Search the archive

LIGHTER BECOMES #1 APPCHAIN L2 ON ETHEREUM

Lighter, a ZK rollup-based perps exchange, has increased to $1.15B TVL and ranks as the #6 overall L2 and top appchain L2 on Ethereum.

FICTIONAL CHARACTERS ARE OFFICIALLY COMING TO SORA AS OPENAI MANAGES COPYRIGHT CHAOS

OpenAI's Sora team leader, Bill Peebles, announced that officially sanctioned fictional character cameos are coming to the video platform, following widespread unauthorized use of copyrighted characters, including disturbing SpongeBob and Pokémon content. CEO Sam Altman reversed the company's opt-out copyright policy over the weekend, promising rightsholders more granular opt-in controls similar to likeness rights and introducing revenue sharing for character usage. The payment model details remain uncertain and will require experimentation to finalize, though Altman claims rightsholders are enthusiastic about enabling "interactive fan fiction" on the platform.

DISNEY+ LAUNCHING NEW NAVIGATION AND UX DESIGN

Disney+ is rolling out a major redesign featuring a new top navigation bar with dedicated tabs for Disney+, Hulu, and ESPN, as well as an algorithm-powered "For You" homepage that personalizes content recommendations. The overhaul includes visual updates, such as cinematic poster artwork, video carousels, and new badge tags, including "Season Finale" and "New Movie," to highlight timely content. These changes coincide with Hulu's global launch on Disney+ on October 8, as the company prepares for a fully unified app experience in the US in 2026.

AIRPODS MAX 2: HERE'S WHAT RUMORS SAY IS COMING NEXT

Apple is reportedly developing a lighter AirPods Max 2 with an updated H-series chip, finally adding features found in newer AirPods models. However, the next-generation version isn't expected until 2027, so Apple plans to continue supporting the current USB-C model for several more years.

TYPOGRAPHY SYSTEMS THAT DON'T SUCK: THE NO-BS GUIDE TO DESIGN-DEV ALIGNMENT

A typography system that aligns designers and developers starts with real screen designs, extracting patterns by function and organizing them into clear hierarchies with explicit scales for size and weight. The approach emphasizes using Figma variables for core properties and semantic naming conventions that mirror code tokens, making systems developer-friendly and eliminating guesswork. By establishing structured, flexible systems that both teams understand, organizations can reduce friction and focus on addressing meaningful problems rather than engaging in endless pixel-pushing debates.

WHY TASTE MATTERS MORE

Taste—the cultivated ability to discern what matters—is more crucial than technical knowledge or experience, which can be learned or automated. While knowledge provides the "how" and experience brings efficiency, taste creates vision, distinction, and cohesive design with character. In an era where AI replicates knowledge efficiently, taste remains the scarce, irreplaceable quality that truly differentiates designers.

THE PERILS OF PREFERENCE TESTING, PLUS 4 GUIDELINES IF YOU MUST

Preference testing in UX research often produces misleading results because human choices are heavily influenced by cognitive biases such as framing, choice blindness, substitution, and aesthetic-usability effects. Studies show that what users say they prefer rarely aligns with what performs best in usability, so researchers should prioritize measurable metrics like task success, efficiency, and satisfaction over opinions—and if preference questions must be included, they should be supported by deeper analysis and independent usability measures.

EXPLORE INTERACTIVE GENERATIVE DESIGN EXPERIMENTS

Gallery of generative art, which draws graphics using code, with practical applications for visual identity.

AI TOOLS FOR CREATIVES

Professional AI-powered tools and free utilities for all your creative needs.

TYPOGRAPHER

Typographer is a new app by The Type Founders that lets designers easily discover, test, and collaborate with high-quality fonts without upfront licensing hassles, streamlining the creative workflow for pitching and prototyping.

SIX WINNING FIGMA MAKES—AND WHAT YOU CAN LEARN FROM THEM

Figma's first global Make-a-thon attracted over 10,000 creators competing for $100,000 in prizes. Showcasing innovative projects, winners emphasized strategies such as defining clear structural requirements, refining designs before building, utilizing modular code organization, and leveraging shorter prompts for easier iteration. The competition demonstrated Figma Make's capability to bridge design and development, with projects ranging from custom font creators to weather-based synthesizers and AR package designers.

DESIGNING AGENTIC LOOPS

Coding agents like Claude Code can brute force solutions by running tools in loops, but require carefully designed "agentic loops" with appropriate tools and credentials to be effective. Running agents in YOLO mode (auto-approving commands) within sandboxed environments like GitHub Codespaces balances productivity with security risks, including data loss and exfiltration attacks. This approach works best for problems with clear success criteria involving trial and error, such as debugging, performance optimization, or dependency upgrades, especially when supported by solid automated test suites.

HOW PONDER CHALLENGED BLAND BI BRANDING WITH TANDEM'S SEVEN-PIXEL LOGO

Tandem, a Copenhagen-based BI consultancy, partnered with PONDER to create a bold, human-centred brand that breaks away from the industry's generic, tech-driven sameness. Centered on the theme of duality—balancing technical precision with commercial accessibility—the new identity features a minimalist seven-pixel gear logo, a flexible pixel-based design system, balanced typography, and a warm yet professional color palette, resulting in a brand that feels both systematic and approachable, reflecting Tandem's mission to make data solutions people actually want to use.

CALIFORNIA BANS NOISY ADS ON NETFLIX, YOUTUBE, AND OTHER STREAMING SERVICES

California Governor Gavin Newsom signed legislation requiring streaming platforms, such as Netflix, Hulu, Prime Video, and YouTube, to air commercials at the same volume as their content starting in July 2026.

TAYLOR SWIFT, DEFENDER OF ARTIST OWNERSHIP, ALLEGEDLY USES AI IN VIDEOS

Promotional videos for Taylor Swift's new album, "Life of a Showgirl," contained numerous visual inconsistencies that suggested AI-generated imagery, including nonsensical text, morphing objects, and disappearing elements, which fans quickly identified.

NEGOTIATING TRUTH

Modern search and AI systems have turned information-seeking into a negotiation of truth, where the speed and confidence of delivery influence belief more than accuracy.

I'M BUILDING A BROWSER FOR REVERSE ENGINEERS

This article goes over the process of building a custom browser for web reverse-engineering to streamline the process of analyzing browser fingerprinting and anti-bot techniques. The project started with a simple browser extension for hooking JavaScript functions but evolved to use the Chrome Devtools Protocol for deeper access. Eventually, Chromium was forked to create custom events for stealthier instrumentation. The final browser includes features like deobfuscation, property overrides, and automated decryption of fingerprinting payloads.

HOW WE FOUND A BUG IN GO'S ARM64 COMPILER

Cloudflare discovered a race condition bug in Go's arm64 compiler due to high traffic volume. The bug caused sporadic panics on arm64 machines related to stack unwinding, which were initially thought to be rare stack memory corruption. Through deep investigation and debugging, it was found that async preemption during stack pointer adjustments in the `(*NetlinkSocket).Receive` function led to an invalid stack pointer during garbage collection, causing the unwinder to crash.

SVELTE REALLY IS THAT FAST

A study compared the rendering performance of Angular, React, Vue, Svelte, and Blazor JavaScript frameworks. It found that Svelte consistently outperformed the other frameworks in various benchmarks, especially at creating and updating elements. Svelte's performance is due to its reactivity system, optimizing compiler, and binding-based rendering.

SEEING LIKE A SOFTWARE COMPANY

Large software companies prioritize legibility (measurability and predictability) over efficiency. While small companies can thrive with illegible, engineer-driven work, large companies require legibility for planning, enterprise deals, and coordination, even if it slows down individual engineers. To balance this, companies create temporary "zones of illegibility" for urgent problems and rely on informal backchannels.

HOW TO *ACTUALLY* TEST YOUR README

Devs should test their software's installation instructions on a fresh virtual machine. When doing so, they should document every step taken during the installation process, including installing dependencies, and then transferring that documented history to the README file to guarantee accuracy and completeness.

THE PROGRAMMER IDENTITY CRISIS

The rise of AI and LLMs threatens the core identity of programmers as craftspeople. Vibe-coding and specification engineering have turned programmers into operators rather than creative problem-solvers. This shift removes a lot of the joy and fulfillment of programming.

ELEVENLABS UI

ElevenLabs UI is an open-source collection of customizable agent and audio components. It provides interactive visualizations like agent orbs that reflect agent states (idle, listening, and talking) and real-time audio visualizations with smooth scrolling waveforms. The UI also includes components for voice chat, music playback with controls, and a conversation interface with text and voice input options.

FLEETCODE

FleetCode is a desktop terminal application for running multiple CLI coding agents like Claude or Codex in isolated Git worktrees, allowing for parallel and persistent sessions. It has terminal theming, setup commands, and MCP server management, all configurable through a settings panel.

UT

ut is a fast and lightweight CLI utility toolkit for devs. It provides a variety of tools for encoding, hashing, data generation, text processing, development, web and network tasks, color manipulation, and Unicode reference.

MY FIRST CONTRIBUTION TO LINUX

This dev's first contribution to the Linux kernel was adding support for the hotkeys on their 2005 Fujitsu Lifebook S2110 laptop. They go over the process of identifying the relevant driver, studying the code to understand how it handles key events, and modifying it to recognize the media keys. They submitted their patch through the traditional email workflow and saw that it merged into the upstream kernel.

WHY WE NEED SIMD (THE REAL REASON)

SIMD (Single Instruction, Multiple Data) instructions give performance gains at a relatively low cost by reusing existing CPU infrastructure. This lets a single instruction perform multiple operations simultaneously. The adoption of SIMD has been hampered by the need for software updates to use new instructions. However, recent advancements are helping increase adoption.

THE EMAIL THEY SHOULDN'T HAVE READ

This dev helped Agency B and C transition to an open-source mail stack, angering their current provider, who used hidden clauses in their contract to retaliate. The provider potentially spied on their emails and threatened legal action, preventing the agencies from switching and ultimately raising their costs. Despite the ethical issues, the agencies were unable to break free, showing the challenges of escaping vendor lock-in.

NOW OPEN FOR BUILDING: INTRODUCING GEMINI CLI EXTENSIONS

The Gemini CLI now offers extensions, letting devs personalize their command-line experience by connecting Gemini to their ideal tools and workflows through integrations.

CSS HAS 42 UNITS

The increasing number of CSS units is a positive evolution driven by specific needs.

RECALL

Recall is a Redis-powered memory extension for Claude that provides persistent context across sessions.

YOU'RE DOING RAILS WRONG

Instead of adding and using numerous JavaScript tools and frameworks, you can just use Rails.

DRAFTKINGS WARNS OF ACCOUNT BREACHES IN CREDENTIAL STUFFING ATTACKS

DraftKings disclosed a credential stuffing attack where threat actors used stolen username/password combinations from external breaches to gain unauthorized access to customer accounts, exposing names, addresses, phone numbers, email addresses, and partial payment card information. The company is requiring affected users to reset passwords and enable multi-factor authentication. This is DraftKings' second major credential stuffing incident since 2022, when attackers previously stole up to $300,000 from compromised accounts. The attack highlights the ongoing vulnerability of organizations to credential reuse attacks, where users' poor password hygiene across multiple platforms enables account takeovers even when the targeted company's own systems remain secure.

RAINWALK PET INSURANCE EXPOSES 158 GB OF US CUSTOMER AND PET DATA

Rainwalk Pet Insurance exposed 158 GB of unprotected customer data containing 85,361 files, including pet insurance claims, veterinary bills, customer names, addresses, phone numbers, partial credit card numbers, and pet medical histories with microchip numbers. Security researcher Jeremiah Fowler discovered the misconfigured database and notified the company, but it remained publicly accessible for nearly a month before being secured. The breach creates significant fraud risks as criminals could exploit the combined pet and owner data to submit fraudulent insurance claims, intercept Venmo refunds, or conduct targeted scams using legitimate claim information and emotional manipulation tactics.

SALESFORCE SAYS IT WON'T PAY EXTORTION DEMAND IN 1 BILLION RECORDS BREACH

Salesforce has refused to pay a crime group calling itself Scattered LAPSUS$ Hunters, which claims to have stolen about 1 billion records from major clients. The hackers used social engineering to breach Salesforce portals and threatened to leak customer data unless paid.

NEW RESEARCH: AI IS ALREADY THE #1 DATA EXFILTRATION CHANNEL IN THE ENTERPRISE

LayerX research reveals AI has become the #1 corporate data exfiltration channel, with 45% of enterprise employees using generative AI tools and 67% accessing them through unmanaged personal accounts outside IT control. The primary threat vector is the use of copy/paste operations in AI platforms, with employees performing an average of 14 pastes per day via personal accounts, and at least three of these containing sensitive data, such as PII or PCI information. Traditional DLP tools miss this threat entirely since they're designed for file-based environments, while 40% of files uploaded to GenAI tools contain sensitive data, and 77% of employees paste corporate data directly into these platforms.

CYBERCRIME OBSERVATIONS FROM THE FRONTLINES: UNC6040 PROACTIVE HARDENING RECOMMENDATIONS

UNC6040 is a financially motivated threat group that utilizes voice phishing (vishing) to deceive employees into authorizing malicious Salesforce Data Loader applications, thereby enabling large-scale data theft from corporate Salesforce instances. The attackers impersonate IT support personnel to manipulate victims into granting OAuth access to fake connected apps, then systematically exfiltrate sensitive data using legitimate Salesforce tools. Organizations should implement phishing-resistant MFA, restrict API access to approved applications only, enforce network-based login restrictions, and deploy real-time detection rules that monitor for suspicious OAuth authorizations followed by bulk data exports.

LOOK MOM HR APPLICATION LOOK MOM NO JOB

Cybercriminals are now exploiting trusted collaboration platforms, such as Zoom, to execute highly convincing phishing attacks. By sending what appears to be legitimate HR documents via Zoom, attackers redirect recipients to a fake “bot protection” page and then to a Gmail login imitation designed to steal credentials. Credentials entered on this page are exfiltrated in real-time over a WebSocket connection, allowing attackers to validate and use them swiftly.

save your spot today

MITMPROXY

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

PIPE-INTERCEPT

pipe-intercept is a tool to intercept Windows Named Pipes communication using Burp or similar HTTP proxy tools.

RADARE2

UNIX-like reverse engineering framework and command-line toolset.

NEW MIC-E-MOUSE ATTACK SHOWS COMPUTER MICE CAN CAPTURE CONVERSATIONS

The "Mic-E-Mouse" attack is where high-precision computer mice can function as unintended listening devices by detecting minute desk vibrations caused by sound waves through their sensitive optical sensors. The attack converts mouse movement data into audio signals using machine learning, achieving 42-61% speech recognition accuracy without requiring malware installation—only access to normal mouse data packets. This side-channel attack illustrates how increasingly sensitive hardware can create unexpected privacy vulnerabilities, particularly as high-DPI gaming mice become more widespread and affordable.

GERMANY SLAMS BRAKES ON EU'S CHAT CONTROL DEVICE-SCANNING SNOOPFEST

Germany's government has decided to block the EU's Chat Control regulation, which aimed to compel messaging services to scan all user chats—including those on encrypted platforms—for child abuse material. This stance creates a crucial blocking minority, likely ending the proposal, as it reflects the widespread concerns about privacy, democracy, and digital rights from major tech and privacy advocacy organizations.

DISRUPTING MALICIOUS USES OF AI: OCTOBER 2025

OpenAI highlights recent efforts to block malicious use of AI, targeting scams, cybercrime, and manipulation by various threat actors. Most attackers use AI to accelerate existing tactics, rather than invent new attacks, so OpenAI has banned accounts that violate their safe usage policies.

MICROSOFT LINKS STORM-1175 TO GOANYWHERE EXPLOIT DEPLOYING MEDUSA RANSOMWARE

Microsoft linked Storm-1175 to exploiting a critical flaw in Fortra GoAnywhere, enabling Medusa ransomware deployment.