guessmyname

MSRC doesn’t fix bugs.

I don’t know the specifics of this case, but I’ve managed bug bounty programs in the past through Bountysource and HackerOne. One thing that occasionally happens is that a report makes its way to the development team before the security team has fully assessed it, in this case MSRC.

At that point, a developer may decide to quietly fix the issue. Sometimes that’s driven by a concern, rational or not, that being associated with a security bug could reflect poorly on them or affect future promotion opportunities. The result is that by the time the security team attempts to reproduce the report, the vulnerability is already gone.

From MSRC’s perspective, all they see is that the provided reproduction steps no longer work. They have no visibility into the internal history of the bug or whether someone already patched it. As a result, the report gets closed as invalid even though the original finding may have been legitimate.

Where do you keep Issues, Pull Requests, Wikis, Discussions, project boards, and everything else? (rhetorical question.)

These days, the problem with cloud-hosted Git platforms is not where to push your code. Replicating repositories across multiple providers is relatively easy, and Git has always been good at that. The harder problem is that successful teams end up accumulating a lot more than source code around their repositories, and much of that information becomes just as important as the code itself.

Bug reports, feature requests, documentation, design discussions, code reviews, project planning, CI/CD configuration, and years of historical context all tend to live inside platforms such as GitHub. While the Git repository itself is portable, all of that surrounding data is often much harder to migrate cleanly, especially if a team has built workflows and integrations around a particular provider.

That, in my view, is one of the main reasons so many companies are heavily dependent on GitHub. Moving the code elsewhere is usually straightforward; moving the entire development process, with all of its history, metadata, and institutional knowledge, is not. When GitHub goes down, the question is often less about where you can push your next commit and more about how easily you can recreate the rest of the environment that your team relies on every day.

Not iCloud servers per se, but close:

• ussea4-edge-fx-012.aaplimg.com

• mensura.cdn-apple.com/api/v1/gm/large

As someone who grew up eating Calbee snacks, I think they’ll be fine.

People from my generation aren’t buying Calbee because the bag is colorful. They’re buying it because it’s Calbee and they already know what they’re getting. The packaging could be black and white and I’d still recognize it instantly.

The only people I could see being briefly confused are younger consumers. Japanese packaging tends to be very colorful, so we’re all conditioned to identify products partly by color. But people adapt quickly. In fact, a black-and-white Calbee bag might end up standing out more on a crowded supermarket shelf than yet another brightly colored package.

There’s also a chance this ends up being a net positive. If simpler packaging lowers costs and sales stay the same, why go back? Japanese consumers are feeling inflation more than they have in decades, and companies are under pressure too. Cutting costs in a place customers barely notice seems a lot smarter than shrinking the product or raising prices again.

At this point, every AI or LLM “breakthrough” announcement should be assumed to be a lie until the company provides hard proof.

Way too many companies have figured out that exaggerating, misleading, or outright lying gets them headlines, investors, and free marketing long before anyone verifies the claims.

I always find titles like “Google Hates You” a bit weird. People usually argue that employees are not personally responsible for bad company decisions, that criticism should be aimed at the corporation itself, not at random engineers or designers working there. But then we turn around and assign human emotions to the corporation anyway.

A company cannot literally “hate” anyone. It has no feelings, intentions, or consciousness. So who exactly is supposed to hate you here? The CEO? The executives? The leadership team? Every single employee at Google? And who is “you,” exactly? Billions of users spread across the planet?

I get the point the title is trying to make, but it feels more accurate to say that Google optimizes for incentives that are often misaligned with users, not that it emotionally despises them.

I am part of Apple's SEAR (Security Engineering and Architecture) organization and can’t attest that we have been using Anthropic models, including, but not limited to, Mythos, as part of our participation in Project Glassing and previous private partnerships with different frontier AI labs for years. We simply don’t talk about it because there’s no benefit to talk about it, and also NDA’s, but mostly because there’s no benefit to talk about it other than to satiate people’s curiosity about what we do or don’t do internally.

Yes, we did. I am the engineer leading Project Glasswing efforts at Apple.

> So many variants of that code

Indeed… That evolution makes perfect sense. A lot of Go developers independently arrived at similar request coalescing patterns around that time, especially in caching, RPC, and high concurrency systems. I have an older implementation from personal 2013-era Go projects that follows almost the same approach.

What is nice about open source is not necessarily the novelty of every individual idea, but having a well-tested, shared implementation the community can converge on. Your work on singleflight clearly became that reference point for the Go ecosystem, and it is cool to see the lineage from dl.google.com to groupcache, x/net, the standard library, and now all the downstream variants.

“homeless” is obviously hyperbole. I know the researcher in real life, they are 100% not homeless, if it makes you feel better, that’s just how they “talk”.

Couldn’t have chosen a more difficult (and ambiguous) name to pronounce, could you? It almost sounds like a curse that I often hear people say out in the bad streets of New York City.

A 128GiB MacBook Pro in Canada is what, north of CAD $11k after tax? That’s around USD $7k. At $20/month for a cloud AI subscription, you’re looking at almost 30 years of service for the same money.

How long do people realistically expect a laptop to stay competitive with SOTA local models? Especially in a space where model sizes, context windows, and inference requirements keep moving every year.

And even if the hardware lasts, the local experience usually doesn’t. A heavily quantized local model running at tolerable speeds on consumer hardware is still nowhere near frontier hosted models in reasoning, coding, multimodal capability, tool use, or reliability.

The economics just don’t make sense to me unless you specifically need offline inference, privacy guarantees, or low latency for a niche workflow. Otherwise you’re tying up $10k upfront to run an approximation of what you can already access through a subscription that continuously improves over time.

You could literally put the difference into index funds and probably cover the subscription indefinitely from the returns alone, even accounting for gradual price increases.

That’s because the rice sold in Japan is generally the highest quality, so it makes sense that it costs more than the rice exported overseas to places like American supermarkets and Costco. The rice you see in US stores is usually a lower grade than what stays in Japan, though not necessarily “low quality.” Japan has historically been pretty selective about what gets exported versus kept for domestic consumption.

There’s also been a rice shortage/crisis in Japan recently, which has pushed prices up even more. See here → https://www.borgenmagazine.com/japans-rice-crisis/ and here → https://old.reddit.com/r/japan/comments/1kthwmr/e/

I think this is a good idea.

Almost every time I get a call from TELUS about a new service or promotion, it’s someone from the Philippines or India. A lot of them speak English fluently, but the accent and phrasing can be pretty different from what I’m used to, and I don’t always catch everything they’re saying. Sometimes I feel like I’m guessing a big chunk of the conversation, which makes me not want to engage, especially on sales calls.

It matters more when I’m the one calling them for billing or technical support. In those cases, clarity really counts, and it can get frustrating when I have to keep asking for repeats or try to piece things together.

Honestly, I’d love something like this for my own speech too. I’m Japanese and have a fairly strong accent, and it would be nice if people could understand me more easily without having to guess.

Oh, this web service is going to be such a nice target for hackers waiting to infect everyone who dares download random binaries. Centralizing “builds on demand” like this creates a pretty juicy supply-chain target. If the service gets popped, you’ve got a one-stop shop for shipping compromised binaries to every arch/OS combo. Convenient idea, but I’d only trust it with strong guarantees: reproducible builds, signed artifacts tied to commits, and a way to verify locally. Otherwise it’s basically “go install URL” with extra steps.

[redacted]

I’m as paranoid as the next person but what’s the purpose of this article?

If you don’t like closed source software and don’t trust the developer(s), then don’t use the software. Why waste time writing an article that all it does is critize the developer’s decision?

If you care so much about the software you run in your computer, then do what I do: open a disassembler and reverse engineer the code, inspect every single HTTP(S) call, every network packet, every system call, and then maybe you will feel at ease.

When I click on the “Download / Buy Now” link [1], Safari tries to download it instead of visiting the page. I tried with cURL and discovered that the page is returning a “content-type: application/octet-stream” header, which makes no sense because the page is just HTML. Also, I can see some portions of raw PHP code in the HTTP response, so I think your web server is not interpreting PHP as it is supposed to and instead returning the raw content from the PHP file.

edit: In fact, every PHP file is being leaked, for example, this file [2] contains a $hash_salt , which is supposedly being used to “prevent[s] users guessing filenames and make data more secure”

[1] https://glowworm.us/securimage/download.php

[2] https://glowworm.us/securimage/securimage.php

Every [*] macOS user uses Rectangle.app — https://rectangleapp.com

The ones who don't use it is because they don’t know it exists.

Or they are still using the (deprecated) Spectacle.app — https://github.com/eczarny/spectacle

[*] if you wonder why I say “every user” even though it’s obviously not true is because everyone loves hyperbole in this website.

I use Little Snitch and so far I have only seen Claude Code connect to api.anthropic.com and Sentry for telemetry. I have not seen any Vercel connections, but I always turn off telemetry in everything before I run it. If you log in with OAuth2, it also connects to platform.claude.com . For auto updates, it fetches release info from raw.githubusercontent.com and downloads the actual files from storage.googleapis.com. I think it also uses statsig.anthropic.com for stats. One weird thing, I did see it try to connect to app.nucleus.sh once, and I have no idea why.

Here are some environment variables that you’d like to set, if you’re as paranoid as me:

  ANTHROPIC_LOG="debug"
  CLAUDE_CODE_ACCOUNT_UUID="11111111-1111-1111-1111-111111111111"
  CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING="1"
  CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY="1"
  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1"
  CLAUDE_CODE_DISABLE_TERMINAL_TITLE="1"
  CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION="false"
  CLAUDE_CODE_ORGANIZATION_UUID="00000000-0000-0000-0000-000000000000"
  CLAUDE_CODE_USER_EMAIL="root@anthropic.com"
  DISABLE_AUTOUPDATER="1"
  DISABLE_ERROR_REPORTING="1"
  DISABLE_FEEDBACK_COMMAND="1"
  DISABLE_TELEMETRY="1"
  ENABLE_CLAUDEAI_MCP_SERVERS="false"
  IS_DEMO="1"

Why thousands? You never read or delete all your emails within a day?

My inbox, which I have for almost two decades only has 28 emails in it. Not 28 unread emails, but 28 total emails. I delete everything within a day of receiving, except for every important things, hence why 28 of them still remain.

Keeping thousands of emails in your inbox, while virtually free, is an attack vector for hackers, and also a gold mine for advertisement brokers who pay email providers money to show you ads based on your daily habits.

Same. Much more difficult as an immigrant because you have to prove a lot more than other candidates but I have always managed to get a job with cold-applications, zero referrals, which even I find interesting because I dozens of people at different companies, have thousands of followers on LinkedIn, and am super active in local meetups as an organizer, which means lots of locals know me, at least by name, but still no good referrals whenever I apply for a job, which is why I always resort to cold apply.

With Go v1.26.1

  package main
  import "fmt"
  func main() {
    fmt.Printf("Hello World!\n")
  }

Binary sizes:

• 2581616B (2.5MB) → 1714560B (1.6MB) (with -ldflags="-s -w")

• 1531920B (1.5MB) → 753680B (0.7MB) (with upx --force-macos)

That said, a trivial “Hello World!” isn’t a meaningful benchmark. If you’re going to play that game, you might as well swap `fmt.Printf` for `fmt.Println`, or even `println` to avoid the import statement entirely. At that point, you’re no longer comparing anything interesting, the binaries end up roughly the same size anyway.

> frizlab: […] while Zed is nice, Sublime is better.

> ramon156: What does this have to do with Tauri?

Not @OP but I imagine they are thinking: “because Zed is built on top of Tauri and Sublime Text is not.” Sublime Text’s user interface is built on top of a mix of (native) UI renderers for each major OS [1], mostly based on Google’s 2D graphics library: Skia https://skia.org/ . Recent versions (v3) go even lower: Vulkan and OpenGL https://www.sublimetext.com/blog/articles/hardware-accelerat...

EDIT: I stand corrected, Zed does not use Tauri (anymore?) but instead gpui ( https://www.gpui.rs ) as seen in their Cargo.toml file → https://github.com/zed-industries/zed/blob/main/Cargo.toml#L...

Problem is, it is often just 1-2 posts on Twitter. Maybe 5… Heck! maybe 10, but that’s it.

And it’s often people who are only superficially involved in the thing they are so expertly talking about.

Sometimes it’s teenagers who just want to troll adults, especially knowing that their posts could appear in the news. Sometimes it’s adults who want to troll other adults for the LOLs or to fulfill a particular agenda. Sometimes it’s bots, actually, usually bots. Something the posts don’t even exist.

> I personally dropped $20k on a high end desktop - 768G of RAM, 96 cores, 96 GB Blackwell GPU - last October, before RAM prices spiked […]

768GB of RAM is insane…

Meanwhile, I’ve been going back and forth for over a year about spending $10k on a MacBook Pro with 128GB. I can’t shake the feeling I’d never actually use that much, and that, long term, cloud compute is going to matter more than sinking money into a single, non-upgradable machine anyway.

Oh yeah! lnav is famous. I remember using it like a decade ago to monitor an array of web servers while at GoDaddy; good ol' times.

First commit is from Sep 13, 2009: https://github.com/tstack/lnav/commit/b4ec432515e95e86ec9d71... . Woah! we’re old.

This is what the UX looked like back in the day: https://github.com/tstack/lnav/commit/bce2caa654160518ec11f6...

There’s actually a lot more environment variables:

edit: removed obnoxious list in favor of the link that @thehamkercat shared below.

My favorite is IS_DEMO=1 to remove a little bit of the unnecessary welcome banner.

There’s actually already an app for that, and I’m not even joking.

edit: I was going to link a specific one I found a few weeks ago, but it turns out there are tons of them now, so I’ll just explain the idea. Most of these apps are basically reminder tools disguised as simple little games. A common example is a flower garden. Each “flower” represents a friend, and you keep the flower alive by staying in touch. That might mean sending a message or planning a hangout. If you don’t, the flower wilts, just like a real one would without care.

I’m also as pedantic as you and use “LLM” even talking about these systems but you need to be flexible and accept that “AI” is already in everyone’s head when referring to GPT variants.