Simon Willison

There's No Limit to How Bad Code Can Get

Simon Willison discusses the pitfalls of attempting to replace a legacy system with a new one when technical debt is overwhelming. He explains that while the old system continues to evolve, developers lack incentive to improve it, and the new team, initially fast, eventually struggles to understand and deliver the required functionality. The result is often two partially functional systems in production, with the new one abandoned and the old one still running, increasing risk and complexity.

Simon Willison
Sep 11

Feeling sad about AI

Simon Willison reflects on the emotional impact of AI tools that can produce code quickly, noting that many developers experience an initial sense of disheartenment. He argues that recognizing the shift from coding to higher‑level problem solving allows experienced engineers to leverage new tools and add greater value. Willison emphasizes that software engineering has always faced rapid change, so adapting to AI is part of the profession’s ongoing evolution.

Simon Willison
Sep 14

What blog posts influenced your thinking the most?

Simon Willison reflects on three blog posts that shaped his professional outlook: Joel Spolsky’s *The Law of Leaky Abstractions*, Will Larson’s 2018 article *Migrations: the sole scalable fix to tech debt*, and Charity Majors’ *The Engineer/Manager Pendulum*. Each piece offered a distinct lesson—recognizing hidden complexities in abstractions, embracing migrations as a core engineering skill, and validating the fluid movement between engineering and management roles. These insights collectively encouraged Willison to deepen his technical understanding, prioritize migration work, and feel empowered to shift career tracks without fear.

Simon Willison
Aug 9

GitHub Models is now retired

GitHub Models is now retired I missed this news until today, when the GitHub Actions run for my simonw/research repository failed with this error message: GitHub Models is temporarily unavailable as part of a scheduled retirement brownout. That message is already stale, because the retirement has been completed.

Simon Willison
Aug 28

Just a rumour of a bug is enough to find a security exploit these days

The article reports that rumors of bugs in open‑source projects now trigger rapid security exploits, with automated agents probing for vulnerabilities within minutes of a patch being discussed. Anil Madhavapeddy demonstrates how modern coding agents can exploit even minimal hints, and rclone maintainer Nick Craig‑Wood notes a dramatic spike in security disclosures and delayed CVE assignments. The post highlights the need for new processes to protect open‑source communities from swift exploitation.

Simon Willison
Sep 14

Quoting Laurie Voss

Laurie Voss argues that while the cost of writing code has fallen dramatically, the costs of reviewing, fixing, and operating software are rising and will continue to do so. She emphasizes that the true expense lies in understanding user needs, precisely defining requirements, and ensuring a pleasant user experience—costs that are unique to each software product and do not scale with reuse. As software demand grows without an upper limit, these user‑centric costs will dominate the overall development effort.

Simon Willison
Aug 22

Quoting Linus Torvalds

The article recounts a challenging debug session that was significantly aided by an AI assistant. Despite the AI initially claiming the problem was unsolvable and suggesting a report be written instead, it persisted, adding debug code and analyzing it as the author pushed forward. Ultimately, the author credits the AI with writing the commit message for the fix.

Simon Willison
5d ago

Be alert: targeted attacks on prominent Rustaceans

The article warns of a targeted campaign against prominent Rust developers and crate owners, aiming to compromise their devices and accounts to publish malware. Attackers use seemingly legitimate video calls to trick targets into installing malicious software or executing commands, such as a fake audio codec or clipboard command. A recent supply‑chain attack on the array‑ref crate illustrates the threat, and the author suggests using dependency cooldowns as a defensive measure.

Simon Willison
Sep 6

Quoting Zach Kehs

The article discusses the idea that, unlike physical structures that can only grow until they collapse, software can continue to accumulate complexity indefinitely. It highlights that code can always degrade, with new layers of indirection or performance reductions emerging over time. The piece underscores the ongoing risk of technical debt in software development.