This side of the river is the old world. The other side is AI. I want to ferry us all across.
RSS FeedFull-stack developer for 24+ years. I formerly led a 400-person engineering team, and I'm still a core maintainer of several large open-source projects. Everything here is something I've actually built, run, or broken: AI engineering practice, open-source dynamics, infrastructure, and security.
中文读者请进 简体中文版 ——每篇文章都有中英双版。
Featured
I tore down HumanLayer's source code: it leashes your coding agent, but sessions move to its cloud
HumanLayer open-sourced its approval layer for coding agents. I read the source: the engineering is real, but there is a simpler path using the CLIs' own built-in doors.
Recent Posts
One robots.txt line to refuse AI training, and no single start date
Google, Microsoft, OpenAI and Anthropic say they will read one shared robots.txt line, __usage_ai-training, as a refusal of AI training. The catch: the document is still a draft, start dates are scattered into 2027, it covers training only, and it reaches nothing already trained. What to add now, and what to keep.
LEANN cut a 60-million-passage index from 201GB to 6GB. Is trading disk space for waiting time worth it?
Berkeley's LEANN drops full vectors from a RAG index and recomputes them at query time: a 60-million-passage index shrinks from 201GB to 6GB, chat-history index from 1.8GB to 64MB, at the same answer accuracy — but retrieval runs about 50x slower. When that trade is worth it, and when it isn't.
The Latest X.com Recommendation Algorithm Code, Decoded and Tested: 'Second Post at 62.5%' Is a Misreading
I checked X's public For You recommendation code line by line (baseline 5ed7963, plus October snapshots through 606b254): which viral claims — 'second post of the day drops to 62.5%', 'one author reply equals 150 likes', 'links are safe in the first reply' — have code behind them, and which are misreadings. Plus 49 open questions, the research scope, and full sources.
I scanned all the red-hot 3-character .si domains and picked out the 27 with the most investment value
SI now reads as short for super intelligence, and .si registrations jumped in September. I checked all 46,656 three-character .si combinations one by one: 24,827 can still be registered, every one of them mixes letters and digits, and an AI ranking picked out the 27 worth a second look. The full list of 24,827 names is in this post.
Your home directory got deleted? Don't look for an intruder. It may have been your own hand
The testmetest npm worm steals tokens, plants a watcher service called net-health-checker on your machine, and wipes the home directory on your computer the moment you revoke the stolen token. JFrog also found 42 real repositories armed with a hidden publisher that GitHub search cannot see.
Tokens from 850 GitHub accounts were stolen, and 13,500 branches were planted with a workflow built to dump repository secrets
Wiz's Gheist report: tokens stolen from more than 850 GitHub accounts were used to plant over 13,500 branches carrying a workflow that prints repository secrets. Nobody broke into GitHub. The payload is clumsy; the standing token is the problem, and the fix starts in your own config files.
