when the AI support agent passes you onto a human whose first message begins "you're absolutely correct, ..." 😐 thanks, now I just have LLM with a longer delay

well this looks like a great nerd-snipe: given a number, is there a way to quickly find its minimal representation?

been listening to the shellgame.co podcast and, wow, the LLM-dialect is so much more annoying when put through text-to-speech overall great concept though e.g. creating a voice clone of yourself and then sending it to therapy

on _multiple_ occasions I've watched automation go rogue and suspend accounts for an entire company since then, I've always built a fuse* into systems like this: if too much stuff tries to happen at once, the fuse blows (* an if-statement with a fancy name)

*not* having the company name on ID badges is pretty much corporate opsec 101 I wonder if the training data is polluted by all these etsy listings for Uber Eats drivers

oof, four years since my last (personal site) blogpost 🧟 so, like every other developer's new-year writing habit, I've started with a classic mistake: spending a bunch of time re-working the theme

> It’s not like there’s an increasing percentage of requests that fail as you get closer to the deadline. now there's an interesting idea for when we next shorten cert lifespans: for the last 7d of validity, clients should start intermittently failing an increasing percentage of requests

it's almost 2026 and a doodad I just bought came bundled with software/drivers on a CD

just 🤯 not just a hash quine (image which contains its own hash), but an image which can render *any* hex string without it's md5 changing

just used this to find two liked posts which were causing the majority of weird stuff in my feed 1. enter your handle 2. scroll through and click "explain" on anything weird 3. check "top source posts" for repeat offenders 4. go un-like them (I'm hoping that un-liking actually has an effect 🤞🏻)

interesting how there's a consistent-across-models mistake in which side of the plug opens (the location of the screw in step 4 is correct, but in reality it's the back of the plug that comes off, not the front)

storing hashed phone number pairs is a very smart way to do this obviously needs some further scrutiny, but this approach solves so, so many of the vulnerabilities you usually see in contact discovery systems

in a similar vein: a surprising number of cold-email bots assume you can get the company name by: stripping TLD from the domain name, and capitalising I get multiple emails a week congratulating me for founding Phish...

feels like the terminal is just an aesthetic choice now? wouldn't building an actual GUI be way simpler at this point? > [use] your mouse to click and navigate directly within the input > clean and polished display regardless of how you resize your window

honestly it'd be better if updating Chrome meant losing all my tabs i'd actually have a clean browser at least every couple weeks

my worst company docs experience: all the documentation used to be on Dropbox Paper, but it got too expensive so they did a crappy export to Google Docs of the most important ones and stopped giving people Dropbox access need to actually read a doc? better find an OG and get them to send you a PDF

opening the window before attempting a tricky refactor

Beautiful (ab)use of the go.bsky.app domain to make a pretty convincing link to the phishing site

From experience, this is incredibly hard (bordering on impossible) to do without enabling enumeration attacks But, perhaps they've pulled off something magical here? *enumeration attacks meaning you can plug in 100,000 phone numbers and get back a list of matching usernames

Huh, as ever it's incredibly hard to segment power users from small businesses Trying to think how you could (automatically) even detect the difference between a 100 user domain and a 1 user/100 email domain 🤔

huh, I've built a lot of complex stuff using [LLM coding tool], but trying to unwind some badly designed postgres row-level security policies is what's finally stumped it > ⚠ Heads up, you've used over 95% of your 5h limit.

this has a neat approach to fine-grained network filtering: sandboxed binary can only talk to a proxy which does hostname allowlisting every other sandbox I've seen only supports all or nothing network blocking but wow are they vibe-coding this (derogatory)

shame this isn't about a key signing ceremony like I first thought some interpretive dance would certainly be a welcome addition to the hours on end of plugging cards into HSMs

shame this isn't about a key signing ceremony like I first thought some interpretive dance would certainly be a welcome addition to the hours on end of plugging cards into HSMs

there needs to be a "Holidays" calendar but just for holidays where people traditionally set off fireworks takes me by surprise every year!

very annoying when vendors create their own completely custom file formats (and don't provide a grammar so you can parse things yourself) *but* it's wild that just giving codex/claude code/etc. a directory of examples and telling it to build a parser actually works?!?

cooked.wiki solves so many issues with the online recipe experience: it just extracts the steps, skips the author's life story puts the ingredient quantities *inline* in the step that actually uses them keeps your phone from locking (saves me from a lot of screen cleaning...)

wish I'd done this a loooong time ago. I'm finding so many utility providers where you can't update the email address on an account 😭 the only thing I'd add: spend some time to find a domain that's also a cute anagram of your names, it's fun!

have we tried just not outputting code that's immediately detected as broken? guess this would probably also happen if I reviewed my own PRs though...

🤯 dynamically generating og:images like this in pure Go is impressive most projects give up and use a headless browser to render a mini webpage and screenshot it Stealing this approach!

example.com is down? I wonder how many unit tests are failing right now

> go to check the GitHub status page > asked to accept cookies from Atlassian 🤔 I guess good on them for having their statuspage infra so separate from their main infra, that it's hosted by a competitor?

Ask an LLM for an OAuth2 implementation? Get boilerplate with hard-coded values where there should be randomised ones (e.g. state param) Mention "PKCE" and suddenly you get a perfect implementation...

"I'm behind 7 proxies" but they're in parallel not in series, because no single location has a full view of the internet

The new (beta) GitHub PR view *finally* lets you switch between unified and split diff without reloading the page 🙌🏻

OpenAI Codex has weirdly become my coding TODO list When I have a feature idea, bug, etc. rather than writing up a ticket, I just set Codex running on it When I come back to review, either I've got a mostly-mergable PR, or it's completely failed and I can convert to an actual ticket

Lol, if you're going to make unsubstantiated claims about your accuracy at least make them impressive Hundreds of thousands of new apex domains are registered every day, let alone subdomains... So 94% accuracy = 10,000+ false negatives/positives per day?

Hmmmm Of all the challenges in detecting phishing links, you'd have thought knowing a government domain was safe would be pretty simple?

It's surprisingly hard to build these types of security features without them becoming tools for phishers

As Bluesky has grown, I've seen a lot of backsliding on alt text. Please try to be considerate to others and include alt text with all of your images. It helps everyone. Indeed, in the "accessibility" setting in Bluesky you can set it to make sure you add alt text, which is a useful thing to do.

With all the people reading @theatlantic.com today it'd sure be nice if they weren't showing scam adverts...

Tired: check for the padlock to know a site isn't phishing Wired: check for a cookie consent modal to know a site isn't phishing

Ah yes, the optimal CO2 level for programming

For those of you who build security UIs: If the security UI is in the same place as attacker-controlled pixels, it's not a security UI. textslashplain.com/2017/01/14/t...

Turns out I've been running the 2023 version of Goland... I think the auto-update only updates patch versions, not "major" updates? This explains so many issues...

And this is why you use exponential backoff with jitter

Mad but I love it. Want to use a utility written in JS using your normal `go` toolchain? Just bundle it up with a javascript engine 🤯 Absolutely horrendous, but it avoids needing package.json so...?

I love this channel. Such great visualisations of how the model is learning over time

Yes DeepSeek obviously has filters and tuning to avoid certain topics, but maybe people need some media literacy and to choose the right tool for the job? I don't go looking on WebMD to learn about historical events in 1989

Easy way to discover bot accounts for just ~8¢ per bot