This side of the river is the old world. The other side is AI. I want to ferry us all across.
RSS FeedFull-stack developer for 24+ years. I formerly led a 400-person engineering team, and I'm still a core maintainer of several large open-source projects. Everything here is something I've actually built, run, or broken: AI engineering practice, open-source dynamics, infrastructure, and security.
中文读者请进 简体中文版 ——每篇文章都有中英双版。
Featured
I tore down HumanLayer's source code: it leashes your coding agent, but sessions move to its cloud
HumanLayer open-sourced its approval layer for coding agents. I read the source: the engineering is real, but there is a simpler path using the CLIs' own built-in doors.
Recent Posts
A worm pushed malware from three developers' own accounts, and git log says it was them
PolinRider, a git worm, spent 28 days inside one team's repositories and force-pushed 139 branches across 10 repositories from 3 developers' own accounts — every forged commit keeping the real author's name, message and date. How it hid in config files behind hundreds of spaces, read its command server's address out of Ethereum and BNB transactions, rode npm and the CI build, and the checks and boring fixes that would have stopped it on day one.
Real secrets sit inside 1,122 Claude Code files on GitHub
Apiiro searched GitHub for one filename, .claude/settings.local.json, and found 104,185 copies. In 1,122 of them, 1,379 real secrets sit in plain text, because clicking 'don't ask again' saves the whole approved command, password included. Why the protection ends at your own machine, why secret scanners miss the passwords written inside commands, and the order to clean up in: rotate first, then the history.
Vercel's agent-desktop lets an agent read your apps the way a screen reader does
Vercel's agent-desktop lets an agent run your computer by reading the accessibility tree, the structured list of controls the operating system keeps for screen readers, instead of guessing buttons from screenshots. Every control comes back in a JSON snapshot with its own reference, and the agent clicks the reference. I ran the Linux build on a server with no desktop, added the missing layers one at a time until it could see, and checked a real click on a zenity dialog against the program's own exit code. Nobody has published a measured saving over screenshot pipelines, and a snapshot can carry your desktop's private content.
An agent-designed serving system returned 4.87 times the vLLM baseline's value per dollar, but only 22 of 33 runs passed validation
CMU's ServerBench let 11 coding-agent models each design a complete LLM inference serving system, then scored them in dollars per dollar under real workloads. The top system, designed by Claude Sonnet 5.5 on Gemma E4B, returned 4.87 times the vLLM baseline's value per dollar, but 11 of the 33 runs never passed validation. The three findings: capacity and load selection only work together, experiments have to mirror real traffic, and every new path an optimization adds needs its own check.
An Alpine account with no password set will take a 300-character password
On Alpine, an account whose password field holds only a star is supposed to accept no password at all. Three old decisions line up so that any password from 257 to 1,024 characters logs in: musl returning a star when crypt() fails, musl returning the same star when it refuses an over-long password, and OpenSSH borrowing another account's salt. Who is exposed, who is not, and why the package version is the check that settles it.
WordPress shipped the patch a week ago, and CISA now wants you to check whether anyone already got in
WordPress 7.1.4 closed a flaw in the core update process, and CISA has listed it as already exploited, with a flag for forensic triage: install the patch, then check whether anyone already got in. The check has five stops, and the sites at risk are the ones nobody signs in to.
