CA residents: Just a few clicks to let your rep know you don't want your 3D printer turned into a camera into your home. www.eff.org/deeplinks/20...

Huh if you live long enough, you really start seeing the cycles.

Happy belated birthday to Octavia Estelle Butler, born June 22, 1947

"We have full audit logs" is the most reassuring sentence in agent infrastructure, and the most misleading. An audit log catches the second incident, not the first. It is a forensic tool, not a control.

Studio Ghibli turns 41 today!

To paraphrase Steve Martin’s speech at the Academy Awards regarding Crouching Tiger, Hidden Dragon: it’s because they are fabled and therefore mythical.

And today, on the centenary of Gaudí's death (10 June 1926), the central tower is to be inaugurated (it was actually topped out on 20 Feb)

The elephant in the room for web application security and privacy protection is that we cannot have it without breaking the web’s original sin: irrevocable trust of the publisher and its services. We need a new kind of application platform, based on web tech, but not on the web. kriskowal.com/giants

It is an interesting thing that it seems like no matter how you feel about AI use, any communication that you receive that smells of AI often elicits a kind of negative vibe

The industry spent years trying to make LLMs ignore malicious instructions. Turns out the cheaper bet is making sure a compromised agent can't reach anything it wasn't handed. Least authority. References as permission. We've had this since the E language.

Hi, I'm Ken. I impulse-buy domain names. I should probably sell some of them: - gastown.ai - apilint.com - civicapi.com - macroscale.io - opsfox.com - timelydb.com

We need to decouple identity from authorization.

english isn't for cowards. if you're not saying 'torpify,' that's a skill issue. there's no Académie Française telling you what to do. if you try to type 'pallific' and freak out when you see a little red underline, maybe you're not ready to roll with the big dogs.

Ted Chiang on AI: www.theatlantic.com/philosophy/2...

Stop trying to make the agent trustworthy. Make the authority you hand it small enough that you do not have to. That is the only design that survives a model swap, a vendor change, or a jailbreak.

slop is something that takes more human effort to consume than it took to produce. When my coworker sends me raw Gemini output he’s not expressing his freedom to create, he’s disrespecting the value of my time

There was also once a BBS in Ann Arbor during my student days with the unfortunately named pair of operations `signin` and `logoff`. It's possible that the operator was trolling his users, because he was kind of a jerk. But also possible that he wasn't, because he was also kind of dumb.

The words upstream and downstream are hereby forbidden. kriskowal.com/naming-thing...

LLMs make it easier to both: - write less rigorous software - write more rigorous software than before. Both are valuable. It’s a fatal mistake to be confused about which mode you want to be in.

I've been mostly working on remote servers as my "sandbox" via vscode remote ssh for a while, as local containers don't offer the build power I need. Two tricks that made it easier for me:

Things will not be as they are.

We share a fragile collective delusion that the part of a platform that maintains security invariants is all written in C and that there’s a hard line where no load bearing code is running in a JavaScript virtual machine.

When a company discovers that AI makes them x% more productive and decides not to be x% more ambitious but instead lays off x% of their workforce and gives their current investors an x% bonus, they have decided to compete with a host of sole proprie-prompters and robbed their own future.

Some more validation for hardenedjs.org: Mythos pen-testing in Firefox was frequently thwarted by frozen prototypes in the host process. hacks.mozilla.org/2026/05/behi...

Ever loaded two copies of the same JS library into one realm & watched them refuse to recognize each other? There's a name for the way out now. We're calling it 'Spackle.' Read more about it in our latest blog post. tinyurl.com/4ndvn4ed

"Just give the agent your API key" is the password-reuse moment of the agent era. Full credentials handed to software that decides what to do with them at runtime. We have seen this movie.

Happy to see the AI models learned the chauvinism and imperial blindness as well. Had Claude review my write-up, it did and explained how some mistakes are clearly attributed to my Russian background. I went WTF I'm Ukrainian, it said oh yeah I assumed from your surname... My surname is Armenian.

Or, they could simply call it Gate.

Check out the reviews: binary board book for babies is edible! www.amazon.com/dp/B0F9VCF3TN

How does MetaMask let third-party Snaps run inside the wallet? Capability-based confinement on top of Endo. Snaps is one of two production users named on the Endo README, alongside Agoric. github.com/endojs/endo

Remembering my late father because of his steam powered car hobby.

Rhubarb season reminds me of my favourite silly German video, about Barbara's rhubarb bar (which naturally serves beer to barbarians and barbers from a barmaid named Bärbel) I think it's relatively understandable if you don't speak German thanks to this charming animation youtu.be/gG62zay3kck

If you have suddenly unlocked a superpower that allows everyone you employ to be 2x (4x, 10x, whatever) more efficient and your response is to lay off a bunch of people instead of *doing more stuff*, why do you even run a company?

Hey @firefox.com @webdevs.firefox.com @jakearchibald.com What are your thoughts on the Import Bytes proposal? github.com/mozilla/stan...

What is democracy for if we cannot compel all data centers to be shaped like pyramids.

who decided to call it speculative execution and not cache me if you can

makes sense

Today I got to tell a native french speaker my favourite french linguistics fact, which she didn't already know and was delighted to learn!

Cowbert, 1999 🧵

Thank you very much for reading it! An interesting question there – I believe the answer you're after is that the alphabet was itself affected by the GVS. Because since the Romans the vowel letters' names were simply the long vowels they represented, they were targets for the shift too.

@dannybate.bsky.social I very much enjoyed WQNU. I came out with a better understanding of how “long” vowels were actually long before they shifted into diphthongs. It left me even more curious how we arrived at the coincidence that each vowel’s name is the same diphthong.

The second half of the "ghost s" thing in French is that many words beginning with é + consonant used to have an s there instead (you can see the intermediary step in Spanish) school escuela école (Latin: schola) spouse épouse esposa student étudiant estudiante

We have a “for bots” fork of the Endo repository and I’m running agents in a VM from a bot account that only has write access to that one repository. 🧵

And Christopher Clavius, the nerd behind the Gregorian calendar, liked to calculate times to the fourth (1/3600th of a second).