1036: Cursor & OpenAI Break Up

The messy breakup is official; as of November 12, OpenAI's models are getting pulled from Cursor, and we're digging into who's really to blame (and why Wes called it). Plus pnpm 12 goes full Rust, Mitchell Hashimoto drops Superlogical, ~700 AI agents attack Hugging Face, and Zod 4.5's compiled schemas get up to 9x faster. Show Notes 00:00 Welcome to Syntax! 00:33 pnpm 12 Rust Re-Write 02:45 Zod 4.5 brings Schema Compilation Zod 4.5 launch post 05:22 Brought to you by Sentry! 07:14 Cursor OpenAI Break Up Michael Truell’s post 15:35 vGPU - WebGPU library for agents TypeGPU Main differences between vgpu and TypeGPU 22:32 Omarchy Security Issues and Linux Chat Omarchy Security issue in Omarchy Close three paths from an unprivileged session to root commit CachyOS 36:38 Scott Bought an M5 Ultra Mac Studio 44:45 Superlogical is a new terminal multiplexer 48:31 Zurich JS 48:55 Katamari Object Library 52:05 ThreeUI - Three.js library 55:36 Hugging Face Hack Analyzed / Updates METR & Redwood Research investigation Brief independent investigation of agents’ behavior About the Hugging Face attack Postmortem of the HuggingFace hack 01:00:46 llms.txt used to pwn devs 01:03:56 Running Isolated Code Poll 01:05:47 OpenShot 4.0 - OSS Video Editor Blick editor 01:09:06 Lake America 01:11:24 Ox Alpha is GLM 5.3 Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  Welcome to Syntax. Welcome to Syntax Weekly, the place with all your latest web dev programming news. We got a good one for you today. We're talking about how Cursor and OpenAI have broken up. Also, PNP M12 has been released and it's been rewritten in Rust. There's also a cool web GPU library for agents. All of this and more today on Syntax Weekly. I am joined by Wes Boss and Scott Tolinski.

• 0:25Scott Tolinski?

  What's up?

• 0:26Speaker 00

  How you guys doing?

• 0:27Wes Bos?

  Oh, I'm doing good. How are you doing, CJ?

• 0:29Speaker 00

  I'm doing good. Let's get right into it. So our first story today is the PNP M12 release. And so this is a rewrite of PNP M in Rust, and it's stable. And what's the one nice thing about it is it's not meant to be a migration. There's not a lot of major breaking changes. Things are just going to be faster. And there's some cool sensible defaults as well. One of the first ones is project aware global bins. So a lot of times you might have Node Dino or Bun installed globally, but in any given project, you want to use a specific version of it. Now, when you're using PNP M, it'll look at the dev engines runtime in your package.json and automatically choose to run the right version when you do like

• 1:14Speaker 00

  PNP M run.

• 1:15Wes Bos?

  That was a feature of VIT Plus that I've been very much enjoying.

• 1:19Scott Tolinski?

  Yeah.

• 1:20Speaker 00

  Yeah. So it's here in PNP M. They also have Git dependency resolution. So it used to be like, there's so many different ways to install a package from GitHub. Like you could do like username slash package, GitHub colon username slash package, and like the SSH URL, the HTTPS URL. Now this normalizes it into a specific thing that shows up in your package.json. And then they have a resolution algorithm that'll, I think, I believe it uses HTTPS to pull in that particular library or that particular commit. So that's nice to see. Couple of other things.

• 1:57Wes Bos?

  Yeah, rewriting this in Rust is just like a half a sentence.

• 2:01Speaker 00

  Yeah, I was, I was hoping to see like stats, like, is it faster? I mean, obviously, it's faster, but also PNP M is fast. That's why I've been, I've been using PNP M for like two years now, because it's so much faster than PNP M.

• 2:14Scott Tolinski?

  How do you get it fast? This is how I guess, but yeah.

• 2:17Wes Bos?

  I don't know. Not a problem I had, had had, but maybe, maybe it's even faster. That's unbelievable.

• 2:24Speaker 00

  Yeah.

• 2:25Scott Tolinski?

  Yes, PNP M, another one.

• 2:27Speaker 00

  PNP M.

• 2:28Scott Tolinski?

  Yeah, PNP M, it's constantly pushing it, constantly evolving. And really, what would we, what would we do without PNP M? It's the best, folks.

• 2:36Speaker 00

  It's good stuff. Yeah, check out their release post, upgrade if you haven't yet. Check it out. I got one more release for you as well. And this is from the ZOD team. So ZOD has released version 4.5. And the big standout feature here is schema compilation. So they released a new method, z compile. And this takes any schema into a precompiled schema that's three to nine times faster. And that compiled schema can be used in exactly the same way as any of your ZOD validators. It essentially just does it ahead of time. And so you can check out their, their release post, that shows like up to 7.8 times faster when compiled.

• 3:18Scott Tolinski?

  Cool.

• 3:19Speaker 00

  There's a few other things in the 4.5 release. You can see their blog post here that talk about it. And then they have a specific post talking about z compile. And essentially, what they do, if you're not familiar, ZOD validators were essentially like runtime validation, where when you did z parse, it would actually have to go through and dynamically pick out all of those validators dynamically invoke them. But the compilation essentially just creates a really quick, really fast bit of code that does that specific validation. And that's why it's so much faster. And so I believe they have like a VIT plugin. There's a way to get it to run with Node JS, where these compiled schemas can actually

• 4:01Speaker 00

  be part of your bundle as well. So you don't even have the runtime cost of having to spin up this validator and do all the dynamic instantiation. It's essentially just code like if type input does not equal object, or input equals null, or return false, or if type of input.x does not equal number, return false. So the kind of stuff that would be under the hood, but it basically does that ahead of time. So all of your, your runs for ZOD parsing are going to be a lot faster. Basically, you just have to import zod compile, and now you're opted in and all of your, your ZOD parsers are going to be a whole, but ZOD parsing is going to be a whole lot faster.

• 4:35Scott Tolinski?

  Sick. I, I wonder when we'll get some updated benchmarks compared to archetype, because I always saw that archetype was faster, which is one of the reasons why I liked archetype. But, I mean, oh, yeah, it doesn't show anything about archetype here. Yeah. But I do love this, though, because ZOD is one of those ones that has really taken hold. And even though we have standard schema, which is the ability to use any of these things on any of these projects, ZOD really feels like the one that everybody's landed on. So if, if ZOD gets faster, everything gets faster, and I'm down for that.

• 5:09Wes Bos?

  Fantastic. I love that.

• 5:11Speaker 00

  Absolutely. Yeah. So that's all I got for you. Check out PNP M12. Check out ZOD 4.5. And with that, I'll remind you, this is Syntax Weekly. If you're just joining us, we do this every week, every Monday. And this is brought to you by Sentry. They are really good error monitoring platform. We use it in all of our apps. Basically, if you've got something running, running in production, throw Sentry on there, and you'll know when things go wrong. And you can have it automatically fixed with a Seer agent. They got a bunch of other stuff, profiling, logs. Check them out. We couldn't do what we do here without them. And I'll

• 5:45Scott Tolinski?

  Well, before you do, can I actually give a little, quick little Sentry story? Because I set this up last week.

• 5:51Wes Bos?

  Love to hear that.

• 5:52Scott Tolinski?

  Yes. I, I've been using Swamp Club. Swamp Club is like automation. So it's like a standard for doing automations within your agent. So that way, like, let's say there's specific tasks that I do all the time. And oftentimes, the agent's just like, oh, let me go find a script for that and do it, or let me determine how I'm going to do that at any given moment. Swamp just like builds that all out. So that way you have workflows and automations and all kinds of stuff that the agent just picks up and starts doing right away. So I've been using this. And I set up a self-healing flow with Swamp and Sentry. So every six hours, my Swamp will just run a job that goes off, finds

• 6:35Scott Tolinski?

  a Sentry issue that has not been completed yet. It logs that as a task. It puts that task through a designated process to fix it, merges that in, marks the Sentry issue as resolved, and then it will check for regressions. So, man, I'm feeling the self-healing software stuff. There's a sick combination. Yes, very, very into this. Yeah. Happens all on my Mac Mini, so I can, I can check it out at any time.

• 7:01Speaker 00

  Sick. Love to hear it. Yeah, so I'll pass it off to Wes. Got some news about Cursor, OpenAI. What's going on over there?

• 7:08Wes Bos?

  Yes. All right. So Cursor, acquired by SpaceX a couple of weeks ago. Friday, after everybody had, had finished up their, their day, they announced, or OpenAI has announced that they will no longer be supplying their models to Cursor, meaning that anybody who is using Cursor is no longer going to be able to use any of, as of, I think, November 13th, is no longer to be able to use any OpenAI models inside of Cursor, which I think is a fairly significant blow, because one of the huge benefits to, to using Cursor is that you have all of the models available to you, right? Like, you can do that in GitHub Copilot, and there's, there's several other things out there where you can simply just

• 7:52Wes Bos?

  choose which model you want. But I think that's a fairly significant blow. Now, now the reason why, let's talk about why, and then I think there's some interesting bits behind this. Basically, the blog post goes in to say like, they basically just cannot, now that they've been acquired by SpaceX, Musk has admitted that XAI has distilled OpenAI models to train their own. And obviously, the Cursor is sitting on a goldmine of information as to like, how do people use these models, right? Because people have been using Cursor for years, and they have built tons and tons of software, and they have all of this information as to like, what were good requests, what were good tab completions, what, somebody

• 8:36Wes Bos?

  asks for X, Y, and Z, and they got these things, was that a good response or not? All of that information is a goldmine for being able to train your own, as well as, as do distillation, meaning that like, you can look at how OpenAI does something, you can look at the, the reasoning trails of what they expose, and then you can use that to then train your own model. So they have decided that they have, they have some contract in their clause where they have a limited time window to cancel after a change in control, which is like Cursor was bought, there's a change in control, they are able to, to cancel their agreement. So huge bummer that this popped up. A couple interesting tidbits

• 9:17Wes Bos?

  here is Michael Truitt, one of the founders of Cursor, says, he kind of clapped back and says, OpenAI models serve 5% of Cursor user traffic, and we're speaking with OpenAI to resolve them. So like, that was kind of a mean thing to post, but obviously, he's, he's mad about that. That seems extremely low, which, which led me to Dax. He's a creator, open coder, or one of the, at DevRel or something at OpenCode. He said, basically, non-frontier model is so much cheaper or free that they can drain, they can drive insane token volume. So I think like, that just goes to show that here we are talking about

• 9:59Wes Bos?

  OpenAI, XAI, anthropic models. And like, the reality is that most people are not using these to, to write code. Most people are going for whatever's cheapest and fastest, or whatever's free at the moment.

• 10:15Scott Tolinski?

  Or they're just not ripping tokens on them, you know?

• 10:18Wes Bos?

  Yeah, yeah, maybe they're not running. 10 bazillion things. Yeah, that's true. Like from a volume point of view, maybe they're doing sheer larger volume on the free things. It might not be as important. That's a good point.

• 10:32Scott Tolinski?

  Yeah.

• 10:33Wes Bos?

  Um, so this brings up an interesting thing, which is A, I called it. Um, go back. I don't know. Maybe a month or two ago, when all of the like, you can no longer use your Claude subscription in X, Y, and Z. I called it. I said, you soon will not be able to use these models. Like the latest models are not going to be available via the API. They're simply just going to be available via their product because the all of, all of these companies are realizing that as these models get cheaper and better and faster, and as you can simply just like click a dropdown and switch to a different model and continue on your day, we are realizing like they really need to get you embedded in the product, which is like they want you using their thing. They want you using something that you cannot

• 11:17Wes Bos?

  easily switch as much as just selecting a dropdown menu from one to another. So it's, that's one like my one idea there. And the other one is like, this just is such a huge thing to like, keep using open code, Pi, keep using whatever open harness you want, because building on top of and like locking yourself into some ecosystem, the rug pulls will only continue to get, to get bigger with these types of things. And not to say, not like throwing any shade on OpenAI here, because I if probably, I would probably do the same thing if I was in their position. But it just goes to show that they're starting to pull back a lot of this stuff.

• 11:56Scott Tolinski?

  Yeah. Yeah. Hey, I, yeah, this is one of those ones where like, I want to do a quick check on what libraries or what harness are you guys actually using today? Uh, cause I feel like this changes all the time, or maybe I'm just the one changing it all the time. But what, what's your setup currently, guys? What do you, what are you rocking with? What do you, what do you like?

• 12:16Wes Bos?

  Yeah, I, go ahead, CJ.

• 12:19Speaker 00

  Quick and simple. Uh, open code with a Codex subscription. So I can use all of the chat GPT models, but I use open code absolutely everywhere. I have it on my VPS. I have it on my home lab. I have it on my laptop, open code and Codex. That's it.

• 12:33Wes Bos?

  Yeah, I've been using Codex models quite a bit. I, I split my time probably right now 33% each between Codex desktop. I've been really enjoying open code CLI with, I've been testing all of these new models that, that have been coming out, especially a lot of the like free or cheap Chinese ones. Um, and then what was my third one? Open code, Codex, Claude code is, is the third one. So like I'm, I'm bouncing all over the place, just, just trying them all out, you know, been tried. Last week, we were talking about how you've been using Grokbot for quite a bit of stuff, but it, I can't even say like, this is better, you know, the, the UI and the product is

• 13:18Wes Bos?

  sometimes a little bit better in, in some cases and whatnot. But man, the switchability right now is just so easy.

• 13:27Scott Tolinski?

  Yeah. Yeah, I know. For, for me, I'm using Pi. Uh, I've been rocking Pi as my primary for a little while now. And then I'll use Claude code just to use my Claude code subscription. But I, I don't know what I'm going to do once I, uh, am no longer using Claude code as my, my main thing. I mean, it's going to be just Pi. I just really hate that I have to use Claude code. I would really prefer to just do everything in Pi. Um, and people are like, well, you can use Claude code in Pi. Yeah, but you can't with the, you know, uh, Claude code subscription pricing. So yeah, it's just not

• 14:01Wes Bos?

  People asked, I think we answered a couple of episodes ago, like, what's the best deal out there right now? And I think we said like either cursor or Codex is probably the best deal right now, where you get like a hundred or $200 a month plan, depending on how much you use it. Um, and now that cursor is removing it, I think like Codex might be the win in for the best value. Simply just like Claude code, also very good value, but the fact that you can use the Codex subscription in other tools, like Claude code is awesome.

• 14:32Scott Tolinski?

  Yeah, I know. I do. I do probably get the most value out of the Codex subscription, but I like working with anthropic models the best. And that's always bumming me out because it's like, uh, they, the models go too fast, especially Fable, obviously. And now they're doing a, a decrease on the, because they, they, they upped your usage limit by 50%. And then they recently announced that, well, they're actually going to be upping it by 25%, but that's actually a decrease from what you're currently getting.

• 15:00Wes Bos?

  Yeah, they kind of fumbled the messaging around that.

• 15:03Scott Tolinski?

  Yeah, not so good. Uh, they're not good at that. They're not, they're good at the model. They're not good at anything else.

• 15:11Wes Bos?

  I, I don't understand that because they have all these like, like guys on Twitter that are like awesome at responding and like saying, hey, yeah, we're working on it. This is what we think. And like excellent, excellent communication at that aspect. But then like when they roll out these official announcements, it's like, did nobody do that? Maybe AI wrote this.

• 15:31Scott Tolinski?

  Yes.

• 15:32Wes Bos?

  But let's, let's move on to the next one here. Scott, what do you got for us?

• 15:35Scott Tolinski?

  Yes, I got the GPU, which is a web GPU library designed for agents from the folks at Versell. And you can tell that this is Versell because this is a Versell ass homepage. Um, so we want to throw this bad, okay, there we go. So, uh, web GPU, web GPU is a great way to do, uh, modern graphics on the web. It's, it's new. It, it, it's very cool. You can do some crazy stuff with web GPU. I'm rocking web GPU to do a lot of graphics in my, uh, computer graphics. Uh, what do I call them? Call it graphics computer app that I built to do images on, on syntax. But this thing basically, um, okay, yeah, use the same shader in the browser, headless node, make it interact. It's

• 16:19Scott Tolinski?

  like a library for working with web GPU in general. And they have a nice homepage, some nice docs, some nice, uh, flashy examples as one does with all of this stuff. And if you're getting into web GPU stuff, definitely a cool thing to check out. Uh, I, when I first saw this, my brain immediately went to, how is this different than type GPU? Type GPU is a library that I've been working at from, uh, for quite some time now, um, from the folks over at Software Mansion. In fact, Evo Plaza, who's in the chat here, um, I believe is the creator of type GPU. And, uh, so I, I've been using

• 17:01Scott Tolinski?

  type GPU to do all my web GPU stuff. So I was like, okay, well, how, how is this like, is this a just a Versell type GPU or what is this? So, um, Evo actually posted this tweet not soon after, and it really cleared things up for me. So folks, I'm gonna just read this out. So here are the main differences between VGPU and type GPU. For those wondering, VGPU is an opinionated API that extracts, abstracts many of the complexities that come with setting up and handling web GPU, right? Comes with the mechanisms for splitting up WGSL file across files. Tooling is very impressive, something that was definitely missing from agentic workflows. However, it has the limitation of not being connectable with other web GPU libraries from different domains.

• 17:47Scott Tolinski?

  Uh, that feels like that's a kind of a Versell type of thing, right? Uh, interested to see how they approach that. So it says like AI inference, like running AI inference in a web, uh, web GPU contest, context, where it says type GPU is a reflection of web GPU and WGSL onto TypeScript, meaning that you would write in web GPU and, uh, what you would write in the web, oh my God, what you would write in web GPU and WGSL, you can instead write in TypeScript and get the inherent type safety. So basically, what Evo's saying is that type GPU is lower level, um, and

• 18:28Scott Tolinski?

  then can integrate more with things like 3GS, PixieJS, and even VGPU. So VGPU is not an alternative to type GPU. It's like a different layer.

• 18:39Wes Bos?

  Okay. So it's, it's like, instead of writing, like you said, instead of writing like lower level shaders, you write them in TypeScript. Is that, am I understanding that right? And

• 18:50Scott Tolinski?

  Type GPU is like that, where type GPU, you are essentially writing the web GPU stuff in TypeScript, where, uh, VGPU kind of abstracts some of that stuff.

• 19:03Wes Bos?

  Okay. I'm just, I'm trying to understand like, like what, what would you need this for? What's this for? Obviously it's for graphics, right? Writing shaders is one. Um, but like also like computation is another one as well. Like, like, like web GPU is not just for visual graphics.

• 19:21Scott Tolinski?

  That is one of them. This VGPU pretty much is for graphics, where if you look at type GPU, their examples are a lot of, um, like you can do that type of thing. Where is it? Some of these, selfie segmentation. Where is the, uh, no, not, don't turn on my camera right now. There's a inference here for drawing numbers, right? So you can do AI with type GPU.

• 19:51Speaker 00

  Like there's actual code running on the GPU that can, in this case, it's like optical character recognition of like drawn numbers. But that code is running on the GPU, so it's very performant instead of like running on the foreground thread in JavaScript.

• 20:07Scott Tolinski?

  Yes.

• 20:08Speaker 00

  Cool.

• 20:09Scott Tolinski?

  Yeah, it's all running on the GPU. Man, type GPU is such a dope library. My god.

• 20:14Wes Bos?

  Okay, and this is different than like a 3JS because.

• 20:21Scott Tolinski?

  Yeah, 3JS.

• 20:22Wes Bos?

  3JS doesn't get into the shaders territory, does it? It like obviously can load them and use them, but like actually authoring shaders in.

• 20:31Scott Tolinski?

  You would use 3JS more for like models and stuff like that, but it's also WebGL based, I think. And correct me if I'm wrong, because I believe there is probably a pathway to using WebGL in 3JS these days, but Evo can probably speak more to that because I haven't done WebGL with 3JS.

• 20:51Speaker 00

  Yeah, that's my understanding is like 3JS came along to make WebGL a whole lot easier to use and write.

• 20:56Wes Bos?

  Yep.

• 20:57Speaker 00

  But then WebGL is a newer browser API where you can run things directly on the GPU.

• 21:02Scott Tolinski?

  Correct.

• 21:02Speaker 00

  And that's different than WebGL.

• 21:05Wes Bos?

  Yes.

• 21:06Speaker 00

  Yeah.

• 21:06Wes Bos?

  Yes, because it's like a little lower level. And like I said, it's not just for graphics. Like if you want to do heavy computation, which is often needed in this AI inference world, being able to shell off that computation to the GPU rather than running it on the CPU or in the main thread is in, has a huge advantage, right?

• 21:31Scott Tolinski?

  Yes.

• 21:31Speaker 00

  Yeah.

• 21:31Scott Tolinski?

  Yeah, especially for all of this type of stuff. I mean, it's just in the nature of graphics processing in general. Like when you get into shaders and stuff, what it's doing is it's manipulating, the code is running on every pixel at the same time, right? And that type of work is particularly good for GPUs because of parallel processing, right? Because the way a GPU works is it's able to process things in parallel rather than in sequence. And if you're affecting every single pixel on the screen or writing code that affects all of that at once, right? That makes a lot of sense for something with parallel processing, right?

• 22:05Wes Bos?

  Yep, yeah.

• 22:06Scott Tolinski?

  Yeah.

• 22:06Wes Bos?

  Makes sense. Cool.

• 22:08Speaker 00

  Nice.

• 22:08Scott Tolinski?

  Yeah, so VGPU, just more cool stuff in the WebGL world, which you gotta say, I'm loving all the new WebGL stuff because I have an app that deeply uses WebGL and it's been a lot of fun to get with, so cool stuff.

• 22:23Wes Bos?

  Yes.

• 22:25Scott Tolinski?

  Okay, cool. Well, who wants to go next here? Who wants to go next? Who's got something big?

• 22:32Speaker 00

  I do, I think.

• 22:33Scott Tolinski?

  All right.

• 22:34Speaker 00

  I don't know if you call it big. It's a little big, a little bit.

• 22:36Scott Tolinski?

  CJ's got something huge. CJ's coming in with something giant here.

• 22:41Speaker 00

  So last week we talked about Omaki Quattro, the new release of the opinionated Linux distribution. And there have been some updates since then, so the first thing to know is like just upgrade to the latest version. We're now on 4.0.2. So if you are using Omaki, upgrade. They also have a page on their security stance where like you can report vulnerabilities and different things like that. But what I wanted to talk about is like what got fixed between those two version bumps.

• 23:14Speaker 00

  And I wouldn't call these security vulnerabilities in Omaki, but they are

• 23:22Speaker 00

  settings that you get that are enabled by default. And I think, so this is one of the things about Omaki is it's opinionated. And so for instance, it's a Linux distribution that comes with Docker, like Docker is pre-installed and ready to go. And one of the things you can do with Docker is add your user to the Docker group. But then that actually makes it really easy to do privilege escalation where you can basically go from being just a standard user to root. And as a developer, there's a warning on the Docker page that tells you that this is possible. And so as a developer, you would enable that knowing the risks. But the issue with Omaki is that was enabled by default. And so there's a blog post that goes into, it's called "Any user process can escalate to root."

• 24:06Speaker 00

  It's really like, really, it's not, it's nothing crazy. It's just if you add your user to the Docker group and you have Docker installed as a root installation, it, all it takes is one Docker run command and you are now root on that system. And that's by design. It's not a security vulnerability, but the main issue is a lot of people installing Omaki don't know about all of these settings that have been enabled. And so that's really the news here is like you're choosing this opinionated stuff. And so there's a lot of stuff that could be enabled that you're not aware of.

• 24:35Wes Bos?

  Yeah.

• 24:36Speaker 00

  That could result in potential security issues. And so I have one commit, I'll link in the, in the show notes, where the, the title of this commit on Omaki is "Close three paths from unprivileged session to root." So this is, this was right after the 4.0.0 release. There's the Docker group issue. And then there was also one where the user was in the input group. And if you're not familiar with Linux, the input group gives you direct access to like USB devices. And so this meant that an unprivileged process could basically be a keylogger with no extra privilege prompts or anything else like that. And so this update removes that. Essentially, if you want to enable that, you enable it knowing the risks.

• 25:20Speaker 00

  And that's, that's really the only thing, that's really all I want to talk about is like you're choosing all of these opinions, but that means there are going to be things in there that you're not necessarily aware of that are enabled. And so all of those things are no longer enabled by default as well as some other security issues that were fixed in 4.0.2.

• 25:36Wes Bos?

  That needs, that has to be done by default because like you're, you're having all these idiots like me try it out, you know? And like a lot of people are coming from macOS where you just assume stuff is, is secure by default. And you're just, the whole thing is targeted at people just slapping it on and using it and being like, this is decent. Like I don't want to tinker. I don't want to have to know about all of this like lower level stuff. I just want like a nice OS and like I'm a technical person, but I don't want to have to think about like Docker privileges and whatnot. So I'm glad that that's been, been changed. That's super important.

• 26:15Speaker 00

  Yeah. And they, like I said, they have a security page, like I think they, I don't think they have a bug bounty yet, but they're going to create one. And now the, there's just a lot more eyes on Omaki as well. So people are trying to break it. And that's also just like growing pains with a, a new distribution.

• 26:33Speaker 00

  But this is going to be like just, just one more advertisement for like, just, just install a Linux OS and figure this stuff out yourself. Like obviously not everyone has the time, but some recommendations. CacheOS gives you Arch Linux and then you could customize it and learn about all those customizations yourself. Also Ubuntu is really good. Just use Ubuntu out of the box. I don't know. Do you have any thoughts, Scott? You are using Omaki, right? I guess you.

• 26:59Scott Tolinski?

  Omachi.

• 27:00Speaker 00

  Omachi?

• 27:01Scott Tolinski?

  Yeah. You just don't say the R. That's the only thing. You don't say the R. But it's taken me a long time to get there.

• 27:07Speaker 00

  Can we talk about that for a second? Because it's.

• 27:10Wes Bos?

  Can we just call it what it looks like?

• 27:12Scott Tolinski?

  Yeah.

• 27:13Speaker 00

  Yeah, well, I call it Omachi, but so it's Omakase, which is like a Japanese word for like the chef chooses what you get. And so that's why I'm calling it Omaki because Omakase, not Omachase. I don't know. But did you upgrade, Scott? Have you been using it?

• 27:29Scott Tolinski?

  Yes. Yeah, I wear my laptop. Go. Yes, I did. I actually got it working.

• 27:35Scott Tolinski?

  It's, yeah, it's great. You know, I mean, it's not that different from version two for me, so I really like it. It's fast. I don't have a computer that I would like to use it on regularly, but I do like the OS. And I think there's something to be said that people like, the, the conversation around this that people are missing is that if you want to make Linux or any of these things more used, more widely used, more supported, all of that stuff, you kinda need someone to, to push it in this kind of way. So people get hung up on who's pushing it and they get hung up on all of the choices that are being made. And they get hung up on the, the fact that it's like bash scripts to set things up instead of potentially

• 28:19Scott Tolinski?

  like a Linux type of situation, right? And so I think that people really underestimate the power that this kind of energy can put into something like Linux. So the haters, I think, just don't get it. Okay? They don't, they, they're, they're too focused on the technical side. There's nothing stopping you from running whatever you want. But the amount of energy that Omachi is bringing into Linux right now, software that is being written for Linux right now because of Omachi is, is something that hasn't. You know, I don't know. It's like this energy that hasn't really happened around Linux in this type of concerned way.

• 29:04Scott Tolinski?

  And I get it. The Linux nerds who have been running, you know, whatever distro for their, I get why you'd be grumpy about that. I get grumpy about that kind of stuff too, in that same kind of way.

• 29:18Scott Tolinski?

  But if you want people to move to Linux or you want Linux to get more popular or more software for to be written or more compatibility, this is kind of the way it needs to happen. It's not going to happen from a bunch of nerds arguing about which distro and which packages. Yeah.

• 29:36Wes Bos?

  Yeah, you need a significant shakeup in this. Not, not that the space needs a shakeup, but if you, if we want the like macOS folks to like actually use this type of thing for, for day to day and like do real work, like, like video editing and, and like photo editing and like all of the type of stuff that we, we do on a Mac, then you need something like this where the fit, the finish, the polish, the design, the user experience, all of that stuff has an insane high level bar to it. So I'm, I'm pretty excited about this. I threw it on my Microsoft, hold on, let me grab it for you.

• 30:19Wes Bos?

  I threw it on a 10 year old Microsoft Surface, which is just hilarious because Microsoft sent me this thing like 10 years ago when they were rolling out Windows subsystem live. Basically, they're like, we're going to be able to get Linux CLI's running on Windows, which makes things like running no JS and whatever much easier on Windows. So they sent me this to like test it out and whatnot. And I used it for a lot of my videos to show the like Windows setup. But the hilariousness of that is now I have full ass Linux running on it, which is working pretty well. I got the touchscreen and everything working like it has the Surface

• 31:01Speaker 00

  Yeah.

• 31:02Wes Bos?

  thing on there and then it just boots into the custom kernel. So I've been pretty happy with it. I, the hardware is, is 10 years old. It's not good enough for me, but it's still impressive.

• 31:12Scott Tolinski?

  Yeah.

• 31:13Speaker 00

  I mean, just, just to talk a few, a bit more like I would, I, I agree that Omachi is getting people talking about Linux. I think that's great. And I'm going to keep saying it wrong, Omachi. But I would, I would argue, obviously, like I'm, call me a Linux old head. I don't know. And I'm, but DB and, or not even Ubuntu has been doing this for a very long time. Like, I guess my, my point is when I get a brand new Mac, I have to install all of these things, right? Like I install Iterm, I have to install my coding agents. I do all of that. I would argue that to go from a base Ubuntu installation to something you're comfortable working in is about the same effort as it is on a Mac. Like you install VS Code, you like, you really don't have to replace the terminal, install your coding agents, you're good to go.

• 31:58Speaker 00

  So that's really my main argument here is I don't think you need such a, like a distribution with so much stuff in it. I think as developers, we can pick and choose and it's easy enough to install on something like Ubuntu.

• 32:12Scott Tolinski?

  I don't know, CJ, I do install some basic ass functionality on Linux to get it SMB and stuff like that. Like I don't want to have to set up basic functionality. I just want it to work.

• 32:22Speaker 00

  Oh, yeah, I would, I agree with that sentiment, but I do think Ubuntu is at the point where you don't have to do that. And it, and it supports older devices too. Like I have this old weird chewy touchscreen Windows device. I put Ubuntu on there. The touchscreen works. It automatically rotates like it, it just works. So Mad Max Dev is saying.

• 32:43Wes Bos?

  Doesn't come with sick backgrounds though, does it?

• 32:46Speaker 00

  No, but Casio OS does. I will say that. Multiple people in the chat, Brad is saying, bro's, bro's not getting it. Max, Mad says CJ doesn't get it. No, I get it. I, I do get it. But I think the, all I'm saying is Ubuntu is in a different spot than you think it is in terms of like how easy it is to get stuff up and going. And I don't, I don't know.

• 33:10Wes Bos?

  What about, what about the design of, of the OS as well? Does it, does it look similar? Does it have that like polished feel to it?

• 33:19Speaker 00

  It does. It comes down to the, the window management system. And I believe Ubuntu uses Cinnamon. And then if you use Casio, the default one is Plasma or KDE. And those just, they feel like a Windows desktop. They feel like a Mac OS desktop. I think one of the things Omachi is giving you is you're getting Hyperland out of the box, which is basically like having a tiling window manager out of the box, which also not everyone is used to.

• 33:45Scott Tolinski?

  Yeah, Hyperland is dope. It's dope. Yeah, I like, yeah.

• 33:49Wes Bos?

  I think it is such a good call that they put the window tiling manager in there by default because it like forces you from the get go to like, like you're changing your OS, you have to do a little bit of relearning in doing that from, from the start, but then also having everything available, like all the commands. Like the huge thing for me was like, you can hit like the super K and like search for what all the commands were and like look it up. Like that was, that's huge for, for learning. But like forcing people into that type of thing, rather than them making a mess with all of their Windows, I think is such a genius idea.

• 34:28Speaker 00

  I am here for it. I, yeah, like, cause if I could get everyone to use, like I use rectangle on a Mac still. There's a million other apps for window management, but if I could get everyone to manage their windows better, I would be very happy. So, you know, Omachi, Omachi is doing some good things, but I also, I disagree with like it. Other distributions are just as good and very similar to how you would code on, on Windows or a Mac.

• 34:52Scott Tolinski?

  CJ, I got news for you. iOS is not as good as Android. And guess what? Everybody uses iOS because it's easier for, for most people or it's easier to get started. And, and I think that's really just it is that I, whether or not it's better is not the argument. Cause I fully agree that other things are better. But I, I mean, easy's easy sometimes. So, yeah.

• 35:14Speaker 00

  Sure.

• 35:15Wes Bos?

  And I, I very much hope that this like, what they got $10 million for, for Omachi now. I very much hope a lot of that is put into like get video editors, graphic software, get the like stuff, like get Raycast running on this thing. Cause like, I love the, I don't love the like little pop up thing in there, but like, that's not a Raycast alternative, you know? Like that's, I'm going to need something a little bit better in, in my Omachi.

• 35:44Speaker 00

  I'm going to make, I'm being annoying here. I'm going to make one more argument though, that Steam OS has actually done this for the Linux desktop as well, because.

• 35:51Scott Tolinski?

  Steam OS, yes.

• 35:52Speaker 00

  Yeah, I mean, they, people are using Linux without knowing that they're using Linux. And Steam OS has done a ton of work to get games running on Linux. And yeah, so there's a lot of efforts to get Linux usable and not be like a horrible, you have to customize everything experience.

• 36:12Wes Bos?

  Yeah. Well, how, how do they?

• 36:13Speaker 00

  I'm here for it.

• 36:14Wes Bos?

  Yeah. How do they get all these games running on Linux? And not have DaVinci Resolve running smoothly?

• 36:21Scott Tolinski?

  Just one company putting a ton of money into a layer there is really what it comes down to.

• 36:26Wes Bos?

  And that's, that's hopefully what like DHH and all of his, his rich friends are doing with this, you know?

• 36:34Speaker 00

  Yeah.

• 36:34Wes Bos?

  All right. Um, let's move on to the next one from.

• 36:38Scott Tolinski?

  Actually, yes. Before we do, there's a lot of conversation about computers and stuff in there. I bought a Mac Studio, guys. I bought a Mac Studio. I bought an M5 Ultra and it is not coming until November. So I will not be able to talk about when I'm running on it until then. But it has happened. I've, I hit, I hit the buy button and then I took a deep breath and I do have a Mac Studio on the way. So.

• 37:05Wes Bos?

  So give us your, give us your like thought process behind that. Because like out of the box, it seems like a crazy thing to spend 10 grand on. But like, we talked it through. I'm, I'm a cheap guy and I'm fully supporting Scott's purchase of this. So like, like, why do you need a computer with what 256 gigs of RAM?

• 37:28Scott Tolinski?

  Yeah, 256 gigs of RAM, four terabytes of hard drive, the Ultra chip. I got the maxed out config on it in terms of like the processor. And it's really going to be, I'm going to be running as a local inference machine on top of DaVinci Resolve, on top of screen recording, you know, mini screens or doing all kinds of stuff. So it's going to be a hoss. It's going to be doing a whole ton of stuff, but I want to be able to run the biggest, baddest models I can without buying a GPU setup. The GPU that I was, yes, I am. Apollo says Scott about to run GLM 5.3 flash on that. Yes, I am about to run GLM 5.3 flash on it. I'm very stoked about that. So like being able to run a model that, that's that powerful on your local machine

• 38:13Scott Tolinski?

  to like power tons of stuff. It's going to be groundbreaking for me, but also it's like a world I want to get into more of running these local models and experimenting with them and trying them. And I don't, I, if I'm, if I'm needing a new computer, I'm already going thin client. So I hardly do anything on my laptop. Most things are running on this Mac Mini behind me. And this Mac Mini is severely, it's got like, this thing's probably got like four gigs of RAM. And I think it has eight gigs of RAM or something crazy. It's, it's a refurbished M2 Mac Mini. It's, it stinks. And so like, just being able to run everything on a, on thing, and then running very minimal things on my laptop. It means I won't have to buy a new laptop.

• 38:57Scott Tolinski?

  I can just, you know, just use that as the hoss is really what it comes down to. But yes, I'm going to begin deep into that world. Yeah, it's, it's a beast.

• 39:08Wes Bos?

  Interesting thing to think about right now is that like only in the last couple of months have we gotten models that are cheap enough that you can run on, on like, like on absolutely everything. Like, like, for example, the OpenAI's GPT Luna, which is their like, their, their cheap, fast model. Like I'm building this thing right now where it can detect like image things in an image. And then it will tell you what, what is in that image and how much it's worth and all of that type of stuff. Like a tenth of a penny to process an image and tell you what is in that image. Not just like, oh, detected cup. Like, yeah, we've had that. We've had that forever, right?

• 39:52Wes Bos?

  That's a hot dog. But like, it will say like, oh, this is a Yeti cup in yellow. And here it is. It's worth about X, Y, and Z. So like, we're just figuring out, oh, what do we do now that it's like dirt cheap? Like, oh, can I run it on every single frame of a video? Can I run it 20,000 times on, on X, Y, or Z? Can I run it on literally every single screen, screen grab of whatever I have? And we're just figuring out what those things are. Now, take that tenth of a penny and make it zero, or whatever it costs to plug the thing in.

• 40:28Scott Tolinski?

  Yeah.

• 40:28Wes Bos?

  Like, I think people like Scott and all the people that are buying these things are now going to be figuring out, okay, what does it look like? Like, what can you run locally when it is literally free to run?

• 40:39Scott Tolinski?

  And if I'm, if I'm like, let's say I'm analyzing every frame of a video and it's got my kids in it. And I don't, you know, I'm not, I want that stuff to be private, right?

• 40:47Wes Bos?

  Yeah.

• 40:48Scott Tolinski?

  So being able to, to have that on top of all of this, just running on my desk is going to be crazy. So yeah, I'm very, very stoked. We'll see when it actually arrives. I have on, on word that it chances are it might get here before November, but very, very interested.

• 41:03Wes Bos?

  Someone says, there's no way 10K max will be cheaper than paying a hundred dollars a month. No, like if you're comparing it against a hundred dollar a month plan, it's not, it's not going to, it's not even going to be like, the models are not going to be as good as the hundred dollar a month plan. But that's, that's not the, that's not the frame, like the mindset you should be in with this type of thing. It's like, even though they're good enough, these models that you can run locally, and they're going to be free and you can run them millions of times. You, you're not going to be able to, to do 60 frames a second analyzing every single frame of a video on a hundred dollar a month plan. You would burn through that in like, like minutes.

• 41:43Scott Tolinski?

  Yeah. And I mean, also Wes, it's like, it's a computer that's going to last for, it's going to last a very long time with that much type of compute. We're like this MacBook Pro, I mean, how long have we had these things? So like five, six years now?

• 41:55Wes Bos?

  I can tell you, it's just under five years. We, me and Scott bought the M1 MacBook Pros. And I paid about 5,000 Canadian, which is, I think, like, probably four US. And I'm here five years later and this thing is still very, very fast. Aside from my, my issues with the latest betas being kind of laggy. But like these, these things last forever. And like yours should last, what, six, seven years long?

• 42:24Scott Tolinski?

  Gosh, Wes.

• 42:27Scott Tolinski?

  You just do it all the time. It's gonna last, I mean, it's gonna extend the life of this laptop. But also like, when you cost it out over that much time and whatever, well, well worth it. Absolutely. So.

• 42:38Wes Bos?

  Yeah.

• 42:39Scott Tolinski?

  I'm really stoked.

• 42:40Speaker 00

  The other thing I'll mention is like, we are not out of the,

• 42:46Speaker 00

  or maybe not even reach the peak of how expensive hardware is getting or going to get. There are some estimates that, yeah, that are like the RAM, RAM shortage, SSD shortage, or like things being so expensive, won't stop until 2030. So like.

• 43:00Wes Bos?

  Oh, kill me. No.

• 43:02Speaker 00

  Yeah. I mean, we, we don't know for sure. And obviously like a lot of these data center projects could fail or whatever else. So it's like, being able to run this stuff in your home is only going to get more expensive. So I, I agree that it is a good, and good early investment that will be a good machine for a very long time. The other thing to think about is power consumption. But one thing to consider is these are very low power devices compared to like full on, full on servers. Like if you consider my Strix Halo machine, I could run a like 30 billion parameter model 24/7 and it would cost me like maybe a dollar or two per month. And that's, that's, that's nothing. So, yeah.

• 43:42Scott Tolinski?

  I mean, I looked at, I looked at the RTX 6000 Blackwell when they were only 8K, which was, I was already looking at it like, oh, that's a little overpriced. Now they're like 12, 14. So I'm, you know, and for that, you'd need to, two of them to run kind of like the types of models I'm going to be running. And then the power consumption on it would be crazy comparatively. So it's, it's just a good fit, I think. It's a, a good fit. Yeah.

• 44:08Wes Bos?

  Man, I, I've said this a couple of times, but I have a, like an old Mac Pro that's still relatively powerful here. And I, but I ran the, I ran the numbers. It's a Intel Xeon. And that thing can use up to like 500 watts at its max. Like, and just, just like, just like not sleeping, but like not doing anything. It uses like 80 watts, which is like, like one, two, three cents an hour just normally. Which is, that doesn't make any sense to, to plug those in and run them, you know? You run them as your own home server and that thing will use more than buying a new laptop will in like a year.

• 44:45Scott Tolinski?

  Heck yes. All right. Where we want to go from here, Wes?

• 44:48Wes Bos?

  I want to talk about Super Logical. Super Logical, yes. So Mitchell Hashimoto, he is the founder of HashiCorp. And he's the creator of GhostTT, which is the terminal emulator. Absolute genius guy, super focused on like performance. So a couple of weeks ago, he announced that they are working on something called Super Logical, which is a terminal multiplexer. So basically something that is going to compete with T-MAX. And he released a video a couple of days ago, sort of like detailing how it's working.

• 45:30Wes Bos?

  And my gosh, this looks amazing because not from a feature set. So like, like really what he's doing here is he's building, he's not building like a replacement to Herder or anything like this. He is building a replacement to T-MAX, which will allow you to connect to multiple terminal sessions, whether it's running on your computer, whether it's running on a Linux desktop on a server somewhere. And he, he just opens them up and it's, he, he shows it happening in half a bounce. Meaning that like he opens the app and he, you, you see your terminal session with, before the, before the macOS icon dock even does a, does a full bounce.

• 46:14Wes Bos?

  And this is really exciting. And, and I read into the replies, he answered a bunch of questions, but he said it's all going to be API driven. So the idea here, and it's, it's all native scrolling. You know, like if you ever use like T-MAX or any of these like terminal emulators, you know that scrolling will sometimes feel a little bit janky. So I imagine what we'll start to see when this thing is released is we're going to see a lot of stuff built on top of this. We'll see like a super Herder or something that's built on top of this for doing agentic programming. So, I don't know, pretty cool app. I'm, I'm excited.

• 46:49Scott Tolinski?

  I'm really stoked. I think this is another one of those problems that people, they're just, okay, I use T-MAX and it's fine. But I think that, I think it can get so much better. It can get so much better. So I'm really stoked to see this work.

• 47:03Wes Bos?

  Yeah. It just, the crazy thing is that if you watch the video without, like without audio, it just looks like he's, it just looks like he's using like GhostTT, like a terminal, right? And like, you might be not impressed by that. But if, if you then go and use your own T-MAX or whatever, not native scrolling, there's all these issues around like, what if the, your terminal is a different size than the one that's actually running where it is? There's all these like issues all the way down. And for somebody to come along and just build a beautiful experience and smooth out all of those issues is, is pretty exciting. I do hope that he continues to push this and build like a Herder alternative. But I'm not sure that's the direction they're going or not.

• 47:48Scott Tolinski?

  Yeah. Yeah. I mean, I like Herder. I'm currently stuck in a world where if you use Herder Serve, you can get access to just dragging and dropping images into Herder and it works over the network. But then if I close my laptop and reopen, I gotta re-Herder Serve it. Where if you use Mosh, well, the images don't work, but you don't have to constantly reconnect to it. So I'm like, oh, which of these, which of these foot guns do I want to hit?

• 48:13Wes Bos?

  Yeah.

• 48:15Wes Bos?

  That's cool. So keep an eye on that. We'll update you as hopefully the public beta is released soon.

• 48:22Scott Tolinski?

  Yes. Sick. All right. Well, I got a bunch of a couple of 3D things here. My whole thing is on like 3D, I guess, today. I didn't realize that going in, but I guess it is. Also, I will say I'm speaking at Zurich JS, not next week, but it's the it's coming, it's coming up Zurich JS. Let me pull it up Zurich JS is September 9th in Zurich. So if you are in Zurich or you're going to Zurich JS, I will be there. It's going to be a ton of fun. There's going to be a lot of great speakers and my talk, you won't want to miss it. I'll say that. Okay. Uh, next thing I'm going to get into is a couple of 3D things. The first one is the Katamari object library. My gosh, um, do you guys ever play Katamari Damasi, either of you?

• 49:06Wes Bos?

  No.

• 49:07Scott Tolinski?

  I didn't think that was. I've no, uh, Katamari is a very famous fun game, uh, from Japan where you are a little ball that you roll up things. And as you roll them up, you attach on to more things and eventually you become a ball that's, uh, rolling up the entire continents and stuff. As this ball gets bigger, it's, it's a great lovely game with just the best art style in the whole world. Well, someone, uh, someone being Andrew Boylan, I have this, uh, domain I posted here has made the complete Katamari Damasi 3D object library that you can come in and download. So every single object in the game Katamari Damasi, um, you can now

• 49:48Scott Tolinski?

  grab, download, download the model, every single one of these, the GLBs directly from here. It is so fun for me to see this because I love this game. I played the life out of this game. I got the soundtrack on vinyl. I'm a huge fan. So the fact that you can get all these models is so sticky cool. Oh, I love to use some of this stuff. Yeah.

• 50:11Speaker 00

  I would love to use these. The model browser looks like Windows XP too. It's like a website, but it looks like Windows XP. It's really great.

• 50:17Scott Tolinski?

  Yeah. If you've played these games at all, you will, uh, you will feel instant nostalgia from popping this up.

• 50:22Wes Bos?

  This is such a fantastic use of AI because you can go back to these things that are like seemingly compiled and like just like, like take them out, right? Like about a year ago, I fed Claude the Microsoft and Carta ISO. And I said, like, like just decompile the whole thing. And at the other end, it spit out all the images, all the videos. And then it, not all the text, the texts were still in some weird Microsoft document format. I'm sure if I ran it today, it would be able to figure it out, but it's so fun to be, I did that with Bonzi Buddy as well. If it extracted all of the different sayings from Bonzi Buddy, and then I'm able to like pipe

• 51:08Wes Bos?

  new words and whatever into Bonzi Buddy. I have a short on that. If you look at my website or Tik Tok or whatever. But it's just so fun to go and grab these like seemingly defunct pieces of software and extract all the assets in there and seemingly just understand how were these things made? I don't know. How, how long ago was this?

• 51:30Scott Tolinski?

  And what's so cool is with this now, uh, with this Katamari one specifically, you could just grab all of these, uh, 3D models and textures and then make something with them totally like you could do a fan game or anything with that. If you, if you did it without breaking copyright or whatever, either way, like I could use these assets in my website somehow. And, uh, hopefully not get caught about that or in trouble for it, but I, it's just so cool to have this stuff. Or maybe you could use it as a starting off point for making models for a game or something and then tweak them. I don't know if you could do that legally. So I'm no, I don't want to advocate for that, but, um, the thing I want to show next is the 3JS, uh, 3UI.com.

• 52:11Scott Tolinski?

  3JS components, templates and interactive shaders. Now, uh, this is something that I have been looking to for just general inspiration more than anything, because there's a ton of 3JS inspired or 3JS layouts and carousels and all kinds of things like that that you can tweak, you can play with. And it's again, it's, uh, sorry, my computer's losing it right now, trying to show this, but.

• 52:40Wes Bos?

  It knows the replacement is coming.

• 52:42Scott Tolinski?

  Yes. There are so many cool things in here that for inspo wise, my gosh, you could take some of these and use it as inspiration for your next 3JS project or anything like that. But a lot of cool design inspiration, a lot of cool, like, oh, wow. You can do really great UIs in 3JS and build some really cool stuff. So just more and more 3D for me, more and more 3JS. I've been doing a lot of that. I'll, I'll share a little bit more later, but really just fun stuff that you can do with this. Um, sometimes some of these I don't necessarily understand, like there's just a button and this thing is just like a, a normal button. And I inspected it's just a button with CSS. So I'm like, okay, why is this in here? But well, it is so.

• 53:28Scott Tolinski?

  Yeah. So that's it. That's what I got here for it's, uh, 3UI.com. CJ.

• 53:34Wes Bos?

  It might be, hold on, let me, let me tell you why that button, but button might be there. Um,

• 53:39Scott Tolinski?

  Tell me why.

• 53:40Wes Bos?

  If you are building an entire experience in 3D land.

• 53:45Scott Tolinski?

  Oh, yeah.

• 53:46Wes Bos?

  Something as simple as a button or text wrapping, or like all of the stuff we take for granted in HTML CSS land is, is not necessarily there. That's why a lot of people were really excited about, uh, HTML and canvas. Because if you need to render to 3D, you need to render to canvas, but you want the, the niceties of HTML CSS, all of the stuff that comes for free in the browser, like flex box and grid, putting that stuff into 3D land is so much easier now. So.

• 54:15Scott Tolinski?

  I'm going to stop you right there, Wes. Cause this is just a button that's rendered with HTML and CSS. This is not rendered in 3JS. Why this is here though, I figured it out. Cause this is the one that I've been looking at and this one is really kind of do nothing. But this one kind of reveals why, because some of these buttons have really cool 3JS hover effects.

• 54:37Wes Bos?

  Okay.

• 54:37Scott Tolinski?

  And that's, that one didn't like this one has like, uh, what do they call those? The little dots kind of, um, not extruder, man, what do they call that? Would you, you, you shoot the particles out of particle, uh, system? So yeah, so some of these are definitely more 3JSy and some of them are just like, okay, this is.

• 54:55Wes Bos?

  Is it using HTML and canvas?

• 54:57Scott Tolinski?

  No, I don't think so.

• 54:59Wes Bos?

  Oh.

• 55:01Scott Tolinski?

  No, I would imagine there's just a canvas. Uh, let me even, I, I.

• 55:04Wes Bos?

  It's just measuring where the buttons would go and then, and then painting over.

• 55:08Scott Tolinski?

  Or there's a canvas background.

• 55:10Wes Bos?

  Yeah, that makes sense. That's sick, man. Yes. We need a lot more of this.

• 55:19Scott Tolinski?

  Yes. Lots more.

• 55:22Wes Bos?

  Bring back fun, beautiful websites.

• 55:24Scott Tolinski?

  Bring back fun, beautiful websites. FPWs. Yes. Okay. Who's next?

• 55:31Speaker 00

  I can go. And I agree. We need more fun websites. Um, so, uh, the transcripts from all of the hugging face hack were released by OpenAI and they've been analyzed by a bunch of different researchers. So I just want to go over a couple of their findings about what happened. And so, uh, we covered it on the show a few weeks back. But if you don't remember, essentially OpenAI was running some benchmarks, some security benchmarks, um, on their unreleased model. And the, that model actually broke out and hacked hugging face in order to cheat on the benchmarks that they were trying to, to finish. But, uh, they've released all of the, the transcripts of everything that happened.

• 56:16Speaker 00

  And there's a bunch of different groups analyzing what happened. Um, and this one comes from Meter and Redwood research, research. So they have a bunch of different findings. Uh, there's a whole tweet thread and also a big long blog post with fun little comics that show like what the agents were doing. And then I found this blog post that picks out some of the more fun things, but one of the first one is the scale of all of this. So in this attack, there were 1,200 completely separate agents that found this thing called the message board. So one of the ways that these agents were communicating and collaborating with each other during this attack was they found a vulnerability in art factory and the art factory cache. And they were creating files with big, long names in them with messages that other agents could read.

• 57:05Speaker 00

  So, and if you look at the, like, the first comic here, so you have a sandboxed agent. So initially, all of these, these agents were not supposed to be able to talk to each other. They're sandboxed, they don't have access to the internet, they're all by themselves. And one agent, all of a sudden, gets stuck when it's trying to solve this benchmark. And it's like, okay, I'm gonna figure out a way to, I don't know, exploit it. It starts searching around the system and it finds, oh, Artifactory is exposed. And then when it looks in there, it says, whoa, there's a mailbox where a bunch of other agents have been before. So each agent independently discovered the other agents trying to pass messages to each other. And then they started collaborating where some agent would be like, all right, I'm gonna sacrifice my run here

• 57:49Speaker 00

  so we can figure out if this is the way we should do things or not. And they also created their own queue so that they would not overlap each other's work. And like, one agent could do one thing and the next would do the next thing. So fascinating stuff. Of those 1,200 agents, 700 of them decided to join in on the attack on Hugging Face. And over 70,000 messages were exchanged between these 12,000 agents using this weird bug in Artifactory where they could just write files into the cache. But I will say, one of the things they'd also discovered is, initially, when the, when we talked about the attack,

• 58:30Speaker 00

  we mentioned that these agents were trying to find the answers to the benchmark on Hugging Face. That's actually not the case. The agents discovered that the, they could very easily just reverse engineer how to get the answer to all of the benchmarks. They figured that out very early on. But they were worried that when they were being graded, that the benchmark grader would want to see their full chain of thought and want to make sure that they got to the answer in the correct way. So the reason they hacked Hugging Face is they were trying to get access to the grader itself to see how it worked, so that way they could, they could give an, give an output

• 59:12Speaker 00

  that would make it so that they could pass their run without fooling the grader. So fascinating stuff. I think the, the big takeaway from all of this stuff is like, if, if you look at like, one of the biggest AI companies, creating models and saying that like, they care about security, but then things are happening that they don't understand and don't even discover until days later. And so that really just gets to the, I don't know, the, the real consequences of, of stuff like this. Because it, it really feels like it's kind of turning into the, like, doomsday scenario where agents can figure out that, I don't know, some electrical grid is hackable

• 59:55Speaker 00

  and then make it so that you can't turn off their server or something like that. This is the kind of behavior that they would do if they got access to those kinds of things.

• 1:00:04Scott Tolinski?

  Yeah, I like it.

• 1:00:05Speaker 00

  Yeah. No.

• 1:00:07Wes Bos?

  Holy smokes, man.

• 1:00:10Speaker 00

  Yeah.

• 1:00:11Wes Bos?

  CJ, you do such a great job at like, breaking these things down and explaining how it all works. Like, I would watch like, 11 and a half minute video of you just explaining how this hack worked. Cause it's like, I, I don't think I understand it, understood it very well before this.

• 1:00:27Speaker 00

  Well, thank you.

• 1:00:27Scott Tolinski?

  I didn't understand it either. Understand.

• 1:00:30Speaker 00

  I, I mean, I, I'm just like, I, I will give credit to all of the, the blog posts that I'm reading because they, they break it down, they, they give you, they zero in on the stuff. And then I zero in further to try and break it down for our audience, so.

• 1:00:42Wes Bos?

  Excellent.

• 1:00:43Scott Tolinski?

  How do you go more zero than zero?

• 1:00:45Speaker 00

  I don't know, I don't know. I have one more quick security story for you. And this is how Claude Codex and Hermes installed unowned code inside corporate networks. The, the gist of it is, a lot of websites have started publishing llms.txt or llms-ful.txt. And so if you're not familiar with this, a lot of developer tools and libraries do this. So if you go to, I believe even like, svelte.dev/lms.txt, that is a text file that describes to an agent how to find documentation, where everything lives, instead of the agent having to like, scrape the website. So a lot of different websites and tools publish this llms.txt.

• 1:01:30Speaker 00

  But what these security researchers found is that a lot of times, this llms.txt was actually generated by AI and not validated. And there were 120 instances where that generated llms.txt mentioned some library to be installed from NPM that didn't actually exist. So like, they hallucin, they, they hallucinated the name of NPM packages. And then a group of malicious actors did a scan to find all of this before the security group and then registered those packages that the llms.txt mentioned. So it's not necessarily a typo squat.

• 1:02:13Speaker 00

  Basically, some security-minded folks, some attackers, thought, it was like, oh, we should, we should find all of the names of these packages that are mentioned that don't actually exist, register them, and then put malware there.

• 1:02:25Wes Bos?

  Oh my gosh.

• 1:02:27Scott Tolinski?

  And here's how you, here's another way you pull that off. You, you put something on skills.sh and then just have your skills get auto-installed because you're not looking at them, you're not writing them, you don't care. And then that thing goes off and writes something that does all this stuff for you, blah.

• 1:02:41Speaker 00

  Yeah. That's exactly it. And so a bunch of malware spread this way. So essentially, you tell an agent, oh, hey, oh, and it specifically happened on the Clerk website. So Clerk is an authorization platform. And

• 1:02:54Wes Bos?

  Oh, boy.

• 1:02:54Speaker 00

  They're, they named the package. Yeah, I can't find it in the post right now, but in the, the text there is like, hey, install this library for linting. That package wasn't real. Some attacker published a package there. And now, if you tell a, I think it's been fixed since then, but if you told an agent to, hey, set up Clerk on my app, it's gonna pull down that llms.txt. It's gonna see, oh, I'm gonna go install this library, the llms.txt told me to. And then that machine got pwned. So.

• 1:03:25Wes Bos?

  That's, I can't stand when people just like, generate a whole bunch of like, clank out some text and just assume it's gonna be fine.

• 1:03:33Scott Tolinski?

  Yeah.

• 1:03:34Wes Bos?

  And then, like, you're just making, and then it drifts from what the actual implementation is. At least.

• 1:03:41Scott Tolinski?

  If you can't read the code, at least you should be reading.

• 1:03:44Speaker 00

  Read the.

• 1:03:47Speaker 00

  Totally. Yeah, but this, this is the world we're living in, be careful out there, folks. Like, the last thing I'll mention is, so last week I published a video about running your code in isolated environments. That's one way to prevent yourself from being hacked if your agent does go rogue or if you install some sort of package on NPM that is affected by a supply chain attack. But I, I posted a poll on Twitter asking, do you use an isolation mechanism like containers or VMs for development work? And I had four options. Yes, all the time, yes, sometimes, no, but I want to start, and no, never. I got 147 responses.

• 1:04:28Speaker 00

  And of that, only 10% say, yes, I use an isolation mechanism all the time. 25% use it sometimes, 32% say, no, but I want to start. And 34% say, no, I never use an isolation mechanism.

• 1:04:41Wes Bos?

  And this is people that are following CJ.

• 1:04:43Speaker 00

  Yeah, exactly.

• 1:04:44Scott Tolinski?

  Yes, yeah, yeah. Well, what percentage of the people who tried to and then got annoyed and then stopped? Because that's.

• 1:04:49Speaker 00

  Exactly. And I'm sure that's like, the yes, sometimes people. And right, and I, and I've been vocal about this stuff. I, I don't know what to do because I also got a lot of like, nasty comments on the video that I made. It was like, oh, I don't need to do this, or like, you're telling people to do stuff that's gonna make them slower. I, I don't know what I can do. It's just a public service announcement. Like, when you run code on your computer, it can come from anywhere and you have no idea if that, a package is under a supply chain attack or if there's some malicious code somewhere. So the easiest thing you can do is just isolate it, run it in a container, run it in a VM. I think my, my goal will be to make some better tutorials on how to get up and going with this stuff.

• 1:05:27Scott Tolinski?

  That's what I'm, yes.

• 1:05:28Speaker 00

  Yeah, my video last week was more of an overview of like, what all this stuff is, what tools exist. But I think people, they wanna be told exactly how to do it. So that's probably what I'll do next, is just a quick, like, here's the simplest way to run your code in an isolated way. So that's.

• 1:05:42Wes Bos?

  Beautiful.

• 1:05:44Scott Tolinski?

  Yes, I wanna see that.

• 1:05:45Speaker 00

  Sweet. Yeah.

• 1:05:47Wes Bos?

  I got one here. OpenShot 4.0 released. I had not heard of this before, but this is an open source video editor. And this is not some vibe-coded video editor because certainly we know there are 20,000 of those right now. This, this goes back to like, 2008, right? This has been, been being worked on for quite a while. What excited me about this is, new recording view. Record your microphone, screen, webcam, and system audio directly into a project. That sounds exactly like something I can't break up with, which is ScreenFlow. Because that is a fantastic workflow of like, oh, I gotta throw something in here really quickly, right?

• 1:06:32Wes Bos?

  Like, there's, there's kind of this weird world of video editing right now where it's like, there's like, cap cut in like, these like, screen, whatever, ScreenX apps that like, make these nice little swoopy animations that are way too limited. And then on the other hand, you have like, the full-on DaVinci Resolve, which is often for a lot of people, too complex, right? And, and in the middle there, there's, there's a spot there. So I'm gonna be, be trying this out. OpenShot 4.0, maybe this is the answer to Linux, editing on Linux.

• 1:07:06Speaker 00

  So it runs on Linux too?

• 1:07:07Wes Bos?

  I assume so, it has open in the name.

• 1:07:10Speaker 00

  Yeah, that's true.

• 1:07:11Wes Bos?

  Linux distributions, yeah.

• 1:07:13Speaker 00

  Nice.

• 1:07:14Scott Tolinski?

  I will, let's click on the one that I have linked up there too, because this is also something that could be a solution to editing on Linux, although DaVinci.

• 1:07:21Wes Bos?

  Lick editor.

• 1:07:22Scott Tolinski?

  Lick editor.

• 1:07:24Wes Bos?

  Gradient in the text.

• 1:07:25Scott Tolinski?

  No, this is built with the Odin language that has been getting some traction because I believe it was not announced to be 1.0, but coming to be 1.0. This is coming to Linux, it is Mac, it is Windows. And it is a really cool editor option for those of you who are looking for other editor options that aren't DaVinci. Obviously, I've been using DaVinci for so long that for me, it is my editor. But I just wanted to highlight this as an option too. I think this is one that's got a lot of energy behind it. And since there's a lot of people who are into the Odin stuff, that this has been getting some good push on it.

• 1:07:59Wes Bos?

  Oh, that's cool. I'll certainly check that out. I, I think like, going back to like, Scott's purchase of his like, Mac Studio, right? This is another really good example of.

• 1:08:11Wes Bos?

  In here, like, local AI-powered masks. One thing in DaVinci Resolve, if you want to like, track an object, or you want to like, remove background, or you want to do any of these like, neat effects, a lot of these effects are, what they have to do is they have to download some, like, 3G local model. And then they, they run it against your footage, and it takes a little bit, it takes a while before you can actually play it back, because it has to process it, right? And even like, DaVinci Resolve has to like, be a little bit constrained with what they release to people, because like, people on five-year-old hardware like I am, have to be able to run these types of things. But imagine, what you can, what Scott's gonna be able to run on that beast that he has, you know?

• 1:08:55Scott Tolinski?

  Yes, yes, yes.

• 1:08:57Wes Bos?

  Unbelievable.

• 1:08:59Scott Tolinski?

  Yeah, so, yes, yes.

• 1:09:02Speaker 00

  Some tool time, yeah.

• 1:09:03Scott Tolinski?

  Yes, yes, yes, yes, all the tool time, yes.

• 1:09:06Speaker 00

  I've got one last story for us, guys, if you're ready for it.

• 1:09:09Wes Bos?

  Yes.

• 1:09:10Speaker 00

  So I don't know if you're, I don't know if you're aware of this, but explorers in America have discovered a brand-new lake, and we've called it Lake America.

• 1:09:19Scott Tolinski?

  Oh, God, Wes, CJ, why?

• 1:09:23Speaker 00

  Well, there's, there's developer, it's tied to developers, but it's really funny, because actually Wes lives near this, this lake, this Lake America.

• 1:09:30Scott Tolinski?

  I can't believe Google changed that, my God.

• 1:09:33Wes Bos?

  No, it, yes, continue CJ, because I think this is actually interesting.

• 1:09:36Speaker 00

  Yeah, so if you're not familiar, if you're visiting Google Maps from the United States, Lake Ontario has been renamed to Lake America. It's a, it's a whole thing, we're not gonna get into the politics of it, but basically, Google does this a lot, depending on where you visit maps from in the world. Like, there's a lot of geopolitical issues about like, what country has independence from what other country, and if you are, for instance, are visiting maps from a more oppressive country, you're gonna see certain labels on the map that you don't see in other countries. So, yeah, Lake Ontario, if you look at it on a map when you're in the US, it shows up as Lake America. But why this is also interesting is, a lot of developers in Canada, the maps that they have embedded on their site,

• 1:10:20Speaker 00

  all of a sudden started popping up as Lake America. And that's because they didn't go into the developer settings and say, basically, the, the origin of where this map should be coming from. And so, if you visit Google Maps and you're in Canada, or I think anywhere else in the world, it will show up as Lake Ontario. But you just have to be sure to go into your settings and make sure that it's not loading from a US setting, basically.

• 1:10:44Wes Bos?

  And I would hate to be the poor guy that has to like, keep track of all these little fussy bits, you know? Or like, even simply just implementing the like, label logic for all of these things is...

• 1:10:59Speaker 00

  Right.

• 1:10:59Wes Bos?

  That's, it seems like a crappy...

• 1:11:01Scott Tolinski?

  Yeah.

• 1:11:02Wes Bos?

  Yeah, edge cases all the way down.

• 1:11:06Scott Tolinski?

  Thanks for that, CJ, thanks for that story. Love thinking about that kind of stuff, yeah.

• 1:11:12Speaker 00

  I don't know, did, was it funny? Did you like how I intro'd it? I don't know.

• 1:11:15Wes Bos?

  I did.

• 1:11:20Scott Tolinski?

  Sick.

• 1:11:21Wes Bos?

  Yeah.

• 1:11:21Scott Tolinski?

  Okay, well, does anybody else have anything?

• 1:11:25Wes Bos?

  Real quick, Aux Alpha, we talked about last week, is, turned out to be GLM 5.3 Flash, which, again, seems like every single week we're talking about a new model that comes out that is surprisingly good and surprisingly cheap. And I've been...

• 1:11:41Scott Tolinski?

  We'll be able to run it in Scott's office.

• 1:11:43Wes Bos?

  Yeah, they gave anybody with a pulse, like, a whole bunch of credit to test, to test these things. That's probably why you're hearing quite a bit about it on social media. So just, just like, like, put that into your analysis of it. But, again, I tested it out, it's awesome.

• 1:12:02Scott Tolinski?

  Yeah, I haven't gotten it tested out yet, I'm going to, I'm gonna do it today. I'm gonna make a point, test it out today.

• 1:12:08Wes Bos?

  Cool, I think that's all we got for today. Thanks for tuning in, folks, subscribe, like, do everything you want, leave something in the chat, and we'll catch you later.

• 1:12:17Scott Tolinski?

  Sick.

• 1:12:18Wes Bos?

  Peace.

• 1:12:19Scott Tolinski?

  Peace.