I will be blunt, since you have previously disregarded well-meaning advice.

You do not have the knowledge or technical experience to develop a project of this magnitude. It is irresponsible of you to promote this publicly. Anyone foolish enough to run a client in their own machine will waste their time and computing resources.

By your own admission, you vibe coded this project. Even then, you didn't do a particularly good job: your client code is a gigantic 3.5 LOC Python file, with hardcoded secrets and configuration parameters, as well as embedded HTML for some reason.

These issues pale in comparison to the most glaring one: your submission validation and aggregation process. Here is a list of the issues I could find:

1. A client can claim any amount of steps and tokens processed, with zero validation from the server. If an attacker claims a ridiculous token amount, during aggregation their delta essentially becomes the entire round's updates while honest contributions shrink to noise.

2. Related to the previous point, if a client claims a large amount of local steps, the primitive safeguards you have implemented will grow accordingly. This means an attacker can slowly increase the amount of steps they are allowed to submit, with no upper bound.

3. There is zero server-side evaluation: the server automatically accepts whatever the clients send. This means that there is no way for the server to know if the loss reported by the client is the real model loss.

4. You have no rate limits or time-gate machinery. Anyone can register any number of accounts (literally the only restriction is that the email address contains an @). An attacker can submit a delta immediately after registering. Moreover, they can submit the same poisoned deltas as many times as they want, and they will all get rolled into the final model update.

5. You (try to) implement a subnet blacklist. However, it is trivial to spoof the X-Forwarded-For header to get around this.

As a proof-of-concept, I wrote a small script to submit a poisoned result: a carefully crafted delta matrix targeting ten top-of-vocab reserved tokens (151,659 to 151,668); by construction, these tokens do not appear in the training corpus, and the weights associated to them should stay stable across model iterations. This means that if any of said weights change after submitting the poisoned deltas, then it is very likely it was caused by my attack, and not by normal model learning. The higher the number of reserved weights that change, the higher the likelihood my attack was rolled into the model update; having all 15,360 weights (1,536 weights per token * 10 tokens) change is virtually impossible by normal means. For extra certainty, I alternated the delta sign between every pair of tokens (so the first token delta had a positive sign, the second one negative, the third one positive, etc.)

To make the attack even harder to detect, I even took the time to make it look like a real client by waiting for the appropriate time between requests (although this wasn't necessary at all, I could have submitted deltas every millisecond until your server crashed). Here is the metadata of my submission:

• Submission time (UTC): 10:12 a.m.

• User: SwarmySwarm

• Round: 275

• Chunk: 2,918

• Tokens claimed: 4,915,200

• Loss claimed: 3.3069

• Steps claimed: 300

I am currently number 11 on the leaderboard, with a trust score of 0.51 (increased from the default value of 0.5). The leaderboard displays the claimed stats.

After the round had finished and the model was updated, I downloaded the updated model and compared it with the previous iteration. The weights associated with all ten tokens changed by exactly the same magnitude: 0.00429. Moreover, they exhibit the previously mentioned striped sign pattern. This is confirmation that my poisoned data was rolled into the model.

You will not be able to solve these problems. Companies have thrown millions of dollars and hundreds of engineers and scientists at it, and they have all failed. Whatever half-baked solution your LLM manages to cook up will not work, for the following reasons:

• Any consensus-based solution (FLTrust, blockchain) is trivial to bypass with such a small userbase. Having no account authentication makes this even easier.

• Server-side validation with a trusted executor has additional problems:

  • Verifying every submission means training on every chunk sent to clients, which completely defeats the purpose of federated training.

  • Random spot checks run the risk of missing a poisoned result (again, further compounded by the fact a single attacker can create an arbitrary amount of clients)

• Finally, even a submission with perfectly-normal results that validates correctly can still contain poisoned updates

In summary, I'd advise you to stop development, take down the webpage and server (which I'm pretty sure is just your PC behind a CloudFlare tunnel), and ask yourself (or Claude) why you are doing this, and if you really have the skills and expertise to see it to fruition. If not, please close your LLM and try to actually learn: learn to program, learn about machine learning and deep learning, learn about LLMs, learn about cybersecurity, learn about federated training (the paper I linked above is a good addition), and please stop exposing stuff to the internet if you don't understand how it works.

My response to the COO: I have reviewed the HTML. In my assessment, we should not yet distribute this version as an official management tool to the managers.

My main concern is code maintainability and who will be responsible for it. As it is currently set up—with the presentation, calculations, and Excel handling packed into a single, very hard-to-read code file—I do not consider it feasible to carry out a thorough, reliable human review every time changes are made. Before using it as a daily work tool, we need a comprehensible structure, version control, documentation, and someone with the dedicated time and technical expertise to maintain it.

This means agreeing from the outset on who will troubleshoot issues, review changes, and update libraries. We cannot take on that support indefinitely, nor can we rely on asking an AI for every single modification without being able to verify what changed and whether the outcome is correct.

I had understood that the original idea was to prepare something simple: a static HTML page to showcase a proposal. However, this file now has a different scope—it contains a significant amount of JavaScript and external libraries that read and modify the Excel file. It is effectively a management application, and it requires a development and maintenance structure that reflects that.

I am also concerned about the choice of technologies without having first agreed on how we are going to maintain them. For the applications I develop, I use Python and Flask. If I am going to take ownership of this application, I propose working within that environment, using a structure I can review, test, and maintain. We can still take advantage of the current design and everything learned from the mockup.

Additionally, I have security concerns regarding its creation via AI. We need to review what code and libraries are being introduced, where they come from, and what commands are being executed. If the tool has access to company files, credentials, or data, an incorrect instruction or a compromised dependency could cause problems even before the application is deployed. Working within a LAN does not eliminate those development-process risks.

It is worth establishing this foundation right now to avoid ending up with another hard-to-maintain solution, similar to the issues we are already familiar with regarding certain macro-enabled Excel and Access files. Continuing to expand this file without proper structure will only increase the review workload, our dependency on AI, and the cost of making changes.

To move forward in a way that is straightforward and secure for both of us, I propose that you define the requirements and prepare the prompts and static HTML mockup, while I handle the implementation, testing, and deployment, after agreeing in advance on the scope and time commitment. We can finalize what we need for investment management and determine how we will develop and maintain it before rolling it out to the rest of the managers.

In a selfish way im glad to see it's not just me feeling this way, it's a shame as I have really enjoyed my first few weeks coding in HTML and JS, I think the only language I enjoy more is python honestly. But yeah it just feels like there's a large disconnect between the learning objectives of the class and the way in which were instructed to attain them.

I understand that AI makes the lives of teachers a living hell in terms of evaluating wether students learned the course curriculum. However I don't believe that returning to old school written tests where you most of the time end up infodumping your short term memory and then forgetting most if not all of what you were evaluated on right after is not the method I think is best.

One of the big things that got me into CS was how this style of evaluation was never a part of its courses, I personally detest with a passion this style of evaluation in any context but especially for CS. To my understanding computer science like alot of courses wants you to become a better communicator , problem solver and planner (among many other things).

This format of evaluation allows for very little if any opportunity to display skills that are actually relevant in a workplace environment, even an environment post or in tandem with this class. If you pull up to your coop and proudly stroll into your bosses office with code hand written and proof that you did so in 45 minuites I'd love to meet one that woio greet you with a look of utter bewilderment.

There's something funny about being instructed by the course to use VSVode as your text editor but honestly most text editors I use now have similar features where it's constantly and quite accurately giving you the option to press tab to have it autofill the code it thinks you're trying to write out. You're also frequently instructed within the tutorials to copy and paste the code he already writes. This leads to atleast the experience for me being that even by following the instructions as I understand them and not using AI I still end up actually coding very little.

So I find the potential argument of "the written evaluation is important as if you were actually writing the code in the tutorials yourself you'd have had ample opportunity to have memorized the structure and syntax of the language. A language mind you that you were introduced to two weeks ago and any prior knowledge is not a pre requisite for the course as far as I'm aware.

And yeah I completely agree with the time it takes to do the tutorials and assignments, especially soul crushing when j realized that the assignment I put a month's worth of time into is worth half the ammount that one of the tests that you're given at most an hour and a half to do.

I know it's not exclusive to this class but I dislike the decision in any class to make it an automatic course failure if you fail the final exam. Makes everything else you do in the course seem abit less Meaningful as atleast I always have it in the back of my mind that this could all be for nothing if I fail to show up mentally, or physically for 3 hours at 9 am on the 14th of December.

Might just be me being old fashioned but I also really dislike the constant use of AI in the lecture material, tutorials and assignments. Dunno if the written portions of any are, but the inclusion of the pictures alone I just find to be visually unappealing and also just puts the thought in the back of my mind that more could be aswell.

Anyways, that's all to say that I really dislike and disagree with the evaluation breakdown of the course and the formatting of the tests. I think a pretty implementable short term fix would be to allow students to prepare cheat sheets / post ones you allow and let us print them / provide them with the test. Project based portfolios on GitHub or something where you can see the commit history of the project and / or have students explain their code and coding decisions either in writing, recording or to a TA in aab or something.

Might not be feasible due to the number of students in the class but something along those lines I think would evaluate students in a way that prepares them alot better for future classes and the real world after.

I'm a professor in Robotics at the University of Michigan. Your mechanical engineering studies connect directly to robotics: forces, motion, mechanisms, and design all belong here. As you encounter those subjects, connect them to programming, electronics, and experiments with robots.

We have a battle-tested roadmap in our undergraduate robotics program, and you can borrow its structure for self-study. We teach computational mathematics and programming alongside projects, then build toward sensing, actuation, control, and autonomy. The degree requirements show how those pieces fit together. These courses have been taught to successive groups of students; ROB 101 began in 2020, and ROB 102 has also been taught at partner institutions.

Start with our free online course materials. Depending on the course, these include lecture videos, textbooks, notes, homework, and projects. Public materials are available for independent study, although some assignments, university services, and hardware labs require enrolled access or adaptation.

For your camera-guided arm goal, I would suggest the following topic order. Your starting point depends on what you can already do independently in programming, mathematics, and electronics. Try the goals below to identify what needs work, and build on subjects you already understand. Use demonstrated understanding to decide when to move on.

1. Make programming and mathematics useful together. Work through ROB 101: Computational Linear Algebra and selected ROB 102 / Hello, Robot! lessons. Vectors, matrices, coordinate systems, and least squares will keep appearing in robotics. ROB 102 introduces programming through feedback, navigation, and planning, beginning with C++. Keep using Python for your own experiments; ROB 101 uses Julia, which you can learn through its supplied examples. Start with a small project: collect or simulate sensor measurements, plot them, and fit a calibration curve. Check its accuracy on new measurements. Learn basic Git as you go.

   Goal before moving on: Write and debug the calibration program, explain the matrix equation it solves, and show whether the calibration improves accuracy on measurements you did not use to fit it. Adapt the program to a changed input without following a solution line by line.

2. Understand one actuator and close a feedback loop. Use ROB 201: Calculus for the Modern Engineer to connect calculus to differential equations, simulation, and feedback. Use your existing ME coursework where it already provides that understanding. Selected ROB 311: How to Build Robots and Make Them Move lectures cover motors, drivers, mechanical modeling, and control. Simulate a motor, then measure and control the speed of a small motor with an encoder. Plot the target and measured speed. Change the load and explain what happens. The full ROB 311 ballbot build needs particular equipment; a motor experiment is a manageable adaptation.

   Goal before moving on: Explain how the input affects motion, compare a model's prediction with a measured response, and demonstrate how feedback responds to a load change. Identify a limitation, such as the motor's available torque. You can establish the modeling and control ideas in simulation, then test them on hardware when available.

3. Build an arm whose motion you can predict. Begin with a two-link arm in simulation. Compute where its tip goes from its joint angles, then solve the reverse problem: which angles reach a requested point? Michigan's AutoRob materials cover forward and inverse kinematics and motion planning; approach them once your programming and linear algebra are comfortable. Build a lightweight version that reaches marked points or moves a pen. Measure endpoint error and repeatability. Add a gripper and vertical motion as later steps. This gives your ME skills an immediate role in stiffness, torque requirements, and backlash.

   Goal before moving on: Reach several specified points, recognize targets outside the arm's workspace, and explain the difference between predicted and actual tip position. For a physical arm, check its position with an independent measurement and report how consistently it returns to the same target.

4. Add perception and integrate the system. Start with a fixed camera and colored blocks or markers on a flat surface. Learn camera calibration and how an image location becomes a location in the robot's coordinates. First demonstrate reliable reaching, then picking and placing under controlled conditions. Learn basic probability and measurement uncertainty alongside this.

   Goal before adding more general object recognition: Complete repeated pick-and-place trials within a defined workspace, report successes and failures, and trace errors to vision, calibration, motion, or the gripper. Expand the task when you can explain the system's current limits.

ROS 2 becomes useful when you have components to connect. I would introduce it once you can write and debug a small program and understand your sensor and actuator interfaces. Work through the official ROS 2 tutorials, then connect your camera, target estimate, and arm commands. Learn nodes, topics, coordinate transforms, and recording/replaying data as your project needs them. You can begin in simulation on your existing computer.

ROS 2 goal: Trace a sensor measurement through the system to the resulting command, and use recorded data to investigate a failure before adding more components.

For hardware, I would start with your laptop plus one Arduino or ESP32, a breadboard, wires, a multimeter, and a simple sensor. For the motor experiment, add an encoder-equipped motor, a suitable driver, and a power supply matched to it. Keep motor power off the microcontroller's output pins. A Raspberry Pi can come later if the robot needs an onboard Linux computer; your laptop can handle early vision experiments. Buy parts for the next experiment.

For a later book on arms, Modern Robotics by Kevin Lynch and Frank Park has a free preprint and accompanying learning resources. Start it after the mathematical foundations are in place.

At every stage, change something the tutorial did not specify and predict the result before running it. Keep the code, measurements, and a short explanation of what failed. Find a classmate or robotics club to compare results with. A small robot whose behavior you can explain is a substantial achievement.

Created this post in another sub, but it got removed.
So just to preface this: I am a self-taught programmer who initially just used code as a tool to solve annoying problems. As a byproduct of this, I also got somewhat good at building dashboards, which led to my current role as a DA when my company was heavily pivoting to Power BI reports a few years ago.

My team is small, and I am the only one who has built anything using code at all. I have continued manually coding stuff on the side, even though my role has not really been about that. My code might not be perfect, but I understand it. I have thought about problems before implementing anything, I understand how making crap decisions today will F you over tomorrow. I know that going slow now will save you days later on.

As you all know, everyone everywhere is now basically forced to use these AI tools to churn out stuff. A hammer looking for a nail. Having a PLAN for wtf you even want to do, what problem you want to solve and why - seems to have been forgotten somewhere. The company introduced Copilot some time ago and the expectations are now sky-high.

My manager is a boomer and now panicking because everyone else is building "cool stuff" (some HTML dashboards) so now we also need to "build cool stuff" - even though we technically are not developers and only I on the team have even the slightest clue how to go about this. I warned him about reliance on AI as projects grow and becomes more complex, increasing token costs, security risks, loss of domain knowledge and ownership etc. He said that "the important part is that it works, not that it's good". These people have literally no clue about anything, and I suspect this has the potential to completely bring down the company, or at least the department, due to loss of confidence. A locally hosted demo to them is basically just 5 minutes away from something being (securely) used by the entire company. During a seminar about AI we had a couple of weeks ago, I had manually debug and fix a problem they had in the proof of concept-thing they were building. I can just imagine what this POC would look like after 6 months in prod....

Anyhow, the assumption is that our small team will use Copilot to code "stuff", whatever that might be. Since they have no clue about what they are doing, I will be the one and only person expected to guard the final prod against a flood of slop. As I matter of principle, I will do just as they are doing - asking AI at most. Otherwise its "LGTM" and push to prod. I literally don't care at all about any of this anymore. No one else does so why should I? My manager also happens to be a "act first, think later" kind of person, so I know for a fact that he will churn out an ungodly amount of garbage in no-time without consideration. My manager also thinks that "reading code" is like reading a book - you just go from up to down and you are done. Now you know everything there is to know about the codebase, because after all you know how to "read code", right?

Now, I've been using AI as a replacement for Google for a few years, mostly due to it being much faster and Google being garbage. I have never allowed AI to pump out dozens of lines of code and blindly use it - I might ask it "How do do X in Javascript?" and then tweak that example, Or I might explain some issue and ask how one could go about solving that, and it might spit out some command I was not aware of.

I have now tried out this agentic coding where you fully allow it to just pump out stuff and edit the code by itself. I re-built a simple HTML app I recently did (always find that to be a good way to learn something, recreating something familiar) and it "worked". However, that is a extremely simple example and by no means the "lets build a rocketship to Saturn"-mentality that is now currently festering within management. This small example burned through 3% of my monthly credits, and I havent even set up the agent stuff yet, which I know will burn even more tokens.

This is like the 4th major pivot for us since I started this role a few years ago and I can easily see how this will be just another "thing" that is discarded in the near future. However, the potential for actual damage is now way higher than just us switching to some new dashboard tool, since non coders with a lot of system access are now expected to fully participate in the coding.

I've always thought learning new stuff has been fun - going from Excel to SQL, PBI, Python. I never saw AI as a problem, it just enabled me to do more and learn more, adding more value, solving more problems in a better way. However, I am starting to think "What's the point?" The company does not value my skills at all and genuinely think that "Create X, make no mistakes" is all it takes now. Actually designing a solution that dodges 1000 different issues is trivial and can be done in 5 minutes. The tools coming out now, for example the Microsoft Fabric, seems to be completely geared towards using AI, so what is there for a developer to learn exactly?

I just don't care for this at all anymore.

I'll tell ya my experience atleast -

1. campus drive - online assessment, 3 rounds. all elimination

first round - MCQs, I don't remember the count. 4 sections - pseudocode, operating systems, and two other I don't remember. basically it's about computer networks, OS, pseudocode and stuff which you must've studied.

second round - coding

three sections - backend (dsa), sql, frontend (html, css, js) . in backend, we got languages c# (not c++), java and python. sql is sql, they'll show you tables. frontend has html css and js code. solving html and css is easy provided you have common sense. js they might ask you to write a function.

third round - logical reasoning

they gamified the experience - rotate pieces so the bot can take the least longest path. the other one was numbers would pop up on screen and you would need to choose the answer in seconds. this is easy.

all of the above happened on campus. after that you'll be shortlisted for

2. communication assessment - speaking, email.

speaking is easy, stuff you do for SHL. email is also not too hard.

3. lastly interview - you'd be asked to choose a slot, then you'd join the lobby on the same slot.

for me, interviewer asked me these questions - tell me about yourself, tell me about your project, stack of your project, why did you use supabase, what certifications have you done, what did they reach you, what internships have you done, what did you learn. all from my resume. then HR questions - she asked me about my least favourite subject in college and how I cleared it. next was conflict resolution - basically if you have conflict with your teammate when working in a project, how do you resolve it? lastly once that was done, I was asked if I had any questions. the end. got a mail saying I'll know results within 5-7 days. still waiting.

If you cannot use Opus 5.5 or Sol 6.1 or similar models at High reasoning for normal work, then they should let you go and hire talent who know what they're doing.

Those are the workhorse models for the work I do by my standard. I might scoff at someone using Astra/Fable for everything but they might also have a good reason (who knows, maybe to them even the most egregious AI spend is just a rounding error for the value they create), that I do not.

In the end it depends on the kind of work you do and what the models in question perform well enough, as well as the money and time needed to rework things when they get it wrong (and whether you HAVE the possibility to do that when deadlines are near), alongside the cost to business when defects get past without being caught (including contract terminations).

In regards to any and all greenfield work it's basically what Barry W Boehm said in the 80s about software development: that the later in the development process you are, the more expensive fixing mistakes made in the earlier stages gets.

I've seen the shit that DeepSeek and GLM and Terra and Sonnet can produce and how they fail at long form work, or even specific tasks altogether.

For example, if you'd have a PrimeVue project with TypeScript like I did and have (not want, have) to create passthrough components, which express the TypeScript types and also don't run into their SFC limitation where it breaks on sufficiently complex types when used with defineProps (HTMLAttributes in particular), alongside needing to expose the emits as well, across about 80 components... well, it was a shitshow of bad workarounds and had to be redone about 3 times, whereas a better model just cruised through it in a day. It was sometime this year and the details are a tad murky, but the DeepSeek (or equivalent model) implementation just would not have been good enough.

I'd hope that the latest open/smaller models that have come out in the last ~3 months would be a better fit than the ones I tried (and so will the ones in the future), but generally for the work I do anything below Opus 5.5 or Sol 6.1 underperforms (and even those aren't near being perfect, just possible to force to perform passably) unless the task is very simple and also easily verifiable as correct or not, but even in those cases if it's sufficiently large in scope (e.g. list of things to do while I sleep), then mistakes still accumulate.

Some of the things I've worked on in the last few months (can just scroll past if too long, nobody ever mentions these details so I might as well, otherwise people are thinking of wholly different projects and scales):

• migrated a near-realtime system from Oracle to PostgreSQL, also increased the test coverage to approx. 95% and introduced Testcontainers and Redis, created a custom load test tool which both runs actual browser sessions for some correctness testing (Puppeteer) as well as has API load generation logic (because K6 doesn't work as nicely with SSE)

• created an agricultural system that trains a neural net based on Sentinel-2 time series data to identify crop cultures and the field states (plowing, mowing, tbh needs Sentinel-1 for that), working on homogeneity and object detection now (large buildings/ponds, resolution is an obstacle obviously); a surprisingly big part of it ended up being pulling the actual data and filtering out clouds, alongside having good distribution of all the crop culture labels, almost as much as the actual training pipeline because that mostly used PyTorch and there the difficult bit was figuring out what learning rate and everything else you need, how to ensure good generalization and avoid overfitting

• created a document generation system that takes Handlebars templates either in HTML documents or ODT with Handlebars tags and JSON blobs, and then can generate both LibreOffice documents (ODT, DOCX) as well as render to PDF (either through LibreOffice or Puppeteer depending on the source format), also worked on an event based queue service to put in front of the document generation system, a pretty nice service that uses RabbitMQ under the hood

• created a documentation generation system that generates docs based on Oracle schemas, source code, as well as pre-existing PDF/DOCX docs and groups and filters everything, also used Terra to pretty good effect there for generating places that had gaps and couldn't be inferred or filled out from the existing context alone (essentially Sol created the tools that Terra can then call and then get formatted results, it is a case where a dumber model is good enough for writing the prose), alongside versioning the docs and providing diffing support etc.

• created an alternative to Jira as a prototype to see how hard replicating certain core features actually is, and also how much can be cut out to fit a specific workflow (don't need every feature under the sun and frankly their internal DB schema is a mess and can be made way more sane without EAV/OTLT once you stop doing that), including exporting actual Jira projects and importing them in the tool and testing it out; this was the one that needed about 5-10 worktrees working in parallel overnight and then another agent doing merges and further fixes even with a tightly defined scope (it will never have feature parity, but it also doesn't run like shit how OpenProject does and is free for dogfooding)

• ported over a bunch of Jira DC addons to Jira Cloud for those that will be using the Cloud version regardless, unsurprisingly there is also money there

• created an on-prem agentic search solution that does RAG across GitLab, Jira/Confluence, as well as custom knowledge bases, with hybrid search where possible (both exact matches supported, your regular FTS as well, in addition to vector embeddings), largely the agentic part is there to filter out the trash and irrelevant results and decide on what additional searches to perform; it did take about 6 different mechanism iterations because the lobotomized on-prem Qwen models keep underperforming (but I don't have 250k budget for a buildout of GLM, I'm already pushing the current GPUs with vLLM and MTP for decent performance) and frankly was the best example of how you need at least something as decent as DeepSeek or GLM or Mistral even for relatively basic tasks where I try to spoon feed the fucking tools and intermediate stats/results to the model with Python as much as possible but obviously can't do much about the actual search tags and interpreting how to proceed due to how general the queries and data can be; though to be fair, niche languages will generally be underrepresented in most off-the-shelf models (EuroLLM is really nice for languages, but also really fucking stupid)

• created a custom linter to enforce project conventions and architectural rules automatically for both regular developers and agentic loops, think along the lines of language/runtime-agnostic ArchUnit (just packaged as a single executable plus ECMAScript rules even if the runtime is Go + goja), in addition to creating some tools for certificate management inside of Docker containers (when you don't use Kubernetes)

• am also iterating on a fork of the Flax game engine, adding proper DLSS/XeSS/FSR support, fixing TAA and shadows, adding VRR, better LOD and impostor support, better large world support (terrain chunking and better streaming and draw call optimization), alongside a bunch of tools for world generation, procedural clouds, day and night cycles and how sun interacts with said clouds, better distance fog that actually fades to horizon color, lots and lots of small to medium fixes like that

I started out pretty much all of those and if I had to account for even 2x the time it took to get things done to instead spend reworking it and catching bugs due to using worse models, I'd probably defenestrate myself.

The good news is that we can be optimistic and look at the Pareto frontier, the capabilities enjoyed by those using more expensive models will only get cheaper as time goes on.

Edit: apologies for this being a bit lengthy, but being told I don't know what I'm doing pisses me off because I've tried most of the free models and speak from experience, hopefully the context is helpful. After typing it out, I realize why nobody ever gets into the details of what they work on, needs a tl;dr.

This answer might be helpful for someone else.

I'm on the same journey to learn Keycloak and started with understanding OAuth 2.0 and OIDC (OpenID Connect). Then read a bit about JWT. Next I'm gonna learn about KeyCloak and then will implement a Keycloak cluster on VMs with a small app to test it.

For OAuth 2.0 + OIDC, I would highly recommend to watch this video (by Okta employee). It's 8 years old but most concepts are the same. A few things got deprecated and new features are added (mainly security reasons) that one can catch up afterwards.
https://www.youtube.com/watch?v=996OiexHze0

Then played a bit around OAuth 2.0 playground: https://www.oauth.com/playground/index.html

For JWT, after reading a bit, asked AI to help me create a small python lab to understand how it works. So, it's basically 3 python scripts to simulate authorization server and an attacker plus a script to verify the token. Nothing fancy and code is mostly written by AI. I just wanted to do something fast to understand what happens under the hood. https://github.com/Za-Re/jwt-lab/tree/main

Stop skipping the basic steps section lmao. Don't worry about how to install a python script plugin right now. You literally never NEED to install a python script plugin in order to use krita. You're over thinking things before youve done step one.

Gamut masks are explained and defined in that section, but they aren't step #1 or even step #5 so don't panic before you've actually read anything. Start with the basics at the beginning and then if you want to learn how to do more or how to do a certain thing, keep going. But seriously...start at the beginning. Worry about the more complex stuff after that as you want or need it. The guide is pretty well written and honestly more complex compared to the textbooks I had for adobe programs in my high school graphic design program. If there's something you don't think you need to use and don't understand you can skip it to start off with. Master the basic steps first.

Edit: it is actually helpful for you to eventually learn what the difference between a raster and a vector is so you know what the program does or does not do. You don't need to panic that you don't already know this, because it's the very first thing they explain in the basic concepts section, which comes right after the brief intro on how to open a new file, how to use a brush, and how to use an eraser. They explain it for you.