Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Command injection in Mage AI's git config
Yunus Aydın details an OS command injection in Mage AI's git utility code (shell=True with unsanitised config values), with proof of concept, and recounts the 26 months between his April 2024 report and the June 2026 fix merging.
5 min · 1,109 words
Consistency is not a localized property
A short N The Loop essay using Kafka's years-long exactly-once effort, which still needed redesign eight years later, to argue that consistency is an end-to-end property no single component can guarantee, so someone must understand and own the whole system rather than trusting machines to hold it.
1 min · 305 words
The Alchemical Transformations of the Mutus Liber (1677)
Mathilde Montpetit on the Mutus Liber, a nearly wordless 1677 alchemical book whose fifteen plates illustrate the humid way to the Philosopher's Stone, tracing how readers from Eugène Canseliet onward have interpreted its imagery and how its reissues transformed the work.
4 min · 967 words
A Practical Guide to “Plug&Pwn” for Pentesters and Defenders
SCRT's Clément Labro gives practical guidance on the Plug&Pwn research from DEF CON 34, showing how emulated USB devices and Windows Plug and Play driver installation can yield SYSTEM code execution on a locked machine or privilege escalation over RDP, and how configuration hardening can block it.
20 min · 4,624 words
Pyramid-JiT: Low-Res Drafts, High-Res Images
Linum introduces Pyramid-JiT, a decoder-only pixel-space text-to-image architecture with no VAE that predicts the target image at several resolutions along the DiT trunk, reaching Linum v2's FD-DINOv2 on 11.3x fewer training samples and training in 4.3x fewer GPU-hours at 4x the pixels.
21 min · 4,822 words
The Missing Piece in Rust Error Handling
Rust already offers explicit control flow, errors as values and concise propagation with ?, but choosing what goes in the error half of Result forces a trade-off between precise types with boilerplate and convenient types that hide which errors can occur. The post argues error types should compose as easily as the functions that return them.
7 min · 1,660 words
OpenAI Math Papers: History of Withdrawals and Updates
OpenAI’s public history.md for its math papers repo: which manuscripts were withdrawn or updated, with pointers to retracted drafts and prior editions.
1 min · 299 words
The Slow Formation of Durable SoftwareHow a group of historians took years to imagine Zotero, the research application that would eventually be used by millions
Today, software can be created more or less instantly with AI, for a large user base or for yourself, for any purpose or for no serious purpose at all. As Robin Sloan enticingly puts it, just “ask for what you want.” The genesis of Zotero, the “free, easy-to-use tool to help you collect, organize, annotate, cite, and share research,” used by over 20 million people in dozens of languages and countless disciplines, is the opposite of this instant gratification. It took five…
15 min · 3,481 words
Declan Chidlow revisits the interactive menus of the DVD era—how publishers used motion, sound and branching to make home video feel authored—and argues for treating those interfaces as a short-lived but distinctive design craft.
8 min · 1,902 words
Why were Victorian elites so effective?
Samuel Hughes argues in Works in Progress that the small elite who ran Victorian Britain and its empire succeeded despite, or because of, habits modern productivity culture frowns on: a classics-heavy, sports-mad education, late mornings, heavy drinking, and endless balls and dinners. He suggests these customs built a tight-knit community bound by loyalty and status competition.
23 min · 5,318 words
Software developers are not okay
Baldur Bjarnason looks at the wave of software developers posting about burnout, layoffs, the 2026 job market and AI taking the fun out of programming, and argues the comment sections reveal an industry in real distress. His essay explains why so many are not doing well and suggests people in software consider a possible future outside the tech industry proper.
10 min · 2,208 words
Zeroization, part 1: Wiping can make things worse
Frank Denis shows how blindly adding zeroization calls for secrets can leave more copies of a secret in memory than the original code. Using compiled C examples, he covers memset being optimized away, how taking a variable's address forces it onto the stack, and what stays live across calls, and advises checking the optimized build you actually ship.
6 min · 1,382 words
The Data Race That Wasn't a Bug (and the One That Was)
Jesús Espino digs into a Go race detector warning inside net/http: how the HTTP client sends a request body across goroutines and can keep reading your buffer after Client.Do returns, why VictoriaMetrics kept that race in vmagent as harmless, and why the same behavior could corrupt data in vmauth, so they fixed it there.
14 min · 3,210 words
The Chrome team announces JPEG XL decoding support starting in Chrome 155. The post explains why they brought the format to Chrome (better compression than JPEG, lossless JPEG transcoding, HDR), how they used jxl-rs, a pure Rust decoder, for memory safety, the SIMD and performance work that keeps it fast, and the Interop Project testing effort.
3 min · 685 words
OpenWAM: An Open Framework for Composable World-Action Models
Stanford researchers introduce OpenWAM, an open framework for world-action models in robotics. It adapts Wan2.2-5B on 14.64k hours of robot and human video, pairs it with a 2B action expert, compares video-then-action, action-then-video, joint and decoupled programs, and adds local-context inverse and forward dynamics models that can be composed across independently trained parts.
9 min · 1,990 words
Calling it quits on ServerFault
After just over 15 years as an elected ServerFault moderator since the first 2011 community election, SysAdmin1138 is stepping down at year end. The post recalls early cross-cultural flame wars that shaped moderator coverage and post locking, the site's decline from its 2011-2012 peak to 2-3 questions a day, and recent Stack Exchange-wide spam campaigns.
2 min · 536 words
Do you actually like hard problems?
Sunil Pai argues that engineers who say they love hard problems mostly love puzzle solving and pattern matching, which AI now does with near-infinite breadth. The genuinely hard problems left mix engineering with product, society, culture and politics, and he reflects on missing being the go-to engineer for the grind even as people still seek his higher-level judgment.
1 min · 312 words
Jev-Driven SRE Diagnosis: What Worked and What Failed
The SREGym team builds a Kubernetes incident-diagnosis pipeline with no LLM agent: a programmatic collector gathers cluster evidence and TypeSafe AI's Jev decision model picks root-cause candidates and supporting evidence. It passed 80 of 105 diagnoses (76.2%) across 21 SREGym-Lite faults with a 14.6s median, close to an LLM agent's score at far lower cost, and the post dissects the faults it failed.
7 min · 1,572 words
Raspberry Pi Desktop now available for PC and Mac
Simon Long announces an updated Debian Trixie with Raspberry Pi Desktop image for PCs and Macs, including a Raspberry Pi Connect client, and recounts how the x86 version began as a 2016 side project after Eben Upton asked whether the desktop could run on his Mac.
4 min · 1,020 words
Burn 0.22.0: Faster Builds, Easier Extensions, and Smarter Autotuning
Tracel's Burn 0.22 deep learning framework for Rust removes backend type parameters from user code, selecting execution through the device, which made rebuilds up to 15x faster in their tests. It also adds adaptive memory management, smarter autotuning, GPU graph replay, a reusable CubeCL Environment cache, LoRA and QLoRA fine-tuning, ONNX export and expanded remote compute.
12 min · 2,837 words