today’s beats#

two reminders for the final project: images and your README

your questions from the Ed megathread

some final meditations on the final project

questions from the floor

images: bring your own key#

the course’s image credit has run out, so strproxy no longer generates images

placeholders first, then a free tier (Hugging Face, Pollinations) or a pay-per-image host (fal.ai, Replicate)

keep the token out of your repo, and the spend is yours: generating images

Ben uses… a styled image skill#

every image on this site/decks: house style from CLAUDE.md, a few reference images, the prompt plus a style suffix, then check it looks ok

have your agent build something similar

your README#

one page with two jobs, published in full at /readme/:

the argument: what good means for your app, with sources (400–600 words)

usage instructions: markers arrive with only the URL and start here, so everything a newcomer needs goes on this page

maintaining an app your agents built#

(agent changes pass the tests but add duplication and complexity: what catches that?)

writing code is cheap, owning it isn’t: Willison and the HN thread

each change looks fine on its own: the agent sees the diff, not the design (HN)

refactoring is a task too: ask for a deduplication pass, with the tests underneath (HN)

Ben’s reflection#

agents are just as good at maintenance as at hacking out greenfield prototypes; it’s up to you to decide where the time and effort go

your own engineering judgement#

(if the agents out-code you, where should your learning go?)

Kent Beck: “It’s the first derivative of your productivity that we’re looking for” (May)

Ankur Sethi retypes every change his agent proposes: “I value comprehension over productivity” (August)

Felix Rieseberg dropped coding interviews from his Anthropic team: “Hunger beats tenure” (this week)

Ben’s reflection#

the agents will get better; who knows when they’ll plateau?

the best way to practise and develop your engineering judgement is to make stuff and show it to others (hey, like in this course!)

the black-boxing of code#

(should we still read the code?)

the agent writes it: Spotify’s best developers, since December (TechCrunch); Claude Code’s lead, 100% (Fortune)

nobody reads it: StrongDM’s software factory bans human review (February); Delinea bought StrongDM in March, and the factory’s model log last changed in September

in between: Willison no longer reviews every line, but is still accountable for all of it

Ben’s reflection#

I’m at (pretty much) 100% for code, although writing not so much (don’t lose your voice!)

you should still be able to whiteboard the system architecture

Ben’s reflection#

for anything medium-sized or bigger: one session to talk it through, weigh the trade-offs and write the plan to a markdown file

then a fresh session: “review this plan”; it always catches something

beyond that, you don’t need to get much fancier

how my thinking shifted this semester#

vaguer provocations, thinner starter repos: working out what to build, and what the harness needs, is most of the job

more ambitious software: Dan Luu, this week: We should be more ambitious with the software we build

people are implicitly carrying around a pre-agentic cost model

security, when anyone can ship#

PHP2Shell (21 October): two unauthenticated remote code execution bugs, CVSS 9.2, exploited in the wild (Tenable); PHP 5.4–7.3 get no fix

found with AI: Calif, OpenAI and Wiz reported them; PHP now scans its own code with Claude Mythos (PHP Foundation)

Node.js (same day): ten CVEs, the worst found by OpenAI Codex Security (release)

vulnzero#

As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better … (We need to hold on for ~18 months.)

(Jason Clinton, Anthropic’s deputy CISO, 22 October; reported here)

and after 18 months: “vulnzero”, with small, cheap models stopping software from shipping security bugs at all

Ben’s reflection#

overall the security situation will get better (maybe not vulnzero? who knows)

make security one of the things you explicitly consider in your design and development work

final meditations on the final project#

the marker looks for one idea of good in the README, CLAUDE.md, spec/ and the app

the median answer (a chat room with the nouns swapped) marks down

when the agent gets something wrong, show the fix landing in CLAUDE.md or spec/

how the final project is marked#

the final project is worth 40%, as much as A1 and A2 combined

COMP4020: process 50%, app 25%, response 25%

COMP8020: process 35%, app 20%, response 20%, research note 25%

it’s marked against the same bands as A1 and A2, but on a much bigger thing, so high marks are hard to get (details)

after the course#

your repos in the course GitHub organisation stay where they are

you’ve got at least a month after the course finishes to move anything you want to keep

the research project#

the study uses data you already generate: commits, telemetry, work, marks

to opt in: Canvas, Start here module, Research participation (voluntary), then the two-minute consent form

a Data Custodian holds the responses; I can’t see yours until after final grades

yes, no or ignoring it changes nothing about your marks, and you can change your answer until the data is de-identified

an interview with Anthropic#

(separate from the research project)

Anthropic would like to interview students about this course

if you’re up for it, tell me after the lecture or DM me on Ed

deadline radar#

noon Monday 9 November: the final project is due

11am–3pm Wednesday 11 November: the final project showcase in the Birch building (optional)

(part of the School of Cybernetics’ Cybernetics Showcase; free, but register)