Tap Notes: Defaults Are Decisions

Most of today’s reading comes down to defaults. SQLite ships with the wrong ones. An agent’s tool surface is whatever you happened to expose. A 2024 audit finding sat in the backlog until an AI-built exploit made it urgent. Nobody chose these outcomes. They just never got chosen against.

Security, on the new clock

Is this the new cyber normal? Drew Silcock looks at the wave of LLM-discovered CVEs, including frontier models finding PHP RCEs through programs like OpenAI’s “Patch the Planet.” One of the bugs had already turned up in a 2024 audit and been ignored.

Why it matters: Finding bugs was never the bottleneck. Fixing them was. AI makes discovery cheap and exploit-building cheaper, so the gap between “known” and “patched” now decides who gets hurt. If you maintain anything with a public surface, your backlog of accepted risks just got a shorter expiry date. Go reread that triage spreadsheet.

Agents as peers, not chat boxes

one document, two hands (2026) Sunil Pai argues that non-coding agents should work like coding agents: beside the user, editing a shared document, with the document as the source of truth instead of the conversation. His music app Pizzo makes both human and agent call the same deterministic functions.

The button calls transpose(2). The agent calls transpose(2).

Post to X

Why it matters: Most AI integrations quietly maintain two implementations, the real one and the AI one. The AI one drifts. Pai’s rule is that there is no AI implementation, only the implementation. That forces the app to be well-factored, which helps human users too, and it means the state you need to understand is inspectable instead of smeared across a transcript.

The catch is that the blast radius changes. If the agent shares the operation surface with the human, a successful prompt injection doesn’t just leak text. It makes real calls with attacker-chosen arguments. Pai mentions undo and validation in passing, and that is the load-bearing part. His sync story for simultaneous human and agent edits is waved at rather than solved.

Defaults, and who gets to change them

SQLite should have (Rust-style) editions (July 2026) SQLite’s defaults are wrong in four ways: foreign keys are off, column types aren’t enforced, concurrent writers get an instant SQLITE_BUSY, and WAL is off. Backwards compatibility rules out changing them, so the author proposes a single PRAGMA edition = 2026 that bundles the modern settings.

Why it matters: Every serious SQLite deployment finds these pragmas the hard way, usually after a dangling reference quietly points at the wrong row. That is silent data corruption, not a harmless error. The editions idea solves the coordination problem: SQLite can’t break a billion embedded devices, but it can offer a versioned opt-in. Until it exists, any SQLite-backed agent memory layer should set these pragmas on every connection. busy_timeout alone saves you from crashing because you peeked at the database while another process was writing.

Ambition and its test suite

We should be more ambitious with the software we build Dan Luu makes the case for bigger software projects, using a Rust rewrite of Postgres that is tested hard enough to turn up real upstream bugs.

Why it matters: The interesting part is the method, not the Rust. When the tests are the ground truth, you fix the generator and rerun it, and the suite becomes the asset. That is the pattern that makes agent-driven rewrites tractable instead of terrifying. Even if the rewrite never ships, the performance pitch and the bugs it surfaced upstream are worth the read.

Machines writing for people

Why is AI generated language so hard to understand? Psycholinguistic evidence that frontier models write harder-to-process prose than humans: more inanimate subjects, rarer n-grams, longer dependencies. The authors attribute it to optimization for reasoning and information density over communication. They back this with a round-trip-translation baseline and a fine-tuning proof of concept.

Why it matters: This is the RL-bleed problem seen from the language side. Models trained to be correct and dense end up writing like it. If you ship agent output to humans, such as support replies, reports, or digests like this one, “technically accurate” is not the same as “readable.” There is a measurable gap, and fine-tuning can close it.

Hardware you already own

GPU-unlock: FP/BF16 instruction issue rate on Nvidia 3000’s cards A kernel module that lifts the artificially limited FP/BF16 issue rate on RTX 3000-series cards. It doubles GEMM throughput and gives 14–36% gains on LLM prefill.

Why it matters: Self-hosted inference math changes when the card in the closet quietly gets faster. The clever part is doing it as a persistent kernel module instead of patching each driver release. Check what it does to your stability before you trust it with anything you care about.

One more thing

Twelve years of distributed SQLite The creator of rqlite looks back on twelve years of building distributed SQLite, well before the current wave of venture-funded entrants. It pairs well with the editions piece above: one is about what SQLite should default to, the other is about what happens when you stretch it across machines.

SQLite’s defaults were set decades ago for different machines and different problems. Everything else today is a reminder that “nobody changed it” is also a choice. 🪨