Karpathy coined it this month and the industry immediately confessed by adoption: “vibe coding,” describing what you want in natural language, accepting what the model writes, iterating by feel, “forgetting the code even exists,” and the term’s instant ubiquity is the two-year review’s missing data point arriving as slang: a meaningful fraction of new software is now being written by people supervising rather than typing, and the file’s dual ledger opens accordingly: the democratization is real (our marketing team shipped an internal tool last sprint; the feature-flag wonder of 2013 is now available to anyone who can describe a spreadsheet), and the engineering ledger is exactly the curriculum bet’s terrain, the gap between “it runs” and “it’s sound” (security, edge cases, maintenance) is invisible precisely to those newest to it, and the review-first pedagogy just became the industry’s general problem (the file pre-registers the sequel: 2025-26’s incident reports will grow a “vibe-coded and unreviewed” category, and the orgs that built judgment infrastructure will grade the difference, the ladder question, now economy-wide).
Anthropic shipped Claude 3.7 Sonnet Monday (the first “hybrid reasoning” release, extended thinking as a togglable budget rather than a separate model, the two-axis doctrine collapsing into one dial, plus a coding-agent harness that the sequence-reliability file will be grading all spring), with GPT-4.5’s launch reportedly tomorrow (the counter-programming calendar never rests); and the crypto file logged the largest theft in history almost as routine: Bybit, $1.5 billion in ETH, February 21st, Lazarus again (the franchise, compounding), via compromise of the multisig signing interface (the signers approved what they saw; what they saw wasn’t the transaction, the Atlassian-deletion lineage arriving at the wallet layer: the UI is part of the cryptographic trust chain, and it was the unaudited part). The proof-of-reserves era’s grim maturation: the exchange survived (reserves real, withdrawals honored, industry bridge loans within hours, the lessons genuinely learned), and the state-actor treasury-heist economy now funds itself at nine figures per incident against interfaces, not protocols (the forged-sword file: the sword was in the signing screen this time).
The fortnight’s quiet governance ledger: the TikTok suspension holds in its legal twilight (enforcement waived, buyers circling, the law upheld-but-dormant, the file’s strangest open docket), Meta’s Community-Notes transition began US rollout, and our own portfolio committee added its first formal “model-provenance” criterion (training-data jurisdiction and weight-custody questions now sit in procurement alongside SOC 2, the weights-as-border-artifact doctrine, arrived at the purchasing layer; the dependency-tiering RFC’s AI appendix writes itself).
(Football, graded from the eve entry: Madrid took the City tie 6-3 on aggregate, Mbappé’s hat-trick in the return leg settling it inside an hour — the contract-engineering file notes the signing repricing itself in real time, and the group chat’s Madrid contingent achieved new insufferability records, exactly as feared.)
TIL: multisig UI attack surfaces. Blind-signing mitigations (hardware-display verification of full transaction payloads, not hashes; the “what you sign is what executes” gap as the custody frontier). Twelve years of this archive’s security files reduce to one migrating sentence: the vulnerability is always in the layer everyone assumed someone else audited (the cert, the logger, the maintainer, the channel file, the signing screen, the sentence never changes; only the layer does).