This side of the river is the old world. The other side is AI. I want to ferry us all across.
RSS FeedFull-stack developer for 24+ years. I formerly led a 400-person engineering team, and I'm still a core maintainer of several large open-source projects. Everything here is something I've actually built, run, or broken: AI engineering practice, open-source dynamics, infrastructure, and security.
中文读者请进 简体中文版 ——每篇文章都有中英双版。
Featured
I tore down HumanLayer's source code: it leashes your coding agent, but sessions move to its cloud
HumanLayer open-sourced its approval layer for coding agents. I read the source: the engineering is real, but there is a simpler path using the CLIs' own built-in doors.
Recent Posts
The Latest X.com Recommendation Algorithm Code, Decoded and Tested: 'Second Post at 62.5%' Is a Misreading
I checked X's public For You recommendation code line by line (baseline 5ed7963, plus October snapshots through 606b254): which viral claims — 'second post of the day drops to 62.5%', 'one author reply equals 150 likes', 'links are safe in the first reply' — have code behind them, and which are misreadings. Plus 49 open questions, the research scope, and full sources.
I scanned all the red-hot 3-character .si domains and picked out the 27 with the most investment value
SI now reads as short for super intelligence, and .si registrations jumped in September. I checked all 46,656 three-character .si combinations one by one: 24,827 can still be registered, every one of them mixes letters and digits, and an AI ranking picked out the 27 worth a second look. The full list of 24,827 names is in this post.
Your home directory got deleted? Don't look for an intruder. It may have been your own hand
The testmetest npm worm steals tokens, plants a watcher service called net-health-checker on your machine, and wipes the home directory on your computer the moment you revoke the stolen token. JFrog also found 42 real repositories armed with a hidden publisher that GitHub search cannot see.
Tokens from 850 GitHub accounts were stolen, and 13,500 branches were planted with a workflow built to dump repository secrets
Wiz's Gheist report: tokens stolen from more than 850 GitHub accounts were used to plant over 13,500 branches carrying a workflow that prints repository secrets. Nobody broke into GitHub. The payload is clumsy; the standing token is the problem, and the fix starts in your own config files.
274 Elvis songs were used to train AI. Here's how the rights holders found out
The Elvis rights holders sued Anthropic over 274 songs. How they checked is the part that matters for everyone else: question the model, search the public corpora, try statistics — and where each of those stops.
The clock in your prompt is quietly killing your cache
A timestamp that changes every second, sitting on line one of your prompt, breaks prefix matching from the first character, so the tens of thousands of fixed words behind it get billed at full price on every request. ProjectDiscovery changed the timestamp to day precision: cache hits went from 3.2% to 91.8%, and their LLM bill dropped 59%.
