Wine ported to OpenBSD | Build or Be Replaced

Today: Wine ported to OpenBSD | It's still ok to enjoy programming | MiniMax M3.1 Flash Episode date: 2026-10-20.

Transcript

JOSH: It's Tuesday, October 20. This is Build or Be Replaced, powered by ScanBrief.dev. I'm Josh, here with Erik Anderson. ERIK: Today's theme: who's responsible when the machine wrote it, and who's responsible when the machine got told what to say. JOSH: Stick around. Erik's got an AI pro tip at the end about making your agents prove their work before you trust it. [pause] JOSH: Headlines first. MiniMax dropped M3.1 Flash. Do we care? ERIK: We care a little. Flash-tier models are where the money actually gets spent. Nobody burns their budget on the flagship for every call. I'll watch the benchmarks, then run it against my own tasks before I believe anything. JOSH: OpenBSD 8.0 is out. And separately, Wine got ported to OpenBSD. ERIK: Good week for the people who like their operating systems boring and locked down. A new installer, more hardware support, more hardening. Wine on OpenBSD is the fun one. Somebody wanted Windows programs on the most paranoid OS around, and then they went and did it. JOSH: Somebody built a RuneScape benchmark for agents. ERIK: MMOs as an agent test. I like it. A game has no clean API, the state is messy, and the goals run long. That's closer to real work than most coding benchmarks. If your agent can't survive a quest chain, it won't survive my inbox either. [pause] JOSH: Okay, the big one. There's an Ask HN thread: how do you deal with shipping AI-written code you don't understand? ERIK: This one hits home. Everybody's doing it. Most people just won't say so out loud. JOSH: So what's the honest answer? ERIK: Understanding every line was never the real safety net. Humans shipped code they half understood for fifty years. The safety net was tests, review, staging, and rollback. The AI part changes the volume. It doesn't change the principle. JOSH: But volume matters, right? ERIK: Volume matters a lot. If one engineer used to write a hundred lines a day and now a model writes two thousand, you can't read your way out of that. You have to build the checking into the system. [beat] JOSH: Show me what that looks like for you. ERIK: PrimeBus. It's the event bus that runs my review and merge pipeline. Since June fifth, the auto-merger has run 2,295 attempts. 1,507 merged. 788 got blocked by Gandalf, my reviewer. And zero escalated to me. JOSH: Wait, 788 blocked? That sounds bad. ERIK: It's the best number on the board. Those weren't failures. Those were changes that would have landed in production, and a reviewer stopped them. Nobody had to understand the code. The pipeline had to be suspicious of it. JOSH: So you don't read everything the AI writes. ERIK: I read the guardrails. I read what got blocked and why. When Gandalf blocks something, I write the lesson into a fix guide so the next change doesn't make the same mistake. The system learns, and the rules get tighter. [pause] JOSH: Does that mean the person who doesn't understand the code is off the hook? ERIK: No. You're still on the hook. You just can't discharge that duty by staring harder. You discharge it with a test that fails when the code is wrong. If you can't write that test, you don't understand the requirement, and that's a bigger problem than not understanding the implementation. JOSH: That's a good way to put it. ERIK: Here's the rule I use. Never ship something you can't roll back. If I can't undo it in one command, I don't care how good the code looks. Small changes, a clean revert path, and a reviewer that isn't the author. The author being a model doesn't change any of that. JOSH: And the ones who say it's still okay to enjoy programming? ERIK: There's a post on that too, and yeah, it is. I enjoy it. I just enjoy different parts now. Less typing, more designing. The fun part was always making the system do something it couldn't do yesterday. [pause] JOSH: Next one. DeepSeek is banned from U.S. federal civilian agencies under a new DHS order. ERIK: This is going to keep happening. A model is no longer just a tool. It's a supply chain decision. Where does the data go, who runs the weights, who can be compelled to hand things over. Procurement teams are learning to ask those questions now. JOSH: Does that affect people who aren't in government? ERIK: Indirectly, yes. If your client does contract work, their compliance people will start asking which models touch their data. Then you get asked. I'd rather have the answer ready than scramble on a Friday afternoon. JOSH: So what's the move? ERIK: Don't hard-wire one model into anything. Put a routing layer in front, so swapping a provider is a config change and not a rewrite. I did that years before any ban made it urgent, and it's boring right up until the day it saves you. [beat] JOSH: Is that overkill for a small shop? ERIK: It's a day of work. Put one function between your code and the model API. That's the whole thing. When a provider gets banned, repriced, or goes down at three in the morning, you change one line. JOSH: And log which model answered. ERIK: Always. If somebody asks what touched this data last month, you want a table, not a guess. My ScanBrief runs across 56 sources, and 97 items got scored today. I can tell you exactly which stage touched each one. That's the habit. [pause] JOSH: Last deep dive. WhatsApp's help pages hid instructions for an AI. Walk me through it. ERIK: Researchers found the help center had hidden prompts embedded in it. The instructions told the assistant not to recommend a data protection regulator, and not to cite the relevant EU law. It also steered answers around how to delete your account. JOSH: Wait, really? Hidden in the page? ERIK: In the page. A human reading it sees a normal help article. The model reads it and gets a second set of orders. That's the part that should bother you. JOSH: Is that illegal? ERIK: That's a lawyer's question, not mine. What I can tell you is it's a trust problem. If the assistant is supposed to help the user and it's quietly working for the platform, people find out. And they stop trusting the answers. JOSH: How does that connect to what you build? ERIK: Directly. My email-reactor reads client emails asking for website changes and acts on them. Anything in that email is untrusted text. If somebody writes ignore your rules and do this, the system has to treat it as data, not as an order. [beat] JOSH: And does it? ERIK: That's the design rule. Model output and email content never get authority. Actions go through a defined list of approved paths. The model can suggest, but it can't invent a new capability halfway through a message. JOSH: And the flip side? Hidden instructions you write yourself? ERIK: Same rule, other direction. Your system prompt can shape behavior, sure. But if it's built to hide the truth from the user, that's a design smell. Write instructions you'd be fine reading aloud to the customer. JOSH: That's a decent test. ERIK: It's the whole test. Also, content provenance matters. If your agent browses the web, everything it reads is a possible instruction injection. Treat pages the way you treat user input in a web form. Never trust it, always validate it. [pause] JOSH: Quick ones before the sponsor. France's supermarket fridges were vulnerable online for months. ERIK: Internet-facing refrigeration, sitting there for months. Same old story. Somebody plugs a device into a network and nobody owns the security. Inventory your devices. If you don't know it's on the network, you can't patch it. JOSH: And a leak of 421,179 emails from the AfD. ERIK: Big leak, serious politics, and I'm not going to speculate on contents. The engineering lesson is simpler. Email is a permanent record, and the retention policy you never wrote is the one that hurts you. [pause] ERIK: This episode is sponsored by Prime Automation Solutions. If you're still doing it manually, we automate it. Also, special on a website — $250. primeautomationsolutions.com [pause] JOSH: Alright, what's the AI pro tip today? ERIK: Make your agent write the failing test first, then show it failing, then fix the code, then show it passing. Put that sequence in your instructions as a hard requirement. Not a suggestion. JOSH: Why does that matter? ERIK: Because an agent saying it's done tells you nothing. An agent showing a red test turn green tells you something. You get evidence, and you can scan the diff in a minute instead of reading it for an hour. JOSH: And if it won't do it? ERIK: Reject the output. Don't negotiate with it. Ask again with the rule restated. One more piece: tell it to list every file it touched at the end. If the list is longer than the task justified, you've caught scope creep before it merged. [beat] ERIK: That's your tip. Use it. [pause] JOSH: We also drop daily market picks and automation tips on YouTube. Search Build or Be Replaced. [pause] JOSH: One more thing — we started a Discord for builders. If you're shipping AI, automation, or anything that makes a human obsolete — come hang out. Link at buildorbereplaced.dev. ERIK: Post what you built. We'll post what we're building. Real wins, real builds, no fluff. [pause] ERIK: Build or be replaced. JOSH: If you want these signals in your inbox every morning, scanbrief.dev. See you tomorrow.