The Nx compromise and the credential-stealing postinstall
A popular build tool's npm packages ship a payload that harvests tokens and pushes them to public repos.
page 9
older dispatches from the README archive.
The image model that finally does consistent characters
Gemini 2.5 Flash Image nails identity preservation across edits. That's a bigger deal than the memes suggest.
Pixel 10 and the on-device model as a platform feature
Tensor G5 moves to TSMC, and Gemini Nano gets an API surface that third-party apps can actually use.
Caching is the only optimization that reliably works
A hierarchy of caches, the two hard problems, and why your p99 is bad in a way profiling won't show you.
Perplexity bids $34.5 billion for Chrome
A company worth less than its offer bids for a browser that isn't for sale. The interesting part is why anyone would.
GPT-5 lands with a router and a backlash
One model that decides how hard to think, an abrupt deprecation of everything else, and a lesson about attachment.
Rust 1.89 and the long tail of const generics
Inferred array lengths in const generic position, plus x86 SIMD stabilizations that matter for anyone doing math.
OpenAI ships open weights for the first time since GPT-2
gpt-oss-120b and gpt-oss-20b under Apache 2.0. A strategic reversal, six years late, and genuinely useful.
Rate limits are a product decision, not an infrastructure one
When a tool's economics change, the users find out through the limit. There's a better way to do that.
Linux 6.16 and the steady grind of filesystem work
Faster ext4 writes, more Rust bindings, and a release with no headline feature. That's a good sign.
ToolShell: SharePoint gets exploited at scale
A patch bypass turns into mass exploitation of on-prem servers in days. The lesson is about what "patched" means.
ChatGPT Agent, and the browser sandbox as a product
OpenAI merges Operator and deep research into one agent with a virtual computer. The interesting part is the permission model.
Windsurf gets pulled apart in a week
An acquisition collapses, Google licenses the technology and hires the founders, Cognition buys the rest. Everyone learns something about acquihires.
Kimi K2 is a trillion-parameter open weights release
Moonshot ships a 1T-parameter MoE with 32B active, tuned for agentic tool use, with weights you can download.
Grok 4 and the benchmark that ate the discourse
xAI claims frontier results with heavy test-time compute. The number that matters is the one nobody quotes.
Write the README first
The oldest trick in the book, still the best design tool available, and almost nobody does it.
Cloudflare flips the default and starts charging crawlers
AI bots blocked unless allowed, plus a marketplace for per-crawl payment. A fifth of the web changes its robots policy at once.
Rust 1.88 ships let chains, and a decade-old papercut closes
if let A = a && let B = b finally compiles. Also naked functions and automatic cargo cache cleaning.
Gemini CLI puts a free agent in your terminal
Apache 2.0, generous free limits, and a very direct shot at the terminal-agent category.
Cursor at $9 billion and the coding-tool land grab
An editor fork raises at a valuation that only makes sense if you believe the IDE is the control point.