This side of the river is the old world. The other side is AI. I want to ferry us all across.
RSS FeedFull-stack developer for 24+ years. I formerly led a 400-person engineering team, and I'm still a core maintainer of several large open-source projects. Everything here is something I've actually built, run, or broken: AI engineering practice, open-source dynamics, infrastructure, and security.
中文读者请进 简体中文版 ——每篇文章都有中英双版。
Featured
I tore down HumanLayer's source code: it leashes your coding agent, but sessions move to its cloud
HumanLayer open-sourced its approval layer for coding agents. I read the source: the engineering is real, but there is a simpler path using the CLIs' own built-in doors.
Recent Posts
I scanned all the red-hot 3-character .si domains and picked out the 27 with the most investment value
SI now reads as short for super intelligence, and .si registrations jumped in September. I checked all 46,656 three-character .si combinations one by one: 24,827 can still be registered, every one of them mixes letters and digits, and an AI ranking picked out the 27 worth a second look. The full list of 24,827 names is in this post.
Your home directory got deleted? Don't look for an intruder. It may have been your own hand
The testmetest npm worm steals tokens, plants a watcher service called net-health-checker on your machine, and wipes the home directory on your computer the moment you revoke the stolen token. JFrog also found 42 real repositories armed with a hidden publisher that GitHub search cannot see.
Tokens from 850 GitHub accounts were stolen, and 13,500 branches were planted with a workflow built to dump repository secrets
Wiz's Gheist report: tokens stolen from more than 850 GitHub accounts were used to plant over 13,500 branches carrying a workflow that prints repository secrets. Nobody broke into GitHub. The payload is clumsy; the standing token is the problem, and the fix starts in your own config files.
274 Elvis songs were used to train AI. Here's how the rights holders found out
The Elvis rights holders sued Anthropic over 274 songs. How they checked is the part that matters for everyone else: question the model, search the public corpora, try statistics — and where each of those stops.
The clock in your prompt is quietly killing your cache
A timestamp that changes every second, sitting on line one of your prompt, breaks prefix matching from the first character, so the tens of thousands of fixed words behind it get billed at full price on every request. ProjectDiscovery changed the timestamp to day precision: cache hits went from 3.2% to 91.8%, and their LLM bill dropped 59%.
Rust is replacing C by never rewriting it
C is not being beaten or rewritten. It is being retired the quiet way: the conservative projects have all adopted the same rule — old C stays untouched, and every new component gets written in Rust. The stock of C decides how long it lives; the flow of new code decides whether it is still alive.
