This side of the river is the old world. The other side is AI. I want to ferry us all across.
RSS FeedFull-stack developer for 24+ years. I formerly led a 400-person engineering team, and I'm still a core maintainer of several large open-source projects. Everything here is something I've actually built, run, or broken: AI engineering practice, open-source dynamics, infrastructure, and security.
中文读者请进 简体中文版 ——每篇文章都有中英双版。
Featured
I tore down HumanLayer's source code: it leashes your coding agent, but sessions move to its cloud
HumanLayer open-sourced its approval layer for coding agents. I read the source: the engineering is real, but there is a simpler path using the CLIs' own built-in doors.
Recent Posts
274 Elvis songs were used to train AI. Here's how the rights holders found out
The Elvis rights holders sued Anthropic over 274 songs. How they checked is the part that matters for everyone else: question the model, search the public corpora, try statistics — and where each of those stops.
The clock in your prompt is quietly killing your cache
A timestamp that changes every second, sitting on line one of your prompt, breaks prefix matching from the first character, so the tens of thousands of fixed words behind it get billed at full price on every request. ProjectDiscovery changed the timestamp to day precision: cache hits went from 3.2% to 91.8%, and their LLM bill dropped 59%.
Rust is replacing C by never rewriting it
C is not being beaten or rewritten. It is being retired the quiet way: the conservative projects have all adopted the same rule — old C stays untouched, and every new component gets written in Rust. The stock of C decides how long it lives; the flow of new code decides whether it is still alive.
I tore down ai-memory: 528,000 lines of trending code, and you probably don't need it
I installed it, ran it for real, and read the code end to end. The engineering is real, but the problem it solves has a dumb, free workaround — and the project is a specimen of a bigger shift: AI made building software nearly free, while adopting it costs exactly what it always did.
GLM-5.3 leaked. Is the API relay you're using safe?
Cloudflare's GLM-5.3 leak was small and is fixed. What it demonstrates is bigger: relays come in two kinds, pure forwarders and self-hosted substitutes, and this kind of leak belongs to the second kind — the one you can't tell apart from the first.
Open source doesn't mean audited: the backdoor in an interview project
A poisoned interview repo hid its backdoor in .vscode settings. The bigger lesson: open source guarantees you may audit the code, not that anyone has. For small unknown projects, a disposable fake repo faces almost none of the restraints a named vendor does.
