Sign in

Andrew Lilley Brinker

@alilleybrinker.com
2.8K followers 585 following 8.7K posts

🧔🏼‍♂️ general words: alilleybrinker.com 🦀 rust words: possiblerust.com Developer Security @ Anthropic Opinions posted are my own

PostsRepliesMedia
Andrew Lilley Brinker @alilleybrinker.com · 19/09/2026
Saw this and had to grab it since @bcantrill.bsky.social’s recommended it repeatedly on Oxide and Friends
Me, holding the book “Skunk Works” by Ben Rich while sitting on an airplane.
4320
Andrew Lilley Brinker @alilleybrinker.com · 12/09/2026
Huh apparently I’m on a massive blocklist for “AI Enjoyers”
My block curve, showing 4,097 blocks including modlists.
290
Andrew Lilley Brinker @alilleybrinker.com · 04/09/2026
They're calling it the "least surprising result of all time"
My dialect map, showing my dialect is Californian. It can't decide if I'm from San Francisco or Los Angeles (for the record, I grew up in San Bernardino, CA, in the Inland Empire far east of Los Angeles).
130
Andrew Lilley Brinker @alilleybrinker.com · 31/08/2026
Text of my email to 1Password about this.

I am extremely unhappy with 1Password committing $300,000 to the Omarchy project (see: https://omarchy.org/news/2026/08/1password-and-37signals-become-distinguished-corporate-patrons/).

Omarchy is created and owned by David Heinemeier Hansson. In the last year, David has published articles calling for the mass deportation of Romani in Europe, comparing them to invasive wolves (see: https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a) and for the ethnic cleansing of minorities from London (see: https://world.hey.com/dhh/as-i-remember-london-e7d38e64).

David's bigoted behavior has been public for many years. Back in 2023, Duke University cancelled contracts with Basecamp, a DHH-owned product, over these issues (see: https://blogs.library.duke.edu/blog/2023/11/30/why-were-dropping-basecamp/).

As a longtime 1Password Family account customer, I am disgusted that 1Password is giving money to this project, and I demand the company rescind the deal with Omarchy, refuse to pay the remaining $200,000, and attempt to claw back the $100,000 already paid.
31137
Andrew Lilley Brinker @alilleybrinker.com · 28/08/2026
Welcome to CS 340, Software Development. Please open your textbook
“Anatomy of Criticism” by Northrop Frye
0346
Andrew Lilley Brinker @alilleybrinker.com · 20/08/2026
Dr. Hancox-Li really said
040
Andrew Lilley Brinker @alilleybrinker.com · 17/08/2026
I think John is imagining a magic LLM-shaped box that only ever chooses the words he personally thinks are best (i.e. one that is never probabilistic). That's not how they work today, and watermarking doesn't change that.
"One of my fundamental problems with this is that no two synonyms carry the exact same meaning. “He leaped at the chance” and “He jumped at the opportunity” are very similar sentences expressing the same general sentiment, but they are not the same. The exact words we choose when writing matter. I want any LLM I use to choose the very best, most precise words at every single decision point."
1181
Andrew Lilley Brinker @alilleybrinker.com · 13/08/2026
The Architect's Melody choir in Hollow Knight: Silksong. Canonically, each statue is filled with the soul of a pilgrim who came to the Citadel to worship. They are victims, trapped forever to sing their part of the Threefold Melody to keep Grand Mother Silk bound high up in the Citadel's peak.
020
Andrew Lilley Brinker @alilleybrinker.com · 11/08/2026
For the unfamiliar
From my website:

My Name

“Lilley Brinker” is my full last name. Two parts, no hyphen. When my wife and I got married we combined our last names without a hyphen. My last name is not “Brinker” and it is not correct to call me “Mr. Brinker”.

“Lilley” is pronounced like the word “lily”.
150
Andrew Lilley Brinker @alilleybrinker.com · 11/08/2026
The "rat-man" room in Portal, where you find hidden messages from an Aperture Science researcher named Doug Rattmann who escaped the facility and began leaving messages on the walls.
0453
Andrew Lilley Brinker @alilleybrinker.com · 11/08/2026
Remember y’all cacm.acm.org/practice/mem...
‘Get good’ is not a strategy.  There is a common reply in conversations about memory safety, coming from the most hardcore skeptics: Programmers should just write better code. They argue, explicitly or implicitly, that programmers who benefit from the guardrails of memory safety are bad programmers, and that real programmers are sufficiently skilled that they do not need a machine double-checking their work.

Let’s be clear: This is anti-intellectual nonsense—macho self-aggrandizement masquerading as a serious technical argument. You should not take it seriously and should consider someone advancing this argument as fundamentally unserious and to be ignored.
2639
Andrew Lilley Brinker @alilleybrinker.com · 07/08/2026
The author has updated the article with a "post-mortem" claiming they did not involve AI in any part of the writing process.
Post-Mortem

On Language

This post reads off as AI slop. You said it, I see it. I’m sincerely sorry for publishing something that has allowed you to feel this way. If my word means anything to you, I would like to assure you that this post was not authored by a LLM. Nor was it storyboarded, reviewed, checked, etc. by a LLM. Some readers have pointed out that people do not speak this way. That is correct. I do not speak, nor usually write, like this and this post will go down as my not-the-proudest, however, I take your criticism to heart—although not personally—and strive to improve.

I do write like this sometimes. The short sentences, the reversals, the one-word lines—all of it. It’s just the way it is. A LLM writes that way too, because it was trained on the same essays I grew up reading, so me doing it badly and a machine doing it look about the same to you on the page. That says something about my writing. It says nothing about who wrote it.

So let me be plain about it: Claude was not here. No LLM wrote this—not a sentence of it, nor was it outlined, drafted, reviewed, checked, etc. by one, and there is no prompt behind it either. It is just me, writing worse than usual. I will write the next one plainer. Next time, write to me. I too am a person behind this screen.
In Appreciation

Be assured that I have read all of your comments—the good and the bad. As with my previous post that reached Hacker News, I’ve received many insightful ones. Whether it was people sharing their experience, or negative comments with the decency to criticize with substance, I have learned something new today—for which I am thankful.
350
Andrew Lilley Brinker @alilleybrinker.com · 05/08/2026
PMF rules everything around me. Congrats to my friends at @oxide.computer!
OP: "- stupid question: how do you go about raising that kinda money consistently

- like why wont you fund me a few million dollars to build my deep edtech startup

- like what guarantee does this guy give you which i cant"

My response: "Product-market fit. Based on prior Oxide announcements, they've been clear the raising is in large part about building out manufacturing to meet customer demand. In venture capital investing, once you've found a winner (a company that you have high confidence will be successful and will produce returns at some multiple above your investment), you ought to put much more money into that winner to maximize that return.

In the last round Bryan and Steve talked about being over-subscribed, especially from existing investors in prior rounds. That likely means those investors see exactly what I've described: a winner that's worthy of additional funding to pump their total return on investment."
0231
Andrew Lilley Brinker @alilleybrinker.com · 05/08/2026
Jack Donaghy from 30 Rock holding up a paper that says "NBC Programming Priorities Breakdown" at the top.

It shows a 3d pie chart with a large section taking ~80% of the chart labelled "The Biggest Loser," a chunk around 15% of the chart saying "Make it 1997 again through science or magic," and a sliver saying "everything else."
070
Andrew Lilley Brinker @alilleybrinker.com · 04/08/2026
This comment on hyperscalars "demolish[ing] their free cash flow" is also weird. You get cash flow as a company *to do things with*, and for an infrastructure company it means you get to build more infrastructure!
What hyperscalers have actually done is demolish their free cash flow and purchased hundreds of billions of dollars’ worth of GPUs, TPUs, and XPUs to support a customer base dominated by two customers that are now accounting for the vast majority of their revenue growth and quite literally cannot afford to pay their bills without a near-infinite flow of venture capital investments.
2100
Andrew Lilley Brinker @alilleybrinker.com · 04/08/2026
Right at the start, it's weird to claim that price increases on existing services accompanying the addition of AI features, which customers continue to pay for at those higher prices, are evidence that growth is not being driven by AI.
"To be clear, all three of these companies’ cloud platforms have many other customers paying for many other things other than generative AI services or AI GPUs, and they’ve all engaged in a combination of multiple outright price increases and changing their core subscriptions to force AI features on them as a means of boosting revenues and conning the street into believing that “AI is paying off” every time they non-consensually thrust it on their customers, framing higher prices as “better value” in a way that fucks the user to appease Wall Street. "
1111
Andrew Lilley Brinker @alilleybrinker.com · 01/08/2026
John Mulaney doing stand up. He's on a stage, wearing a black suit with a white shirt and black tie. He's got a microphone held to his face and one hand held out in front of him with the palm facing away.Transcript from a John Mulaney bit: "Then there’s the homily. If you’re not Catholic, the homily is when the priest does a book report that is also stand-up comedy. It normally begins with a charming anecdote that is fake and never happened. “A woman was at a shopping mall with her young son.” What was the woman’s name? Hey, Father, what was the name of the shopping mall? Your story doesn’t have a lot of details. You only had a week to work on it and you’ve had the book for 2,000 years."
060
Andrew Lilley Brinker @alilleybrinker.com · 30/07/2026
Tumblr post by "classically-lit-memes4u":

"RIP to everyone killed by the gods for their hubris but im different. and better. maube even better than the gods"

It has 105,116 notes.
010
Andrew Lilley Brinker @alilleybrinker.com · 27/07/2026
My site how has a "Reading" page that extracts links to articles I've shared on Bluesky. www.alilleybrinker.com/reading/
The "Reading" page from my site, showing the list of recent articles, which includes:

- "Postscript on the Societies of Control," by Gilles Deleuze
- "How to think about async/await in Rust," by Cliff Biffle
- "NFL owners vote to allow private equity funds to buy stakes in teams," by Judy Battista
- "Making end-to-end encrypted AI chat feel like logging in," by Moxie Marlinspike
- "'Critical' projects and volunteer maintainers," by Jake Edge
- "In the economy of user effort, be a bargain, not a scam," by Lea Verou.
0140
Andrew Lilley Brinker @alilleybrinker.com · 27/07/2026
000
Andrew Lilley Brinker @alilleybrinker.com · 26/07/2026
Here’s what Claude says. Probably best to validate with a Slovak or Czech speaker
Origin: Slovak/Czech — likely derived from “pšenica” (wheat), so probably an occupational or descriptive surname related to wheat/grain.

Pronunciation: roughly “psheh-NEETS-kah” (PSH-eh-NITS-kah) — the “ps” is pronounced together as in “Pshenitska,” not like a silent P.
220
Andrew Lilley Brinker @alilleybrinker.com · 24/07/2026
Wow he's just like me (@davidcrespo.bsky.social)
One of my co-memeticists, @davidcrespo.bsky.social, with two shared memes: "long industrial revolution" and "jj new main".
020
Andrew Lilley Brinker @alilleybrinker.com · 24/07/2026
I *will* make "self-managing types" happen (as a replacement term for "RAII")
My top repeated trigram, "self managing types," repeated three times by me and no one else on Bluesky has ever said it.
1140
Andrew Lilley Brinker @alilleybrinker.com · 22/07/2026
I don't love being pessimistic about Rust's ability to deliver large-scale improvements, but the project has a long track record of approved-but-half-completed features. I hope this improves over time, but I do not want to bet on it.
Comment chain 1

nrc (@ncameron.org):
I think you wouldn’t have to tweak rust too much to get there. It would be backwards incompatible, but not too much. Plus of course a total rewrite of the compiler and cargo, but with the help of llms, both issues are probably solvable now.

Andrew Lilley Brinker (@alilleybrinker.com):
I am pretty pessimistic about Rust’s cultural and organizational ability to do that, even if it’s technically feasible.

Comment chain 2

huevosabio.bsky.social (@huevosabio.bsky.social):
Or another way to see it, would it be possible to make Rust compile much faster?

Andrew Lilley Brinker (@alilleybrinker.com):
It would require large breaking changes and a degree of coordination, product direction, and follow-through which I don’t believe Rust could organizationally muster.
170
Andrew Lilley Brinker @alilleybrinker.com · 22/07/2026
I don't know if I'd pick out a standout chapter (each chapters' methods are good for different things), but I like this bit in the intro explaining a core thorny challenge with causal inference:
Economic theory tells us we should be suspicious of correlations found in observational data. In observational data, correlations are almost certainly not reflecting a causal relationship because the variables were endogenously chosen by people who were making decisions they thought were best. In pursuing some goal while facing constraints, they chose certain things that created a spurious correlation with other things. And we see this problem reflected in the potential outcomes model itself: a correlation, in order to be a measure of a causal effect, must be based on a choice that was made independent of the potential outcomes under consideration. Yet if the person is making some choice based on what she thinks is best, then it necessarily is based on potential outcomes, and the correlation does not remotely satisfy the conditions we need in order to say it is causal. To put it as bluntly as I can, economic theory says choices are endogenous, and therefore since they are, the correlations between those choices and outcomes in the aggregate will rarely, if ever, represent a causal effect.
120
Andrew Lilley Brinker @alilleybrinker.com · 20/07/2026
I don't even know what to say at this point
Image of the Revzani Tank, which looks like a Jeep Wrangler that really wants to be a Halo Warthog when it grows up
250
Andrew Lilley Brinker @alilleybrinker.com · 20/07/2026
Not to always be the "read Societies of Control" guy, but uh, read Deleuze's "Postscript on the Societies of Control" theanarchistlibrary.org/library/gill...
In the societies of control, on the other hand, what is important is no longer either a signature or a number, but a code: the code is a password, while on the other hand the disciplinary societies are regulated by watchwords (as much from the point of view of integration as from that of resistance). The numerical language of control is made of codes that mark access to information, or reject it. We no longer find ourselves dealing with the mass/individual pair.
130
Andrew Lilley Brinker @alilleybrinker.com · 20/07/2026
The secret is to get a hex wrench set. I have this one and it's paid enormous dividends. www.homedepot.com/p/Husky-Long...
Hex wrench set product picture, showing many different sizes of hex wrench in two different scales.
220
Andrew Lilley Brinker @alilleybrinker.com · 19/07/2026
Seeing England win
John Oliver staring intensely
030
Andrew Lilley Brinker @alilleybrinker.com · 14/07/2026
theportalwiki.com/wiki/Moralit...
GLaDOS' Morality Core from Portal
010
Andrew Lilley Brinker @alilleybrinker.com · 10/07/2026
Here's a map of all the stuff the New Deal built or conserved. livingnewdeal.org/map/
A map of the United States from "The New Deal Map" site, with an enormous number of dots indicating distinct New Deal-funded works programs and conservation programs. There are particular concentrations in the Bay Area, Los Angeles area, and around New York City, but dots truly cover the entire country.
050
Andrew Lilley Brinker @alilleybrinker.com · 09/07/2026
Oh yeah, for sure. From me in "Memory Safety for Skeptics":
"‘Get good’ is not a strategy.  There is a common reply in conversations about memory safety, coming from the most hardcore skeptics: Programmers should just write better code. They argue, explicitly or implicitly, that programmers who benefit from the guardrails of memory safety are bad programmers, and that real programmers are sufficiently skilled that they do not need a machine double-checking their work.

Let’s be clear: This is anti-intellectual nonsense—macho self-aggrandizement masquerading as a serious technical argument. You should not take it seriously and should consider someone advancing this argument as fundamentally unserious and to be ignored."
130
Andrew Lilley Brinker @alilleybrinker.com · 09/07/2026
TIL about Social Cognitive Career Theory
Diagram from "Student Motivations and Expectations for an Introductory
Programming Course in Biology" by Zuckerman, Vo, and Juavinett, explaining the career choice to enroll in "Introduction to Python for Biologists" as being influenced by prior experiences (prior exposure to coding, mathematics experience and gatekeeping), self-efficacy (belief in possible success, strongly informed by support, course description, and prior experiences), and social support (direct connections such as family, secondary connections, and societal figures).
091
Andrew Lilley Brinker @alilleybrinker.com · 09/07/2026
When TigerBeetle, another flagship product for your language that you hold up as a paragon of "doing Zig right," says this, it's an indictment of your language github.com/tigerbeetle/...
From the TigerBeetle issue tracker's list of problems they have with Zig:

"Language features around pinned structs, result location semantics aliasing and implicit pass by reference. We currently avoid pass by value syntax altogether, and always use *const T or *T."
160
Andrew Lilley Brinker @alilleybrinker.com · 09/07/2026
Here's Jarred, showing much more class in his response than Andrew did in his post
Jarred posting on Hacker News about Andrew's blog post.

"	
Jarred 3 hours ago | next [–]

I have learned so much reading Andrew’s code and as I said in the original post: Bun would never have happened without Zig.

> The post claims they were fuzzing their Zig code, while during our calls the whole Bun team told us that they were not fuzzing anything. This appears to be an outright fabrication.

Fuzzilli integration: https://github.com/oven-sh/bun/pull/24826

Merged PRs fixing issues Fuzzilli found in Bun’s Zig code:

- https://github.com/oven-sh/bun/pull/28926

- https://github.com/oven-sh/bun/pull/28934

- https://github.com/oven-sh/bun/pull/29255

- https://github.com/oven-sh/bun/pull/29210

- https://github.com/oven-sh/bun/pull/29199

Searching “Fuzzilli” shows more PRs: https://github.com/search?q=repo%3Aoven-sh%2Fbun+is%3Apr+Fuz..."
0201
Andrew Lilley Brinker @alilleybrinker.com · 02/07/2026
Yes I do, a Breville barista express. It's a solid machine, though I separately weigh my beans per-drink, pre-start the grinder, and then pour them in to get more precise grinds.
A Breville Barista Express, with the portafilter in, pulling an espresso shot.
010
Andrew Lilley Brinker @alilleybrinker.com · 01/07/2026
Good morning from Microsoft Teams. Can I interest you in some tag mentions?
Menu from Microsoft Teams, where "Tag mentions" is listed twice.
020
Andrew Lilley Brinker @alilleybrinker.com · 28/06/2026
Brian David Gilbert won an invitational tournament of Pokémon Champions today, dressed in all gold, with Goldengho taking the final opponent out using Make It Rain.
BDG, sunglasses on indoors, dressed entirely in gold, immediately after his win.
0162
Andrew Lilley Brinker @alilleybrinker.com · 25/06/2026
SoftBank said “get in the car, we’re doing Goose Math”
Slide deck from the same presentation saying “market capitalization equals egg value plus goose value, and also equals JPY 74t plus alpha”
230
Andrew Lilley Brinker @alilleybrinker.com · 24/06/2026
Yeah it's basically this! Alternatively: "oh you own an iPhone, so you approve of child labor at rare earth mineral mines" or "you keep your money at a bank that also offered loans to a corporation that does <insert horrible thing>."
280
Andrew Lilley Brinker @alilleybrinker.com · 24/06/2026
I feel this in my bones
Quote from Charity's post:

"Some technologies are more damaging than others — knives are less damaging than guns, Facebook for colleges was less damaging than Facebook for Myanmar — but we always discover risks before we know how to govern them.2 There is always a gap while we try to catch up.

That gap is not proof that AI is evil. It is proof that we have work to do.

The fact that we have not solved the problems yet is not an argument to disconnect. It is an argument to engage, especially if you work in technology and already have an arsenal of relevant skills.

You do not learn to govern a tool by refusing to touch it. You learn by using it and understanding well enough to critique it, shape it, contribute to it, and set boundaries around it. You learn how to make it boring.

“Learn AI so you can complain about AI better.” I said it and I meant it. I still do."
0339
Andrew Lilley Brinker @alilleybrinker.com · 23/06/2026
Computers want to be cubes
Nintendo GameCubeNeXT's NeXTcubeValve's Steam Machine
1876
Andrew Lilley Brinker @alilleybrinker.com · 23/06/2026
CISA recently issued BOD 26-04, directing affected agencies to meet tighter remediation timelines for some vulnerabilities, with the most serious giving 3 days with a required forensic triage included. Source: www.cisa.gov/news-events/...
Table from the linked CISA article showing timelines for remediation based on whether a vulnerability is 1) publicly exposed, 2) in the Known Exploited Vulnerabilities (KEV) list, 3) automatable by an adversary, and offers total or partial control to an attacker. In some cases the remediation timeline is 3 days with a mandatory forensic triage.
130
Andrew Lilley Brinker @alilleybrinker.com · 06/06/2026
Huh, imagine that
"The outrage selected on a single tail event and narrativized it"
A Mastodon user noticed a regression in v3.4.3, saw Claude commits, and concluded causation. But v3.4.3 at 3.29 sev/10c is at the 77th percentile — elevated but not extreme. 8 historical releases scored higher. The correlation is noise.
1284
Andrew Lilley Brinker @alilleybrinker.com · 03/06/2026
*This* is exactly the kind of "legitimate target" garbage I find unconscionable. This was in a quote-post of me, which I've now detached. Harassment isn't justified by someone using an LLM.
"If you buy into vibe coding you shouldn't be given the same grace; like somebody who can't make straight rip cuts on a table saw."
191
Andrew Lilley Brinker @alilleybrinker.com · 03/06/2026
010
Andrew Lilley Brinker @alilleybrinker.com · 03/06/2026
110
Andrew Lilley Brinker @alilleybrinker.com · 02/06/2026
This write-up on levels of validation is *chef's kiss*
"Because iddqd is such a foundational data structure at Oxide, we go through great lengths to validate its correctness, including the soundness of its abstractions. There is a great deal of analytical reasoning performed by experienced Rust authors and reviewers, as described in the section above. But we also empirically validate iddqd along several different dimensions. None of the layers is sufficient by itself, but by rigorously doing all of them we can be more confident that iddqd is correct.

The layers of validation we apply are:

(The following is in a table)

Technique: Analytical; Catches: reasoning Soundness errors

Technique: Example-based tests (including doctests); Catches:  Regressions, broken examples

Technique: Pathological tests with Miri; Catches: Adversarial trait impls causing UB

Technique: Model-based tests (PBT with NaiveMap oracle); Catches: Divergence from oracle over random operation sequences

Technique: Panic safety fault injection; Catches: Invariant violations on mid-operation panics

LLM adversarial review; Catches: Blind spots in adversarial user code
230
Andrew Lilley Brinker @alilleybrinker.com · 01/06/2026
dril tweet: "drunk driving may kill a lot of people, but it also helps a lot of people get to work on time, so, it;s impossible to say if its bad or not,"
020
Andrew Lilley Brinker @alilleybrinker.com · 01/06/2026
The first paragraph of the conclusion ought to be at the top of the article IMO
"Depending on the context, different programs will have different priorities, and for some it’s the legitimately correct choice to prefer performance over minimizing risk of misbehavior, in which case turning asserts into optimization opportunities makes perfect sense." — Loris Cro
220