mobeigi

So TempleOS was ahead of its time!

I enjoyed the reference more than the story itself :)

I saw a recent post about only adopting packages a certain number of days post release (say +3 days, or +7 days) after. The idea is you never bring in fresh commits, only older ones. This would need dangerous or bad commits to be marked vulnerable too.

It means you skip supply chain attacks but may miss fresh vulnerability patches too.

I'd very much like to learn more about this too, deserves its own blog post.

I've made the same exact SVN mistake. My first week in my first Software Engineering job, accidentally deleted trunk and my team lead had to scramble to fix my mistake.

I will always remember how he told me "Don't worry, it happens fairly often".

Been using Claude as a harness to OpenRouter for a while now. It's a nice setup if you don't mind API based billing.

I wish people wouldn't abuse the author of that project over this. Giving them the benefit of the doubt in that this was a mistake and not intentionally malicious, it feels really bad for hundreds if not thousands of people to send hate, insults, abuse to a single individual. Shame on the people who are doing that.

Such a feel good post, thanks for sharing OP!

This was not on my bingo card. Not sure why eBay would take this personally. They've had a solid couple of years and there is room to grow. Gamestop on the other hand I'm not sure will exist in 10 years.

Valve's VACnet solution is definitely interesting. It uses AI, deep learning and is server side. It's hard to tell how effective that has been for them compared to traditional client side detection systems; I don't imagine they'll share any results.

The fact that it's completely hidden from cheat developers gives them a huge advantage though. In the past, any client side algorithm or detection method could be reversed engineered by cheat developers and patched before lunch time. Now they're working against Valve completely in the dark.

Couldn't agree more, I have personally benefited from the additional layer and it irks me when people outright claim it has no value.

I'm being very cynical here but who says that their tool or LLM discovered this. How do we know they didn't hire some expert security researchers to find it or bought it off the black market as a promotion stunt.

With that being said, I wouldn't mind if they made more sales on whatever they're advertising IF they followed the disclosure process well. A bad disclose immediately tells me I can't trust them because their moment in the light was more important that the safety of millions of boxes.

Last time I heard about Zed I was intrigued. Now i'm interested, going to give it a go.

Very neat, definitely some creative approaches in there I didn't expect like `yt-dlp`. Maybe I shouldn't have that just sitting around :)

KeePass users continue to live the stress free live.

I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

I used to use a Windows firewall which basically hijacked a bunch of WinAPI calls and let me approve/deny every request. Trying to be a good secure boy I ran this setup for a while but it was exhausting. Every single action needed dozens of approval windows. After a while I removed the software. I reckon it is good situationally though, trying out a new program for first time (that isn't risky enough for a VM or sandbox), might be good to turn on a tool like this.

The parody is amazing! They were quick to respond and made a great ad at a time a lot of people are moving away from Ring.

Any modern system with a sizeable userbase has thousands of bugs. Not all bugs are severe, some might be inconveniences at best affecting only a small % of customers. You have to usually balance feature work and bug fixes and leadership almost always favours new features if the bugs aren't critical to address.

I believe the idea is to pick small items that you'd likely be able to solve quickly. You don't know for sure but you can usually take a good guess at which tasks are quick.

Even the PS2 isn't safe from JavaScript.

Lovely attack vector. It's fun to open the various databases stored by browsers like Chrome in SQLITE to see the kind of information they store. I wouldn't be surprised if a similar attack vector existed for a different stored artefact.

Great read. It makes you wonder how heavily optimised the tokenizers used by popular search enginea truly are.

I wonder if there is a real person out there called John Doe who regularly received legal threats for a myriad of alleged crimes.

I wish people would understand how expensive meetings are. Don't get me wrong, a good meeting can be very useful for all parties involved by the vast majority of meetings can be replaces by a blog post or pre-recorded video which can be shared out for people to consume on their own schedules.

I love the landing page for this project. It's very engaging.

I've heard good things about Zig. I want to pick it up and experiment with it but at ~2% market share I find it hard to justify spending the time to learn and master it right now. It's usually much easier to find the time to learn a new language if there is a project (work or open source) that is also using it.

https://survey.stackoverflow.co/2025/technology

Interesting.

From what I can tell this allows some screen readers to select specific accents. Also the browser can select the appropriate spell checker (US English vs British English).

Exactly. Most CTO's have tens if not hundreds of direct reports that rely on them regularly. Which is why their time must be used to support them leaving absolutely 0 time to do PR code contributions on the side (unless you work weekends).

I appreciated the sentiment but I do wonder how on earth a CTO has enough time to write one line of code, let along several thousands. Even before reaching the C-suite roles, higher ups tend to be in meetings all day, back to back. In the short amount of non-meeting time they find, they typically have to do other admin related things or information sharing.

I guess that CTO uses weekends or works super long hours which I is fine if they don't push that expectation onto others.

I'd only really expect a CTO in an early stage startup to be pushing code like this (and eventually stepping back when they grow).

Hopefully the worker is okay. I have to agree that the non-emergency classification seems odd. This should warrant a proper investigation and steps to avoid this in the future.