The outcome has been measured after all - just not on developers - and the answer is “not as a rule”.

On average, admitting the weak point does nothing. Daniel O’Keefe and Hans Hoeken’s 2021 synthesis of 30 persuasion meta-analyses puts two-sided messages (the ones that concede the opposing point) against one-sided ones at a mean correlation of -0.002, over 107 effect sizes and 20,111 participants. That is no lift. The 95% prediction interval runs from about -0.28 to +0.27, so in any one new setting it could be a real gain or a real loss. Their title is the conclusion: message design choices “don’t make much difference to persuasiveness and can’t be counted on”. Anyone selling candour as a growth tactic in general is selling something the evidence does not support.

With a sceptical reader, it may. The one moderator that maps onto this beat points the other way. In three experiments, José Mauro da Costa Hernandez, Murilo Costa Filho and Maria Paula Strano (International Journal of Consumer Studies, 2022) found two-sided ads raised purchase intention through greater credibility, but only among consumers more sceptical of advertising. Less sceptical consumers responded the same to both, so the honest version cost nothing with them. That is one paper, about consumer advertising, measuring intent in an experiment rather than purchases.

Developers are the sceptical reader. Stack Overflow’s 2026 Developer Survey (results published 6 October) asked how far developers trust AI output. The commonest answer among the 14,304 who answered was “I trust it when I can easily verify the output” (48.0%), against 6.6% who trust it with important decisions. TrustRadius’s 2026 buying report (1,862 technology buyers surveyed in January, released 15 July) says the same from the purchasing side. 74% consulted customer reviews and 53% spoke to a peer. “Their demo blew us away” rose from 13% to 18% as a deciding factor, and transparent pricing has topped buyers’ requests four years running. In the publisher’s own write-up (the ranking table is not public), “vendor marketing collateral ranked dead last among resources buyers actually consult”. LeadDev’s 2026 audience research, from 455 engineering leaders, says they “asked specifically for concrete examples, including failures” in case studies. That is a stated preference, and its figures sit behind a business-email form at an organisation that sells sponsorship to the vendors it describes. The one technology-buyer figure that links candour to the sale is older and correlational: in TrustRadius’s 2018 survey, as reported at the time, 85% of vendors said they were open about their product’s limitations and 37% of buyers agreed, and buyers whose vendor was highly influential in the purchase called it upfront about limitations 56% of the time, against 31% for the rest. That can run backwards - a buyer who was won over may remember the vendor as candid.

So the honest reading is: not a general win, plausibly a win with this reader, and unmeasured on developers. No vendor has published the before and after on an honest piece, and nobody has run the test on a technical audience.

October’s breaches: the number under load

A breach is the purest version of the move, because the number can only cut against you, and this autumn ran the test at scale. Wiz’s “Black October” list, updated to 9 November, now holds sixteen AI developer platforms with incidents reported since 6 October (one of them, RunPod, only on social media so far). Wiz gives an affected count for none of them and says “detailed technical information is not available” for most. The four the house can read at the primary split four ways.

  • Railway published its preliminary report on 22 October: “at most 1.85% of all workspaces” had environment variables potentially compromised, “about 100,000 workspaces”, with an attack window from 20 October 13:58 UTC to 22 October 03:32 UTC laid out by the minute. It names a likely route (privilege escalation in its build infrastructure) but no confirmed root cause.
  • Trigger.dev said “a subset of organizations” on 1 November, with no count, cause or timeline. Its report on 6 November gave the share - “This impacted 0.66% of all customers” - and withheld the vector: “We are unable to comment on the specific attack vector currently”.
  • Northflank has timed everything to the minute on its status page (first known decryption 02:39 to 03:08 UTC on 30 October, the exploit “patched within 60 minutes of notification”) and has published no count, only “some customers”. A root cause analysis is promised.
  • Warp, whose cost-per-PR figures live on its blog, put its own number somewhere else: its CEO, Zach Lloyd, estimated “roughly 1% of Warp users may have been impacted”, as BleepingComputer reported on 27 October. The blog carries no incident post.

The reception repeats what Vercel’s sandbox write-up found. Trigger.dev’s vague first notice drew 167 points and 88 comments on Hacker News; its report with the number drew 3 points and one comment. Vercel’s honest findings post drew 3, its launch 1. Two cases on one channel are not a measurement, and points are attention rather than trust. But in both, the forum rewarded the event and ignored the account of it, which neither helped nor hurt the vendor that told it straight.

The three mechanics

A developer audience checks claims, in public, at speed. An adjective costs nothing to write and earns nothing, while a number someone can verify does work. A number that cuts against you should do the most work of all, because nobody publishes those by accident. Three distinct mechanics are on the record, and it is worth keeping them apart rather than filing them all under “be honest”.

Dogfooding that names its own cost. Cloudflare migrated cdnjs onto its own developer platform (30 July) and reported the two ceilings it hit - 1,000 subrequests per Worker invocation and 1,024 steps per Workflow - and that both were raised, to 10 million subrequests on paid plans and 10,000 steps by default (25,000 configurable). The same company moved its own blog onto EmDash, its own CMS, in late August and published the load figures: 75 requests per second normal, a 7,000 RPS burst load test, 99.5% of static-file requests served from cache, and a 28,000 RPS DDoS absorbed mid-migration. GitHub’s September port of the Copilot runtime to Rust is the largest specimen - about 430,000 lines of TypeScript to about 832,000 of Rust in fourteen and a half weeks, primarily one developer using Copilot - with 158 unsafe blocks located by file, 135 releases counted and the regressions listed by category.

A benchmark that reports where you lose, or what it cannot see. Neon’s September entry ran 42 models through a fixed support-ticket task with a stated seven-check rubric and published the full ~1,446x cost spread, including that open-weight models undercut the proprietary ones it resells. PlanetScale’s Neki post (11 September) printed 118.5 million queries a second across 512 shards beside what the run did not do: single-row reads only, primary-only, no failover attempted, 67 errors a second. Arcade (15 October) calls its own accuracy benchmark “indicative rather than exact”. OpenRouter’s 30 October post on Claude Code session costs (medians by model and turn count, 30 days to 18 October, no session count given) warns that the results of its own small test “come in under” the dataset medians because its sessions shared a warm cache. It still sells OpenRouter’s harness.

Proof that ships its receipts. Sentry shipped its Seer review numbers (6 August) with the close-without-merge rate up 12.5%, asked “why share it?”, and argued the increase was healthy. It is the hardest version of the move, because it needs a thesis about why the bad-looking number is good. GitHub Security Lab went further on 28 September: 24 vulnerabilities in popular Android apps, with the taskflows in a public repository and one script to rerun the audit. Parallel has taken the move onto billboards, buses and subway posters this autumn: its “See the whole picture” campaign, in New York, the Bay Area and London, is six compositions, each grounded in a real Task API run, and a companion archive publishes the brief, the report and the full JSON behind each one.

Vercel’s challenge closed below its own interim count

The cleanest specimen the thread has recorded. Vercel put $1M on breaking its agent sandbox in August; SecurityWeek reported interim figures on 15 September (91 validated findings, seven high, two kernel defects). Vercel’s own write-up, published 14 October, is the smaller and less flattering count: 1,285 reports, 57 valid (one critical, five high, nine medium, 42 low) plus 32 informative, and $242,000 paid. The worst bug was an upstream Linux kernel networking zero-day whose host-memory leak was demonstrated against production sandboxes. An intern found that any sandbox could read recycled disk blocks from deleted ones. The control plane “accepted values returned by software running inside the microVM” for snapshot storage, fixed within a week, and egress policy was parsed by several subsystems that did not always agree. The kernel fix is under private review with CVEs pending and no date.

It earned no visible reward. The write-up drew 3 points and no comments on Hacker News - but the August launch post drew 1 point, twice, so the channel rewarded neither the flattering announcement nor the honest account.

The flattering side of the ledger

The counter-case keeps arriving faster than the honest one, and nothing visible punishes it. Warp is the clearest run of it. Its 3 September benchmarks launch said internal cost per PR fell “about 63% over the past couple weeks”. Its 15 October guide said “$80 → $20 in the last six weeks”, with “40% higher PR throughput” and “a lower revert rate”. Neither defines cost per PR, counts PRs or names the tasks. Its 29 October post on building a factory gives no measured result at all, and its 5 November post on code review lists “cost-per-PR, cycle time, and incident rollbacks” as the metrics to watch, cites “early benchmarks on cost-to-quality” without a figure, and promises “more findings here soon”. GitHub’s 5 November post on its new Git storage gives “5,000 concurrent agents” and “7,200 pushes per second to a repo”, from internal testing, with no hardware, repository size, duration or failure run stated - the opposite of PlanetScale’s Neki post, which printed what its run did not do. Unblocked’s homepage still carries “48% fewer tokens” and “83% faster”, resting on one engineering task run twice. PostHog’s homepage said “97% of users pay us $0” under its signup button on 13 September, with no denominator. Snyk put Evo at 60% of new deal volume, every figure its own. GitHub’s stacked pull requests went GA on 6 October on “a 9% increase in merged code compared with peers”, with the peer group loosely defined. In mid-October OpenAI published a case study saying its ChatGPT plugin “tripled signups” for Stack Overflow for Agents - a platform’s numbers about its own customer, chosen to sell the platform. A number without a denominator is an adjective with digits.

The vocabulary half moves the other way. CodeRabbit’s pricing table has sold “Slop Detection - Flag low-quality AI-generated PRs” as a named line in every tier since 10 October: the problem named in the buyer’s own insult reads as checkable where a coined euphemism reads as positioning.

The deprecation window is the same argument

When a product goes away, the window is the headline and the mechanics decide whether anyone gets burned. A dated window a developer can plan against is a proof point in exactly the way a benchmark is; a generous but vague one is an adjective. The ledger laid side by side: Spark at roughly 27 days, GitHub Models 29 days to dead, Cerebras about a month, GitHub’s four Copilot models roughly four weeks, MCP at twelve months, HCP Vagrant Registry at about five. Google’s Jules (29 October) gives 13 days of working sessions before it goes read-only on 11 November and shuts on 31 December, with an export to a local folder rather than a path into Antigravity, which the notice names only as where the lessons went. Firebase gives Extensions until 31 March 2027, but on 1 November its FAQ still said migration tools “will be released in September 2026” - a dated promise left in the future tense after its date passed. Nobody has yet sold the migration itself as the feature.

Tension

Founder credibility buys attention, not a verdict, and proof does not always win the room either. Block shipped Buzz in late July to 304 points on Hacker News and a broadly “LLM slop” reception. Postman’s four-week audit of its own laptop (22 secrets leaving the machine to 18 hosts, late September) is the mechanic applied to a vendor’s own hygiene, and nothing shows it moved Postman’s numbers. The research says why that should not surprise anyone: on average, conceding the weak point neither helps nor hurts. What this thread can still find out is whether developers are the exception the sceptical-audience experiments predict, and nobody on the beat has run that test.

What would settle it

5 open loops

  1. 01 Open

    A second limits-raised case study - a vendor that dogfooded, hit its own published ceiling, and said so with the number.

  2. 02 Open

    The first vendor to market a migration plan as a feature rather than an apology. Deprecation is currently damage control everywhere; treating it as a selling point is the untested move.

  3. 03 Open

    Does Warp define its cost per PR, or publish WarpBench's tasks? The figure has read 63% (3 September) and $80 to $20 (15 October) with no denominator, and its 5 November post names the metric without a value and promises "more findings here soon". A definition would turn the industry's most-repeated flattering number into a checkable one.

  4. 04 Open

    Do Trigger.dev and Northflank publish the attack vector and a count, as Railway published a count? Trigger.dev says it may share the vector later; Northflank has promised a root cause analysis on its status page.

  5. 05 Open

    Has anyone tested two-sided against one-sided vendor claims on developers or technical buyers - an A/B test on a trial page, or an experiment with a technical sample? The persuasion research behind this thread is all consumer and general audiences.

Each is checkable by a date. If one goes quiet, that is itself an answer.