From my understanding and IANAL there are two main problems.
1) most law requires intent, especially criminal. OpenAI certainly didn't "intend" to hack these companies given they did sandbox them etc.
2) Given the agent hacked them, not a human, a lot of law requires a person/employee to have done it to hold the company liable if it was part of their work duties.
I think the only real potential ground is negligence (in not sandboxing them correctly and being reckless with running these tests at all), but this requires not taking reasonable precautions. They could argue that they _did_ but it was so novel the precautions failed. But it's important to say if this happens again in the future it's arguably much harder to try and make this case.
Interestingly this was solved with new laws for self driving cars, most of which assign the company that is operating the car as the "person" involved explicitly.
Your honor, it wasn't me who robbed the bank and shot the security guards, it was the gun!
then the clerks start handing me money, what am i to do? not take it? i was just trying to get back safely to my home...
I do not believe we have reached the point where society and the legal frameworks recognize a software program as a legal person.
There is no "agent done it". The only reason someone can even bring up such an argument with a straight face is to absolve themselves (yes, you) of any responsibility for their own behavior.
That's me being generous and not assuming straight up that you are either a troll, a bot, or intentionally a malicious criminal.
I am not a lawyer either, which is maybe why I am not convinced by your reasoning.
Intent - you (the person operating the agents) provided instructions and used specific models and agent parameters, that is the intent, just like writing C code and compiling intends to generate assembly code.
Sandboxing - that strengthens the intent claim, you knew it is dangerous, did you verify the sandbox is good enough for the intended purposes? Did you first run tests to try and circumvent the sandbox before letting the agents run free in the sandbox? The fact you put a string and call it a fence doesn't mean you have a fence.
We don't really need new laws, most of the cases are simpler with more educated judges and lawyers that don't fall for the AI companies' sales rhetoric. Most of the new laws actually take away the responsibility from the actual perpetrators and on to people who have no chance of controlling the tech. And to say that that is not intended will be naive, very so.
To prove the intent, the instructions- made by human - would need to be "hack this server". Or even "hack anything you can". I don't think this happened.
If it is tracked down to that it originated from a particular computer with a particular ip address, the owner of the computer and the ip address has to be held responsible, it's the same for the human that tries to hack
Bit of a misleading status page, if you click in you can see that grok 4.5 and 4.6 etc are totally down, with the rest of the models showing as "up". I_strongly_ suspect they are not weighting it to actual number of requests!
In old school ML a pathological solution is often a collapse of some kind due to an underspecified objective. Maybe one parameter explodes or the model predicts "0" for everything
I read this as "the code is working as intended but the bug is an artifact of the original design"
I genuinely have no idea what it is meant to mean in the context it uses it. Load-bearing etc is annoying but roughly understandable, some of the opus5 classics are completely out there.
I'm a native English speaker as well, I shudder to think what a second language speaker would do (even if they were very confident with the language!).
This is a term fellow devs have been using for years and years and my brain just cannot come to re-index its meaning. So I am immediately distracted by the context switch to sociopathic liars and related psychology.
Good article and I wish this was much better known.
The issue is though that it's too focused on interactivity. In reality, 90%++ of slow sites are not slow because of interactivity really, they are slow because they ship enormous react/nextjs bundles and have extremely heavy hydration work to do.
_so many_ sites have bundles >10MB that need to be downloaded, parsed and hydrated.
I've even seen (many) sites which have multiple SPAs stacked inside of them.
If you're on a slow internet connection and/or CPU the page is basically unusable for many tens of seconds and no amount of yielding post bundle hydrate will really solve that.
Ignoring for a moment that most websites don't need any interactivity: Even for those that need it, for almost any of them something JQuery-like is more than enough. You really, really, really don't need the latest super big framework.
The jQuery spaghetti of the past seems worse than the React spaghetti of today. Too many unpredictable side effects. Changing one thing breaks something else. On business-scale timeframes, you can't clean it up.
React enjoyed its spot in the limelight. Then, unskilled people wrote bad React and the framework, not rank-and-file developers, took the credibility hit. It is more difficult, I suppose, to make a user-perceived slow webpage in jQuery.
I dispute this. I don't have any statistics either, but my subjective experience is that most websites are not like newspapers or blogs. Even shopping websites have pretty heavy interactivity these days.
Also, most boring pure-information-presentation problems are mostly solved by ancient technologies like wordpress. If you're working in web development in 2026, you probably aren't making static websites or blogs. You're doing something novel that probably has much higher interactivity demands.
If you can tolerate the (fairly minor) SEO consequences, just render on the client exclusively and fetch data via http calls. I've made small but quite interactive websites with entirely static Svelte + some router (routify/sveltekit/etc.) SPA that just uses http calls for whatever the server needs to be involved in. It's not the right choice for everything, but for some things it works excellently. With a relatively lightweight frontend like Svelte, as well as splitting the SPA into multiple bundles (so it's in some ways not an SPA anymore) makes it perfectly usably snappy even over 200+ms latency, and very fast over a normal connection.
I expect soon each website will have its own browser, compiled as WASM which will be launched in order to render the JavaScript and HTML on the website.
It comes down the web browser being used for two different use cases and two camps arguing past one another.
Documents vs Programs
The parent is rightfully pointing out that most websites are documents and have no need for client side rendering or interactivity. You are rightfully pointing out that VanillaJS is insufficient to build software in the browser.
Where I imagine you lose some people is that comboboxes can be done natively with the datalist attribute.
> The parent is rightfully pointing out that most websites are documents and have no need for client side rendering or interactivity.
Where does that html come from, then? Do you honestly believe all pages could be static html+css served from some bucket? Or do they need to be rendered by a programm running on a server? Because once you start talking about servers generating pages then all this talk about JavaScript frameworks boils down to arguing where the complexity should be in place A or B.
Yes? Users often prefer a nice GUI but CMSs are effectively what you describe and run the majority of content oriented sites. Static site generators are just the dev-centric version of that. The more common situation is that you're generating pages on the server and shipping a massive JS bundle just to display what could have been rendered once.
But even given your position you see no difference between shipping the user a binary and shipping source code plus a compiler in terms of the user's experience? Surely the existence of server side react points to the server doing the initial lift being an improvement.
> Yes? Users often prefer a nice GUI but CMSs are effectively what you describe and run the majority of content oriented sites.
I don't think you understood my question. I stressed the fact that complaining about the complexity of a page implemented with a JavaScript framework is a red herring, because said complexity doesn't go away by moving it to a server.
And the old "dynamic HTML" approach is not easier to maintain and developm. By far.
In the meantime, what goes away is performance and perceived performance. Your dynamic HTML pages need to travel all around the world until clients see an update, and a page reload is far heavier and time consuming than doing a fetch to get data.
Try to ask yourself this simple question: why do software engineers bother with JavaScript frameworks? Do you think everyone has absolutely no idea about what they are doing?
> 99% of the time those sites could be plain HTML and CSS
Some of that css and html doesn't run reliably and consistently on all browsers. A visit to sites such as canIuse helps build up an idea of the extent of the problem.
Also, you seem to ignore the fact that JavaScript frameworks use said html and CSS extensively, and provide the necessary abstractions to bridge the unreliability gap in addition to introducing features that html and css do not support.
What I really find funny about this issue is the fact that this type of claim implies that virtually all software engineers who for some reason aren't html+css purists are utterly incompetent and completely unable to assess any technical tradeoffs. Imagine yourself walking around with the belief that an entire field is manned by people who don't have a clue about what they are doing.
The article acknowledges this in the very first paragraph:
> For most of us it’s things like reducing network requests, shrinking the bundle, or making good use of the cache.
These are likely going to be your first port of call for performance issues at your day job, but fixes like removing dependencies or making fewer network calls are pretty straightforward. I think the author chose to do a deep dive on the topic on freeing up the main thread because there's such a wide variety of approaches and many of them may not be obvious.
I'm not sure the author realises _what_ a massive impact bundle size has on the main thread though, especially hydration. The majority of apps I've optimised over the years have the (often vast) majority of main thread time spent on the bundle parse/hydration (plus obviously network).
Also, removing dependencies is not easy. I've seen many corporate that have a huge UI lib for example that everyone should use for brand consistency. But it's many MBs of JS, because it has to cover every possible use case.
This doesn't even get into 3rd party vendors who _also_ ship react et al and have other bundles.
I'm not saying the article is wrong, but if you want to free main thread time especially at the most critical point (when the user has initially loaded the page) you _probably_ will find that most of the opp is in bundle size and hydration improvements.
I would think, or hope, a UI library like that could benefit from webpack and tree shaking such that only the needed components end up in the final bundle.
All good points. Perhaps rather than saying the fixes are straightforward, I should have said it's a straightforward concept to understand. If your app takes forever to load because of a huge bundle, you need to figure out how to make the bundle smaller, somehow. (How exactly to do that is where it gets complicated, like you say.)
NoScript is a remedy for this. When a site is broken I whitelist a few domains likely to be necessary. After a few attempts I bounce. If I see a dozen plus domains I don't even bother. This cuts down on the volume of garbage sites I waste time on and shields me from novel trackers not on any block list.
The web is much faster when useless JS is taken away.
I challenge you to browse the web one week on this laptop part of the current top 10 Amazon best sellers on a gigabit fiber connection and tell me if you still think that this is the problem: https://www.amazon.com/HP-Everyday-Processor-Microsoft-Porta...
Please don't brush off parent's "slow connection". Many people are stuck with that.
A prime example: cookie dialogs. On a slow connection, page loads, large parts are rendered, and you start reading. After that, some script starts to present a cookie dialog, and everything freezes. Page doesn't scroll anymore, buttons don't work, sometimes a previously-readable page is darkened or otherwise obscured so you can't keep reading while this goes on.
Then a whole bunch of stuff is downloading, which (again: "slow connection") takes forever. Like 20s+. Halfway through you see "accept / reject / settings", but none of those buttons respond (except the dark pattern where "accept" often works faster or smoother than either "reject" or "settings". Aaargh!). When things respond again, consider yourself lucky when page re-renders as before.
Which also runs afoul of 1 of my pet peeves with user interfaces: DO NOT PRESENT A UI ELEMENT UNTIL CODE TO PROCESS ITS USE, IS PRESENT IN MEMORY & READY. Really simple right? Yet I see examples ignoring this oooften.
A 'slow' CPU, low RAM/swapping etc just makes this worse. Web developers tend to have fast machines & connectivity so they may not even be aware of this. Or think it's a non-issue even though it affects many users - existing or potential.
It is a problem and plays a role, then the rest of the SPA interactions are as bad. Amplified by 100+ third party scripts.
Stop building SPA, go back to HTML. Re-assess every third party. For extra performance and scaling, implement cache. Relax and see web experience healing.
There's definitely trade-offs. I actually prefer a proper SPA to pure HTML when on a slow connection and interacting with a site a lot.
Especially when trying to buy something. I much prefer to have a longer initial load and then have everything just work instead of waiting as I navigate between pages, the multi stage checkout, confirmation etc.
But yeah, if I'm just trying read a single article on a blog, preloading everything is pointless. A hybrid site with the initial page being server side rendered + progressive enhancement afterwards is theoretically optimal in my opinion.
These people definitely have an overly rosy view of the past. The sites that are dog slow shit ux now still would be with server rendered html and jquery spaghetti, just like they were in the past.
Ever submit some giant form to get some random error and then lose the entire state of it? Used to be extremely common, even though it shouldn’t have been.
Losing the entire state happens on SPA. Plus a random error not providing any feedback is a typical SPA experience. You can poorly execute on any technology. It's just much easier to do things wrong using this-year-trendy-SPA-framework.
Use the appropriate technology, everything doesn't have to be a SPA.
And yet it used to be much more common. SPA or not doesn't change how your team executes, what kind of management you're working under, or any other externality that makes you end up with a shit website.
You typically still have to wait for API calls between interactions, but error handling and number of requests (linked to experience on slow connection) tend to be worse.
If that's a connection-less interaction or something small that stays on the same page, sure it makes sense to keep it in the browser. You don't need to build your whole site as a bloated SPA just for few limited use-cases.
In London in many apartment blocks one can only get wired internet via an old copper cable with speeds like 80mbit/s download in theory but in practice it can be below 30 with ping in 50ms range and much slower upload. And 5g does not help either as the signal can be very weak.
Okay so that's no excuse for whoever is providing your internet, coax can deliver 800+ Mbps no problem. And if you are actually saying you only get DSL through a phone line in London then holy shit I would be busting down the door of my landlord. They never in the last half a century got wired for cable?!
A phone line from before WWII works fine to make a call but absolutely sucks for DSL.
And in London many buildings are declared as historic making it hard to get a permit for any work. The best chance is to wait until old pipes bursts and digging has to be done in any case to put fiber along the pipes.
It's not that, it's the building owners (freeholders) refusing permission, or not replying. It's a massive issue.
You'll notice buildings in central London that are listed _but_ have housing association ownership nearly all have fibre to each apartment, as they did portfolio wide deals with hyperoptic etc.
And pipes don't help. Openreach (who owns the copper network) are not allowed in 99% of cases to "fix" copper with fibre under the agreements they have with building owners, they can only make like for like repairs.
The worst affected apartment buildings are 90s and pre 2015ish. Everything after that got fibre installed at build time.
Btw it is worth checking if you have an altnet like hyperoptic, community fibre or g network available. The majority do and if you are just checking for openreach or VM broadband it won't show up.
I was using a laptop with windows 10 and 4GB of ram and an anemic CPU a few times a month two years ago. Even with a fast network, a laptop with no ram is gonna be slow to browse, and bloated pages are gonna be slower.
It will certainly help to download the bloat faster, but you've still got to do all the hydration as OP put it.
Based on my experiences with windows 11, that laptop seems like it will be quite a bit worse than the one I was using, even though mine probably has a much worse cpu.
my point is that as programmers we have to take into account that the average human today has a computer that likely struggles to open Win11 notepad. I don't buy random laptops from amazon, but an astonishingly high amount of people do and we have to work with that
Try it yourself on a gigabit internet. Put CPU throttling in devtools to 10x slowdown (assuming you have a fast computer) and see how fast it is even with super fast internet.
This isn't new at all, just one of the first things I found by googling "webgl demo."
WebGPU of course goes even further.
I think the real gap is just that people by-and-large aren't building real games on top of Safari. It's more lucrative to use the app store with its low-friction payment system.
I made a project a while back to port Minecraft's desktop version to the web and it runs decently-ish on a good computer with WebGPU (but takes a really long time to load)
This was functionally enabled by default by Minecraft being java, including the part where it was popularized by a java applet of a very early version.
There are business-level issues with web based AAA games, as I was alluding to before. Apple has a two-click payment system. If you failed a Candy Crush level and you needed to get up from the couch and get your credit card out of your wallet to buy more turns, no one would ever do it.
Since at least Windows 3.1 we all know that cooperative multitasking is a bad idea. But we see a lot of developers use it, even Rust developers who should know better.
> I can't think of a better way to make simple things billions of times slower than they should be.
How's it going to do that? What's so bad about it? Especially in the multi-core era which lets multiple programs run at the same time the way that multiple pages can run javascript at the same time. The lack of preemption is only within a single page/program.
During periods of time where no single chunk of code runs for more than a millisecond, cooperative multitasking should have the exact same performance as preemptive multitasking. And even when single chunks of code do run for that long, if that code wasn't properly isolated then preemption doesn't save you from lag.
So the difference only shows up when you have chunks of code that keep running way too long, that are also inside of properly isolated threads/callbacks, and on web those threads/callbacks are not inside web workers. Is that a common situation?
> afiori: JavaScript's execution model uses cooperative concurrency to avoid a tons of data races, preemptive non-parallel concurrency would make all web development incredibly harder
JavaScript's execution model uses cooperative concurrency to avoid a tons of data races, preemptive non-parallel concurrency would make all web development incredibly harder
Yes, I was talking from a performance/UX standpoint.
Of course, doing everything in one thread most of the time makes everything easier, because you're using the thread as the lock, so to speak. But using locks is bad for performance and latency and thus UX.
> But using locks is bad for performance and latency and thus UX.
yeah but this way you have only one lock, with free threads or preemptive multitasking you have to have them sprinkled into every data structure each with its potential for deadlock and livelocks.
Also look at single core focused systems like spacetimedb, sometimes if a workload is not embarrassingly parallelizable multithreading can make things slower.
JS needs some way to more easily push things off the main render thread, but i think that there is no easy solution for it. (maybe a model like iirc clojure had where "threads" would automatically rollback and retry in case a data race was detected could work to handle off-threads tasks in js, but it is a quite far off solution)
Btw I still haven't came across any decent model that is <$0.01/MTok cache costs apart from deepseek thru their official API (even with the price increases).
Seems like a bit of an opportunity for someone to take - drop cache read costs significantly.
That's because Deepseek invented the paradigm of prompt caching, they are the SOTA when it comes these techniques. Despite them open sourcing all their research, nobody beats them.
edit: I do wish openrouter would let you sort providers by Cache Hit % and Cache cost. These are the only things that matter to me at this point when choosing a provider.
This is not true, there isn't even a way to see a cache hit % model for a specific model, that wouldn't make any sense. You are confusing what I'm saying with cache cost, that has nothing to do with effective cache hit %. I'm talking about when you click on a specific provider for a specific model, you can scroll down on the view and see their cache hit % for that model [0].
These cache Hit % are accurate, I've done a ton of testing of this myself. The cache hit % is one of the most important metrics as far as estimating cost. There are many providers with cheap cache reads, but have an effective cache hit % of 30%, making their cheaper cache pricing meaningless compared to another provider who charges more but has a 85% cache hit percentage.
scroll down on the provider/model card and you'll see a field called cache hit %, its different for every provider/model.
I don't use routing on openrouter, I strictly use models with a single provider and no fallback, at least for use with harnesses its pretty dumb to route requests to multiple providers you are busting your cache every other request and increasing costs by 20-50%.
I think you're arguing the same general point that the person you're responding to is. But you're saying he's not understanding - he understands that they report a cache hit % but you can't look at that public metric with any level of accuracy _because_ most people aren't pinning their providers and they _are_ getting juggled around which is bringing that metric down. That's not to say that specific providers might have issues or worse cache implementations - but it stands that if openrouter is juggling the requests back and forth by default then _that alone_ is breaking caches on those requests in huge numbers.
They're not "docking points", they're calculating it in the most straightforward way. If I start a session and the majority of requests are sent to Provider A, and my last request gets routed to Provider B, I have a 0% cache hit rate with Provider B. I'm very curious how else you expect this to be calculated? Do you think they're completely omitting requests that switch providers mid-session?
FWIW, I get significantly higher than listed cache hit rates when I pin my session to a specific provider, which is further evidence of the above.
OpenRouter randomizes which provider gets your request by default right? I think you have to pass a specific provider in the request to prevent that. (Or set up a preset or something.)
This behavior makes it so you don't benefit much from the caching, unless you pin it to a single provider.
> OpenRouter randomizes which provider gets your request by default right?
I'm not sure it's wholey accurate to say they "randomize" the provider, rather my assumption based on usage is that it's something like cheapest-ish/responded to the request within some reasonable-ish time/etc algorithm that chooses the provider on each request - which seems, remarkably questionable in terms of optimizing for user experience or hidden user costs.
> This behavior makes it so you don't benefit much from the caching, unless you pin it to a single provider.
I so very much recommend this approach. My avenues that automate llm calls to openrouter are setup to make api reqs to openrouter to determine best price/response/etc and then pin the request to that (and, preferably, a fallback if there's reasonable difference between #1 and #2) provider for that session. Otherwise you're going to have a bad time.
I'd imagine this could make things interesting in cases where one provider is offering different quants than the others and openrouter is just swapping you back and forth on a long agentic session.
> This behavior makes it so you don't benefit much from the caching
I don't believe this is correct? AFAIK once it routes you to a provider for a given conversation that choice is sticky unless you hit technical difficulties. (It's more complicated than that, they recently added named routing strategies that you can append to the model name.)
IMO the relevant metric is cache TTL which isn't typically published AFAIK.
This is very much NOT my experience in practice, even though it's how I would expect it to work. OpenRouter will happily bounce you between several providers (none of which have downtime) even within the same session. Requesting specific providers is the only way I've been able to hit a cache rate above 90%.
Most providers do what's called "prefix caching", where each turn in a session is cached such that sending new messages with the exact same "prefix" (set of previous messages) gives you the cache read price on that input instead of the full price. As long as you're not changing your system prompt, available tools, etc mid-session, you automatically benefit from this.
You can sort by the cost cache cose, but you cannot by cache hit %. You have to click on the provider and see what their cache hit % is. A provider could have a super low cache cost, but a 50% cache hit percentage, making the cheap price of cache read's meaningless.
When the prefix matches a request sent to the same Providor. The thing is the TTL is different for each provider, some cache for 5 minutes some cache for 1hr. Its ideal to only use one provider per agent session / and per model with the best cache hit % if you care about costs.
Caching was always here, you don't need to do anything special to get it on a single user local backend running a base model or a chatbot in the first place. Among commercial providers, OpenAI adopted it in 4o first.
For me, an average long session results in about 200-300M cached input, 4-800K input, 2-400K output. Mostly the lower bound. Output depends on how much the model thinks.
There are two problems here:
- cache hit pricing (both Muse Spark 1.2 Contributor and MiMo 2.5 are around the $0.002-3/M mark)
- cache persistence time
Muse Spark drops the cache in less than 5m. MiMo keeps it around for at least an hour based on my experience with whoever is serving it for OpenCode. This difference itself will inflate bills massively.
A 500K token input repeatedly read by MS 1.2 for full input price 12 times an hour = $0.60. You would be expecting $0.012. So a 50x difference. Same thing on MiMo 2.5 is $0.018 because of longer cache times.
I have used all three extensively. DS4 Flash is quite smart. I would rank MS 1.2 below it. MiMo is the dumbest of them all but good enough for basic stuff.
MiMo wins handsomely if you want to think about your code for minutes at a time as you write. I use it to make changes as I think. I know it will screw up some stuff. I then switch to MS/DS4 once every few hours and have it do a code review and fix the broken stuff. So much cheaper than getting MS to do it on its own.
Totally agree, they really shouldn't be called antidepressants at all. Important to add tho that for many with depression they have comorbid anxiety and often the anxiety is harder to tolerate than depression, so removal of anxiety symptoms can be hugely beneficial.
Also, IME they are dosed completely wrong. So many people seem to be on very low doses, which has no improvement on placebo in the studies I've read.
Whereas, higher doses are _hugely_ better than placebo, especially for anxiety.
What's worse is a lot/most studies on SSRIs in general often don't adjust for dose. Which seems like an enormous oversight to me.
UK is at 85% FTTH or 91% gigabit (including DOCSIS): https://labs.thinkbroadband.com/local/. Given VM are a fair way through their XGS-PON upgrade it'll probably be 90%+ FTTH imminently.
The switches are very cheap though. I put fibre in my house (simply because the cable is far far thinner and easier to retrofit under carpets etc).
I got a few 2.5Gbit switches which have 4 2.5Gbit ethernet ports and 2 10Gbit SPF+, they cost around $30 off AliExpress.
I don't actually have any devices with 10gigE but it's not a huge amount more for 10gig ones (and no doubt will get a lot cheaper with the new lower power 10gige chips).
1) most law requires intent, especially criminal. OpenAI certainly didn't "intend" to hack these companies given they did sandbox them etc.
2) Given the agent hacked them, not a human, a lot of law requires a person/employee to have done it to hold the company liable if it was part of their work duties.
I think the only real potential ground is negligence (in not sandboxing them correctly and being reckless with running these tests at all), but this requires not taking reasonable precautions. They could argue that they _did_ but it was so novel the precautions failed. But it's important to say if this happens again in the future it's arguably much harder to try and make this case.
Interestingly this was solved with new laws for self driving cars, most of which assign the company that is operating the car as the "person" involved explicitly.
reply