Sign up

Simon Willison's Weblog

Not verified No WebSub updates Supports Webmention Not yet validated

Author
Simon Willison
Public lists
Featured
Fetched

Simon Willison's Weblog Supports Webmention

Quoting D. Richard Hipp

But once we got that and got this aviation grade testing in place, the number of bugs just dropped to a trickle. Now we still do have bugs but the aviation grade testing allows us to move fast, which is important because in this business you either move fast or you're disru...

Simon Willison's Weblog Supports Webmention

Quoting Jason Gorman

The hard part of computer programming isn't expressing what we want the machine to do in code. The hard part is turning human thinking -- with all its wooliness and ambiguity and contradictions -- into computational thinking that is logically precise and unambiguous, and th...

Simon Willison's Weblog Supports Webmention

Copyright Release for Contributions To SQLite

Copyright Release for Contributions To SQLite D. Richard Hipp called me out for spreading misinformation on Hacker News that SQLite refuses outside contributions: No, Simon, we don't "refuse". We are just very selective and there is a lot of paperwork involved to confirm th...

Simon Willison's Weblog Supports Webmention

Quoting Aaron Levie

Jevons paradox is coming to knowledge work. By making it far cheaper to take on any type of task that we can possibly imagine, we’re ultimately going to be doing far more. The vast majority of AI tokens in the future will be used on things we don't even do today as workers: they will be used on the software projects that wouldn't have been started, the contracts that wouldn't have been reviewed, the medical research that wouldn't have been discovered, and the marketing campaign that wouldn't have been launched otherwise.

Aaron Levie, Jevons Paradox for Knowledge Work

Tags: ai-ethics, careers, ai, llms, generative-ai, jevons-paradox

Simon Willison's Weblog Supports Webmention

simonw/actions-latest

simonw/actions-latest

Today in extremely niche projects, I got fed up of Claude Code creating GitHub Actions workflows for me that used stale actions: actions/setup-python@v4 when the latest is actions/setup-python@v6 for example.

I couldn't find a good single place listing those latest versions, so I had Claude Code for web (via my phone, I'm out on errands) build a Git scraper to publish those versions in one place:

https://simonw.github.io/actions-latest/versions.txt

Tell your coding agent of choice to fetch that any time it wants to write a new GitHub Actions workflows.

(I may well bake this into a Skill.)

Here's the first and second transcript I used to build this, shared using my claude-code-transcripts tool (which just gained a search feature.)

Tags: github, ai, github-actions, git-scraping, generative-ai, llms, coding-agents, claude-code

Simon Willison's Weblog Supports Webmention

Substack Network error = security content they don't allow to be sent

I just sent out the latest edition of the newsletter version of this blog. It's a long one! Turns out I wrote a lot of stuff in the past 10 days.

The newsletter is out two days later than I had planned because I kept running into an infuriating issue with Substack: it would refuse to save my content with a "Network error" and "Not saved" and I couldn't figure out why.

Screenshot of the Substack UI, with a Network error message on purple and a Not saved message higher up. The content in that editor includes an explanation of a SQL injection vulnerability.

So I asked ChatGPT to dig into it, which dug up this Hacker News post about the string /etc/hosts triggering an error.

And yeah, it turns out my newsletter included this post describing a SQL injection attack against ClickHouse and PostgreSQL which included the full exploit that was used.

Deleting that annotated example exploit allowed me to send the letter!

Tags: sql-injection, security, newsletter, substack

Simon Willison's Weblog Supports Webmention

Pluribus training data

In advocating for LLMs as useful and important technology despite how they're trained I'm beginning to feel a little bit like John Cena in Pluribus.

Pluribus spoiler (episode 6)
Given our druthers, would we choose to consume HDP? No. Throughout history, most cultures, though not all, have taken a dim view of anthropophagy. Honestly, we're not that keen on it ourselves. But we're left with little choice.

Tags: ai-ethics, generative-ai, tv, training-data, ai, llms

Simon Willison's Weblog Supports Webmention

Quoting Boris Cherny

A year ago, Claude struggled to generate bash commands without escaping issues. It worked for seconds or minutes at a time. We saw early signs that it may become broadly useful for coding one day.

Fast forward to today. In the last thirty days, I landed 259 PRs -- 497 commits, 40k lines added, 38k lines removed. Every single line was written by Claude Code + Opus 4.5.

Boris Cherny, creator of Claude Code

Tags: anthropic, claude, ai, claude-code, llms, coding-agents, ai-assisted-programming, generative-ai

Simon Willison's Weblog Supports Webmention

textarea.my on GitHub

textarea.my on GitHub Anton Medvedev built textarea.my, which he describes as: A minimalist text editor that lives entirely in your browser and stores everything in the URL hash. It's ~160 lines of HTML, CSS and JavaScript and it's worth reading the whole thing. I picked u...

Simon Willison's Weblog Supports Webmention

How uv got so fast

How uv got so fast Andrew Nesbitt provides an insightful teardown of why uv is so much faster than pip. It's not nearly as simple as just "they rewrote it in Rust" - uv gets to skip a huge amount of Python packaging history (which pip needs to implement for backwards compati...

Simon Willison's Weblog Supports Webmention

How Rob Pike got spammed with an AI slop "act of kindness"

Rob Pike (that Rob Pike) is furious. Here's a Bluesky link for if you have an account there and a link to it in my thread viewer if you don't. F you people. Raping the planet, spending trillions on toxic, unrecyclable equipment while blowing up society, yet taking the time ...

Simon Willison's Weblog Supports Webmention

A new way to extract detailed transcripts from Claude Code

I've released claude-code-transcripts, a new Python CLI tool for converting Claude Code transcripts to detailed HTML pages that provide a better interface for understanding what Claude Code has done than even Claude Code itself. The resulting transcripts are also designed to...

Simon Willison's Weblog Supports Webmention

uv-init-demos

uv-init-demos

uv has a useful uv init command for setting up new Python projects, but it comes with a bunch of different options like --app and --package and --lib and I wasn't sure how they differed.

So I created this GitHub repository which demonstrates all of those options, generated using this update-projects.sh script (thanks, Claude) which will run on a schedule via GitHub Actions to capture any changes made by future releases of uv.

Tags: projects, python, github-actions, git-scraping, uv

Simon Willison's Weblog Supports Webmention

Quoting Salvatore Sanfilippo

If this [MicroQuickJS] had been available in 2010, Redis scripting would have been JavaScript and not Lua. Lua was chosen based on the implementation requirements, not on the language ones... (small, fast, ANSI-C). I appreciate certain ideas in Lua, and people love it, but I was never able to like Lua, because it departs from a more Algol-like syntax and semantics without good reasons, for my taste. This creates friction for newcomers. I love friction when it opens new useful ideas and abstractions that are worth it, if you learn SmallTalk or FORTH and for some time you are lost, it's part of how the languages are different. But I think for Lua this is not true enough: it feels like it departs from what people know without good reasons.

Salvatore Sanfilippo, Hacker News comment on MicroQuickJS

Tags: salvatore-sanfilippo, lua, redis, javascript

Simon Willison's Weblog Supports Webmention

MicroQuickJS

MicroQuickJS New project from programming legend Fabrice Bellard, of ffmpeg and QEMU and QuickJS and so much more fame: MicroQuickJS (aka. MQuickJS) is a Javascript engine targetted at embedded systems. It compiles and runs Javascript programs with as low as 10 kB of RAM. T...

Simon Willison's Weblog Supports Webmention

Cooking with Claude

I've been having an absurd amount of fun recently using LLMs for cooking. I started out using them for basic recipes, but as I've grown more confident in their culinary abilities I've leaned into them for more advanced tasks. Today I tried something new: having Claude vibe-c...

Simon Willison's Weblog Supports Webmention

Using Claude in Chrome to navigate out the Cloudflare dashboard

I just had my first success using a browser agent - in this case the Claude in Chrome extension - to solve an actual problem. A while ago I set things up so anything served from the https://static.simonwillison.net/static/cors/ directory of my S3 bucket would have open Acces...

Simon Willison's Weblog Supports Webmention

Quoting Shriram Krishnamurthi

Every time you are inclined to use the word “teach”, replace it with “learn”. That is, instead of saying, “I teach”, say “They learn”. It’s very easy to determine what you teach; you can just fill slides with text and claim to have taught. Shift your focus to determining how you know whether they learned what you claim to have taught (or indeed anything at all!). That is much harder, but that is also the real objective of any educator.

Shriram Krishnamurthi, Pedagogy Recommendations

Tags: teaching

Simon Willison's Weblog Supports Webmention

Quoting Andrej Karpathy

In 2025, Reinforcement Learning from Verifiable Rewards (RLVR) emerged as the de facto new major stage to add to this mix. By training LLMs against automatically verifiable rewards across a number of environments (e.g. think math/code puzzles), the LLMs spontaneously develop strategies that look like "reasoning" to humans - they learn to break down problem solving into intermediate calculations and they learn a number of problem solving strategies for going back and forth to figure things out (see DeepSeek R1 paper for examples).

Andrej Karpathy, 2025 LLM Year in Review

Tags: andrej-karpathy, llm, generative-ai, llm-reasoning, definitions, ai, llms, deepseek

Simon Willison's Weblog Supports Webmention

Sam Rose explains how LLMs work with a visual essay

Sam Rose explains how LLMs work with a visual essay

Sam Rose is one of my favorite authors of explorable interactive explanations - here's his previous collection.

Sam joined ngrok in September as a developer educator. Here's his first big visual explainer for them, ostensibly about how prompt caching works but it quickly expands to cover tokenization, embeddings, and the basics of the transformer architecture.

The result is one of the clearest and most accessible introductions to LLM internals I've seen anywhere.

Animation. Starts in tokens mode with an array of 75, 305, 24, 887 - clicking embeddings animates those into a 2D array showing each one to be composed of three floating point numbers.

Tags: ai, explorables, generative-ai, llms, sam-rose, tokenization

Simon Willison's Weblog Supports Webmention

Introducing GPT-5.2-Codex

Introducing GPT-5.2-Codex The latest in OpenAI's Codex family of models (not the same thing as their Codex CLI or Codex Cloud coding agent tools). GPT‑5.2-Codex is a version of GPT‑5.2⁠ further optimized for agentic coding in Codex, including improvements on long-horizon wo...

Simon Willison's Weblog Supports Webmention

Agent Skills

Agent Skills Anthropic have turned their skills mechanism into an "open standard", which I guess means it lives in an independent agentskills/agentskills GitHub repository now? I wouldn't be surprised to see this end up in the AAIF, recently the new home of the MCP specifica...

Simon Willison's Weblog Supports Webmention

Your job is to deliver code you have proven to work

In all of the debates about the value of AI-assistance in software development there's one depressing anecdote that I keep on seeing: the junior engineer, empowered by some class of LLM tool, who deposits giant, untested PRs on their coworkers - or open source maintainers - ...

Simon Willison's Weblog Supports Webmention

swift-justhtml

swift-justhtml

First there was Emil Stenström's JustHTML in Python, then my justjshtml in JavaScript, then Anil Madhavapeddy's html5rw in OCaml, and now Kyle Howells has built a vibespiled dependency-free HTML5 parser for Swift using the same coding agent tricks against the html5lib-tests test suite.

Kyle ran some benchmarks to compare the different implementations:

  • Rust (html5ever) total parse time: 303 ms
  • Swift total parse time: 1313 ms
  • JavaScript total parse time: 1035 ms
  • Python total parse time: 4189 ms

Tags: html5, ai, generative-ai, llms, ai-assisted-programming, vibe-coding, swift

Simon Willison's Weblog Supports Webmention

Your job is to deliver code you have proven to work

In all of the debates about the value of AI-assistance in software development there's one depressing anecdote that I keep on seeing: the junior engineer, empowered by some class of LLM tool, who deposits giant, untested PRs on their coworkers - or open source maintainers - ...

Simon Willison's Weblog Supports Webmention

Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain

Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain Mehmet Ince describes a very elegant chain of attacks against the PostHog analytics platform, combining several different vulnerabilities (now all reported and fi...

Simon Willison's Weblog Supports Webmention

AoAH Day 15: Porting a complete HTML5 parser and browser test suite

AoAH Day 15: Porting a complete HTML5 parser and browser test suite Anil Madhavapeddy is running an Advent of Agentic Humps this year, building a new useful OCaml library every day for most of December. Inspired by Emil Stenström's JustHTML and my own coding agent port of th...

Simon Willison's Weblog Supports Webmention

Gemini 3 Flash

It continues to be a busy December, if not quite as busy as last year. Today's big news is Gemini 3 Flash, the latest in Google's "Flash" line of faster and less expensive models. Google are emphasizing the comparison between the new Flash and their previous generation's top...

Simon Willison's Weblog Supports Webmention

firefox parser/html/java/README.txt

firefox parser/html/java/README.txt TIL that the HTML5 Parser used by Firefox is maintained as Java code (commit history here) and converted to C++ using a custom translation script. You can see that in action by checking out the ~8GB Firefox repository and running: cd parse...

Simon Willison's Weblog Supports Webmention

The new ChatGPT Images is here

The new ChatGPT Images is here OpenAI shipped an update to their ChatGPT Images feature - the feature that gained them 100 million new users in a week when they first launched it back in March, but has since been eclipsed by Google's Nano Banana and then further by Nana Bana...