Search the archive

THIS DESIGNER TURNS CHILDREN'S IMAGINATION INTO FURNITURE THEY CAN TRULY OWN

Taekhan Yun's Chair for Kids project transformed children's drawings into functional furniture.

INTRODUCTION TO POSTGRESQL INDEXES

PostgreSQL indexes are database objects that speed up data access by allowing the system to read less from disk, mapping key values to physical row locations. While these provide speed benefits for queries, they introduce costs such as increased disk space, overhead on write operations, longer query planning times, and higher memory usage.

THE BROWSER IS THE SANDBOX

The browser has potential as a secure sandbox for agentic AI tools, which automate tasks and require access to a user's local files and network. It has mechanisms for filesystem isolation, controlled network access via CSP, and secure code execution using iframes and WebAssembly. A demo project is displayed in this article that shows these capabilities.

HOW I ESTIMATE WORK AS A STAFF SOFTWARE ENGINEER

AI TRIBALISM

Discussions around LLMs have devolved into unproductive tribalism, fueled by early negative associations with tech "hucksters" and fears of job displacement. AI agents are already capable of efficient code generation, bug fixing, and addressing complex issues like security and performance. Engineers need to keep experimenting with AI to stay on top of new tooling.

scenarios. Save your spot →

CLAWDBOT

Clawdbot is an open-source, personal AI assistant designed to run on a user's own devices. Offering local, fast, and always-on AI capabilities, it integrates with many messaging channels like WhatsApp, Telegram, Slack, and Discord.

FENCE

Fence is a lightweight, container-free sandbox tool that wraps commands to restrict network access and filesystem operations. It's designed for running semi-trusted code, like package installs or CI jobs, with controlled side effects, and it improves AI coding agent security.

DPAINT.JS

DPaint.js is a web-based image editor modeled after the classic Deluxe Paint, specifically focusing on retro Amiga file formats. It allows users to read, write, and convert various Amiga formats, including icon files, IFF ILBM images (up to 256 colors), and even directly from Amiga Disk Files (ADF).

150,000 LINES OF VIBE CODED ELIXIR: THE GOOD, THE BAD, AND THE UGLY

BoothIQ used AI to write all 150,000 lines of its Elixir codebase, finding the language's small, terse, and immutable nature great for AI generation. AI is great at generating code efficiently, especially when aided by Elixir-specific tools like Tidewave. However, it struggles with architectural decisions, often produces defensive code trained on imperative languages, and is ineffective at debugging complex Elixir concurrency and understanding isolated test environments.

SOME C HABITS I EMPLOY FOR THE MODERN DAY

Despite not writing C frequently, the author has developed a specific set of programming habits and styles for C projects due to the language's lack of standardization. They typically use C23, define custom fixed-length types like `u8` and `i32`, use a `length+data` struct for strings, and prefer C23's `bool` type.

I BUILT A 2X FASTER LEXER, THEN DISCOVERED I/O WAS THE REAL BOTTLENECK

While optimizing a lexer for a 2x speedup, the author discovered the true bottleneck was I/O syscall overhead from numerous small files.

USING POSTGRESQL AS A DEAD LETTER QUEUE FOR EVENT-DRIVEN SYSTEMS

Using PostgreSQL as a Dead Letter Queue for an event-driven system provided much visibility, queryability, and controlled reprocessing of failed events compared to Kafka.

COI

Coi is a modern, type-safe, component-based programming language that uses WASM and fine-grained reactivity to build high-performance web applications with zero garbage collection and a minimal runtime.

WHEN EMPLOYEES FEEL SLIGHTED, THEY WORK LESS

New research shows that even minor workplace mistreatment, like delayed birthday greetings, reduces employee productivity.

Add enterprise features today →

THE HAMSTER WHEEL HAS ENGINEERS

Some products will eventually mature to the point where forward-deployed engineers (FDEs) are no longer required. Others, particularly in AI, might have FDEs permanently as a feature. Products where value comes from applying judgment, recognizing patterns, and doing things that can't be reduced to a configuration screen may require human expertise to be part of the product forever.

THE YEAR OF MULTI-MODAL

Text was the fastest path to usefulness for AI, but it was always a middle state. Humans don't experience the world in text. Work doesn't happen in text. What's changing now is that multi-modal models are good enough, inference costs are low enough for always-on perception, and cameras, microphones, and sensors are making the physical world legible to machines. Once AI can see, hear, and react continuously, text-only AI will feel as constrained as desktop-only software felt once mobile took over.

WILL AI KILL FINTECH SAAS?

AI advancements challenge Fintech SaaS by enabling rapid, cost-effective software development. However, real value remains in data, regulatory relationships, and handling complex edge cases at scale—categories agents can't easily replicate. Fintech companies with strong data moats and network effects will thrive, but must adapt quickly to maintain their competitive edge.

STRIPE'S LIGHTHOUSE HIRING PATTERN

Lighthouse Hiring is the idea that hiring well-connected people makes subsequent hires both easier and higher quality. Spending the extra time to land one 'lighthouse hire' can improve the quality and velocity of any hiring push. Not all of these people will be well-known - they are just widely-connected. This strategy isn't without its downside - it takes some nuance to deploy effectively.

BREX AND THE PROS AND CONS OF HUBRISTIC FUNDRAISING

Hubristic fundraising is where companies raise so aggressively that they are essentially betting the entire future of the company on hitting an extraordinary outcome. These deals attract the best talent and capital, create customer and partner gravity, generate relentless press coverage, and demoralize competitors, but the talent is usually mercenary, any stumble becomes a 'failure', decision-making is warped, and the bar for success becomes close to impossible. The Age of AI is seeing hubristic fundraising return at a scale that makes 2021 look quaint.

DATA LEAP

You describe the work, and this tool turns it into automation.

SKILLS MP (RESOURCE)

A marketplace of the most used Claude skills.

PROMPTSY

Promptsy is a prompt management platform for creating, organizing, versioning, and sharing AI prompts.

HOW TO BUILD A STARTUP PEOPLE ACTUALLY CARE ABOUT

The next era of tech brands that will win will be the ones that become something akin to a lifestyle brand. They will stand for something clear, and that something will show up everywhere. Tech has historically been bad at this, but it is now integrated deeply in people's lives, and the market and user demand have grown. People will soon associate themselves with tech brands as they do with brands like Nike. Soon, brands will do more of the work than the products themselves.

IT'S TIME TO START YOUR CONTENT CREATOR ERA

Personal audiences are becoming a crucial distribution channel for companies. A following proves agency and an understanding of the latest growth tactics. Acquiring and engaging an audience has a lot in common with acquiring and engaging users and customers. Content creator skills translate a lot to quality marketing and growth. Hiring someone with a big audience is practically bringing in a new distribution channel.

THE FUTURE OF SOFTWARE ENGINEERING IS SRE

Software engineering is shifting towards Site Reliability Engineering as operational excellence becomes crucial.

MAYBE, FINALLY—THE END OF SQL

AI-generated code is becoming increasingly common, shifting the focus from writing to testing code.

SYSTEMS OF ACTION AND THE DOMINO'S PIZZA TRACKER PRODUCT MODEL

A system of action should look just like a timeline with a transparent record of discrete events and the ability for users to see that the whole agentic system is tracking everything.

DO NOT FALL FOR COMPLEX TECHNOLOGY

Simplicity often leads to better, faster, and cheaper outcomes.

POLAND'S ENERGY GRID WAS TARGETED BY NEVER-BEFORE-SEEN WIPER MALWARE

Poland's power grid faced a cyberattack in December that involved a new “DynoWiper” malware. Likely linked to Russia's Sandworm group, the attempt to disrupt electricity failed. The operation coincided with the 10th anniversary of Sandworm's landmark 2015 Ukraine blackout, and it fits a long pattern of Russian wiper use.

FORTINET ADMITS FORTIGATE SSO BUG STILL EXPLOITABLE DESPITE DECEMBER PATCH

Attackers can still exploit a critical FortiCloud SSO authentication vulnerability in FortiOS, even on systems fully patched in December, by abusing a new SAML-based SSO attack path. Recent campaigns involve automated reconfiguration of FortiGate firewalls, the creation of backdoor admin accounts, and the theft of configuration files. Fortinet has urged customers to monitor authentication logs, restrict management exposure, and track admin changes while it develops a new fix.

ANCIENT TELNET BUG HAPPILY HANDS OUT ROOT TO ATTACKERS

A critical (CVSS 9.8) vulnerability in telnet could allow unauthenticated users to obtain root privileges on systems running InetUtils telnetd. To exploit the vulnerability, an attacker only needs to set their USER environment variable to “-f root” and pass the “-a” or “--login” flag to telnet. Experts recommend updating to the latest version of telnet or, ideally, switching to a more secure protocol such as SSH.

KUBERNETES V1.35: A BETTER WAY TO PASS SERVICE ACCOUNT TOKENS TO CSI DRIVERS

Kubernetes v1.35 added the ability for CSI drivers to opt-in to receiving service account tokens via the `secret` field in `NodePublishVolumeRequest`. Prior to this update, service account tokens were received via the `volume_context` field, which could lead to secrets being included in gRPC request logs if drivers did not implement custom sanitizer logic. To opt in to this feature, CSI drivers should implement the `serviceAccountTokenInSecrets' field as well as implement logic for backwards compatibility.

BUILDING TAMPER-PROOF MEDIA APPS: C2PA VS CPP DEEP DIVE FOR DEVELOPERS

This technical deep dive compares C2PA (the industry standard backed by Adobe and Sony) with the emerging Content Provenance Protocol (CPP) for building tamper-proof media applications that prove content authenticity. CPP's key differentiator is its "Completeness Invariant," which uses XOR hash sums to mathematically detect deleted evidence—a critical capability for legal proceedings, insurance claims, and regulatory compliance that C2PA cannot provide architecturally. The article provides Swift and Python implementations of cryptographic patterns, including Secure Enclave signing, Merkle tree construction, RFC 3161 timestamp anchoring, and privacy-preserving human attestation without storing biometric data.

THE DUAL-USE DILEMMA OF AI: MALICIOUS LLMS

While LLMs can be a useful tool for defenders, they can also be used by attackers. WormGPT was the first malicious LLM that was released. It is still being developed. KawaiiGPT is an open-source malicious LLM. This article analyzes the efficacy of these models at producing ransomware notes, data exfiltration scripts, and lateral movement detection.

AWESOME-BLACKHAT-ARSENAL

Whether you're in red teaming, blue teaming, appsec, or OSINT, this list helps you explore and leverage the best tools demonstrated live by security professionals across the world.

SECURITY DETECTIONS MCP

Security Detections MCP is an MCP server that enables LLMs to query a unified database of over 7,200 Sigma, Splunk ESCU, Elastic, and KQL security detection rules through natural language. The tool features SQLite FTS5-powered full-text search across detection fields, MITRE ATT&CK mapping, CVE coverage lookup, and process name filtering, with token-optimized analysis tools that reduce data transfer by 25x compared to traditional queries. Security teams can integrate this with Claude Desktop, Cursor IDE, or VS Code to perform coverage analysis, identify detection gaps against threat profiles, and generate ATT&CK Navigator layers directly from their AI assistant.

BANDJACKS

Bandjacks is a comprehensive Cyber Threat Intel system that quickly extracts MITRE ATT&CK techniques from threat reports, builds a knowledge graph of threat actors, and utilizes LLM response caching for faster extraction, among other features.

MICROSOFT GAVE FBI A SET OF BITLOCKER ENCRYPTION KEYS TO UNLOCK SUSPECTS' LAPTOPS

The FBI has obtained a warrant compelling Microsoft to hand over BitLocker recovery keys for three seized laptops, allowing agents to decrypt the drives despite full‑disk encryption. BitLocker recovery keys are often stored in Microsoft's cloud, enabling lawful access but also raising privacy and security fears if the company or its keys are compromised.

MICROSOFT FLAGS MULTI-STAGE AITM PHISHING AND BEC ATTACKS TARGETING ENERGY FIRMS

Microsoft describes a layered phishing and BEC campaign against energy companies that abuses trusted services like SharePoint and OneDrive to deliver links leading to adversary-in-the-middle credential theft pages. Attackers then use stolen credentials and session cookies to set stealthy inbox rules, launch large internal and external phishing waves, and bypass MFA using tailored phishing kits and social engineering, prompting defenders to adopt phishing-resistant MFA, conditional access, continuous access evaluation, and robust anti-phishing controls.

IRELAND WANTS TO GIVE ITS COPS SPYWARE, ABILITY TO CRACK ENCRYPTION

Ireland has announced the release of a new communications bill that seeks to provide sweeping updates to its decades-old telecommunications legislation. Among the provisions in the bill, Ireland is looking to provide law enforcement with the ability to utilize spyware as well as the ability to intercept encrypted messages. Ireland is looking to follow the framework laid out by the EU Commission in 2024.

ANTHROPIC PREPARES TO RELEASE SECURITY CENTER FOR CLAUDE CODE

Anthropic is preparing to launch Security Center for Claude Code, a feature that will provide users with an overview of recent security scans, detected issues, and the ability to manually initiate repository scans.

GMAIL GLITCH APPEARS TO BREAK EMAIL FILTERING, TABBED INBOXES

Google resolved a Gmail glitch that caused marketing and promotional emails to flood users' Primary inboxes instead of being routed to the Promotions tab.

1PASSWORD ADDS POP-UP WARNINGS FOR SUSPECTED PHISHING SITES

1Password will now display pop-up warnings when users attempt to enter credentials on typosquatted or suspected malicious domains that don't match URLs stored in their vault.

Try Asana for free >>