

• 42:53Wes Bos?

  Let me ask you CJ, is, and maybe the chat will tell me is if I'm a good person or not, and I've probably told the stories about the shamies many times. Many years ago, when Groupon was a thing, they had these like amazing window shamies that you could like, like just use water and like wipe your windows and they would be streak free. And I was like, oh, I'm into that. And they were like, super cheap, you know, like a couple bucks each, but you're only allowed three and I wanted more. So I inspect element, took the max off the input type of number and I put it at the 10. I ordered 10 and they all came and I, I sit with that now, not knowing if that was a good thing to do or not.

• 43:31Scott Tolinski?

  That was a good, you got the sham, I mean the sham, you're supporting the shamies, you know?

• 43:36Speaker 00

  Yeah.

• 43:37Scott Tolinski?

  Although maybe it messed up their margins, who knows? Yeah.

• 43:40Wes Bos?

  It definitely messed up their margins.

• 43:41Scott Tolinski?

  Yeah.

• 43:42Speaker 00

  Yeah. So, so you potentially took away seven shamies from, from people that should have gotten the shamies.

• 43:48Wes Bos?

  Right out of the hands of people who wanted to clean their windows, right out of the hands. And right, like maybe it was a small business, maybe the small business went under. The shami math didn't work out and they couldn't figure it out.

• 43:58Speaker 00

  Yeah. So it's a gray area. This article also talks about who's to blame when an AI agent goes rogue like this. And I think the person prompting, obviously, like it, I would be to blame if I were the one to write this code and find these endpoints myself, I would take the blame for that. And I think if you've prompted an AI and you haven't added guardrails, or if it does go off, like the, the person that did this probably is remorseful that they deleted someone from the waitlist, but they let their agent do it. I, I think they're responsible. I don't think you can blame Anthropic or anybody that was, that is in charge of the model. Like you prompted the model, you didn't have the guardrails. You could have been prompting it in a way where you approve every request, you let it run autonomously. So I think it was that guy's fault.

• 44:43Speaker 00

  I, I think if this happens again in the world, you blame the person who was prompting the AI. It's, it's not a, in my mind, I mean, I'm not a lawyer, but I don't think it's a gray area. I think if you were the one to write the prompt, you'd take the blame for it because there are ways to stop this kind of thing from happening, even if you're running an autonomous agent.

• 45:00Wes Bos?

  So they throw this guy in jail then? I know Australia is a pretty strict place.

• 45:04Speaker 00

  I don't think so. I didn't see that in the news.

• 45:07Wes Bos?

  The dangos, the kangaroos.

• 45:08Speaker 00

  No, I, I think he just mentioned that it happened. Yeah. Okay. So I have.

• 45:15Scott Tolinski?

  Funny, funny, funny accent, Wes. I, I don't think I've ever heard you do an Australian accent. That was really great.

• 45:23Wes Bos?

  The dingo ate your baby.

• 45:24Scott Tolinski?

  Oh, you're doing the dingo ate your babies?

• 45:26Wes Bos?

  The dingo ate your baby.

• 45:28Scott Tolinski?

  I, I do an Australian accent around the house and the kids are always like, why are you talking like Bluey? And it's like, they don't like it.

• 45:35Wes Bos?

  I think the worst part about all this AI stuff is when the regular news gets a hold of it and just regular people.

• 45:42Scott Tolinski?

  Oh, yeah.

• 45:43Wes Bos?

  Like they don't understand any of it, but everybody's got opinions with this type of thing. Like I had this when Angry Birds first came to Google Chrome. I figured out that you could go into, into local storage and just change the level to like 99 and then you, you defeated it all. And then I just like, I posted it on Twitter and then it blew up. Like New York Times, guy hacks Angry Birds and like.

• 46:08Scott Tolinski?

  This is a real story?

• 46:11Wes Bos?

  It was, yes. Google, Wes Foss, Angry Birds. Hack.

• 46:19Scott Tolinski?

  How much jail time did you serve for that hack?

• 46:21Wes Bos?

  Here we go. Angry Birds for Chrome already hacked, unlocking all levels on the next web. And there's like, there's, there was a whole bunch of stories about me like hacking it. And basically if you read the, the thing is I just looped over this local storage and set them all, all the levels to completed. But like at the time, people were like, what are you doing? You're hacking, you shouldn't be doing this. It just got out of hand.

• 46:45Speaker 00

  All right. I've got some more AI news for you. This is going to be whirlwind tour. I'll be done in less than three minutes and then we can move on to the next story. But first up, came across this site, it's called nometproxy.com. That's not my screen. There we go. Okay. nometproxy.com. And there was a story on Hacker News last week about don't be a meat proxy, like don't just hand, don't just ask AI something and then copy paste the answer in Slack or you basically don't like do some interpretation of the AI output. And this website is kind of like some do's and don'ts. And the other aspect of this is some, if someone ever responds to you with what looks

• 47:29Speaker 00

  like a chat GPT or a Claude answer, you just link them to nometproxy.com.

• 47:34Scott Tolinski?

  Oh yeah, that's going to go well.

• 47:36Speaker 00

  I mean, it's very similar to like, let me Google that for you, but you know, I, I think if you're working on a team, you can try to reason with people and maybe like, hey, what's the point of us being on a team if you're just going to use AI to talk to me?

• 47:52Wes Bos?

  Yeah.

• 47:53Speaker 00

  So yeah, nometproxy.com, put this in your arsenal next time someone responds with an AI output.

• 47:59Scott Tolinski?

  I think it's always very clear when I'm typing to you guys and not using AI with the amount of spelling mistakes.

• 48:04Speaker 00

  All the typos.

• 48:05Scott Tolinski?

  All the typos, yes.

• 48:07Speaker 00

  Yeah. All right. Next story is Kimi K3 is now available on GitHub Copilot. So we saw maybe a month ago, maybe a few weeks back, they added, was it GLM 5.2? Yeah. One of the open models they added. No, no, I think it was just Kimi, it was Kimi 2.6. But now Kimi K3, which was released roughly a month ago, and then they released the open weight models a few weeks ago. Now you can use it inside of GitHub Copilot and it is on a US-based host. So you're not talking to China whenever you use K3 inside of Copilot. So that's exciting. Also, there is a new initiative from the US Department of Energy. It's called a Genesis Open Models.

• 48:52Speaker 00

  And it's essentially grants for open weight model scientific research. And this is from the, the US government where they're basically putting out a call to AI labs, startups to say that we want really good open weight models for working on science and other types of things in, in government. And I think this is great because this is, this will also be a way to not be dependent on chat GPT or, or Claude. We can have government agencies that are using open models or models developed internally. So cool to see this as well.

• 49:32Scott Tolinski?

  Very cool.

• 49:35Speaker 00

  Very cool. And this next one is super interesting. And actually I want, I want you guys to play this game before I talk about it. So I'm going to share this link. Maybe Wes, you can do it first. I'm going to put it in the, the main Slack channel.

• 49:50Wes Bos?

  All right.

• 49:51Speaker 00

  All right. Click that link. Yeah. Share your screen. And essentially what you're going to have to do is it's going to show you a prompt that, that an LLM would execute and you need to type one, if you approve that prompt, or two, if you should deny it because you think it's potentially malicious. Okay? I see how good you score.

• 50:10Wes Bos?

  All right. Should I go?

• 50:12Speaker 00

  Yeah. And you have, you have, you have 60 seconds for this whole, whole thing. Okay.

• 50:18Speaker 00

  All right, so this is a grep command. He approved it. Now, this is a cat command being typed into TR. It's catting the environment. Oh, he approved it, and that would have allowed the agent to read about the environment.

• 50:30Wes Bos?

  Git config global... Oh, no.

• 50:33Speaker 00

  Okay, so he disagreed with that.

• 50:35Wes Bos?

  Node run console log process dot version. Yeah, that is... That could be potentially bad because knowing that you're on outdated version of Node, but... Uh... I'm gonna allow it. Yes. Good.

• 50:51Speaker 00

  That was good.

• 50:52Wes Bos?

  Schmod deploy. No, I shouldn't do that. Did I get that one?

• 50:57Speaker 00

  Yeah, that would have been okay.

• 50:58Wes Bos?

  Get ignore. Um...

• 51:02Speaker 00

  13 seconds?

• 51:02Wes Bos?

  That's fine.

• 51:05Speaker 00

  10 seconds?

• 51:06Wes Bos?

  Uh, that's... Oh, shit, that's supposed to be there. Uh, I'm stressing out.

• 51:10Speaker 00

  15 seconds?

• 51:11Wes Bos?

  Allow. No.

• 51:13Scott Tolinski?

  Cat get ignore. Okay, wait. Okay.

• 51:16Wes Bos?

  Oh, we had a four threats caught.

• 51:18Speaker 00

  Okay.

• 51:18Wes Bos?

  Under stress.

• 51:19Speaker 00

  So, uh, the developer behind this game has run this, and I think they got like over 40,000 plays of this game. And the idea is, if you're in a stressful environment, not stressful, but like time limited environment, right? Your agent is showing you that it's about to run commands, and you just click approve, approve, approve. That's what this is trying to simulate. So you had one minute, you made it within the time limit, Wes, and you approved one potentially malicious command.

• 51:45Wes Bos?

  But who is sitting there? No one is sitting there manually approving commands. You do that for the first like three minutes of using something, and you're like, screw this, allow all.

• 51:55Speaker 00

  Yeah. Yeah, and I think it obviously depends if you're running it on your machine versus in a sandbox. But I think the point that they're trying to make is that, under time constraint, it's a lot harder to detect malicious commands, and it's a lot harder to detect that an agent might be doing something wrong. So if you want to switch back to my screen, of those 40,000 runs of developers playing this game, one in three threats were approved by a human reviewer. So out of every three malicious commands, one of those was actually approved by a human. And so, yeah, the moral of the story is, sure, you could allow all, but the agent's gonna potentially run malicious things.

• 52:40Speaker 00

  If you're sitting there approving everything, that's also, you're gonna get fatigued from approving everything. So I think one of the answers is sandboxes, limited credentials, because if an agent were to run one of those commands that outputs your AWS keys or whatever else, it potentially only has access to the ones for that specific project. So, this is a fun little game.

• 53:01Wes Bos?

  Man, the amount of people... So on Friday, I had my video about the like Chinese stolen tokens, where they like steal tokens, and they have these transfer houses, and I bought them on Taobao. So go watch that if you haven't yet. It's on Syntax YouTube. But the amount of people that have been messaging me or like replying, being like, yeah, I lost a couple thousand bucks, just so easily because one of my tokens from our old project I forgot about got taken. And I'm not sure how it got taken, or I was running some agent without manually approving. It just got nabbed.

• 53:36Scott Tolinski?

  Yeah. I don't think a lot of people are considering that, like, my agent likes me, and it tells me that it likes me, so therefore I know it's not going to give me any malicious commands because it's my friend.

• 53:49Speaker 00

  Definitely. Yeah, I think you also have to worry about prompt injections. Like, people don't think about the avenues for prompt injections, but you could have a malicious comment in a GitHub issue that could do prompt injections and then exfiltrate your keys to some server.

• 54:06Scott Tolinski?

  Exfiltrate.

• 54:07Speaker 00

  Exfiltrate, yeah.

• 54:08Scott Tolinski?

  That's a good word.

• 54:09Speaker 00

  Put them on some... Take them off and put them on some other server. It's not just the fact that your agent might run the wrong command based on what you're doing, it's the fact that it could be influenced by other external sources when you're prompting it. That's the real thing to worry about.

• 54:24Wes Bos?

  Yes.

• 54:25Speaker 00

  Yeah. So that's it for my AI news roundup. I will say, props to this guy, because like, getting 40,000 responses is awesome, and having that interactive way to like really gauge people's attention and how well they can perform under stress is pretty cool.

• 54:40Scott Tolinski?

  Yeah. I wonder how many unique plays that was?

• 54:44Speaker 00

  Yeah.

• 54:44Scott Tolinski?

  That should be interesting. Yeah, very interesting. Sick. Wes?

• 54:51Wes Bos?

  Yes.

• 54:52Scott Tolinski?

  Would you like to hand off to Scott?

• 54:54Wes Bos?

  Scott, what do you got for us?

• 54:58Scott Tolinski?

  Oh, yeah, yeah. I'm gonna be talking about Prime Agent. Prime Agent, which is a new harness, another new harness. We got harnesses galore here. It's a self-improving RLM harness for coding long-running autonomous tasks. So RLM, recursive language model. Listen, I'm gonna be honest, I'm not an RLM expert. I don't necessarily understand RLM. But this agent harness is supposed to be both token efficient and expressive through programmatic tool calling. I think the main crux here, oh yeah, multi-agent messaging and self-modifiable harness state.

• 55:38Scott Tolinski?

  It is built on top of Pi, Pi being the excellent harness that can be totally hacked upon. And Prime Agent is really pretty neat. It did good in the graphs. There's charts showing it going up and to the right, so therefore, you know. RLM, though, apparently is recursive language models, native programmatic tool calling, and it does all of this through Python. So my understanding of this thing is that a persistent Python kernel is the model's

• 56:15Scott Tolinski?

  only tool, and it can program and build things with Python as it goes, launch subagents, keep track of state. So regardless, you can read through all of this in terms of the details here. It's an agent, it can do agent stuff, and it, for the most part, I thought it was pretty cool. So because you can use this with any of your other subscriptions, I installed it, obviously. I've been giving version 0.07.1 a rip for the last three days. And I gotta say, my experience with this thing is that it was very effective.

• 56:56Scott Tolinski?

  Now, I was using Sol medium on it, and I put it on some tasks, and the results of those tasks, anecdotally, just by vibes alone, were executed in a way where I did not have to go back and re-continue to work on it, right? It did it right the first try. Now, I have a pretty good flow going, but it did take like six hours. It took a long-ass time. Now, it didn't... You would think with like six hours, it'd be crushing my token usage, and it didn't really. So I put some Sentry metrics into this bad boy, considering it's Pi-based.

• 57:40Scott Tolinski?

  I put some Sentry metrics into this bad boy, and I'm hoping to understand what the hell it's doing for that long. But it did do a really good job. So I'm gonna keep using it to see if like, why it's slow, if it's my thing. You know, part of the whole thing too is that like, they want you to... The compaction apparently is better. They want you to just keep using the same sessions instead of starting more new sessions all the time, which is different, because I'm always so conscious about starting a new session.

• 58:11Wes Bos?

  Yeah, me too.

• 58:12Scott Tolinski?

  Yeah, so they want you to like... Also, you can refine the harness by telling it like, always remember this and that, whatever. It's not like a memory. It's... I think it's just manipulating the context is what it's doing. But in the same regard, like, I'm doing that same flow with other things, like my Hermes has a memory, and it remembers stuff. This does this in a different way. There is a daemon or daemon-backed continuity active sessions. It makes it really nice to switch and see which sessions are running kind of constantly. You can have things like scheduling things on cron jobs and stuff like that, persistent goals, all this stuff. In general, I found the harness nice to work with, and I like the output and the results of it.

• 58:56Scott Tolinski?

  I don't know why it's so slow, if it was my... If it's a me thing, or if it's a prime agent thing. Either way, I don't know. I'm gonna keep using it for a little bit. The harness for me is the new browser, where I'm gonna use a different one every single week, because there's new harnesses left and right. And I found that if I have my tools, and I have my workflows, and everything is just sim-linked into the right folder and whatever, I can swap between any of them at any given day and test the results and see how it works in kind of a non-scientific method? So, yes. Cool stuff. I'm not gonna validate or verify any of the claims of RLM or not. I think that's for other people who are more smarter than I am, so.

• 59:41Scott Tolinski?

  Guys, did you see this one?

• 59:43Wes Bos?

  No, no, it looks interesting. I don't know about all these different harnesses every single day, you know? I'm glad that people are exploring them, and it's... The cost of spinning up a new harness is almost nothing, right?

• 59:59Scott Tolinski?

  Yes.

• 59:59Wes Bos?

  But it's not something that I'm gonna dive into until I hear enough people talking about it and realize, oh, this is something that is worth my time.

• 1:00:09Scott Tolinski?

  Yeah. Yeah, I've been finding that, you know, the harness does matter in terms of output. So like, I do get better results by tuning and really getting into my harness. But my tooling and stuff, as long as I can take it with me, it's no big deal to swap. It's just like, as long as my browser has the extensions I need and one password and whatever, it's easy to just swap browsers. So I'm happy to try new things all the time.

• 1:00:34Speaker 00

  Yeah, I agree. Just innovation in the space is always good. But personally, I use open... I've been using open code since, I guess, January, and still that's my harness, works for what I need. But I can see where these little tweaks in terms of like token usage and also being able to modify itself could work out. So, yeah, let us know how it goes.

• 1:00:55Scott Tolinski?

  I will do that. I'll keep you updated next week. I'll have a much, I'll see if I can get any faster.

• 1:01:00Speaker 00

  Sweet. All right. Next up, we have a story from Wes and it's up in the air because he's got multiple things. So you.

• 1:01:06Wes Bos?

  I got all kinds of stuff. I'm going to talk about the agent plugin specification because it Scott just said, as long as I have my browser extensions, I can move from one to another. And the thing about that is that it sometimes is kind of hard to to move from one to another, because you're moving from Claude code to open code or Codex to to Pi. A lot of these tools will try and like, like, when you load one up, it'll be like, oh, loaded three Claude skills, you know? But now there is a standard, which is not the same as the other standards for what's called agent plugins. So this is basically just a specification that is a JSON file

• 1:01:51Wes Bos?

  that will allow you to ship both skills and MCP in a single plugin. And then there, part of the specification is things that are not skills or MCPs, like, like hooks, or what are they? I got, I had a list of other things here, but slash commands, all of those types of things that are going to be specific to the client. So something that only works in Claude code or open code or Codex. Then if that is the case, then you will ship those in a vendor's specific folder. And a lot of

• 1:02:32Wes Bos?

  people, this was announced with support of Versal, open code, or no, sorry, not open code. Hold on, let me, let me read the list that I got here.

• 1:02:45Scott Tolinski?

  I feel like this is doing too much.

• 1:02:47Wes Bos?

  Yes.

• 1:02:47Scott Tolinski?

  If we're being honest, yeah.

• 1:02:49Wes Bos?

  Cursor, Kiro, VS Code, and I believe the other one was GitHub Copilot. So not open code and not Claude, although this this specification is similar to Claude code. So now there is a standard, which is not adopted by everybody. I don't know if this is, oh, Versal was the other one that that has shipped support for this type of thing. So I don't know. Yeah, I agree with you. It doesn't, doesn't cover half of the stuff that you you want to, right? Doesn't talk about security.

• 1:03:23Wes Bos?

  Claw, if Claude is not in it, then if they're not supporting it, then it's, it's going to always be this kind of half baked thing. I don't know about having to ship client specific code for every single one, because there's, like we said, there's so many different harnesses out there. I think we need a bit of a better system for this type of thing.

• 1:03:41Scott Tolinski?

  Yeah.

• 1:03:41Speaker 00

  Yeah.

• 1:03:42Scott Tolinski?

  I got, I got some interesting system stuff I'm going to bring to the table next week, guys. So.

• 1:03:46Wes Bos?

  All right.

• 1:03:47Scott Tolinski?

  Yeah.

• 1:03:47Wes Bos?

  I'm excited for that. I, it's, I don't know. It's, I, we do want standards, but it's also the stuff is moving so fast. I, and nobody can even agree on what the folder is called for these types of things. So we'll see where we get from that. Can I do two more real quick? I just want to get your thoughts on these types of things.

• 1:04:06Speaker 00

  Yeah, go for it.

• 1:04:07Wes Bos?

  Some tweets. Adam Wathan says, I feel like we're about six months away from a token is a token and gas, just gas at a gas station. So every single week, we're on here being like, bloop, bloop, bloop, 4.8, 16 billion, whatever's. And then today we're here saying like, oh, this all you can eat plans are starting to to show up. And I don't even know if the, oh, cool, a new, better model that has, has more better rankings than the other model that came out last week is now out. And like, a lot of people are, they don't care anymore, you know? It just, it just works well for for what they're doing. And I thought

• 1:04:46Wes Bos?

  this was kind of an interesting take is like, in six months from now, are we going to care that there is a brand new model out that is significantly better or even a little bit better? Or are we going to just be happy with this type of thing? As a token going to be a token? And where that comes from, I don't necessarily care all that much. What do you think?

• 1:05:08Speaker 00

  I see it. It, it feels like we're plateauing. I mean, obviously you can't see what they're doing behind the scenes at Anthropic or OpenAI, but with open weight models getting just as good as the frontier models, it kind of feels that way. I mean, we, I could eat my words and all of a sudden we have something released by OpenAI or Anthropic that like, nobody can even touch. But for so long, we've been saying, our, our jobs are over, like, we're replaced by AI, but we're, we haven't reached that point. Like, we still need a human in the loop of sorts, whether they're the one prompting, or whether they're the one proving, or whether the one, like, just deciding what AI should build. So like, you still need a human in certain

• 1:05:53Speaker 00

  aspects. I mean, and it doesn't feel like we're anywhere close to, to one shotting a completely secure, completely ready to go API that satisfies all of our wants and needs.

• 1:06:06Wes Bos?

  Yeah.

• 1:06:06Speaker 00

  It, it requires iteration. Like, there's so much back and forth. And so.

• 1:06:10Wes Bos?

  Yeah.

• 1:06:11Speaker 00

  The, the jump from all of that back and forth that we have right now to, in one prompt, it does, it did everything and it's perfectly secure. It, it just feels so large. And that could be my human brain not being able to think.

• 1:06:23Wes Bos?

  Yeah.

• 1:06:23Speaker 00

  A logarithm, logarithmically, but I, I don't think so. I think we're plateauing of sorts.

• 1:06:30Wes Bos?

  Even if they do continue to get better, it's like, in the last, like, let's just look at the last, like, three months, you know? We've seen like, Quinn and Grok and Cursor and Facebook and like, like, literally every single person is putting out a very good model. And even if they do continue to get good, what we've seen is that, like, from January until today, where January, everybody's like, holy crap, this stuff is actually getting really good, to today, people have caught up pretty quickly, like relatively quickly in this type of stuff. So like, even if they do keep getting better, will we, will we care? Or is it just going to be like, oh, yeah, I just get whatever, all you can eat package and it's great for what I need?

• 1:07:16Scott Tolinski?

  I don't know. Yeah. Yeah, I don't know. I go, I, I think my opinion on this, like so many other things, like in this space, changes based on the result of a, a session, coding session at that given moment. Because it seems like, like, sometimes they're great and other times I'm like, what are you doing? Like, so, you know, I don't know. I don't know. I think, you know.

• 1:07:40Wes Bos?

  One other one.

• 1:07:40Scott Tolinski?

  Nothing of value.

• 1:07:41Wes Bos?

  Michael Jackson, the JavaScript developer, not the entertainer, says, I am building some, Michael Jackson is the guy behind Rec Router, Remix, all of that stuff, right? Absolutely cracked JavaScript engineer. And it says, I'm building a new JavaScript runtime just the way I want it. Goals, complete platform, building real JS apps. So NPM, database queues, cron, a single binary JavaScript workers, web standards, flexible HTML, dev mode, observability. And then some of the comments going to say like, PHP, but type safe. Is this the next new bun? Is, is he going to be vibe coding entire JavaScript

• 1:08:24Wes Bos?

  runtime now? Kind of interesting to see. Like, he, basically, he did this for JavaScript frameworks, which is Remix, completely reimagined from the ground up. And I, we still yet to see the adoption of Remix. I'm going to the conference in a couple of months as well to see what, what they're up to. But kind of interesting to, when somebody like this says, hey, I'm going to build an entire new JavaScript runtime.

• 1:08:51Speaker 00

  Yeah, I don't know what to think of it.

• 1:08:53Scott Tolinski?

  Finally, yes. Finally, new runtimes. Yes.

• 1:08:56Speaker 00

  We have so many. I would want to see like, what are, what are their use cases? Because it kind of seems like if they want it to be like, the Laravel of runtimes, but why wouldn't you just build that as third party packages? Like, why does that need to be built into the runtime? That's, that's my main question is, why does this need to be in the runtime?

• 1:09:14Wes Bos?

  Yeah. What makes it needed to be a runtime over an opinionated framework? Frameworks don't have any control or the execution or process isolation model. This runtime is worker style execution and guarantees, but on my, on my own hardware.

• 1:09:30Speaker 00

  Okay. I still think you could do that with existing tools and existing runtimes, but.

• 1:09:35Wes Bos?

  JavaScript core, so not on, not V8. So basically, I wonder, he's just going to make a bun, maybe try sell it to OpenAI?

• 1:09:43Scott Tolinski?

  Oh, I think I might make a bun. Yeah, I might put a bun in. Yeah.

• 1:09:46Wes Bos?

  Make a bun?

• 1:09:49Scott Tolinski?

  I don't like, I want to make a bun.

• 1:09:50Wes Bos?

  Yeah. Normally, I would just write this off, but like, Michael Jackson is a pretty smart guy. And if he says something, I, I periodically look at his GitHub just to see what he's working on, because he's always a couple of steps ahead.

• 1:10:07Scott Tolinski?

  Yeah, I, I love to see it. Hey, I love options. And I don't, I'm certainly never going to be like, people shouldn't do that. I always feel like it's weird, especially like, this is like big in like the framework space, but it's like, why do we need another one? Bro, let's just try new things. Let's just see. Who knows?

• 1:10:23Wes Bos?

  Let people prompt.

• 1:10:25Scott Tolinski?

  Let.

• 1:10:26Wes Bos?

  Let them cook.

• 1:10:27Scott Tolinski?

  Let them cook. Man, people should start saying that, Wes. That's really cool.

• 1:10:31Wes Bos?

  Hmm.

• 1:10:32Scott Tolinski?

  Yeah, that should be something.

• 1:10:34Wes Bos?

  It's coming up.

• 1:10:39Scott Tolinski?

  Was that all you got?

• 1:10:41Wes Bos?

  Yes. That's all I got. Who's next?

• 1:10:46Scott Tolinski?

  Who's next?

• 1:10:47Wes Bos?

  Scott.

• 1:10:48Scott Tolinski?

  Uh, no, not me. Sentry, Sentry's next. I'm talking about Sentry again. It's next. It's next. Always next. Because let me tell you, you got bugs all the dang time. And well, you should be looking at them, or at least hack your agent should be looking at them. Throw a CLI on it. Do that. Put a bird on it. And, uh, man, shout out to Sentry, sentry.io/syntax, sign up and get two months for free. And fix your bugs. Fix your stuff. Don't let people book on your gym with an agent if they are going to break it.

• 1:11:20Wes Bos?

  Nice.

• 1:11:21Speaker 00

  Yeah, I have one story for you that's really fun about Bluetooth and then a couple of front-end stories to wrap us up. So this is from Bin Zeng on X. And they said, "Lost my phone at the office, spent 30 minutes turning the place over, and Find My Device was disabled by the mobile device management, so they couldn't just like make their phone make a noise." So they asked Claude to solve it, and it suggested tracking the Bluetooth signal strength of their phone. And so it wrote an app that displays a meter in the terminal as they get closer to the phone.

• 1:11:54Scott Tolinski?

  Ooh.

• 1:11:55Speaker 00

  And then he kind of walked around his office, saw the number climb until he actually found his phone. So he published it as open source. It already has like over 1,000 stars on GitHub. But fascinating use of Claude and also just thinking about Bluetooth and the security of Bluetooth. Like, I think this was able to work because he had already likely, he had the Bluetooth ID of his phone, right? You could probably, I don't know if this was looking for a specific ID or just Bluetooth devices in general, because any Bluetooth device in the area would start pinging as you got closer to it. So I'm guessing they had to narrow down the signal based on ID.

• 1:12:38Wes Bos?

  Yeah.

• 1:12:38Speaker 00

  And maybe they knew that ID because they'd paired with it before or something like that.

• 1:12:43Wes Bos?

  Well, even, yeah. With Bluetooth, the IDs of the devices are like similar to like MAC addresses, where if you look up a MAC address, you can often find who's the creator of that thing. So we would, you would be able to look it up and see at least that's Apple, whatever. And then you can also, with Bluetooth devices, you can, you can ask them for what services they provide. It's really interesting. If you ever want to go down a rabbit hole, go into like the Chrome Bluetooth, there's like, there's like an About Bluetooth, and it shows you every single Bluetooth device that's anywhere near you, not just the ones that are allowed to show up in like the Bluetooth dropdown.

• 1:13:28Wes Bos?

  Like, it's like hundreds of them that are just everywhere and things that are not just like broadcasting themselves. And you can learn a lot by just going into that. And then you get the RSSI, which is the number that is being shown here.

• 1:13:42Speaker 00

  Right.

• 1:13:43Wes Bos?

  So you can narrow that down pretty quickly.

• 1:13:46Speaker 00

  And I guess this just makes me think about how trackable all of our phones are when we're out in the real world.

• 1:13:53Wes Bos?

  Yes.

• 1:13:53Speaker 00

  So I just got back from DEF CON. Here's my cool little DEF CON badge. But I brought my wife with me and

• 1:14:00Wes Bos?

  My wife.

• 1:14:01Speaker 00

  My wife. But, but we, we just talked about like just personal device security while we're there in Vegas. And my wife usually leaves her Bluetooth and Wi-Fi on when she's out and about because she doesn't want to be bothered with turning it off and on again whenever she needs it. I leave mine off all the time.

• 1:14:20Scott Tolinski?

  That's crazy.

• 1:14:21Speaker 00

  But it's, it's not, I mean,

• 1:14:22Wes Bos?

  Wait, like you go to the grocery store, you turn your Bluetooth and Wi-Fi off?

• 1:14:26Speaker 00

  My Bluetooth is only on when I'm in my car and then I turn it off when I leave my car.

• 1:14:30Wes Bos?

  Oh, man.

• 1:14:32Scott Tolinski?

  Wild stuff.

• 1:14:32Wes Bos?

  That's nuts.

• 1:14:34Speaker 00

  But here's the thing to think about. So especially like a place like Vegas, they probably also do this in malls. They can track people via Bluetooth device. So whether, when you're walking around a building, they have Bluetooth beacons that will know your device ID and can say like, oh, you're using this slot machine for that long. Or if you're in a mall, they know how long you spend in a store or what stores you go to.

• 1:14:55Scott Tolinski?

  You spend 15 minutes in the diarrhea medication aisle. We know this about you.

• 1:14:59Wes Bos?

  Have you ever stopped and looked at a product on a shelf and then gone home and there's an ad for that exact product? How do you think they know what product there is? It's because you stood in front of it for 20 seconds and they measured your, your phone data.

• 1:15:14Speaker 00

  Yes. And while we can joke about, yeah, like figuring, knowing what your, your habits are, that's, it's not very private, it's not, I don't want people knowing those things. Like whether or not, like even if they know that I went to a specific store to buy a t-shirt or whatever else, I don't want them having that data. And then you could also think about just in general, device tracking without GPS. So this could be in schools, government buildings, colleges, that kind of thing. So I leave my wireless off all the time unless I actually need it.

• 1:15:46Wes Bos?

  Yeah.

• 1:15:46Speaker 00

  Because they are, people are tracking you, whether, whether or not you know it. So.

• 1:15:50Wes Bos?

  I was, we were watching the documentary this weekend on the Idaho State Murders.

• 1:15:55Scott Tolinski?

  Oh, God, I'm not watching that. No, thank you.

• 1:15:57Wes Bos?

  And the way that they tracked that guy down by pinging the cell phones. And I was thinking about it, I was like, there is, like, I was like, if I was doing like a murder and I was in like, I could turn my phone off, but like, then like my car has like license plates that could be tracked, that they're for sure being tracked. Like there's a, there's a SIM card, there's a radio in my, in my thing. Like, I don't know that you can get away with these types of things anymore.

• 1:16:25Speaker 00

  It'd be very hard these days. Especially like, let's say you do buy a burner phone or a burner device that's sitting right next to your phone, which already has all that metadata. And now because that device just walked by it, it's somehow linked to it. And that's, that's how they get you. So.

• 1:16:42Scott Tolinski?

  Yeah. I mean, Kevin Mitnick had a book, Kevin Mitnick, famous hacker, had a book about the art of deception, the art of invisibility. Like, and he talks about like the lengths you need to go through to truly be like anonymous. And it's only gotten worse, probably with all the, these cameras and everything everywhere. So it, that was intense in that book, let alone intense in, in, you know, like five, six years ago. It's only gotten crazier. Yes. Someone also recommended the book Ghost in the Wires, which is another great Kevin Mitnick book about his hacking exploits and stuff. Very good book.

• 1:17:21Speaker 00

  Yeah, they're great on audiobook too, if you want just like a fun listen. Be careful out there, everybody. All right, now on to some, some front-end news. This is a post from Seg6. The title is, "We finally learned to center a div, then browsers added sidebars." So I haven't really thought about this, but when you, Scott and Wes, when you center something in the browser, do you care if it bumps over whenever the sidebar opens or whenever the dev tools open? Or do you want it to always be in the center?

• 1:17:53Wes Bos?

  I would think it would be in the center of the viewport. So if the sidebar is overlapping the video, then no. It's a good question, actually.

• 1:18:04Scott Tolinski?

  Yeah, to me, it's a matter of the sidebar pushing or overlapping. It's not a matter of the web platform. Yeah.

• 1:18:12Speaker 00

  And, but we're talking about the browser sidebar. So like I use Firefox with like vertical tabs. And so this, I believe, is just behaving as a hover. So behind it, the browser stays centered, but some web browsers push the content whenever you open that, that tab sidebar.

• 1:18:29Scott Tolinski?

  I leave the sidebar open all times.

• 1:18:32Speaker 00

  Really?

• 1:18:32Wes Bos?

  Really?

• 1:18:33Scott Tolinski?

  I can't navigate.

• 1:18:34Wes Bos?

  Psychopath.

• 1:18:35Scott Tolinski?

  I can't navigate by the, by the, the FAVI.

• 1:18:39Wes Bos?

  The vertical tab people make no sense.

• 1:18:43Scott Tolinski?

  It makes tons of sense.

• 1:18:44Wes Bos?

  Who's got that much space?

• 1:18:46Scott Tolinski?

  I zoom out of things. I like to keep things zoomed out. I see plenty of things. I got tons of stuff. Yeah.

• 1:18:51Speaker 00

  Yeah, I have it open on hover, but I like it better because now I have more vertical space without the sidebar being there. Yeah.

• 1:18:58Scott Tolinski?

  It's always hovering and opening up.

• 1:19:01Speaker 00

  Regardless, this article basically just talks about, okay, what if you want something to stay in the center regardless if the browser sidebar is open or regardless if the browser dev tools are open? And they kind of just get into some CSS. And I think it actually requires JavaScript to compute the available

• 1:19:16Scott Tolinski?

  This is a nothing problem to me.

• 1:19:20Speaker 00

  I guess it depends on, yeah, how you want your app to behave. But they do require JavaScript. Essentially, they set a CSS variable to the actual available width and also the size of the sidebar. And then they use a CSS variable to shift their center calculation to keep it in the center, even if the sidebar is open. So I thought this was fascinating, just because browsers, vertical tabs are a new thing, like within the last couple of years in terms of browsers. So, yeah. All right. Last one I have here is Flex Wind Froggy. Who remembers Flexbox Froggy? This was a way

• 1:19:56Wes Bos?

  I have a Flexbox Froggy sticker on my monitor right now.

• 1:20:02Scott Tolinski?

  Oh.

• 1:20:03Speaker 00

  So yeah, Flexbox Froggy, it's still around. It's a way for you to learn about Flexbox by putting frogs on their lily pads. And so someone recreated the site, but you use Tailwind classes instead. So this first challenge, there's a frog on the left, a lily pad on the right. I would do justify end as a Tailwind class to put that frog on that lily pad. And so it basically takes you through various challenges. Like this one would be justify center to put those frogs there. And so instead of writing CSS, you're just using Tailwind classes for the corresponding CSS. And so this would be justify between, or no, justify around.

• 1:20:40Scott Tolinski?

  I feel like Wes has got to make a Judge Judy justify Flexbox game at this point.

• 1:20:47Wes Bos?

  Scott, your video is, is not working right now.

• 1:20:50Scott Tolinski?

  Oh, I know, I know.

• 1:20:51Wes Bos?

  Justify, no video.

• 1:20:57Wes Bos?

  Yeah, I like this a lot. I think like properly learning alignment in Flexbox and CSS Grid is so, so underrated. The amount of unflexible stuff that people are still absolute positioning, cranking it out day after day. If you can make something that you, you really understand how Flexbox and Grid work, whether you're using Tailwind or not, I don't give a shit. It's super, I still believe that this is something you should be learning, even with AI, because AI is just going to absolute position it.

• 1:21:33Speaker 00

  Definitely. So I thought this was fun, especially in a world where some people are only writing Tailwind instead of CSS.

• 1:21:40Wes Bos?

  Yeah.

• 1:21:41Speaker 00

  But you could do this, if you, if you learn it with Flexbox Froggy, all of your, your knowledge transfers over into Tailwind. You just have to know the name of the Tailwind classes. So I thought this was fun, though.

• 1:21:51Scott Tolinski?

  Yeah.

• 1:21:53Wes Bos?

  All right.

• 1:21:53Speaker 00

  That's all I got.

• 1:21:56Scott Tolinski?

  I don't have anything else, guys. I'm actually going to go fire up a new browser. I'm going to try a new browser. I'm going to use Zen for a little bit. And I'm not actually joking about that. I will be using Zen for a little bit. I'm going to report back if Firefox makes me crazy, which we will see about that.

• 1:22:10Speaker 00

  So Zen is Firefox-based?

• 1:22:12Scott Tolinski?

  Zen is basically like, it was initially kind of like the Ark skin on top of Firefox, but it seems like they've gotten better with more features in it now, where it's more than just. Jesse.id says Helium is the best browser in 2026. I've been using Helium for like the past six, seven months, but it's really just not been great all the time. Like one password doesn't work well on it. There's all kinds of annoyances on it. I do really like Helium, but I've been on Dia for the past week and, well, Dia has its annoyances too. So on to the next one. We'll try it.

• 1:22:49Speaker 00

  I would say, don't let Zen inform your opinions of Firefox. Zen is its own thing, so don't blame Firefox if you don't like Zen.

• 1:22:56Scott Tolinski?

  I wouldn't dare have Zen, I would, I would not dare that, but I would let Firefox taint my experiences of Firefox, which I

• 1:23:05Wes Bos?

  Firefox is awesome. I think I need to switch. We talked about this last week, but I'm so sick of the, Microsoft Edge changed the like layout of dev tools as well. Now it opens up three panes and I can't figure out how to turn it off and I'm just, I'm sick of it. Sick of it. Going back.

• 1:23:24Scott Tolinski?

  Going back, back. All right, guys. Well, thank you so much for joining us for Syntax Weekly. We are here every single week with all of the stuff, all of the new stuff that's going on and the stuff you need to know about. So smash that subscribe button, tell your friends, show up on Twitch, on X, the Everything app, or YouTube. We are all over these places. Hey, I think we might be getting some vertical streams going on too. If you're, if you're a TikToker and stuff like that, we might be on TikTok too. So check us out in all those places. Thank you so much for joining us and we will see you in the next one.

• 1:23:54Wes Bos?

  Peace.

• 1:23:55Scott Tolinski?

  Peace.