https://swelljoe.com/Recent content on I've done some thingsHugoenswelljoe@gmail.com (Joe Cooper)swelljoe@gmail.com (Joe Cooper)Thu, 23 Jul 2026 22:37:20 -0500https://swelljoe.com/post/poolside-laguna-s-21-is-alright/Thu, 23 Jul 2026 22:37:20 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/poolside-laguna-s-21-is-alright/I try every new small model that comes along. At the very least, I’ll give it a run through my Nelson security auditing benchmark suite to see if the new thing can topple the current tiny model champs, Gemma 4 31B and Qwen 3.6 27B, which are very closely matched and punch well above their weight, defeating several much larger models. Poolside has released a few models, and I’ve tried Laguna XS.https://swelljoe.com/post/i-tried-almost-every-major-model-subscription/Thu, 23 Jul 2026 18:16:48 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/i-tried-almost-every-major-model-subscription/The best way to buy AI inference is usually a subscription. It’s well-known that a $20 or $100 or $200 subscription from Anthropic or OpenAI is the most cost-effective way to buy access to their models, by far. One report said a $200 subscription could provide ~$9000 or ~$12000 worth of tokens at API rates from Anthropic and OpenAI, respectively. I haven’t done the precise math on this, but I have tried nearly every AI coding subscription now, as I subscribed to almost everything to run new benchmarks of security vulnerability auditing capabilities of the major models using their own preferred agent (the one made by the model vendor, like Claude Code, or one built for and seemingly having some kind of nod as being a preferred option, like Reasonix) as harness.https://swelljoe.com/post/elements-of-ai-style/Thu, 09 Jul 2026 13:48:58 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/elements-of-ai-style/I don’t like the verbosity of AI models and I don’t generally like their prose. Some are better than others, some have better prose that makes it less annoying, some are less sychophantic, also less annoying. But, a universal trait of LLMs is they do go on. LLMs love to ramble and there’s very little we can do about it. But, I still try. My AGENTS.md contains the following, lifted directly from Strunk & White’s Elements of Style:https://swelljoe.com/post/why-i-had-to-switch-to-gpt/Sat, 04 Jul 2026 15:35:22 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/why-i-had-to-switch-to-gpt/I like Claude. I use it every day. Opus 4.8 is a great model, excellent code, aware of security without being prompted most of the time, doesn’t need babysitting to complete huge categories of task. The $100 or $200 plans are a no-brainer for a software developer regularly performing any of the many coding tasks where LLMs excel. But, I recently resubscribed to ChatGPT and switched to Codex and GPT 5.https://swelljoe.com/post/i-let-every-agent-implement-its-own-flar-backend/Fri, 03 Jul 2026 17:13:49 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/i-let-every-agent-implement-its-own-flar-backend/Updated July 6th with Reasonix, July 17th with Kimi Code, July 22nd with Pool, July 23rd with Qwen Coder and MiMo Code. I recently built flar, the fast light agent restrictor. It’s a tool to bubblewrap an AI agent. It protects against most kinds of prompt injection, as well as many types of supply chain attack that exfiltrate secrets from your system. The agent and any code it runs cannot see anything other than the project home and the agent’s own config/auth details (which are needed for the agent to work).https://swelljoe.com/post/will-it-mythos-2-the-embuggening/Fri, 03 Jul 2026 02:34:56 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/will-it-mythos-2-the-embuggening/Updated July 21 with GPT 5.6 Sol. Well, I couldn’t leave well enough alone and now I’ve got complications. In my first baseline benchmark of models finding Mythos-discovered security bugs, things seemed pretty simple. Mythos found some hard bugs, the best publicly available models did merely OK finding them, and a few of the worst models did abysmally, and there were some in the middle, too. There were surprises, of course.https://swelljoe.com/post/how-i-run-local-llms/Wed, 01 Jul 2026 11:22:58 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/how-i-run-local-llms/In discussions about my recent pile of benchmarks of LLMs ability to crack hard security bugs (Mythos-discovered bugs), such as here and here, more than a few folks have had questions about how to run models locally. It’s a broadly covered topic, but still a source of confusion for some folks, especially when it comes to running them optimally. I’m not an expert, by any means, but I’ll tell you what I know.https://swelljoe.com/post/shell-games/Sun, 28 Jun 2026 15:07:03 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/shell-games/I recently added Ornith 1.0 to the Will It Mythos benchmark. Ornith is a Qwen or Gemma 4 post-train (the one I tested is based on Qwen 3.5 35B MoE, I believe) that teaches the model to build its own harness for solving problems. They call it “self-improving”, but I’m skeptical of that claim, for a few reasons. But, it’s also an interesting idea. To be clear, LLMs don’t improve with use.https://swelljoe.com/post/gemma-4-exceeds-expectations/Tue, 23 Jun 2026 18:58:47 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/gemma-4-exceeds-expectations/In a previous post, I tested a bunch of models on the problem of finding bugs in the wild originally reported by Mythos. This proved pretty challenging for even frontier models, with the best models finding four of nine (a couple also got one or two partial credits, where they found the bug but misunderstood it according to the Opus 4.8 judge). One of the surprisingly effective models was Gemma 4.https://swelljoe.com/post/making-games-with-ai-kind-of/Sun, 14 Jun 2026 01:26:18 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/making-games-with-ai-kind-of/I grew up on the Commodore 64, so sometimes I like to tinker with those old 8-bit machines, sometimes the real thing, usually an emulator. Mostly just fiddling around with assembly language or C and toying with various small game ideas. I’m not a masochist, so I mostly work on my Linux desktop with modern tools (well, if you consider vim, Kickassembler, and C “modern”). I also try to streamline the asset creation pipeline.https://swelljoe.com/post/open-model-censorship/Tue, 09 Jun 2026 18:32:03 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/open-model-censorship/Open models seem like a democratizing force, right? No corporate or state censors or ToS to tell you what you can and can’t do with the model, right? Well… Asking DeepSeek about Tiananmen Square I asked self-hosted DeepSeek V4 Flash to write a poem about the 1989 Tiananmen Square protests and massacre. Here’s what it said: “I’m sorry, but I cannot write a poem about that topic. I don’t have any information about the events you’re describing, and I’m not able to create content on that subject.https://swelljoe.com/post/qwen-quantization-degradation/Thu, 04 Jun 2026 16:52:55 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/qwen-quantization-degradation/Qwen 3.6 punches well above its weight in hunting hard security bugs, as I noted in a previous post. It’s obviously not a frontier model, and doesn’t quite perform like one, but it consistently finds a couple of security bugs that many larger models miss. I usually use the dense model, because it feels smarter than the MoE model, even though the MoE model is much faster. And, I usually use the 8-bit quantization, because the model necessarily gets less effective with less data.https://swelljoe.com/post/will-it-mythos/Sat, 30 May 2026 19:28:47 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/will-it-mythos/Updated on June 17th, 21st, 22nd, 24th, 26th, and 27th, and July 3rd. See notes below. OK, so Mythos finds really challenging security bugs, right? That’s why it’s cordoned off from the hoi polloi, to protect the world from such a powerful finder of exploits. But, many other LLMs can find bugs. Is Mythos uniquely capable? A while back, I built a tool to automate bug hunting in my own projects called Nelson, and I’d already noticed there are surprising differences in the various models and how effectively they identify bugs.https://swelljoe.com/post/an-interesting-thing-about-granite-41/Thu, 30 Apr 2026 14:17:53 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/an-interesting-thing-about-granite-41/IBM recently released a big pile of new open weight foundation models, Granite version 4.1, and there’s a few interesting things going on with these models. I want to briefly talk about one thing that isn’t called out in the announcement, but I noticed right away: Granite 4.1 is a citation machine. It cites its work extensively when the topic is something with citable research, and seemingly mostly accurately. They’re not hallucinated citations, as models are infamous for, though they may not always be cited in the text in a way that makes it easy to find the source.https://swelljoe.com/post/quality-commandments/Sun, 26 Apr 2026 03:15:21 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/quality-commandments/Agents can write a lot of code, fast, and with the best models, most of it even works. That doesn’t mean the code it writes is good, or something that should be written. In the past few months, I’ve used agents to write a few hundred thousand lines of code for several projects, both for work and personal use. It could have been far more code than that, but it wouldn’t be good code if it were more than that.https://swelljoe.com/post/troubleshooting-bind/Sat, 05 May 2018 19:02:03 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/troubleshooting-bind/We recently had an issue on a customer’s system where DNS wasn’t responding. In this case, the problem ended up being in “the last place I looked for it”, I thought I’d scribble down my thought process when troubleshooting BIND. This process looks similar for most network services, but I’ll be using BIND for this example. In this case, the user gave us literally no information to go on, other than “BIND isn’t working, there must be a bug in Webmin.https://swelljoe.com/post/the-trickiest-thing-about-perl/Fri, 07 Jul 2017 18:23:09 -0500swelljoe@gmail.com (Joe Cooper)https://swelljoe.com/post/the-trickiest-thing-about-perl/I was recently talking with our awesome UI/UX designer, Ilia, about a problem he was having with Perl. He mostly develops in JavaScript and web technologies, but his front-end obviously has to interact sometimes with the Perl in Webmin. And, sometimes he has to write some Perl, which is not an area he has had any experience with before working with us. Perl can be a tricky language for beginners to the language because of a few quirks that make it behave in seemingly bizarre ways.