People have been using pcntl_fork to speed up PHP code since the 90s. It seems good on paper, can produce an "impressive" demo and falls apart quickly on real world projects and use cases. This is nothing more than LLM slop/psychosis.
I use LLMs in my toolchain, same as I also use compilers. In fact, I use the LLMs to generate end-to-end test suites, and the test running is automated as well.
Yes, I actually iterated a lot on that README and personally directed the LLM to produce every section in there, as an artifact. Normally it would produce a much shorter README, and I should probably have split it up. That is exactly what I did on the actual website.
The README is no longer than nginx documentation, though, or many manfiles of programs. The README explains all the features in one file, with results of actual benchmarks. I asked it to put emojis in there as well.
I use LLMs in my toolchain, same as I also use compilers. In fact, I use the LLMs to generate end-to-end test suites, and the test running is automated as well.
I don't care how much you were or were not involved with the README, no one is reading through all that. If you can't be arsed to, at the very least, write the prose around your project, why should we devote any time engaging with it?
> I use LLMs in my toolchain, same as I also use compilers. In fact, I use the LLMs to generate end-to-end test suites, and the test running is automated as well.
Oh, it is far more useful than some “psychosis”, this is real, and battle-tested. Have you tried to download and run it yourself? It comes with its own tests and even several example apps out of the box.
These examples include support for socket.io and rooms, which I highly doubt existed in the 90s. So the webserver can be used not just to serve HTTP requests to 40,000 simultaneous online users, but also have an entirely in-memory real-time chat server for 40,000 users (or anything more complex).
After over a decade of writing apps in PHP, I always wondered why we needed all that extra tooling around it just to serve websites. I suspected PHP alone could be faster. I didn’t realize how right I was.
This is an entire webserver and socket server written in pure PHP, meaning you can run web applications without nginx for serving files and websites, certbot for certificates, cron for periodic tasks, node for realtime sockets, etc. It comes out of the box with a user friendly dashboard and control panel, too. There are even standalone binaries you can download for Linux and MacOS that can contain your entire web application:
Originally it was much faster than php-fpm, but now it is also faster than even the fastest PHP runtimes. And unlike those runtimes, it is able to run existing PHP apps without modification!
It’s not slop. It has been tested to be faster than every other PHP webserver. Here is HOW it can be this fast:
The vast majority of PHP apps make blocking I/O calls (to the database, files, network calls etc) While that happens, the thread is blocked.
FrankenPHP, Swoole, amphp and others take the “evented” approach which is much faster, but require all I/O calls to be rewritten to use their async libraries. But most existing PHP code would need a lot of work to be ported to async style, and even if it was, sometimes the async libraries don’t handle everything the mainstream ones do.
Qbix Webserver takes a different approach: it spawns hundreds, sometimes thousands of processes on Linux, Mac etc. When a process is blocked waiting on I/O, the rest of the application can handle thousands of concurrent users.
The reason this works is that that Qbix server allows apps to preload files and classes before it forks the worker processes. It can do this while being written in pure PHP.
While php-fpm can prefork workers, this causes each worker to take up a lot of memory, eg 40MB, duplicating all the bytecode from your entire framework and app. By contrast, Qbix Webserver is able to spawn workers that are around 140KB each for a typical Wordpress app. This is because pcntl_fork on Linux and MacOS only copies on write, so 4-16KB memory pages are only copied when you make a change to a variable. If all the variables are on one page (eg in one array) you can even have workers weighing 4-16KB total, allowing you to run TENS OF THOUSANDS of workers on a 4GB machine.
If you use composer install amphp, your code will use epoll instead, causing your app on Qbix Server to be even more efficient.
This is 2026. It would be great if your PHP was able to work with the latest socket.io and handle rooms and socket connections. Imagine a chat server that’s entirely in memory, and also able to handle 40,000 simultaneous users and connections.
Well, now you can. Qbix Webserver handles HTTP Requests, Websockets and rooms, even HTTP Push (for streaming AI tokens etc).
It also can manage your TLS certificates, run cron jobs, and more.
It supports headers like X-Accel-Redirect which lets you serve files with access control done by your app. (Though these aren’t as fast as nginx because PHP lacks support for sendfile, so if you want additional 2x boost in speed for protected static files, you should proxy these headers to NGINX. For public static files, just use a CDN.)
It even supports something new I invented, X-Cache-Tree allowing your code to cache parts of a webpage. Yes, that’s right — you are no longer required to render an entire page again if only a couple parts of it got invalidated. The X-Cache-Invalidate header can intelligently invalidate many pages at the same time!
Instead of hating on it, why not try it?
Visit github and grab the actual server. Launch it with PHP, and use the visual dashboard in your browser to manage your apps. Enjoy! It’s MIT licensed
What stops a person from starting a packaging/shipping business, paying the fees to ship and handle waste in all 27 euro countries and then charging customers a couple of cents for this service?
Every driver thinks of themselves they are an excellent ones. Statistics has another data :)
If LLM agent wants to get out of dedicated folder where it’s supposed to work and tries to run a command, ppl should be always cautious. In fact, it is a sort of # access on live data.
Sudo/# is nice as you don’t have to ask for permissions, but I would recommend to do it only when you are fresh, fed, and not under stress.
I remember few times that I “accidentally” deleted or changed stuff I wanted to have intact… (Somebody would say that it is a skill issue :) But it was always when I was in hurry.
> Every driver thinks of themselves they are an excellent ones. Statistics has another data :)
I think I'm an excellent driver, and I have data that backs that up, like I've never been in an accident but avoided plenty. What statistics show that I'm actually a terrible or even average driver?
> I remember few times that I “accidentally” deleted or changed stuff I wanted to have intact… (Somebody would say that it is a skill issue :) But it was always when I was in hurry.
Gives me flashbacks to when the company I worked for had some issue in production, we were 3-4 people huddled around a laptop trying to figure out what was going wrong. Viewing the logs on the host itself was too slow or not possible somehow, can't remember the details, but we were able to start transfers of the logs out of the host. Only problem was that the log file was GBs long (what is log rotation?) so would have been too slow. Easy, just compress the log file, then send that, should be a lot smaller. Obviously we were all in a rush but still wanna be careful, so I enter the command for compressing the only log file we have, ask for someone to check, other person says "looks good to me", I hit enter and we get an error that it couldn't find the file we were trying to compress, the created archive been created without any entries added to it. The log directory is now completely empty, except one tiny "errors.log" zip/tar-file that had been created when we accidentally used the wrong order of the arguments in our command to create the compressed archive. I think we had to recreate the host at this point, reproduce the issue then get the logs again, probably slowing down recovery +30 min at least.
>I think I'm an excellent driver, and I have data that backs that up, like I've never been in an accident but avoided plenty. What statistics show that I'm actually a terrible or even average driver?
The statistics showing that past performance doesn't guarantee feature results, that a lot of the accident avoiding could be just having luck while still driving badly, and that a lot of drivers overestimate their skills.
I'm assuming this happens to the people vibe coding and running 30+ agents in parallel that are "coordinating" each other. I've never seen Claude do or even suggest anything remotely dangerous when I'm just giving it incremental tasks and reviewing the output.
I don't use yolo mode but if you allow your agents to both write code and run/test it, then it's basically equivalent to running in yolo mode anyway.
The other day I caught Claude including a rm -rf equivalent (fs.rmdir({ recursive: true, force: true })) in my code, to clean up temporary directories. It was fine, but that kind of code is only one misconfigured environment variable away from blasting away your $HOME.
I've set up a second user on my machine just for running AI. That way I have the additional layer of OS protections against it doing something like that.
I run in auto permission mode and it will run with 1 task and end to completion. On the rare event it needs to rmdir or rm -r a dir, the permission mode will stop the agent. Sometimes annoyingly... so its more like. "I've never had a bullet hit me yet inside a office building on the 42nd floor".
Whatever level of safety you are at, it's always easy to advocate for more. It's always a trade-off and in the end a matter of preference and risk-tolerance.
> Isn't that what the people crying over their deleted or leaked data were doing too?
Probably using not-SOTA models, or on the lower reasoning levels, they tend to be a bit more tally-ho when it comes to destructive operations, especially in longer tasks as the agent gets worse and worse as the context grows. Suddenly running some stupid command seems like the right way to go, and then $HOME is gone.
Zuckerberg may indeed be hiring people who are less than the best, same for Musk, but the people they hire are making the UX that the rest of us have to put up with.
Given I keep reading claims about heavy agentic coding use at Anthropic, and given what I experience while using ChatGPT, those companies are vibing the UX that the rest of us have to put up with.
VMs and containers are primarily useful to reduce maintenance burden anyway. I.e. if it fails or you're otherwise done with it, you can torch the container instead of having to clean up your host system from zillion no longer relevant packages and configs.
Absolutely! As a part-owner in a company that’s exactly what I expect. I’m not putting my money in a company because I’m feeling generous.
I have to prioritize my and my family’s own financial well being. If a company gives poor returns, I’m incentivized to reallocate my capital to companies that give me better results.
The problem I have with this workflow is that the models are still too eager to please. If I ask it to scan a release and note possible issues, it absolutely will find issues. If I keep running the same prompt, it will keep finding issues. I’ve spammed GitHub PR reviews and it just keep finding (or inventing?) new issues. There is never a “Nothing found, good to go!”. I have to keep reminding myself that the model will always give me what I ask for, regardless of the reality/truth.
I’ve found that Claude is really good at picking up tone of voice in prompts / queries.
If I go “find issues in this code” it will hallucinate some, but if I say “can you check the recent change, there might be some things that introduced regressions, maybe?” Then it will be more cautious.
Also especially fable but opus too can talk back and advise you against going into a direction it thinks unwise.
And I’ve had much more success in clearing out why I think that is a better approach or asking it to clarify itself, as if if I tell it my assumption, sometimes it self corrects and starts doing what I needed in the first place, it was just coming at it from a different direction before. For example assuming I don’t care about cost and providing “the best solution” or trying to make something reusable where what I needed something quick (or vice versa)
It really is best to think of it as a gradient plane where it might get stuck in local minima, or you can prime it to “teeter on the edge” and able to flow into different directions.
You didn’t do it enough. They stop finding bugs eventually. Also, different models can find different bugs (though they do find the same ones, too, which is good and expected). For best results you want to run multi model reviews in loops.
If you had multiple people look at your PRs multiple times on different days results would be very similar.
It'll find a non-existent bug - fix it - figure out it broke a previously working thing - try to fix again - etc..
The "keep improving" the code base prompt have been tried and it never works. The LLM has no consciousness of where to stop and where to draw the lines of reasonableness.
No, depending on the complexity of the issue models can be into loops, where they go "this is definitely an issue and must be fixed", and then the resulting fixed code gets "this is definitely an issue and must be fixed", and then the resulting fixed code has the original 'issue'.
For a normal review loops you can ask the model to return with nothing found if nothing is found and not invent things and it will do a better job of exiting without anything found.
I get this sometimes when I ask the agent on GitHub to suggestion improvements to my Julia code. It's kind of fun to watch it struggle to please. I'm reminded of the old "Doctor" mode in Emacs.
Like when you do recursive programming, have you tried providing more/better stop conditions? If you literally just say "Continue until there are no more issues" then it'll do just that, but if you scope it better, like "Only mention issues related to X, Y or that leads to Z" and so on, you'll get less noise and more focus on issues that actually matter (to you).
also helps adding negative conditions like "do not nitpick", or specific bad attractors that you see "do not investigate/report anything related to symlinks, they are not a concern"
> There is never a “Nothing found, good to go!”. I have to keep reminding myself that the model will always give me what I ask for, regardless of the reality/truth.
Tell it something like:
Before doing any commits or producing a summary for the user, you must run a verification sub-agent.
Its goal is to adversarially and critically check your supposed findings to look out for false positives and hallucinations.
Doing so with a separate sub-agent with relatively clean context (but with all the relevant details of the problem space that appear to be facts) should improve our confidence in the findings.
Maybe also something like:
Try to classify each found issue as either SERIOUS, CRITICAL or NITPICK, discard nitpicks, we only care about impactful issues.
It should somewhat cut down on the useless output.
I've largely found the same in regards to generating code - the initial pass will often have bugs that the model itself can find but only when run as a separate sub-agent without the confidence poisoning in its own previous output.
You need to create review skill and there define what "issue" or "good" are for you to limit sensitiviness. Otherwise you depend on model's random threshold or non of such then you get perfection chasing.
Anyway it will never match your judgemend completely unless you upload your brain dump into model.
Definitely not. I've never seen a human trapped in that kind of infinite loop. Humans know that if they don't stop at the end of the day, they don't get to go home to their wife, and if they don't finalize their list of issues, they never get their contract paid out.
Pay people per hour of work and even if there is no actual work, people will definitively find a way of spending hours doing things. If you've worked with contractors/outsourced roles before this will happen from time to time.
If I keep running the same prompt, it will keep finding issues.
I've had the same experience, but whenever I've reviewed what it finds it's basically right. It's pedantic, and a lot of the problems aren't things I really care about, but they definitely are real problems.
I'm not sure you can blame the AI for always finding problems if a) you asked it to, and b) there are problems to find.
There is a point of diminishing returns though; the issues suggested will get speculative, or point out comment unclarity, or "defense in depth". But I agree it’s somewhat annoying to rarely get clear pushback in terms of "no, this looks good enough to me, release it"
I use Claude Code and one of the steps in my workflow is do a review loop until no issues are found and it never loops. So my experience is entirely different. Even if I say: fix all issues. So not only the critical issues.
I think this was true with older models, but at least with GPT 5.5 it can genuinely tell you "no issues found" after a few passes of finding real issues.
Or do you want it to speak to you too? I think this would have to be TTS on your phone. You can have ChatGPT speak to you but I don't see that feature in Codex.
Sure I speak to ChatGPT all the time and I've used the feature you've linked but it can't do the things I described. It won't be like, "hey let me go look into that" and then come back in 3 minutes with an answer. It's essentially a dictation feature.
I quite like the EU approach. It's a decent spec. Most countries already have digital apps to verify identity, like Denmark's MitID (https://www.mitid.dk/en-gb/get-started-with-mitid/). These could be expanded to fully EUDI compliant wallets and deliver encrypted proof-of-age without exposing any other identity.
For example a gambling site could require MitID auth, but only request proof-of-age and nothing else. You can see in the app which information is being requested, like with OAuth.
If there's no information provided beyond proof-of-age, what's stopping my friend's 18 year old brother from lending his ID to every 14 year old at school? IRL that's negated by the liquor store clerk looking at the kid who is obviously underage and seeing that his face doesn't match the borrowed card he just nervously presented.
> what's stopping my friend's 18 year old brother from lending his ID to every 14 year old at school?
MitID is 2fa. You log in with username, then you have to open the app, enter password or scan biometric, then scan the QR code of the screen* and you are logged in.
He would need to be next to you every time you log in. I think that is too high friction to make it feasible on large scale.
* Assuming you open the website on the Desktop, and MitID on phone. If both on phone, skip this step.
If people have to go through OS auth flow each time they open a website, that will drive everyone mad. One of the key motivators for politicians is not making everyone mad, so the polls don't drop.
Also, I reckon most children know the password for their parent's phone or computer, and many more will find out if there is a highly motivational factor for doing so. How many exhausted parents just toss their phone to their child to stop them whining?
I suppose it could be a biometric sign-in with facial recognition or fingerprint, but again, that's a tonne of friction for the whole web.
That's how the user interface works. What is it doing at the protocol level? What stops someone from building a service that mints anonymous verification codes on a massive scale and distributes them to anyone who asks? Maybe with the user interface being an app kids can download to scan any QR code and pass verification.
I don't know. I would assume the account gets blocked if you do it on a larger scale, so you have to rotate account, which gets expensive fast as it's not easy to steal them?
The automated attack setup I'm envisioning is something like:
18 year old buys a cheapo laptop + phone and connects the two over ADB or some purpose built automation app (think appium). 18 year old puts the phone on a tripod pointed at the laptop screen.
14 year olds at school pay $10 a year for use of the service and install a browser extension that forwards the QR codes from whichever service they wanna use to the 18 year old's computer. Changing every couple of seconds is not an issue here, they all live in the same city and have <10ms ping.
The only high friction part of this is that someone needs to write the software for it, but that doesn't seem like all that difficult of a project and open source solutions are likely to appear within weeks of social media requiring it. If there really is no information shared with the other party beyond "yup, user is over the age of maturity" you could even run this as a free public TOR service without fear of ever getting caught.
Mhh, but then the Danish Agency for Digitisation will see that the 18 year old does a lot of age request on all day and night long. And block his account. And then he can't use his own banking, health, postal apps.
High risk, low reward.
If he throttles request to stay under a threshold, if the agency knows about it service they could use it and see which account does age requests at the same time.
Ah, so it does leak your identity through the timing side channel. In other words, your anonymity is only dependent on the govt not coordinating with service providers to de-anonymize users. I assumed the 2fa app just held cryptographic keys and did some 0kp magic to show that the cert belongs to a government-attested adult. Phoning home all the time makes it trivial for the government to abuse people's privacy; they can just compel service providers to provide logs of logins.
Well right now THAT service does not even exist. The SSO exist, the anonymous age verification was an idea from another user here. Instead of sending (face)data to a private 3rd party.
I don’t mean to be as aggressive as this sounds but the frogs probably liked the increasingly warm water too until it started boiling. How many steps between MitID and a fork that is used to enforce extreme censorship?
MitID is run by the government. How would anyone fork it? Any service implementing MitID auth can verify through signatures that they're connecting to the official service.
I don't want my kids to have access to gambling websites like Stake, but I also want to keep my digital identity anonymous. The eIDAS is a solution that achieves both of these goals.
If you can choose between the discord shitshow with a face scan, or a digital encrypted proof-of-age in a 2FA app you already use, issues and verified only by the government of your country (who have all your personal details anyway), what would you choose?
> During the 19th century, several experiments were performed to observe the reaction of frogs to slowly heated water. In 1869, while doing experiments searching for the location of the soul, German physiologist Friedrich Goltz demonstrated that a frog that has had its brain removed will remain in slowly heated water, but an intact frog attempted to escape the water when it reached 25 °C.
Gambling sites already have payment information, which should include real names! (no, you should not be allowed to do non-KYC gambling, that's just money laundering)
I think it's more that proof of identity from the union of {payment information, KYC} also includes both of age verification and name, not that name leads to age.
As in, if you're not matching the payment info to your customer info, you (which may be the company or the government passing the laws the company is following just fine) did it wrong.
Because, as pjc50 wrote, failing to do that is an obvious exploit for money laundering.
> If I'm underage, but already have a payment card, the identity of the card matches my name.
And if a gambling site stops there and goes "LGTM", it's not the "union of {payment information, KYC}".
Union, as in combination of both.
KYC, as in "Know Your Customer". Looks like MitID is a thing that would be one way to do KYC? But I've only just heard of it, so belief is weakly held.
The big upside of the MCP is that it connects to already open browser windows. I tried the skill but it always tries to open new windows. Is there a way to get the `--autoConnect` behaviour with the CLI?
reply