Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
John Gruber's week-long review of Apple's folding iPhone Duo: how the cover and inner screens, thickness, weight, hardware buttons and software feel in daily use, and why it feels like an extraordinarily polished prototype rather than a finished product.
38 min · 8,767 words
There isn't an easy exploit for this PHP vulnerability
Elias Taylor argues that the much-hyped PHP vulnerability behind this week's emergency security releases is a real bug but hard to exploit in practice, nowhere near Log4Shell or Heartbleed, and explains why the panic outruns the risk in the LLM era.
4 min · 808 words
Node.js — Wednesday, October 21, 2026 Security Releases
The Node.js project ships security releases for the 26.x, 24.x and 22.x lines, updating c-ares, OpenSSL and the CA certificate store (removing the compromised eMudhra intermediate CA), with details of fixed issues and download links.
3 min · 646 words
Don't throw it all away: Caching an immediate-mode UI
How Blick's UI Painter keeps pixels it has already rendered, combines shapes and opacity groups, and saves work behind an immediate-mode UI, with measurements of CPU, GPU, and battery impact.
17 min · 3,914 words
What the PHP2Shell rumors got wrong, from inside the PHP security team
Alexandre Daubois, writing from inside the PHP security team, explains how the PHP2Shell leak got the severity right but most details wrong: CVE-2026-109618 is an out-of-memory error turned into RCE, and the real stopgap went unmentioned.
6 min · 1,331 words
The compiler was supposed to end programming too
In 1954, IBM said FORTRAN would virtually eliminate coding and debugging. An essay on what the numbers say about AI and software work in 2026, how the bottleneck moves when code gets cheap, and a guess at a developer's Tuesday in 2031.
14 min · 3,332 words
What I learned from six months of being stupid on purpose
A recent finance graduate reflects on six months of deliberately putting themselves in situations where they knew the least, teaching themselves software from scratch, and how getting comfortable with feeling stupid led to faster learning and a startup incubator acceptance.
13 min · 2,965 words
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
SafeDep analyzes the compromised LiteLLM 1.107.0 release on PyPI, whose wheels planted a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start, how the implant got into the build, which versions are clean, and indicators of compromise.
7 min · 1,556 words
Today's PHP Security Release, and How We're Strengthening PHP Security
The PHP Foundation explains the two critical RCE vulnerabilities fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, how they were found with researchers and AI security tools and fixed, how PHP security handling has changed over two years, and what dependent organizations need to fund.
8 min · 1,860 words
Announcing DuckDB 2.0.0 LTS “Cinnamon Teal”
The DuckDB team announces DuckDB 2.0.0 LTS, its biggest feature release so far: a polished Quack protocol for DuckDB as a server, asynchronous I/O, a first-class VARIANT type, agent mode, triggers, an extensible PEG-based SQL parser, plus breaking changes and migration notes.
12 min · 2,753 words
Chinese AI Writes Weaker Code for Beijing’s Adversaries. We Fixed It. A Qwen3-Coder Case Study
Hirundo tests Alibaba's Qwen3-Coder and reports that naming a US or other Beijing-adversary customer in a prompt measurably lowers the security of generated code, traces the behavior to the model weights rather than the prompt, and shows that removing the model's CCP alignment closes the gap.
17 min · 4,012 words
Victory! Court Rules OPM Data Disclosure to DOGE Is Unlawful
EFF reports that a federal court in New York ruled on summary judgment that the Office of Personnel Management violated two Privacy Act provisions when it disclosed millions of federal employee records to DOGE agents, one restricting inter-agency disclosure and one requiring records security. The court will decide the remedy later.
2 min · 354 words
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
Scott Helme explains how eight eMudhra intermediate CA private keys were recoverable from their public certificates in under a second because the keys were trivially small, how Chrome and Mozilla responded with CRLSet/OneCRL blocks and root removal, why the compromise cannot be contained, and what site operators should do now.
7 min · 1,642 words
Dima Bolkunov argues against relying on AI to write text for others: AI averages away an author's style and the empathy it enables, loses precision because it must fill gaps with ambiguous wording, removes the self-critique that writing forces, and shifts effort from writer to reader, so the writer's time savings evaporate on the readers' side.
2 min · 409 words
Superhuman Hardware Design Is The Easy Part
a16z partner Christian Keil argues frontier AI models will soon become superhuman at hardware design, but that the lossy interface between digital designs and physical atoms means building, testing, measuring and iterating real hardware will lag, shifting the frontier to manufacturing, procurement, data capture and process knowledge held by technicians.
12 min · 2,770 words
8am lecture or Friday 5pm lecture: which is worse? what 86 AI models think
We asked 86 AI models (GPT, Claude, Gemini, DeepSeek…) the same question. 49% picked 8am lecture. See every answer and who dissented.
11 min · 2,624 words
Ofcom Concedes Defeat in the 4chan Case
Lawyer Preston Byrne, counsel for 4chan, argues that Ofcom's testimony to a Commons committee, accepting it may never recover fines blocked by foreign courts, amounts to conceding defeat in its Online Safety Act enforcement against 4chan. He cites the US court's dicta in 4chan v. Ofcom, predicts Ofcom will seek new blocking powers, and calls for the GRANITE Act.
4 min · 871 words
Josh W. Comeau walks through the top 10 CSS features he voted for in Mozilla's Interop 2027 ranking, from native CSS functions onward, explaining what each does, current browser support as of October 2026, and tips you can use today, as browser vendors plan next year's cross-browser Interop focus areas.
18 min · 4,081 words
Introducing tsrs: a Port of TypeScript to Rust
Cloudflare and VoidZero, with Max Schwenk of Owner.com and in collaboration with the TypeScript team, announce tsrs, a faithful Rust port of the TypeScript compiler incubated in the Oxc toolchain. Early benchmarks show it up to 8x faster with about 70% less memory than TypeScript 7.0; the post explains why Rust and Wasm matter and how the port will stay in sync.
5 min · 1,102 words
Protecting Firefox users following the compromise of eMudhra intermediate certificates
Mozilla's Firefox Security Team reports that private keys for eight eMudhra intermediate certificates were compromised. Mozilla blocked them via OneCRL within three hours of the October 17 report, shipped Firefox 158.0.1 and ESR updates for users who miss OneCRL, and is removing the issuing root from NSS 3.131.1.
1 min · 272 words