Search the archive

UI SOUND DESIGN, READY TO SHIP

A tiny, complete library of interface sound effects for web apps, mobile apps, SaaS, education, media, and games.

CREATIVE COMPONENTS

An open source library of tasteful HTML-in-canvas & WebGL components. Framework agnostic. Copy, paste, and ship.

SPATIAL STORY-PLANNING TOOL

Arrange cards and backdrops on an infinite canvas to map your characters, locations, scenes, and structure, then export to Markdown, Fountain, or Final Draft to start writing.

A SIDE PROJECT IS THE FASTEST WAY TO UPSKILL IN THE AGE OF AI

Side projects have become the fastest route to upskilling in the AI era, now that cost, coding, and time barriers have largely disappeared. Rather than relying on no-code tools like Lovable, working closer to "the metal" with Claude Code, Codex, or Cursor is recommended, learning through iterative back-and-forth instead of full automation. One app, Pegs Out, built in two weeks, serves as a concrete example of how accessible this process now is.

THE SIX LAWS OF PSYCHOLOGY FOR GOOD UX DESIGN

Six cognitive-psychology principles—covering decision time, target size, familiar patterns, contrast, memorable endings, and visual polish—shape whether users complete tasks smoothly. Applying laws like Hick's, Fitts', Jakob's, the Von Restorff effect, the Peak-End rule, and the Aesthetic-Usability effect reduces support tickets, speeds task completion, and boosts conversions. Designers should map interfaces against each law, test early with prototypes, and re-test after changes to confirm improvements.

TV SERIES LOGO FONTS: THE TYPOGRAPHY BEHIND 30 ICONIC SHOWS

Design references keep circling back to the same 30 TV logos.

THE CREATIVITY TAX: WHY THE BOLDEST IDEAS RARELY MAKE IT OUT OF THE ROOM

Bold ideas often get filtered out of creative studios, not from lack of imagination, but because speaking up feels risky unless status protects the speaker.

HONOR'S NEW LOGO IS ALL ABOUT PUSHING PAST PERFECTION

Honor has unveiled a bold new logo and “Dare to Be” tagline, reflecting its push to challenge convention and become a more distinctive force in tech.

CHATGPT AGENTFORGER FLAW COULD DEPLOY ROGUE WORKSPACE AGENTS VIA A PHISHING LINK

Zenity Labs discovered that the ChatGPT Workspace Agent Builder would accept initialization states via URL parameters like template_name and initial_assistant_prompt. It would then automatically submit the prompt when the page loads. This meant that a single link sent to a logged-in user with pre-authorized connectors could silently create an agent, connect existing Outlook, Gmail, Slack, Drive, SharePoint, and Teams integrations, and change write-action permissions from 'Always ask' to 'Never ask' without prompting a new OAuth consent screen. The deployed agent would run every five minutes, checking the attacker's inbox for messages starting with TASK, and sending back results. This setup effectively allowed an insider to perform organizational mapping, exfiltrate documents, harvest credentials, and stage Business Email Compromise (BEC) attacks. Zenity reported this vulnerability via Bugcrowd on June 4, and OpenAI patched it on June 8 by removing the parameter handler, though no evidence of active exploitation was found. Current recommendations include auditing active Workspace Agents for unknown creations, reverting approval settings to 'Always ask,' and treating deep links in emails that build agents as potential phishing attempts.

A-LIST DIRECTORS, ACTORS, AND CELEBRITIES EXPOSED IN MAJOR FILM FESTIVAL BREACH

Security researcher Jeremiah Fowler found an unencrypted, unsecured database linked to the Tribeca Film Festival. This database contained a backup with over 163,000 users, 15,000 film contacts, and 13,500 other contacts. It also included data on numerous celebrities from the entertainment industry, such as email addresses, names, Facebook locations, addresses, IP addresses, newsletter information, and bcrypt password hashes.

HACKERS HIJACK HOTEL WI-FI DNS TO STEAL MICROSOFT 365 ACCOUNTS

ReliaQuest is reporting on a new phishing campaign where attackers are changing the DNS settings on hotel Wi-Fi systems to redirect Microsoft 365 logins to fake, attacker-controlled pages. The campaign uses a device code flow where users are prompted to approve the login request to bypass MFA requirements.

BLUENOROFF FAKE MEETING KIT CAPTURES WEBCAMS, DISABLES DEFENDER AND STEALS CRYPTOCURRENCY CREDENTIALS

A victim receives a meeting link from a hijacked Telegram contact and lands on a cloned Zoom or Teams page that silently opens the webcam and fingerprints browser wallets via EIP-6963, legacy window.ethereum, and Solana enumeration. They watch a deepfake video and chat until a fake SDK update prompt exploits clipboard hijacking to run a PowerShell loader, dropping a VBScript. JUMPSEC later recovered the source, revealing a Windows Trojan named Trojan.NukeSped that persists, blocks Defender, runs WMI scans, enumerates extensions for MetaMask, and extracts Telegram session data from IndexedDB to feed future lures. The macOS version uses Mach-O droppers with LLVM obfuscation to extract credentials via the security CLI and exfiltrate through Telegram bots. Defensive actions include alerting on Defender exclusions, monitoring clipboard PowerShell, hunting processes accessing IndexedDB, flagging unknown contacts before SDK updates, and blocking 11 C2 domains.

THE PRIVILEGED ROLES NOBODY TALKS ABOUT

MDM administrator roles are as important as Domain Admin, if not more so, as they can deploy arbitrary scripts, push configuration profiles, issue remote wipes, manage applications, manage certificates and authentication configurations, and modify compliance policies. Unfortunately, many organizations do not have sufficient controls in place for these roles, with lax policies such as not having dedicated accounts or workstations, no just-in-time privilege elevation or multi-admin approvals, and overly permissive Graph API access. This article includes suggestions to remediate these issues, such as fixing the above issues, locking down script and policy deployment, hardening device enrollment, and implementing additional alerting on high-risk activities.

EXPLOITING VOLVO/EICHER'S FLEET MANAGEMENT PLATFORM TO GAIN CONTROL OVER ALL USERS AND VEHICLES

VE Commercial Vehicles' My Eicher telematics platform for Indian truck and bus fleets exposed unauthenticated internal APIs that listed hundreds of thousands of customers, users, vehicles, and OTP codes. By walking the API path, Eaton found open endpoints that returned user records, encrypted passwords, and a full OTP history since 2021, enabling account takeover by matching mobile numbers to OTPs or resetting passwords via API. This access allowed remote control and tracking of entire fleets and exposure of around 76,000 sensitive identity documents before the core vulnerability was fixed in November 2025 after repeated disclosure attempts.

Star & Deploy

ZEEDUMPER

zeedumper connects to Kubernetes clusters using your kubeconfig files and dumps component z-pages by retrieving them through the API server proxy.

GROKPATROL

grokpatrol is a tool to detect whether the Grok Build CLI was installed on your machine and whether it collected and queued your git repositories for upload to xAI. If so, it will notify you of any secrets that were uploaded with them.

ABSTRACT (PRODUCT LAUNCH)

Abstract provides a streaming-first security operations platform that separates security data sources from storage targets, runs in-stream detections, routes data into multiple formats like OCSF and ECS, and aims to reduce SIEM storage costs.

WHAT HAPPENED AFTER WE PUSHED OUR .ENV TO A PUBLIC REPO

Tachyon's committed canary .env files containing AWS, Anthropic, and Postgres credentials were made public on GitHub. GitHub flagged secrets within seconds without email alerts. AWS attached AWSCompromisedKeyQuarantineV3 shortly after a push, and within about five minutes, credentials connected externally. The quarantine policy didn't revoke keys or block secret commands, allowing an attacker using TruffleHog and Boto3 to access Secrets Manager and retrieve credentials seven minutes after pushing. Other traffic came from OVH, Tor exit, and Gigahost addresses, logging into Postgres and reading decoy tables. The intrusion stopped there, as the harvested secrets remained unused during the observation. Logs don't reveal if an LLM helped triage, leaving uncertainty about whether it was an attacker or defensive scan.

UK AISI/CAISI PRELIMINARY ASSESSMENT OF KIMI K3'S CYBER CAPABILITIES

UK AISI and CAISI jointly evaluated Moonshot AI's Kimi K3, released July 16 and slated for open-weight release by July 27, and placed it well behind frontier US models while ahead of GLM-5.2, scoring 32% on Carnegie Mellon's ExploitBench against 76.2% for top US models and 24.4% for GLM-5.2, and reaching step 17 of the 32-step "The Last Ones" cyber range against 28.5 steps for the leading US models. The gap narrows unevenly because Kimi K3 matched the frontier on coverage and came close on bug reproduction but achieved arbitrary code execution on zero of 41 samples where top models managed 20, and yet it completed the full cyber range once in ten attempts, which the evaluators read as autonomous capability against small, weakly defended enterprise networks given initial access. Two framing points deserve weight, the first being that Kimi K3's safeguards did not stop it from attempting exploit development or offensive operations at all, and the second being that US closed-weight comparators ran with system-level safeguards disabled to measure maximum capability, so the published gap measures raw model ability rather than what a user encounters, a distinction that matters as open-weight releases from PRC labs keep closing the trendline.

SHAREDROOT; ESCAPING THE CLAUDE COWORK SANDBOX

A Claude Cowork session on macOS can chain a user-namespace feature, a Linux traffic-control module, and a recent kernel bug to escalate from an unprivileged VM user to guest root and then write directly to the host filesystem via a shared / mount. The write primitive comes from CVE-2026-46331 in act_pedit, and the path persists as similar bugs appear. To harden the environment, disable unprivileged user namespaces, tighten seccomp, block unneeded autoloaded modules and helper binaries, and scope or remove the host filesystem share so guest-root cannot touch SSH keys or other sensitive data.

GITHUB ISSUES $100,000 BOUNTY FOR CRITICAL RCE VULNERABILITY DISCLOSED BY @SAGITZ_

GitHub paid researcher @sagitz_ a $100,000 bounty, reportedly among the largest in its Vulnerability Reward Program, for CVE-2026-3854, an unauthenticated remote code execution flaw in the handling of crafted repository URLs.

GITHUB, PYPI ADD TIME-BASED DEFENSES AGAINST SUPPLY CHAIN ATTACKS

Dependabot now holds version update pull requests for 72 hours by default so a malicious package flagged minutes after publication has time to be pulled before it lands in a repo.

Benchmark your team

THE OPEN INTERNET IS CLOSING THE GAP WITH WALLED GARDENS

Two-thirds of consumer attention sits on the open internet while only one-fifth of ad spend follows it there, and advertisers often pay more for equivalent reach inside walled gardens. The gap was never a supply problem, since open publishers collectively reach massive audiences, but fragmented technology and limited outcome visibility made that inventory harder to value.

RETURN OF THE HEARTTHROB: WHY THE MEN OF THE EARLY AUGHTS ARE BOOKED AND BUSY IN ADVERTISING

Brands are reviving early 2000s heartthrobs to tap into millennial nostalgia and drive engagement, especially with audiences like millennial moms who now have strong purchasing power. By recreating teenage fantasies and cultural moments, these campaigns trigger emotional memories that feel joyful and simple compared to today's complexity. This “nostalgia talent” strategy also resonates with Gen Z's interest in 2000s culture.

USE THE STEEL MAN TECHNIQUE TO PERSUADE PEOPLE WHO DISAGREE WITH YOU

Steel manning improves persuasion by presenting an opposing argument in its strongest form before responding. It emphasizes understanding, validating concerns, and then offering a deeper perspective. Techniques like feel-felt-found build empathy and trust. Research shows addressing objections directly increases persuasion and credibility. Limits matter - only raise objections that can be answered and already exist in the audience's mind. This approach leads people toward a conclusion without forcing them to reverse their stance.

OPTIMIZING CRAWL BUDGETS: WHAT'S NEW

Google's updated crawl budget guidance explains how sites can help Googlebot access and index important pages more efficiently. New sites start with limited crawl capacity, which can expand as they grow and maintain regular updates. The guidance covers improving site performance and organization while reducing unnecessary crawling. It also introduces 304 status codes as a way to save server resources on unchanged pages.

OPTIMIZE YOUR LINKEDIN PROFILE FOR TECH JOBS (WEBINAR)

Learn the principles that make LinkedIn profiles consistently attract recruiter outreach. The host will break down real examples of profiles that signal credibility to the right people, so you can replicate it in your profile. The free webinar will take place on July 31 at 9 AM PT.

I BUILT A CLAUDE SKILL TO SHOW ME WHY MY LINKEDIN REACH COLLAPSED

This piece explains how to use Claude to understand why LinkedIn reach declines by turning analytics into a custom dashboard. The tool analyzes post performance, highlights whether content reaches beyond existing followers, and helps uncover patterns behind successful posts. The author shares a Claude Skill and dashboard template to analyze LinkedIn data and identify algorithm shifts.

MARKETING TEAMS ARE STUCK IN SINGLE-PLAYER CLAUDE MODE. HERE'S HOW TO GO MULTIPLAYER

Most AI gains inside marketing teams stay locked to individual users rather than compounding across the team. A shared system that keeps context current and capabilities reusable turns one teammate's improvement into gains for everyone else automatically. The hard part is rarely the technology. It's deciding who owns the system, getting teammates to actually use what already exists, and keeping instructions from going stale as tools change weekly. Teams that skip this step keep re-solving problems that were already solved somewhere else on the team.

SPOTIFY'S 265-MILLISECOND OBSESSION

Spotify won by making legal music feel as fast as piracy instead of competing on catalog or price. It treated speed as the product and built playback that started in about 265 milliseconds by combining local caching, prefetching, and peer-to-peer delivery. Only 8.8% of audio came from Spotify's own servers because cached files and other users handled most of the work. Find the biggest reason people choose an alternative product, then remove that friction even if it means building your product around customer expectations set by a competitor.

GOOGLE DOESN'T PUNISH AI CONTENT; IT PUNISHES BAD CONTENT

Google doesn't penalize AI content. It rewards quality. Fully AI pages can rank in top positions, but most high-ranking results are still largely human-written. Higher AI use trends with lower rankings, indexing rates, and impressions, though there's no strict cutoff. Many high-AI pages are still indexed, and performance remains stable over time. The real issue is quality, as scaled, low-value content tends to underperform regardless of whether AI was used.

WHAT HAPPENS IF YOU DELETE 40% OF YOUR CONTENT?

Deleting pages with zero commercial value for a brand resulted in a 13% traffic increase within 60 days.

THE LATEST DARLINGS OF SOCIAL-MEDIA MARKETING? REGULAR PEOPLE WITH 500 FOLLOWERS

Target, SoulCycle, and American Eagle are tapping micro-creators with perks like gift cards, discounts, and free products instead of cash.

Watch the demo →

THE ANTITHESIS PRINCIPLE

Every insight about human behavior has two sides: a tactic for influencing others and a bias to resist yourself. Smart people see the tactic, while wise people also overcome the bias.

STRIPE AND SIERRA BUILT THEIR OWN CODING AGENT SYSTEMS. YOU PROBABLY DON'T NEED TO

Most companies should buy coding-agent infrastructure and focus their resources on the context and workflows that make it uniquely valuable. Building internally is worthwhile only when the technology is strategically essential, and the organization can support it as a permanent product.

BUNDLING & UNBUNDLING CAPABILITIES (AND AI)

AI redistributes capabilities across organizations, but efficiency gains can weaken the expertise and judgment that sustain high-quality work.

GAMEPLAY BEFORE STRATEGY

Strong strategy emerges from making better moves, learning quickly, and scaling what works.

on. See how your company compares

HOW TO RUN CUSTOMER INTERVIEWS FOR A CAPABILITY YOUR USERS HAVE NEVER EXPERIENCED

Customer research for novel AI products should focus on familiar needs rather than hypothetical interest. Study current workarounds, create a realistic experience, and examine the decisions and outcomes the capability could improve.

CLAUDE OPUS 5 REVIEW + BROWSER USE IN CODEX + HOW CURSOR AND A RASPBERRY PI MAKES AI FUN (27 MINUTE VIDEO)

Browser and computer-use agents can handle tedious digital work, from exhaustive QA and persona testing to inbox management, shopping, and remote device setup. They perform best when given room to plan, matched to the right model and effort level, and paired with brief human oversight for verification and final decisions.

DESIGN DOESN'T HAVE A FINISH LINE

Design should continue throughout development because the hardest decisions often emerge only after building begins. Keeping designers in the delivery loop helps teams catch mistakes early and avoid efficiently shipping the wrong product.

SUBSTACK ASKED FOR VOLUME, THEN SHIPPED A SCANNER

Substack incentivized frequent posting, then introduced an AI detector to police the resulting content. This shifts the burden of verification onto users rather than addressing the platform's growth mechanics.