xophe @xopheb

Everybody hates AI mandates -- unsurprisingly, since most of them are terrible and poorly resourced. But they don't have to be terrible. A mandate plus enablement is the most honest and effective way to fund a lot of change on a tight timeline. charitydotwtf.substack.com/p/in-defense-o…

I poured my 10 years of teaching experience into a skill. It's called /teach, and it can teach you anything. Here's how it taught me to solve a Rubik's cube:

A DEVELOPER PROVED THE REGEX YOU'VE WRITTEN A THOUSAND TIMES IS SECRETLY A COMPILER AND THAT ALMOST NO ONE WHO USES THEM HAS ANY IDEA WHAT ACTUALLY RUNS 36 minutes from Paul Wankadia, the engineer behind a regex engine that compiles your pattern straight down to raw machine code -- walking through what really happens between the slashes. -> The moment it clicks, regex stops being magic punctuation you paste from Stack Overflow and becomes what it actually is: a tiny machine. Your pattern gets turned into a state machine, and that machine is what runs against every character of your text. That one idea explains everything you never understood. Why one regex returns instantly and a nearly identical one hangs your whole server. Why some patterns are safe and others are a denial-of-service waiting to happen. It was never random -- it's whether the machine underneath is built well or badly. Writing a regex was never the skill -> reading one is. And now that an AI agent hands you dense, clever patterns you'd never write yourself, the person who can see the machine underneath is the one who catches the one that takes down production at 3am. Everyone copies regex and prays. This is the talk that ends the praying. Save it. The next time a pattern "Just works," you'll actually know why ↓

slash1s @slash1sol

4 weeks ago

A DEVELOPER MADE A REAL COMMIT WITHOUT EVER TYPING GIT ADD OR GIT COMMIT -- JUST TO PROVE THE COMMANDS YOU LIVE BY ARE A THIN SHELL OVER A DATABASE YOU'VE NEVER ONCE OPENED 55 minutes from Tim Berglund, a longtime Git teacher and GitHub evangelist, taking the tool apart down to

24 67 642 237K 1K

Un `SKILL.md` signé Google Chrome pour injecter les bonnes pratiques web modernes directement dans vos agents de code — APIs natives, performance, accessibilité, au lieu des vieux patterns que les LLMs reproduisent par défaut. github.com/GoogleChrome/m…

open sourcing Marlin-2B 🐟 a tiny VLM to extract structured information from videos Marlin is finetuned for two questions devs want to ask in their videos: what is happening, and when? Best open model in its weight class, competitive with Gemini-2.5-flash at only 2B params 🧵

Every AWS Lambda invocation runs in a full VM that boots in under 125ms. Firecracker is the ~50,000 line Rust binary that makes that possible. I wrote an interactive blog about it, with components you can play with.

Kyle Jeong @kylejeong

2 months ago

x.com/i/article/2052…

5 25 296 266K 573

Public github repo is live with plan: github.com/namanbarkiya/i…

You're in a Research Scientist interview at Google. Interviewer: We have a base LLM that's terrible at maths. How would you turn it into a maths & reasoning powerhouse? You: I'll get some problems labeled and fine-tune the model. Interview over. Here's what you missed:

🍾 aube v1 stable github.com/endevco/aube

| |- diffs[dot]com |- trees[dot]software

Duncan @ephraimduncan

2 months ago

building a simple git client using diffs.com and trees.software 🪾

22 22 539 67K 328

Update: we merged it 😅 The next release of Dagger will be buildkit-free.

keyboard_arrow_left Previous keyboard_arrow_right Next

Solomon Hykes @solomonstre

3 months ago

FYI, Dagger is about to move off Buildkit, to a cleanroom reimplementation. This matters beyond Dagger. Buildkit is load-bearing infrastructure for a huge chunk of CI/CD. It has fundamental limitations that are getting harder to work around, but it's too entrenched and complex

12 16 127 34K 54

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software. It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans. anthropic.com/glasswing

HE HAS RETURNED TO OPEN SOURCE DEVELOPMENT LET'S FREAKING GOOOOO github.com/maaslalani/she… Great person to follow if you're looking for project inspo. He's always building fun stuff.

Orange a commencé depuis 00h l'extinction de son réseau 2G en France. Le GSM, lancé en 1992, tire sa révérence après 34 ans de service. Un thread sur pourquoi c'est plus qu'un simple changement technique 🧵👇

do you understand what just happened to one of the most used npm packages on the internet? → axios gets downloaded over 100 million times a week and today it got compromised → an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions → [email protected] and [email protected]… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine → the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too → there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely → StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package → a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself this is the wake up call all vibe coding bros need to hear right now: → if you installed either version… assume your system is compromised → pin to [email protected] or [email protected] → rotate all secrets, API keys, SSH keys, and credentials on affected machines → check network logs for C2 connections → add –ignore-scripts to CI npm installs going forward 100 million weekly downloads and one compromised maintainer account… that’s all it took to wreak absolute havoc and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding be safe out there y’all

Feross @feross

3 months ago

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios

539 4K 16K 12.4M 7K

Introducing TurboQuant: Our new compression algorithm that reduces LLM key-value cache memory by at least 6x and delivers up to 8x speedup, all with zero accuracy loss, redefining AI efficiency. Read the blog to learn how it achieves these results: goo.gle/4bsq2qI

⚠️ Coucou les copains par pur but préventif faites attention quand un site vous demande de copier cette commande dans un “terminal” Regardez le texte à copier dans la base de recherche et regardez réellement ce qui est copié dans le clipboard ⚠️ Faites attention !

keyboard_arrow_left Previous keyboard_arrow_right Next

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets. A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic. open.substack.com/pub/calif/p/a-…

x.com/i/article/2026…

the French government’s MCP is better designed than 99% of MCP servers coming from tech companies citizens can use agents to understand how their money is spent

Antonin Garrone @antonin_garrone

4 months ago

Les données disponibles sur data.gouv.fr sont désormais interrogeables via un serveur MCP dédié en experimentation, vos retours sont bienvenus ! 💻 Le code est ouvert et accessible sur GitHub : github.com/datagouv/datag… Pour en savoir plus : data.gouv.fr/posts/experime…

113 381 2K 613K 2K