#490 It’s a vibe coding party

**Topics covered in this episode:** - Some more things about Django I've been enjoying - **Who cleans up after the vibe-coding party?** - **Where Did All Your AI Tokens Go? AgentsView to the rescue!** - **Careful with phishing all** - **Extras** - **Joke** Watch on YouTube **About the show** Sponsored by us! Support our work through: - Our courses at Talk Python - Consulting from Six Feet Up **Connect with the hosts** - Michael: Mastodon / BlueSky / X / LinkedIn - Calvin: Mastodon / BlueSky / X / LinkedIn - Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually **Tuesday at 7am PT**. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. **Calvin #1: Some more things about Django I've been enjoying** - **Julia Evans** is learning "2010-style" web dev (Django + SQL + server-rendered HTML) after years of Go backends and JS-heavy frontends - **Query builders**: likes defining custom QuerySet classes with chainable filter methods (`.approved().future().with_tags()`) — more readable than raw SQL - **Template filters**: highlights `urlize`, `linebreaksbr`, `json_script`, and especially `querystring` for building/modifying query-string links in templates - **Migrations**: still loves Django's auto-generated migrations — 19 and counting on her project - **Skips inheritance** for class-based views; prefers function-based views for sharing code, though fine using Django's own mixins/interfaces - **Performance surprise**: CPU profiling (via `py-spy`) — not slow DB queries — revealed the culprit; she'd accidentally disabled the cached template loader, and re-enabling it took throughput from ~2-3 req/s to ~12 req/s on a $10/mo VM **Michael #2: Who cleans up after the vibe-coding party?** FT Magazine piece by Sam Learner (July 11) on AI coding tools overwhelming open source maintainers - sent in by listener Dylan McConnell, whose main point was that this ran in the *Financial Times*, not a dev blog. - **cURL as the case study** - Daniel Stenberg has been the only full-time person on it for years; libcurl has been installed an estimated 20+ billion times with 3,000+ listed contributors. - **Bug bounty killed** - cURL ended its paid security bounty program in January, citing an "explosion of AI slop reports" that take real time to debunk and drain morale. - **Extractive contributions** - authoring a PR is now nearly free, reviewing one still costs a human; tldraw's Steve Ruiz closed outside contributions entirely, asking why he'd want someone else writing the easy part. - **Guido weighs in** - van Rossum says projects are holding emergency meetings over the slop flow, and notes LLM patches tend to touch unrelated parts of a file, making review more tedious. - **"Vibe Coding Kills Open Source"** - paper from Miklós Koren's group: packages frequently recommended by coding models saw big download jumps with no matching engagement, breaking the reputation loop that sustains maintainers. - **Stack Overflow flatlined** - over 100,000 questions a month before ChatGPT, under 1,500 last month, with the response rate cut roughly in half; the public archive is now stale training data. - **The course-creator angle** - Josh Comeau's newest web dev course launched at about a third of prior enrollment, and he worries about devs who never learn which questions to ask. But **the most interesting portion is what was omitted**. - Focused on: The end of the curl bug-bounty - Omitted: High-Quality Chaos **Why the omission is interesting** - It fits a narrative. The FT piece is a maintenance-and-decline story, and January-Stenberg is a perfect witness for it. April-Stenberg complicates it - same person, same project, better data, opposite direction on the specific claim being used. - The tell is already in the article. Learner quotes Stenberg saying AI tools are much better at finding problems than fixing them. That's the April thesis in one line, and it goes undeveloped. - Reason for the shift is process, not vibes. Killing the bounty removed the cash incentive and the venue change filtered the rest. Worth saying out loud, because "AI reports got better" isn't quite it - "no bounty plus a real triage platform" is closer. Joke too: Sarah O’Connor wrote a related piece (is this just before skynet launches?) **Calvin #3: Where Did All Your AI Tokens Go? AgentsView to the rescue!** - Local-first desktop/web app for browsing, searching, and analyzing your past AI coding agent sessions (Claude Code, Codex, Copilot, Cursor, Gemini, Aider, and dozens more) - Auto-discovers session files on your machine — no config needed; everything stored locally in SQLite, no cloud/accounts - `agentsview usage` is a drop-in `ccusage` alternative — reads from pre-indexed SQLite, reports run 80–220× faster on large histories - New **Activity** dashboard shows peak concurrency, active vs. idle time, agent-minutes, and cost — filterable by project/agent/machine, with a `-json` CLI report too - Full-text + optional semantic search across every session; also imports Claude.ai/ChatGPT chat exports - Install via `pip install agentsview`, `uvx agentsview`, `brew install --cask agentsview`, or download desktop binaries from GitHub Releases **Michael #4: Careful with phishing all** **The situation** I pass this along because it was a pretty sneaky bit of targeted phishing, and happened to play off an old interaction in bandit's repo. As usual with phishing scams there are a bunch of tells that this isn't legitimate, but just enough plausibility that I could see falling for it in a weak moment. Relative nobodies like me haven't historically been worth the effort to hit with scams this specific. Agents change the game though :-/. Be careful out there folks! **Original message** From: "Patrick (Blacktrace)" \[HTML\_REMOVED] To: LISTENER EMAIL Subject: Your Bandit #1350 (B105 NextToken false positive) -- just fixed that exact case Date: Wednesday, July 15, 2026 12:02 AM Hi AJ, Saw your Bandit issue #1350 -- the B105 hardcoded-password false positive on the string NextToken. I build a deterministic gate that filters that class of Bandit noise, and #1350 was literally the case I just fixed: NextToken / next\_token / page\_token / nextPageToken now stay quiet, while a genuine hardcoded token like api\_token="sk-live-..." still fires. Verified against your exact case. 30-second paste: https://blacktrace.co/noise-eraser Where it still trips, published: https://blacktrace.co/kruc Curious whether it clears what you hit -- and if it trips on something of yours, that's the more useful reply. - Patrick, Blacktrace * * * I asked Claude for some analysis too. It was pretty good at finding them. The message name-drops enough real detail to feel legit, but the structure is pure phishing - everything in it exists to get AJ onto blacktrace.co. The strongest ones: - **Freemail sender, corporate signoff.** Signs as "Patrick, Blacktrace" but sends from [emailpjv@gmail.com](mailto:emailpjv@gmail.com). Real company outreach comes from the company domain, not a personal Gmail - and there's no last name. - **Over-specific targeting.** It mirrors AJ's exact public activity - issue #1350, the B105 rule, the NextToken false positive, even the token variants. That's the "just enough plausibility" AJ flagged, and it's exactly what agents make cheap: scrape a GitHub issue, auto-generate tailored bait. Legit cold outreach rarely reads your history back to you this precisely. - **The entire payload is two links.** Strip the technical flattery and the message is just "paste here" plus "see results here." When the whole point of an email is the click, that's the tell. - **"30-second paste."** Low-friction urgency, and "paste" most likely means paste your source into their tool - handing your code to a stranger's site. Exfiltration dressed as convenience. - **Brand-new, no-reputation domain.** blacktrace.co has no track record, and the name is doing some ominous work. The `/kruc` slug is random noise, not how real product pages get named. - **Precise-sounding jargon that's actually vague.** "Deterministic gate," "noise-eraser" - impressive, empty. Bolted onto correct real details (B105 is the Bandit hardcoded-password test, `sk-live-` is a Stripe live-key prefix) to borrow credibility. - **The disarming close.** "if it trips on something of yours, that's the more useful reply" - engineered humility that flatters your expertise and baits a response. Makes engaging feel like you're doing *them* a favor, which drops your guard. **Extras** Calvin: - DjangoCon US 2026 is rapidly approaching, **August 24-28, Chicago** - **Ruff v0.16.0 massively expands its default rule set** - Ruff now enables 413 rules by default, up from 59 - https://astral.sh/blog/ruff-v0.16.0 Michael: - Completely redesigned the home page. - Try /insights in Claude Code (terminal) **Joke:** We’re Safe