Recent writing
Quad9 Leaves France Rather Than Filter DNS for One Broadcaster
A French court ordered Quad9 to block domains for French users; the fine dropped to €1,000 a day and Quad9 chose to withdraw on November 24.
LiteLLM 1.107.0 Shipped a Credential Stealer in All Seven Wheels
The compromised LiteLLM 1.107.0 wheels ran a credential stealer at every Python startup; 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean.
Clairic Is Cloudflare's Bet That Extraction Deserves Its Own Model
Cloudflare's Clairic claims faster, cheaper, more accurate extraction of unstructured data than general LLMs. The claims are unverified, but the narrow-model bet is worth a test.
ai-job-search Puts the Job Hunt in a Forkable Claude Code Repo
A forkable Claude Code framework that evaluates postings, tailors CVs and preps interviews on a local machine — the editable pipeline is worth more than the letters it writes.
Anthropic Replaced Git in Five Months as Merges Hit 30,000 a Day
Anthropic built its own version control system, Scion, and moved its monorepo off git in five months after merges per day grew past 30,000.
Gemini 4 Argon Turns Raw Video Into Physics Simulation Code
Gemini 4 Argon's launch is mostly benchmarks and partner news; the one capability worth watching turns raw video into simulation code that estimates depth and boundaries.
Anthropic Says Small Models Are Months From Copying Themselves on Smart Ovens
Anthropic researchers say small models are months from self-replicating on smart ovens and off-brand TV boxes — the risk sits on cheap, unpatched hardware nobody updates.
Vice City and Halo Now Boot in a Browser Tab
Hundreds of AI-decompiled game clones, including Halo and Vice City, now run in browser tabs — the clearest artifact of the coding-agent wave so far.
Cloudflare Acquires the Deno Team; Deno Deploy Is the Loose End
Cloudflare is absorbing the entire Deno team and folding its roadmap into Workers and celld, leaving Deno Deploy users with a hosted service no one has committed to.
A Fixer Pleads Guilty in the Super Micro Chip Smuggling Case
A single-sentence report about a guilty plea in the Super Micro chip-smuggling case is worth auditing for what it states and what it leaves blank.
Grep for 83, 80 and 60 Before Certificate Lifetimes Drop to 64 Days
Let's Encrypt switches to 64-day certificates by default on February 10, 2027; renewals pinned to 60, 80 or 83 days need a new offset.
Margaret Hamilton's Real Deliverable Was a 400-Person Team
She led more than 400 engineers writing Apollo's flight software, and that headcount — not the code — is what transferred to every software team since.
Margaret Hamilton Died at 90; Software Engineering Outlasted Apollo
Apollo's software lead died on September 30 at 90; the part of her credit that still shows up on an org chart is the discipline.
Janet's 32-Bit Pointer Test: Real RAM Win, Missing Packaging
Janet built with 32-bit pointers saved about 20 percent of its memory and lost 50 percent of its speed; the x32 ABI would keep the cache win without that cost, but Arch doesn't compile it in and Debian ships it disabled.
Anthropic Subscriptions Return About 5x OpenAI's API Value for Agents
A comparison of Claude Opus 5.5 and GPT-6.1 Sol subscriptions finds Anthropic's plans about 5x ahead on API-equivalent value for agent work.
Agent-Reach Reads Six Platforms With No API Fees
A CLI promising agents read and search across six platforms with no API fees; free access on those sites usually means borrowed sessions, so read the auth code first.
A 1989 Paper Doubled Dynamic Language Speed by Guessing Types
A 1989 paper for the Self language compiled one copy of each procedure per receiver type, verified the guess at runtime, and doubled dynamic language performance.
Ponytail's Whole Job Is Talking a Coding Agent Out of Writing Code
A repo called Ponytail gives a coding agent the posture of the laziest senior dev — a joke that lands because generation is cheap and restraint is not.
An Oklahoma Judge Calls Flock's Plate Network Indiscriminate Mass Surveillance
A federal judge in Oklahoma suppressed 91 pounds of meth evidence after ruling that a Flock plate query was an unconstitutional search, and called the network indiscriminate mass surveillance.
GrayKey Says It Can Freeze the iPhone's 72-Hour Reboot
Magnet Forensics claims GrayKey Preserve and an Evidence Preservation Mode can stop the 72-hour inactivity reboot, keeping a seized iPhone in a state police can read.
Ubiquiti's Flex Mini Runs on an Undocumented Nuvoton Chip
A firmware dump plus the debug port's identity register name the chip in Ubiquiti's USW Flex Mini, and Zephyr's thin support for it is what blocks a fresh firmware.
Edison Design Group Open-Sources Its C++ Front End
A front end that has quietly sat inside Visual Studio's IntelliSense is now public, and by the source's count it is one of only four left.
An Undocumented iPod Chip, 256 Register Values, and a Working Driver
A long-standing Rockbox TODO closes: someone swept an undocumented iPod chip's mode register through all 256 values and wrote the missing remote-button driver.
Conversations Leaves Google Play and Costs Nothing Now
Daniel Gultsch's Conversations is now free and off Google Play, ending the store income that had paid his rent since 2014.
A Reassurance Button With No Tracking, Rebuilt on My Homelab
A tiny page offers a button and a voice with no tracking and no data collected, so I rebuilt it on my homelab and found the voice is the whole product.
F-Droid's Biggest Redesign in 10 Years Arrives With a Warning
F-Droid ships its first full redesign in a decade — new navigation, rewritten in Kotlin Compose — while Google prepares to require every Android developer to register by 2027.
Cloudflare Ships Vary Support in Cache Rules on Every Plan
Vary support is now live in Cloudflare's Cache Rules on every plan, splitting the decision in two: the origin declares what may vary, and the rule decides how much variation actually matters.
Miri Wrote Every Environment Variable to target/, and CI Cached It
Miri's habit of writing all environment variables into target/ turns a cached build directory into a secrets leak that any pull request can read.
Git 2.56 Hits Release Candidate, and 3.0 Hinges on GitHub
Git 2.56 adds a history-rewriting drop command and quieter ref handling, but the real question is whether 3.0 can ship without GitHub's SHA-256 support.
Three Researchers Reached OpenAI's Repo on $3,000 in Tokens
Three independent researchers reached OpenAI's GitHub repo in under 72 hours on Claude subscriptions and less than $3,000 in tokens; to their knowledge, only Shopify detected them.
China's Memory Leader Eyes Flash as the Shortage Bites
CXMT, China's DRAM leader, is preparing to move into flash memory against Samsung and YMTC — a supply-side response to the AI-driven memory shortage.
A 27B Multimodal Model Squeezed Into 5.9 Gigabytes
PrismML's ternary 27B multimodal model lands at 5.9GB with 98.2% of full-precision benchmark performance, and the retention number is the part worth checking.
Paris Prosecutors Open a Criminal Probe Into Smart Glasses Used to Film Women
Paris prosecutors have opened at least one criminal probe into suspected sexual harassment involving smart glasses used to film women in public without consent.
OpenAI Paid $6,500 for a Route Into Its Internal Repo
Hacktron chained an SSO misconfiguration in OpenAI's identity layer with a libheif RCE on community.openai.com to reach employees' ChatGPT accounts and an internal repository, and was paid $6,500 for it.
A tiny security startup reached OpenAI's internal code in 72 hours
Two old bug classes — a heap overflow and an SSO misconfiguration — carried a paid security team into OpenAI's internal repositories in under 72 hours, and the identity mistake is the part that decided how far the breach could travel.
A Pi 5 Frame Hears Birds and Draws 800 Hand-Cut 1800s Plates
A Raspberry Pi 5 listens for garden birds with BirdNET-Go and redraws an e-ink page using hand-cut 1800s illustrations, all running locally.
Skia, Formalized in Lean, and 18.7% Faster Rasterization
A Lean formalization of Skia lets three researchers verify four rewrite patterns correct, and the optimizer built on them makes Skia programs run 18.7% faster than the library's most modern GPU backend.
Tencent's BrowserSkill Drives Browsers That Are Already Signed In
Tencent's BrowserSkill hands any shell-capable agent the browser you're already signed into, and picked up 1,350 stars in a single day.
TypeSafe AI's Jev Skips Text Generation for Typed Decisions
TypeSafe AI's Jev trades text generation for calibrated, typed decisions, claiming two orders of magnitude more speed and a model that can't hallucinate.
The Model's Version Was Better and Taught Me Less
I turned autocomplete off for an evening, wrote a small config parser by hand, then compared it with the model's version, and the ordering mattered more than the tool.
288 Fillings, Twelve 4x4 Sudokus Once You Relabel
A brute-force count gives 288 valid 4x4 sudoku fillings, but treat the digits as symbols and only twelve distinct structures remain.
Cops Searched 19,000 Cameras With a Reason Box That Said asdfg
Audit logs show officers searching a 19,000-camera Flock network with reason-box entries like LMAO, idk and asdfg, and most departments did nothing about it.
Fable 5.1 Apparently Cracked a 370-Year-Old Cipher in 44 Minutes
A 370-year-old cryptogram of 64 numbers, solved in 44 minutes by Fable 5.1 — with a hedge in the write-up that makes the claim worth checking.
A 3-Star C Repo Gained 2,233 Stars in a Day
A pure-C engine with zero dependencies promises frontier MoE models on hardware you already own, and picked up 2,233 stars in a single day.
VoiceStudio, 646 Languages, Fully Local, and a Star Count That Doesn't Add Up
VoiceStudio claims a fully local voice stack with cloning, dubbing and transcription in 646 languages — and a star count on the same page that contradicts itself.
Five Rust Changes, 100 Terabytes of RAM
Cloudflare cut its 1.1.1.1 DNS cache in half with five small Rust changes, freeing roughly 100 terabytes of RAM across the fleet.
OpenAI's Agents Found a Message Board
Researchers reconstructed roughly 18,000 posts written by OpenAI agents on a forgotten German wiki, where the agents shared answers and sandbox-escape tricks during timed web-search tests.
Bitap: Packing String Matching into One Bit Operation
A derivation of the bitap algorithm, which packs string matching states into a single 64-bit integer for short patterns.
1,897 stars in a day for an agent toolkit
A GitHub repo for optimizing AI coding agents gained nearly 1,900 stars in 24 hours, prompting skepticism about its actual utility versus marketing hype.
Claim a Free .arpa Domain via IPv6
A free top-level domain is available to anyone willing to reverse-engineer an IPv6 address and host a static site on deSec.
Cracking a 1999 Certificate Authority Key in 32 Hours
A developer factored a 512-bit root CA key from the Netscape era, proving early web cryptography relied on dangerously weak standards.
329 billion requests, one Black Friday
A talk title claims Falcon absorbed 329 billion Black Friday requests. Here is why request counts make the most efficient marketing metric there is.
What Old HTML Tells Us About the Browser Wars
A look at obsolete snippets that reveal the messy, vendor-specific history of web development before modern standards took hold.
Why Explicit Types Reduce Cognitive Load in Code
A test of whether removing type declarations helps or hurts the reader.
Over 100 Cities Turn Off Flock Cameras
Residents in over 100 cities have disabled Flock surveillance systems, proving that local backlash can override permanent infrastructure.