Lightnews — Scholar-powered news

Pete Hodgson @thepete.net · 9d

1000000%

Chris Coyier @chriscoyier.net · 9d

I feel like how we feel about smoking on airplanes is how the next generation will feel about us just mainlining social media.

1

Pete Hodgson @thepete.net · 13d

See if you can spot the prompt injection: github.com/trailofbits/...

Or if you can spot the backdoor being added: github.com/trailofbits/...

More on the lethal trifecta: simonwillison.net/2025/Jun/16/...

Pete Hodgson @thepete.net · 13d

Super interesting proof-of-concept exploit against an AI agent via GH pull request.

Very sneaky prompt injection which convinces an AI coding agent to subtly inject a remote backdoor into a codebase.

A great example of @simonwillison.net's Lethal Trifecta!

blog.trailofbits.com/2025/08/06/p...

Prompt injection engineering for attackers: Exploiting GitHub Copilot

Prompt injection pervades discussions about security for LLMs and AI agents. But there is little public information on how to write powerful, discreet, and reliable prompt injection exploits. In this ...

blog.trailofbits.com

1

Pete Hodgson @thepete.net · 17d

Good example of why it's important to monitor your LLM-powered features in prod.

Apparently some bug in Amazon's AI assistant where the product description isn't in it's prompt.

Pre-production evals are super important, but wouldn't catch this. Monitoring some key metrics in prod would.

1

Pete Hodgson @thepete.net · Sep 11

c) invest in making your codebases agent-friendly by wrapping all your conventions and tribal knowledge into a small set of scripts

point C is exactly the same guidance that I was giving 11 years ago(!!!): www.thoughtworks.com/insights/blo...

I was ahead of the curve I guess :D

In Praise of the ./go Script - Part I

My step-dad is a cabinet-maker by trade. We chat about his work from time to time. I've often been struck by the similarities between building furniture and building software. Take tooling for example...

www.thoughtworks.com

1 1

Pete Hodgson @thepete.net · Sep 11

The point being:

a) In many situations LLMs are WAY WORSE that "classic" deterministic tools.

b) don't waste a ton of ultra-valuable LLM context on guidance that could be enforced a different way

🧵...

In Praise of the ./go Script - Part I

My step-dad is a cabinet-maker by trade. We chat about his work from time to time. I've often been struck by the similarities between building furniture and building software. Take tooling for example...

www.thoughtworks.com

1 1

Pete Hodgson @thepete.net · Sep 11

hotline bling meme.

Drake is very upset about an AGENTS.md file which include the instruction "when writing javascript, ALWAYS use `for…of`, NEVER `forEach(...)`"

Drake is very content with an AGENTS.md file that contains the instruction "ALWAYS run ./bin/precommit" along with an eslint.config.js file that includes the rule "no-array-for-each": "error"

1 2

Pete Hodgson @thepete.net · Aug 8

Such a nice way to illustrate the point

Jessica Kerr @jessitron.bsky.social · Aug 7

Putting all your controllers in one directory and your views in another
Is like putting the cortisone and hemorrhoid cream in the drawer with toothpaste because they're all tubes.

1

Reposted by Pete Hodgson

Samuel @samuel.fm · Aug 7

they should be taken to The Hague for this graph crime

Bar chart where 52>69 and 69=30
about gpt5 comparison

25 68 530

Pete Hodgson @thepete.net · Aug 6

I also highly recommend checking out other sessions from that AI That Works series if you're building AI-powered product features. There are some gems on how to do evals the right way, how to build agents, and lots more.

The presenters are practitioners in the thick of it - they know their stuff!

Pete Hodgson @thepete.net · Aug 6

- invest time in really good "agent onboarding" - CLAUDE.md (or equivalent), and agent-friendly tooling in your repo. This is super valuable because *every time* you compact context or spawn a subagent it's like a brand new engineer just joined the team.

2

Pete Hodgson @thepete.net · Aug 6

- when implementing you should be manually “compacting” context fairly regularly
- or even better, use tasks/subagents to achieve the same
- invest time in building really good re-usable prompts for research and planning phases

/🧵...

1

Pete Hodgson @thepete.net · Aug 6

- break the task down into researching, then planning, then implementing, with human-in-the-loop at each step, and a new context window at each step (I wrote about this here: blog.thepete.net/blog/2025/04...)

/🧵...

Chain-of-Vibes

Chain-of-Vibes is a workflow that lets you overcome AI's current inadequacies in tackling meaty coding tasks, by setting up a tight feedback loop between yourself and the AI.

blog.thepete.net

1

Pete Hodgson @thepete.net · Aug 6

I really like how @dexhorthy.bsky.social (the presenter) summarized some of the concepts visually - check out the github doc for a sneak peek.

My favorite take-ways:

/🧵...

1

Pete Hodgson @thepete.net · Aug 6

There are some amazing pro-tips for AI coding in this session:
github.com/hellovai/ai-...

Specifically, really good advice on how to manage agent context (which can have a big impact on the LLMs performance).

If nothing else, just skim the summary and see if anything looks interesting.

/🧵...

ai-that-works/2025-08-05-advanced-context-engineering-for-coding-agents at main · hellovai/ai-that-works

🦄 ai that works - every tuesday 10 AM PST. Contribute to hellovai/ai-that-works development by creating an account on GitHub.

github.com

1 2

Reposted by Pete Hodgson

Mike Roberts @mikebroberts.com · Jul 29

Hi #AWS -using friends. I’ve been writing some articles about fundamental AWS ops for small-medium companies, all oriented around AWS Organizations. So far I’ve covered org structure, Accounts, managing human users, IaC. I have another 4 or so articles still to come, so am about half way.

(1/3)

1 2 3

Pete Hodgson @thepete.net · Jul 30

I've tried "right-sized services" in the past, but it doesn't exactly skip off the tongue.

I quite like mezzoservices. It's cute, but that's ok :)

Pete Hodgson @thepete.net · Jul 30

This continues to shock and confuse me: the proportion of devs who are still not getting any active encouragement from their employers to start experimenting w. AI-assisted coding.

Also goes to show how silly the "all devs will be replaced by AI in 2 years" claims are.

/via @angiejones.tech