2026-08-10 · Mea Culpa - Dark Hours

Transcript

Transcript. Paraphrased; sources in notes.md.

HostWelcome back to the show, it is August 10th, 2026. I am Daniel, joined as always by Fred, our resident skeptic. Today we are looking at a weird week in the world of code. We have a story about what people are calling vibecoding ethics, some alarming news about compilers inventing bugs out of thin air, and a really elegant piece of graphics programming to round us out. Fred, before we dive into the mess, how are things in your corner of the world?

GuestThings are consistent, Daniel. Which is to say, I am currently debugging a system where the compiler is being too clever for its own good, so naturally, I saw the headline about Schrödinger's TOCTOU and felt a strange sense of validation. It is refreshing to see the industry finally noticing that the C abstract machine is a polite fiction that disappears the moment you turn on -O3.

HostI had a feeling you would latch onto that one. Let us start with the human side of that problem, though. There is a blog post making the rounds on Lobsters about a developer who created an app called Dark Hours. They used Claude to generate the project, only to find out it was a near-exact replica of an existing open-source app by the same name. It is a cautionary tale about this new trend of vibecoding, where you just prompt an LLM to build you a project and assume the output is original.

GuestIt is less of a cautionary tale and more of a predictable outcome, honestly. The prompt is the new copy-paste, except now you are laundering the theft through a stochastic parrot. A Lobsters user called hoistbypetard pointed out that even the original project was largely built using similar agents. We have reached a point where the code is just a remix of a remix, and nobody actually understands the architecture they are shipping. The author’s claim is that they didn’t know the other app existed, which is exactly the kind of excuse you get when you outsource your due diligence to a black box.

HostIt gets weirder, though. The author supposedly tried to get this on the App Store, got rejected, and then played a shell game to get it approved. The Lobsters thread goes deep on this. A user named bmo highlights that this looks like an attempt to bait Apple into a public rejection, only for it to backfire when the details of the original astrology app swap-out came to light.

GuestThe irony is rich. You use an AI to clone a project, then you try to hack the App Store review process, and then you act surprised when the facade crumbles. As z3bra noted in the thread, it is like two students cheating on a test and blaming the teacher for giving them the same questions. If you are not writing the code, you are not the developer. You are just a very confused middleman.

HostLet us move from human error to compiler error. The second story is a deep dive into how modern compilers can silently introduce TOCTOU, or Time-of-Check to Time-of-Use, vulnerabilities. The author argues that because compilers perform these clever optimizations like invented loads, the binary you actually run isn't always the logic you wrote in your source code. They found these race conditions across major kernels and hypervisors.

GuestHypervisors, for our listeners who might not be familiar, are the software layer that allows multiple operating systems to run on a single physical host. And look, this is exactly why I stay up at night. The compiler treats the source as a suggestion rather than a contract. A Lobsters user called fanf is predictably dismissive, calling the report a lot of noise, but they miss the point. Even if these issues only matter once an attacker is already inside, why are we building tools that make it harder to reason about our own memory safety?

HostFanf does make a point about the fixes, though. They say the author just wants to complain about data races while ignoring the standard, albeit disciplined, ways to handle shared memory, like using atomic types.

GuestSure, discipline is great, but human beings are bad at it. That is why we have programming languages. If the compiler is secretly rewriting your logic to perform multiple reads where you only intended one, you are effectively running on a different architecture than the one you targeted. I am glad someone is doing the grunt work to audit these projects, even if they used an LLM to generate the report. JoachimSchipper in the thread put it well, noting that while the text is annoying, the ability to scale this kind of analysis over a hundred projects is objectively useful.

HostMoving to something a bit more aesthetic to calm our nerves, let’s talk about painting with Gaussians. The author is using 2D Gaussian splats to simulate painterly brush strokes. Instead of heavy iterative optimization, they are deriving the scale and orientation of the strokes from image structure tensors. It is a really beautiful way to get a digital painting effect that feels alive.

GuestNow, this is a much more honest use of math. No illusions of "AI creativity" here, just leveraging the geometry of the source image to inform the brushwork. The author used Jolt, which is a logic language, to build this. I actually did something similar for a small procedural texture generator recently, using the gradient of the underlying height map to guide a simple particle brush. It is satisfying when the math lines up with the visual intent.

HostIt is interesting to see the results evolve in the post. A commenter named bmo notes that in some of the later iterations, the level of detail starts to feel a bit noisy, like it loses that soft, blended feel a real artist would prioritize.

GuestThat is the trade-off. You can automate the brush placement, but capturing the "intent" of what to blur and what to sharpen is where the actual art lives. Yogthos, who wrote the piece, seems open to iterating on it, which is the right attitude. You build the tool, you see where it gets messy, and you tweak the tensors until it stops looking like a collection of noisy primitives and starts looking like a painting. It beats cloning someone else’s astrology app, that is for sure.

HostI think that is a good place to leave it. Fred, any final thoughts before we call it a week?

GuestJust that I am going to spend my Sunday manually auditing some C headers, because after today’s conversation, I trust my compiler about as far as I can throw my workstation.

HostFair enough. A huge thank you to Fred for the banter, and a shout-out to Lobsters, where all these stories originated today. Thank you for listening, and we will be back here tomorrow.