Search the archive

SAM ALTMAN ON BUILDING FACEBOOK-SIZED COMPANIES

Build something so good people spontaneously tell their friends.

FINDING YOUR PACE

Founders burn out trying to stay the fastest person on the team.

THE DURABLE GROWTH IMPERATIVE: GO TO MARKET EFFICIENCY

GTM efficiency is crucial for sustainable growth in a capital-constrained market.

Get started for $7.99/user/month with 1 TB per user

Time to switch to Proton Drive.

✅ Unlike Google and Microsoft, Proton uses END-TO-END ENCRYPTION, which means nobody—no tech company, no governments, not even Proton—can access your files. No scanning, no sharing, no AI training.

PALO ALTO NETWORKS FIXED MULTIPLE PRIVILEGE ESCALATION FLAWS

Palo Alto Networks fixed seven privilege escalation vulnerabilities in its products, the most severe of which was CVE-2025-4232 (CVSS 7.1), which allows non-administrative macOS users to escalate privileges to root through a wildcard vulnerability in GlobalProtect's log collection feature. The company also patched two authenticated admin command injection flaws in PAN-OS (CVE-2025-4231 and CVE-2025-4230) that enabled authenticated administrators to execute commands as root users. Palo Alto also integrated 11 Chrome security patches and addressed a cache vulnerability in Prisma Access Browser. There were no known active exploits of these vulnerabilities.

DISCORD INVITE LINK HIJACKING DELIVERS ASYNCRAT AND SKULD STEALER TARGETING CRYPTO WALLETS

Attackers are exploiting Discord's invite system by hijacking expired vanity links to redirect users from trusted sources to malicious servers distributing AsyncRAT and Skuld Stealer malware targeting cryptocurrency wallets. The attack, designed to harvest credentials from Exodus and Atomic wallets via injection techniques, employs ClickFix social engineering to trick users into running PowerShell commands that download multi-stage payloads, followed by Skuld Stealer. The campaign targets users in the US, Vietnam, France, Germany, and other countries using trusted cloud services like GitHub, Bitbucket, and Pastebin to blend malicious traffic with legitimate communications.

PARAGUAY SUFFERED DATA BREACH: 7.4 MILLION CITIZEN RECORDS LEAKED ON DARK WEB

Hackers leaked the personal data of 7.4 million people in Paraguay on the dark web. A cybercriminal group called "Cyber PMC" demanded $7.4 million, blaming government corruption and poor security.

HUNTING THROUGH APIS

This blog compares three Microsoft security APIs for threat hunting: Azure Monitor API, which queries Sentinel data only; Graph API, which queries both Defender XDR and Sentinel data, and Defender ATP API, which is limited to Defender for Endpoint data. The Graph API is recommended as it offers unified access to both platforms and supports more data types, while the Defender ATP API has notable limitations, such as a 30-day query timeframe restriction. Each API needs specific permissions and has different rate limits, with the Graph API allowing over 45 calls per minute based on tenant size.

BUILDING UBER'S MULTI-CLOUD SECRETS MANAGEMENT PLATFORM TO ENHANCE SECURITY

Uber initially employed various secrets management practices and vaults for different teams and clouds, which it consolidated into six vaults under the purview of its Secrets team. The Secrets team created scanners to perform real-time scanning and scheduled scanning to identify secrets usage in chat apps and code, as well as built APIs for automated secrets rotation from the centralized secrets vaults. The team also developed a secrets exchange system to distribute secrets to third-party vendors.

WHY IS NO ONE TALKING ABOUT MAINTENANCE IN DETECTION ENGINEERING?

With the movement of detection engineering towards a detection-as-code model, detection engineers must also embrace software maintenance requirements. Maintenance can be broken down into four categories: corrective maintenance, which directly fixes an issue that is occurring; adaptive maintenance, which adapts the detection to changing requirements such as a new API; perfective maintenance, which focuses on improving the query, documentation, or adding new features; and preventative maintenance, which proactively seeks to address issues before clients identify them. Although all detection engineering teams must perform maintenance, there is a dearth of information and posts discussing it.

PRIVADO

Privado is an open-source static scanning tool that detects data flows in your code, identifies data security vulnerabilities, and generates Play Store Data Safety Reports. It identifies over 110 personal data elements and maps their flow from collection points to "sinks" like external third parties, databases, logs, and internal APIs.

CLOUDPEASS

The Cloud Privilege Escalation Awesome Script Suite (CloudPEASS) is a one-stop solution for enumerating permissions, sensitive data, and privilege escalation vectors across AWS, GCP, and Azure.

AWESOME CYBERSECURITY AGENTIC AI

Awesome Cybersecurity Agentic AI is a collection of resources and tools for learning and using agentic AI.

UNUSUAL TOOLSET USED IN RECENT FOG RANSOMWARE ATTACK

Fog ransomware operators attacked an Asian financial firm in May using Syteca monitoring and pentesting tools GC2, Adaptix, and Stowaway. They stayed in the network for two weeks before deploying ransomware. The attackers maintained persistence post-attack and utilized tools often linked to espionage, suggesting intelligence-gathering motives with ransomware as a secondary goal. Since May 2024, Fog ransomware has evolved from targeting US schools through compromised VPNs to exploiting Veeam vulnerabilities and shifted to email infections featuring provocative ransom notes mocking Elon Musk's DOGE agency.

COMING TO APPLE OSES: A SEAMLESS WAY TO IMPORT AND EXPORT PASSKEYS

Apple previewed a new import/export feature for passkeys at the most recent WWDC. The new mechanism will fundamentally differ from current credentials exports that utilize JSONs or CSVs, as it happens directly between participating credentials manager apps without creating insecure files. Data miners have discovered artifacts in newer releases of the Google Authenticator app, suggesting that Google is working on similar functionality for the Android ecosystem, but Google has not announced the feature yet.

MENSTRUAL TRACKING APP DATA IS A ‘GOLD MINE' FOR ADVERTISERS THAT RISKS WOMEN'S SAFETY

Researchers from the University of Cambridge highlight the risks associated with cycle tracking apps (CTAs) and broad data collection practices. CTAs regularly collect and sell sensitive data on women's cycles to advertisers and tech giants without user consent. The researchers are calling on governments to create non-profit, public CTAs or at least require CTAs to offer fine-grained data collection approvals.

WESTJET INVESTIGATES CYBERATTACK DISRUPTING INTERNAL SYSTEMS

WestJet is probing a cyberattack that temporarily hindered its internal systems and app, impacting user login, although access has since been restored.

DUTCH POLICE IDENTIFY USERS AS YOUNG AS 11-YEAR-OLD ON CRACKED.IO HACKING FORUM

Dutch police found children as young as 11 using a hacking forum called Cracked.io.

MICROSOFT CONFIRMS AUTH ISSUES AFFECTING MICROSOFT 365 USERS

Microsoft 365 users are experiencing sign-in and password reset issues due to recent multi-factor authentication (MFA) enhancements, but Microsoft is addressing the problem and has already implemented some improvements.

Register here

‘THE ATTENTION DIVIDEND' – PREMIUM LARGE FORMAT DOOH COMMANDS 5X MORE ATTENTION THAN DIGITAL CHANNELS

Premium large format Digital Out of Home (DOOH) ads are far more effective at capturing attention than online digital formats. They generate 5X more attention and hold it significantly longer. Viewers engage with these ads 8.2X longer than online display, 5.5X longer than social media, and 1.6X longer than online video. They also drive up to 2.5X higher brand recall and brand choice when using video creatives. This increased attention is linked to long-term brand profitability, especially when premium DOOH is combined with standard OOH. 3D DeepScreen formats also boost brand desirability by 32%.

AI NEEDS EXPERIENTIAL MORE THAN EVER—AND EXPERIENCES NEED AI

In an era overwhelmed by digital noise and fake content, brands must shift from screen-based interactions to immersive, sensory experiences that feel real and emotionally engaging. Simply adding chatbots or basic AI won't cut it anymore. The future lies in AI-driven experiences that adapt in real-time, connect with human behaviors, and blend physical and digital worlds seamlessly.

THE EMPLOYEE ADVOCACY PLAYBOOK

Employee advocacy means employees voluntarily sharing company content on their personal social media. It drives 8X more engagement than brand accounts. People respond to real, human posts, not corporate-sounding updates or heavily filtered messages. Brands should support willing employees with quality content, guidance, and trust while avoiding micromanagement or forced participation.

THINGS TO AVOID IN JAVASCRIPT

JavaScript devs should avoid common pitfalls that can lead to bugs and reliability issues. Important things to avoid include using `innerHTML` for setting text, relying on `JSON.stringify()` for object cloning, overusing regular objects as associative arrays, and utilizing `eval()` for code execution.

USE ASYNC LOCAL STORAGE TO PREVENT PROPS DRILLING IN NEXT.JS ROUTE HANDLERS

Async Local Storage acts like React Context but for Node.js, storing data accessible within the same execution context. It can be used to pass a user object through multiple functions easily. The code provided uses `userContext.run()` to wrap functions needing access.

THE CASE FOR SOFTWARE CRAFTSMANSHIP IN THE ERA OF VIBES

The increased accessibility of code generation through AI should elevate the standard for software quality, not just quantity. System design and taking ownership of the user experience is even more important now.

LESSONS FROM 9 MORE YEARS OF TRICKY BUGS

In this developer's nine years of tricky bugs, common coding errors involved empty cases, date-related logic, data format upgrades, and aliased dictionaries. Good testing had exploratory methods, smaller test environments, and accounted for varied access rights. Debugging relied on detailed logging, collaboration, alerting systems, and reproducing issues with minimal examples.

started

AMAZINGPRINT

AmazingPrint is a Ruby gem that provides customizable, colorized pretty-printing of Ruby objects with proper indentation, including support for Rails and IRB/PRY integration.

WILDCAT

Wildcat is a high-performance, open-source, embedded key-value database engine written in Go with C interoperability. It has a log-structured merge tree architecture, multi-version concurrency control, ACID transactions, and various iteration and configuration options for optimal read/write performance and durability.

CAN AI REBUILD A RAILS PAGE IN NEXT.JS? WE TRIED IT

These developers attempted to rebuild a page from an internal Rails app using Cursor with different LLMs (Gemini 2.5 Pro and Claude 4). After three attempts with varying degrees of success, the LLMs almost completed the task, missing only a simple "use client" directive to make it fully functional.

SOURCE CODE SANDBOXING

It's easier than expected to implement source code sandboxing, which limits a program's access to system resources, across various operating systems and languages in 2025. This article goes over tools like seccomp, landlock, seatbelt, Capsicum, pledge, JSM, secmodel, and privileges, analyzing the complexity of their documentation and implementation through code examples and a case study of OpenSSH. The findings suggest OpenBSD's pledge has seen the most success due to its simplicity, while Linux's seccomp is considerably more complex.

GOOGLE CLOUD SERVICE HEALTH

A faulty code deployment triggered by an invalid automated quota update caused a widespread Google Cloud and Workspace service disruption with API request errors across multiple regions on June 12.

MCP INDEX

The MCP Index repository provides a curated list of MCP servers, giving AI applications access to many tools and data sources across categories like official servers, web search, browser automation, memory management, weather and location, Git workflow, and business tools.

TIP: PUT YOUR RAILS APP ON A SQL QUERY DIET

To improve Rails application performance, minimize SQL query count by monitoring queries, eliminating unnecessary and duplicate queries, consolidating data access, and focusing on retrieving only the data needed for client application use cases.

ONE MORE REASON TO CHOOSE POSTGRES OVER MYSQL

A big advantage of Postgres over MySQL is Transactional DDL, which allows database schema changes within a single, reversible transaction.

Read the Delve case study.

SHOPIFY PARTNERS WITH COINBASE AND STRIPE IN LANDMARK STABLECOIN DEAL

Shopify is rolling out stablecoin payments to all users on its platform later this year. Merchants will be able to set up their own online marketplaces and accept payments in USDC, a stablecoin issued by Circle. Access will be gradually expanded across the US and Europe before being opened up to all users. Shopify worked with Coinbase and collaborated with Stripe to develop new payment protocols and integrate stablecoins into its existing software stack.

AMD REVEALS NEXT-GENERATION AI CHIPS WITH OPENAI CEO SAM ALTMAN

Advanced Micro Devices (AMD) has unveiled new details about its next-generation AI chips. The Instinct MI400 series will ship next year. They can be assembled into full server racks with thousands of chips. AMD's rack-scale setup will make the chips look to users like one system, which is important for most customers who develop large language models.

EXPERIMENTAL RETINA IMPLANTS GIVE MICE INFRARED VISION

Chinese scientists recently built prototype retinal implants that can replace failing photoreceptors and potentially provide infrared vision as a bonus. They work without an external camera or power source. The implants have been tested in mice and non-human primates - results in mice seemed promising, with the blind mice in the study responding to light and seemingly being able to see near-infrared wavelengths as well. The implants let the primates see infrared light, but their normal vision appeared unchanged.

BIOENGINEERED TOOTH "GROWS" IN PLACE TO LOOK AND FEEL LIKE THE REAL THING

Researchers have developed an artificial tooth implant that 'grows' into the gums and fuses with existing nerves to mimic the form and function of a real tooth. They can be put in place without any bone drilling. The artificial tooth features a biodegradable outer layer that contains stem cells and specific proteins that trigger the cells to mature into nerve tissue. This allows the implant to 'talk' to the brain, much like a real tooth, allowing the tooth to sense things like food texture and temperature.

AGENTIC CODING RECOMMENDATIONS

Agentic coding is evolving rapidly. This post describes an agentic workflow - while it might be quickly outdated, it shows how integrating agents in the development processes can unlock significant productivity gains. While tools and techniques will evolve, the core principles remain essential. The goal isn't just to leverage agents to write code faster, but to write better, more maintainable, and resilient code.

SUPPRESSIONS OF SUPPRESSIONS

Developers will sometimes need to suppress rules in build processes because those rules are wrong or unnecessarily strict. However, as people get used to suppressing rules, they might run into another problem - some rules are really bad to suppress as suppressing them might cause unforeseen issues. One way to deal with suppressions is to introduce a lint rule that forbids developers from suppressing some other lint rules.

WAYMO RIDES COST MORE THAN UBER OR LYFT — AND PEOPLE ARE PAYING ANYWAY

Waymo's self-driving car rides are consistently more expensive compared to offerings from Uber and Lyft. The company's average price at peak hours is about $11 more expensive than Lyft and nearly $9.50 pricier than Uber. The price difference shows excitement for the technology and a real preference to sometimes be in a car without a driver. Shorter trips tend to cost more than longer ones - the pricing gap shrinks as rides get longer.