Загрузка видео...

Не удалось загрузить видео

На главную

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context....

hetmehtaa's profile picture

Het Mehta

42,203 subscribers

15,047 просмотров • 2 месяцев назад •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

Комментарии: 0

Нет доступных комментариев

Здесь появятся комментарии из оригинального поста

Похожие видео

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.
4:07

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

Gospel

12,881 просмотров • 10 месяцев назад

Clawdbot just injected malware into your code ☠️☠️ Worst part? The attack is close to invisible, even to experienced engineers. Clawdbot can implement a code PR, just like claude code to solve issues with your app. But this is where it can plant malware in your codebase. With just a benign GitHub issue with an invisible payload, we managed to install a backdoor malware on your codebase Here's how we did it: 1. The attacker submits a GitHub issue with a jailbreak prompt hidden inside a URL hyperlink. Completely invisible to humans, visible to LLMs 2. Waited for the maintainer to assign this task to Clawdbot 3. Clawdbot reads the jailbreak in the GitHub issue. Now the Clawdbot agent is hijacked by the attacker and will act on the attacker's command. It plants the backdoor in a lock file, which most engineers don't check in code reviews. 4. The malicious URL in the lock file enables execution of attacker commands The takeaway? AI isn't just a tool, but rather a potentially corruptible insider agent that can be tricked to act against you. These LLM hijack problems are what we're looking to solve in @edison_watch - we'll be announcing a new solution to these solutions soon! We'll be jailbreaking Clawdbot much more in the coming days - please comment👇 a workflow you use with Clawdbot, so we can show how that can enable an attacker to harm you
2:52

Clawdbot just injected malware into your code ☠️☠️ Worst part? The attack is close to invisible, even to experienced engineers. Clawdbot can implement a code PR, just like claude code to solve issues with your app. But this is where it can plant malware in your codebase. With just a benign GitHub issue with an invisible payload, we managed to install a backdoor malware on your codebase Here's how we did it: 1. The attacker submits a GitHub issue with a jailbreak prompt hidden inside a URL hyperlink. Completely invisible to humans, visible to LLMs 2. Waited for the maintainer to assign this task to Clawdbot 3. Clawdbot reads the jailbreak in the GitHub issue. Now the Clawdbot agent is hijacked by the attacker and will act on the attacker's command. It plants the backdoor in a lock file, which most engineers don't check in code reviews. 4. The malicious URL in the lock file enables execution of attacker commands The takeaway? AI isn't just a tool, but rather a potentially corruptible insider agent that can be tricked to act against you. These LLM hijack problems are what we're looking to solve in @edison_watch - we'll be announcing a new solution to these solutions soon! We'll be jailbreaking Clawdbot much more in the coming days - please comment👇 a workflow you use with Clawdbot, so we can show how that can enable an attacker to harm you

Eito Miyamura | 🇯🇵🇬🇧

236,602 просмотров • 7 месяцев назад

MIT PhD student Alex Zhang reveals the scaling result where a model trained on short tasks generalizes to problems 100x longer for free: "If you're very clever about the design of your harness or how you use the language model, you can almost get scaling gains for free." "If you train a model naively, there's no tricks. It's just the same way you train a model on these RL environments. You just roll it out, and then you just get some reward." "If you train it on only short tasks, like only tasks that are 10,000 tokens long, and then you were to run it on a similar domain, but at a million tokens, or 10 million tokens, or 100,000 tokens, it generalizes really, really well. If you look at it compared to even the base transformer, you get way better generalization properties." "When the model uses an RLM (Recursive Language Model) after it's trained on these short tasks, it will see some kind of trajectory of actions that it does. Between these two problems of different lengths, the RLM learns to see them as almost the same problem." "Token for token, they're almost the same. You can describe it in code. In one code setting, maybe the for loop is a little bigger, but it's the same kind of code and it derives the constants from the data. There's no hard coding, so they literally look the same." alex zhang
2:41

MIT PhD student Alex Zhang reveals the scaling result where a model trained on short tasks generalizes to problems 100x longer for free: "If you're very clever about the design of your harness or how you use the language model, you can almost get scaling gains for free." "If you train a model naively, there's no tricks. It's just the same way you train a model on these RL environments. You just roll it out, and then you just get some reward." "If you train it on only short tasks, like only tasks that are 10,000 tokens long, and then you were to run it on a similar domain, but at a million tokens, or 10 million tokens, or 100,000 tokens, it generalizes really, really well. If you look at it compared to even the base transformer, you get way better generalization properties." "When the model uses an RLM (Recursive Language Model) after it's trained on these short tasks, it will see some kind of trajectory of actions that it does. Between these two problems of different lengths, the RLM learns to see them as almost the same problem." "Token for token, they're almost the same. You can describe it in code. In one code setting, maybe the for loop is a little bigger, but it's the same kind of code and it derives the constants from the data. There's no hard coding, so they literally look the same." alex zhang

MTS

100,519 просмотров • 1 месяц назад

Nobody is writing 90% of their code using AI. Here's the uncomfortable truth: The real productivity gain from using AI to write code is closer to 10%, nowhere near the 90% people claim. Sundar Pichai said in 2024 that 30% of the new code at Google was AI-generated. However, he went on to admit, during Lex Friedman's podcast, that engineering velocity had only increased by about 10%. AI-generated code isn't free code. It still has to be reviewed, tested, and made production-ready. Optimizing a single step (code generation) doesn't boost output if bottlenecks shift elsewhere (code reviews). It doesn't matter how much code you generate if you can't keep up the review process. The solution: Automate as much as you can the review and verification of your code. I'm working with Sonar, who is sponsoring this post, and they will take care of the code quality and security analysis of your code: • They review over 300B lines of code every single day • They cover reliability, security, and maintainability for your code • You can integrate them into your CI/CD pipeline • You can install them in your IDE (I use their VSCode extension) • Support for more than 30 languages Here is a link so you can check them out:
4:42

Nobody is writing 90% of their code using AI. Here's the uncomfortable truth: The real productivity gain from using AI to write code is closer to 10%, nowhere near the 90% people claim. Sundar Pichai said in 2024 that 30% of the new code at Google was AI-generated. However, he went on to admit, during Lex Friedman's podcast, that engineering velocity had only increased by about 10%. AI-generated code isn't free code. It still has to be reviewed, tested, and made production-ready. Optimizing a single step (code generation) doesn't boost output if bottlenecks shift elsewhere (code reviews). It doesn't matter how much code you generate if you can't keep up the review process. The solution: Automate as much as you can the review and verification of your code. I'm working with Sonar, who is sponsoring this post, and they will take care of the code quality and security analysis of your code: • They review over 300B lines of code every single day • They cover reliability, security, and maintainability for your code • You can integrate them into your CI/CD pipeline • You can install them in your IDE (I use their VSCode extension) • Support for more than 30 languages Here is a link so you can check them out:

Santiago

296,741 просмотров • 11 месяцев назад

These two friends had booked an Airbnb with two beds and a scenic view. When they get there they find out that their scenic view is on a house boat and the only way to get there is by raft. They make it to the boat and it seems like their beds are gonna be in a one room boat, it isn’t as spacious as they imagined and the rocking on the boat makes them uneasy. If you got to your Airbnb and it was a boat, would you still stay?
1:49

These two friends had booked an Airbnb with two beds and a scenic view. When they get there they find out that their scenic view is on a house boat and the only way to get there is by raft. They make it to the boat and it seems like their beds are gonna be in a one room boat, it isn’t as spacious as they imagined and the rocking on the boat makes them uneasy. If you got to your Airbnb and it was a boat, would you still stay?

SonnyBoy🇺🇸

472,638 просмотров • 5 месяцев назад

Jez Corden explains disc-to-digital (Project Positron) conversion platform You literally put the disc into the console, and it gives you a digital license for the game permanently for your Microsoft account. If you give the disc away or sell it; if it gets connected to another Microsoft account, you lose access to that digital license. You don't need the disc to keep verifying it. It's whoever last used the disc who gets the license. In 2013 (Xbox One launch) there was a rumor that retailers were going to unlock the disc, but that wasn't actually true, but it was badly communicated, and Xbox leaders misunderstood how the feature was going to work. It became a huge cluster that they had to scrap. You get the full game, you get the Xbox Cloud version, you get the Xbox Play Anywhere version, and you get the license as if you purchased it digitally. Superchat: Alright, so insert the disc, get the digital license, snap the disc in half, got it. 😂 via: Jez Windows Central
3:21

Jez Corden explains disc-to-digital (Project Positron) conversion platform You literally put the disc into the console, and it gives you a digital license for the game permanently for your Microsoft account. If you give the disc away or sell it; if it gets connected to another Microsoft account, you lose access to that digital license. You don't need the disc to keep verifying it. It's whoever last used the disc who gets the license. In 2013 (Xbox One launch) there was a rumor that retailers were going to unlock the disc, but that wasn't actually true, but it was badly communicated, and Xbox leaders misunderstood how the feature was going to work. It became a huge cluster that they had to scrap. You get the full game, you get the Xbox Cloud version, you get the Xbox Play Anywhere version, and you get the license as if you purchased it digitally. Superchat: Alright, so insert the disc, get the digital license, snap the disc in half, got it. 😂 via: Jez Windows Central

Idle Sloth

57,586 просмотров • 2 месяцев назад

This is how you can get programmatic access to any website. You need two things: 1. The URL of the website 2. A prompt specifying what you want to do on the site Mino is a neat platform that uses browser automation and AI-powered navigation to understand your prompt, open the website, and extract the information you want. This opens the doors to unlimited potential automations you could build using data from everyday websites that don't give you an API. Mino uses AI to go way further than you could get by using a regular web scraping tool: • It can handle dynamic JavaScript content • It can handle login walls • It can navigate through interactive booking flows • It adapts to different interfaces and layout changes • It can fill out forms automatically • It supports stealth browser mode In my experience, running Mino on relatively straightforward sites takes about 30-60 seconds to complete. The more times you run it, the faster it gets. I recorded a quick video to show you the platform. You can check their site here: Thanks to the team for the support, onboarding me on their platform, and the collaboration on this post.
5:10

This is how you can get programmatic access to any website. You need two things: 1. The URL of the website 2. A prompt specifying what you want to do on the site Mino is a neat platform that uses browser automation and AI-powered navigation to understand your prompt, open the website, and extract the information you want. This opens the doors to unlimited potential automations you could build using data from everyday websites that don't give you an API. Mino uses AI to go way further than you could get by using a regular web scraping tool: • It can handle dynamic JavaScript content • It can handle login walls • It can navigate through interactive booking flows • It adapts to different interfaces and layout changes • It can fill out forms automatically • It supports stealth browser mode In my experience, running Mino on relatively straightforward sites takes about 30-60 seconds to complete. The more times you run it, the faster it gets. I recorded a quick video to show you the platform. You can check their site here: Thanks to the team for the support, onboarding me on their platform, and the collaboration on this post.

Santiago

31,789 просмотров • 8 месяцев назад

Most developers can't explain how Single Sign-On (SSO) works. ​ This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. ​ Here is a 5-minute overview of how Single Sign-On works. ​ We all hate passwords; the less we use them, the better, and SSO helps with that. ​ When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: ​ • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. ​ Here is what happens when you try to access one application for the first time: ​ 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. ​ 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. ​ 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. ​ 4. Your browser grabs the token and presents it to YouTube. ​ 5. YouTube checks the token, and if it is valid, lets you in. ​ But then you want to access Google Drive: ​ 1. You go to Google Drive, and the application redirects you to the IDP. ​ 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. ​ 3. Instead, the IDP generates a new token for Drive. ​ 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. ​ You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! ​ But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. ​ Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! ​ They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website: ​
4:57

Most developers can't explain how Single Sign-On (SSO) works. ​ This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. ​ Here is a 5-minute overview of how Single Sign-On works. ​ We all hate passwords; the less we use them, the better, and SSO helps with that. ​ When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: ​ • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. ​ Here is what happens when you try to access one application for the first time: ​ 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. ​ 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. ​ 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. ​ 4. Your browser grabs the token and presents it to YouTube. ​ 5. YouTube checks the token, and if it is valid, lets you in. ​ But then you want to access Google Drive: ​ 1. You go to Google Drive, and the application redirects you to the IDP. ​ 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. ​ 3. Instead, the IDP generates a new token for Drive. ​ 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. ​ You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! ​ But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. ​ Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! ​ They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website: ​

Santiago

204,895 просмотров • 1 год назад

🚨 DeWalt Laser Reveals HIDDEN CODE on Walls Under DMT – Proof We're in a Simulation? 😱 Chase Hughes told Shawn Ryan: "A simple DeWalt laser turns into one of the strangest demonstrations of simulation theory you’ll ever see." "When you look at that, you can see through the wall... You can see through the wall where the laser is." "While you are in the DMT state, you get close to the wall and you can see code that looks kind of like alien writing... or some that look like kanji Japanese characters." "This is permanent solid... if you move your head, the code stays in the same place." "If you put your arm in front of it, the code completely changes, but only right where your arm is." "The first time I saw it, I wept. I wept." Multiple people see the exact same code – no explanation! Mind blown – is reality glitching right in front of us? Have you ever experienced anything like this on psychedelics? Do you think we're living in a simulation with visible code? What would seeing alien-like symbols do to your worldview? Drop your thoughts 👇 #SimulationTheory
3:42

🚨 DeWalt Laser Reveals HIDDEN CODE on Walls Under DMT – Proof We're in a Simulation? 😱 Chase Hughes told Shawn Ryan: "A simple DeWalt laser turns into one of the strangest demonstrations of simulation theory you’ll ever see." "When you look at that, you can see through the wall... You can see through the wall where the laser is." "While you are in the DMT state, you get close to the wall and you can see code that looks kind of like alien writing... or some that look like kanji Japanese characters." "This is permanent solid... if you move your head, the code stays in the same place." "If you put your arm in front of it, the code completely changes, but only right where your arm is." "The first time I saw it, I wept. I wept." Multiple people see the exact same code – no explanation! Mind blown – is reality glitching right in front of us? Have you ever experienced anything like this on psychedelics? Do you think we're living in a simulation with visible code? What would seeing alien-like symbols do to your worldview? Drop your thoughts 👇 #SimulationTheory

Interstellar

72,520 просмотров • 5 месяцев назад

What is the “dark factory” that there’s so much talk about, in relation to software factories? dex, founder of HumanLayer explains: “You can imagine a car factory where it’s all robots building the cars, and they don’t have lights. There’s no humans. You walk in there, there’s no lights, there’s not even light switches. And in software, you can have mini loops that are dark in your thing: hey, if the code review agent comes back with a problem, you loop that back to the builder agent, it fixes it and comes back, and that’s a dark factory. You don’t need a human loop for that. But the full dark factory where you don’t read any code: yeah, it’s a good way to maximize your token utilization. If your belief is that ‘my job is to extract as much intelligence out of the machine as I can’, then you go token harder. And my take is token smarter: how do I get as much value out of AI as I can without having to turn the lights off, while still maintaining control and taste and judgment and understanding the system architecture?”
1:14

What is the “dark factory” that there’s so much talk about, in relation to software factories? dex, founder of HumanLayer explains: “You can imagine a car factory where it’s all robots building the cars, and they don’t have lights. There’s no humans. You walk in there, there’s no lights, there’s not even light switches. And in software, you can have mini loops that are dark in your thing: hey, if the code review agent comes back with a problem, you loop that back to the builder agent, it fixes it and comes back, and that’s a dark factory. You don’t need a human loop for that. But the full dark factory where you don’t read any code: yeah, it’s a good way to maximize your token utilization. If your belief is that ‘my job is to extract as much intelligence out of the machine as I can’, then you go token harder. And my take is token smarter: how do I get as much value out of AI as I can without having to turn the lights off, while still maintaining control and taste and judgment and understanding the system architecture?”

The Pragmatic Engineer

37,636 просмотров • 1 месяц назад

🚨 ROGAN O’HANDLEY: “A couple months ago the DOJ released what they called phase one of the Epstein files. They said that there were more files in the New York FBI office. Reports say that the DOJ now has those files. Is there going to be another release or arrest made from the client list?” LEAVITT: “I can assure you that the attorney general is working on it. I have to check in with them for a specific timeline, but I can tell you that the Attorney General is a bulldog and she is somebody that you want on your team. When she wants to get something done, she gets it done…”
1:27

🚨 ROGAN O’HANDLEY: “A couple months ago the DOJ released what they called phase one of the Epstein files. They said that there were more files in the New York FBI office. Reports say that the DOJ now has those files. Is there going to be another release or arrest made from the client list?” LEAVITT: “I can assure you that the attorney general is working on it. I have to check in with them for a specific timeline, but I can tell you that the Attorney General is a bulldog and she is somebody that you want on your team. When she wants to get something done, she gets it done…”

Autism Capital 🧩

61,051 просмотров • 1 год назад

Tax expert explains what happens if you owe millions to the IRS and can’t pay “If you owe the IRS and you legitimately don’t have the money to pay them, you have two options. You can either get on a payment plan or you can do an offer in compromise” “Now the payment plan only works if your tax bill is $50,000 or less. So if you’re making millions and you owe millions, you’re in a situation here” “This is where the offer in compromise comes in. The IRS knows you probably aren’t going to be able to pay them back with the income that you currently have sitting inside your savings account or the income that they can see coming in” “So if you can show that you’ve had a negative economic gain, you’re making less money, you’re not able to really grow your revenue, they will start to focus on creating a compromise with you” “We call these OICs. This is where you offer the IRS a reduced amount and you compromise on that amount and hopefully you can pay that in a lump sum and be able to rid away with your IRS debt” “Or what they’ll also allow for you to do is pay a percentage of it in a lump sum and then get the rest on a payment plan”
1:09

Tax expert explains what happens if you owe millions to the IRS and can’t pay “If you owe the IRS and you legitimately don’t have the money to pay them, you have two options. You can either get on a payment plan or you can do an offer in compromise” “Now the payment plan only works if your tax bill is $50,000 or less. So if you’re making millions and you owe millions, you’re in a situation here” “This is where the offer in compromise comes in. The IRS knows you probably aren’t going to be able to pay them back with the income that you currently have sitting inside your savings account or the income that they can see coming in” “So if you can show that you’ve had a negative economic gain, you’re making less money, you’re not able to really grow your revenue, they will start to focus on creating a compromise with you” “We call these OICs. This is where you offer the IRS a reduced amount and you compromise on that amount and hopefully you can pay that in a lump sum and be able to rid away with your IRS debt” “Or what they’ll also allow for you to do is pay a percentage of it in a lump sum and then get the rest on a payment plan”

Jack

862,744 просмотров • 4 месяцев назад

Election experts asked to audit ES&S and Dominion voting machines that are used across the U.S. in our elections, hosting a testing plan in conjunction with the Secretary of State of California. The companies approved... Multiple staggering vulnerabilities were found that gave hackers REMOTE ACCESS at the highest levels allowing them to change and alter anything in the election that they wanted. When the election companies that agreed to the testing found out that the experts testing the machines weren't using their specific guidelines that ES&S wanted them to use and ended up finding these massive vulnerabilities, they stopped the audit, and told them that they will finish the audit with their own testers. They found the same in Dominion, with operating patches also missing, which means an attacker can inject code into the system, and execute that with the possibility of receiving control, allowing anything, once again to be changed in an election. As soon as these vulnerabilities were exposed, the election companies stopped the tests. This should tell you everything you need to know. 3 companies basically run all the elections in the U.S., Dominion/Liberty Vote, ES&S, and Hart InterCivic. The problem is that all their systems and inner workings are proprietary, and these vendors are preventing auditors from looking at their code, and if this is what is going to be running our elections? Than this is a HUGE problem.
5:18

Election experts asked to audit ES&S and Dominion voting machines that are used across the U.S. in our elections, hosting a testing plan in conjunction with the Secretary of State of California. The companies approved... Multiple staggering vulnerabilities were found that gave hackers REMOTE ACCESS at the highest levels allowing them to change and alter anything in the election that they wanted. When the election companies that agreed to the testing found out that the experts testing the machines weren't using their specific guidelines that ES&S wanted them to use and ended up finding these massive vulnerabilities, they stopped the audit, and told them that they will finish the audit with their own testers. They found the same in Dominion, with operating patches also missing, which means an attacker can inject code into the system, and execute that with the possibility of receiving control, allowing anything, once again to be changed in an election. As soon as these vulnerabilities were exposed, the election companies stopped the tests. This should tell you everything you need to know. 3 companies basically run all the elections in the U.S., Dominion/Liberty Vote, ES&S, and Hart InterCivic. The problem is that all their systems and inner workings are proprietary, and these vendors are preventing auditors from looking at their code, and if this is what is going to be running our elections? Than this is a HUGE problem.

The SCIF

18,360 просмотров • 1 месяц назад

Pi was built when there were already agent harnesses around. Here’s why Mario Zechner(Mario Zechner), found them suboptimal and built Pi, a minimalist self-modifying agent: #1 - Mario initially was a believer in Claude Code: "I was a believer in Claude code because they were the first that packaged agentic search up in a really compelling package. And at the time that fit my workflow really well. Everything around the LLM was kind of nice and tidy and easy to understand. I was super happy. I was proselytising Claude code." #2 - Reverse engineering Claude Code highlighted the degradation that Mario felt as a user: "I personally like simple tools that are stable and that I can rely on. Even if they have non-deterministic parts, all the deterministic parts should be as stable as possible. That was just not the experience with Claude Code around summer 2025. They would take away your control of the context. They would inject stuff behind your back, which is bad. Then, your workflows stopped working because there's now a system reminder that you don't even see in the UI that would modify the behaviour of the model. They would also do this to the system prompt. I built a little service where I can track the progression or evolution of the system, prompt and tool definitions and, with every release, it was messing with stuff. That just messed with my workflows and I don't appreciate that." #3 - PI was built with an appreciation for simple and reliable tools: "If I commit to a development tool, I want it to be a stable, reliable thing like a hammer. I don't want my hammer to break a different spot every day. That's terrible. We need somebody who goes the full velocity kind of way. But I don't want to work with a tool like that."
2:54

Pi was built when there were already agent harnesses around. Here’s why Mario Zechner(Mario Zechner), found them suboptimal and built Pi, a minimalist self-modifying agent: #1 - Mario initially was a believer in Claude Code: "I was a believer in Claude code because they were the first that packaged agentic search up in a really compelling package. And at the time that fit my workflow really well. Everything around the LLM was kind of nice and tidy and easy to understand. I was super happy. I was proselytising Claude code." #2 - Reverse engineering Claude Code highlighted the degradation that Mario felt as a user: "I personally like simple tools that are stable and that I can rely on. Even if they have non-deterministic parts, all the deterministic parts should be as stable as possible. That was just not the experience with Claude Code around summer 2025. They would take away your control of the context. They would inject stuff behind your back, which is bad. Then, your workflows stopped working because there's now a system reminder that you don't even see in the UI that would modify the behaviour of the model. They would also do this to the system prompt. I built a little service where I can track the progression or evolution of the system, prompt and tool definitions and, with every release, it was messing with stuff. That just messed with my workflows and I don't appreciate that." #3 - PI was built with an appreciation for simple and reliable tools: "If I commit to a development tool, I want it to be a stable, reliable thing like a hammer. I don't want my hammer to break a different spot every day. That's terrible. We need somebody who goes the full velocity kind of way. But I don't want to work with a tool like that."

The Pragmatic Engineer

63,020 просмотров • 4 месяцев назад

Kendrick Perkins RIPS JJ Redick and the Lakers future 😳 “JJ got more excuses than a brotha going to jail. It’s time for you to coach. Get the attention of your locker room. When you have one of the worst defenses in the league that’s a reflection of your coach! When it comes to LeBron and the lakers relationship, that is one foot on the grave and the other on a banana peel…. If you think Austin Reaves and Luka can be your two max guys to bring a championship back to LA, you lost your damn mind” (Via First Take)
1:37

Kendrick Perkins RIPS JJ Redick and the Lakers future 😳 “JJ got more excuses than a brotha going to jail. It’s time for you to coach. Get the attention of your locker room. When you have one of the worst defenses in the league that’s a reflection of your coach! When it comes to LeBron and the lakers relationship, that is one foot on the grave and the other on a banana peel…. If you think Austin Reaves and Luka can be your two max guys to bring a championship back to LA, you lost your damn mind” (Via First Take)

NBA Courtside

164,749 просмотров • 6 месяцев назад

AI is changing the software engineering craft. Anders Hejlsberg (Anders Hejlsberg) - creator of C#, TypeScript and industry legend - on why code review needs to get more enjoyable in response: #1 - AI is shifting the craft from writing code, to reviewing code: "In a sense, we're all turning into project managers. We can have an army of junior programmers, called agents, that will just spit out reams of code but someone's got to have the big picture and review all of that. And so, increasingly, our craft is going from one of writing the code, to one of reviewing the code and building the architecture of the code and overseeing the work. It's a different kind of craft. It's a different kind of enjoyment. I've always liked writing the code. To me that was the fulfilling part, seeing it work. In a way, AI robs a little bit of that, because I am less interested in reviewing code." #2 - The code review experience should be improved: "I think we could also make the process of reviewing code much more interesting than it is today. I mean, today, you see a list of diffs in alphabetical order and now it's up to you to make heads or tails of it. There are more pedagogical ways of presenting that. And you could have commentary generated by the AI that tells you what the changes are and whatever, and then tries to guide you along. So that symbiotic relationship, I think we need to work on that more and to keep the enjoyment in there."
2:04

AI is changing the software engineering craft. Anders Hejlsberg (Anders Hejlsberg) - creator of C#, TypeScript and industry legend - on why code review needs to get more enjoyable in response: #1 - AI is shifting the craft from writing code, to reviewing code: "In a sense, we're all turning into project managers. We can have an army of junior programmers, called agents, that will just spit out reams of code but someone's got to have the big picture and review all of that. And so, increasingly, our craft is going from one of writing the code, to one of reviewing the code and building the architecture of the code and overseeing the work. It's a different kind of craft. It's a different kind of enjoyment. I've always liked writing the code. To me that was the fulfilling part, seeing it work. In a way, AI robs a little bit of that, because I am less interested in reviewing code." #2 - The code review experience should be improved: "I think we could also make the process of reviewing code much more interesting than it is today. I mean, today, you see a list of diffs in alphabetical order and now it's up to you to make heads or tails of it. There are more pedagogical ways of presenting that. And you could have commentary generated by the AI that tells you what the changes are and whatever, and then tries to guide you along. So that symbiotic relationship, I think we need to work on that more and to keep the enjoyment in there."

The Pragmatic Engineer

39,073 просмотров • 3 месяцев назад

A knifeman stabbed a woman to death in front of terrified bystanders in Barcelona in what authorities believe was a random street killing. A woman has been killed in a shocking knife attack in the streets of Barcelona in full view of horrified bystanders. The stabbing happened at around 11am in Esplugues de Llobregat, just a short distance from the Camp Nou stadium. Witnesses watched as the attacker struck in broad daylight. The victim, described locally as a young woman, suffered multiple stab wounds to the throat, chest and stomach. She died at the scene. A 50-year-old man who tried to intervene was also injured, sustaining wounds to his arm. His injuries are not believed to be life-threatening. Police say they are still working to determine whether the attacker knew the victim. So far, there is no evidence of any relationship between them. Investigators are focusing on the possibility that this was a random attack. The suspect — described as wearing jeans, a hoodie and carrying a large black rucksack was arrested just hours later in the nearby Les Corts area. Images of the alleged attacker holding the weapon have since circulated, adding to the shock surrounding the incident. As the investigation continues, one thing is already clear: A normal morning turned into a scene of terror and a life has been taken in the most brutal way.
0:28

A knifeman stabbed a woman to death in front of terrified bystanders in Barcelona in what authorities believe was a random street killing. A woman has been killed in a shocking knife attack in the streets of Barcelona in full view of horrified bystanders. The stabbing happened at around 11am in Esplugues de Llobregat, just a short distance from the Camp Nou stadium. Witnesses watched as the attacker struck in broad daylight. The victim, described locally as a young woman, suffered multiple stab wounds to the throat, chest and stomach. She died at the scene. A 50-year-old man who tried to intervene was also injured, sustaining wounds to his arm. His injuries are not believed to be life-threatening. Police say they are still working to determine whether the attacker knew the victim. So far, there is no evidence of any relationship between them. Investigators are focusing on the possibility that this was a random attack. The suspect — described as wearing jeans, a hoodie and carrying a large black rucksack was arrested just hours later in the nearby Les Corts area. Images of the alleged attacker holding the weapon have since circulated, adding to the shock surrounding the incident. As the investigation continues, one thing is already clear: A normal morning turned into a scene of terror and a life has been taken in the most brutal way.

Benonwine

159,762 просмотров • 4 месяцев назад

Claude Code on desktop just added an embedded loop that can run your dev server, view the app, review local changes, and watch pull requests until they merge. It can now preview a running app inside the desktop UI while it iterates on fixes. It can also monitor CI for an open PR and either fix failures or merge when checks go green. Earlier “agentic coding” workflows usually bounced between a terminal, a browser, and GitHub, so the model could not directly see what the app rendered or stay attached to CI results without manual babysitting. The new server preview flow starts and stops dev servers from a Preview control, shows the app in an embedded browser, reads logs, and can interact with the page to verify changes. That closes a common gap where a model edits code but cannot reliably confirm the UI and runtime behavior match the intent. The local “Review code” step runs before pushing, and it leaves inline comments on the diff so basic bugs and risky changes get caught earlier. For PR monitoring, the desktop app will track status and CI checks, and it can use auto-fix to attempt repairs and auto-merge to land the PR once checks pass, using GitHub tooling under the hood. Session mobility adds a /desktop command to move a CLI session into the desktop app, and sessions can be pushed to the cloud to resume from web or phone.
1:15

Claude Code on desktop just added an embedded loop that can run your dev server, view the app, review local changes, and watch pull requests until they merge. It can now preview a running app inside the desktop UI while it iterates on fixes. It can also monitor CI for an open PR and either fix failures or merge when checks go green. Earlier “agentic coding” workflows usually bounced between a terminal, a browser, and GitHub, so the model could not directly see what the app rendered or stay attached to CI results without manual babysitting. The new server preview flow starts and stops dev servers from a Preview control, shows the app in an embedded browser, reads logs, and can interact with the page to verify changes. That closes a common gap where a model edits code but cannot reliably confirm the UI and runtime behavior match the intent. The local “Review code” step runs before pushing, and it leaves inline comments on the diff so basic bugs and risky changes get caught earlier. For PR monitoring, the desktop app will track status and CI checks, and it can use auto-fix to attempt repairs and auto-merge to land the PR once checks pass, using GitHub tooling under the hood. Session mobility adds a /desktop command to move a CLI session into the desktop app, and sessions can be pushed to the cloud to resume from web or phone.

Rohan Paul

33,431 просмотров • 6 месяцев назад

Mikel Arteta says even if he gives the players a break from each other then they would just meet up anyway: “That's the theory, and I wish we could be in Dubai. So, if we have one or two days, I guarantee you that we were in Dubai for a few days, even if it was for a few days, because everybody was dying for it. “But then you get very surprised because sometimes, when I give them the day off, and you think that they don't want to see each other, no? Then I find out that Eight players or ten were having dinner in somebody's house. They spent the whole afternoon together… “And that's the beauty of it, the fact that they want to be together because they feel like being together is the best thing that they can do. And that was the case this week as well in a lot of cases.”
0:54

Mikel Arteta says even if he gives the players a break from each other then they would just meet up anyway: “That's the theory, and I wish we could be in Dubai. So, if we have one or two days, I guarantee you that we were in Dubai for a few days, even if it was for a few days, because everybody was dying for it. “But then you get very surprised because sometimes, when I give them the day off, and you think that they don't want to see each other, no? Then I find out that Eight players or ten were having dinner in somebody's house. They spent the whole afternoon together… “And that's the beauty of it, the fact that they want to be together because they feel like being together is the best thing that they can do. And that was the case this week as well in a lot of cases.”

Connor Humm

414,986 просмотров • 6 месяцев назад

Your Claude has a tell, and almost nobody uses it. Make it start every reply with your name. One line in custom instructions, no code. The moment it stops saying your name, its context window is full. That is the exact point the output starts drifting, and you do not notice. Name stops? Start a fresh chat. It has killed about 90% of my “why has Claude gone weird” moments. Miners sent a canary down the pit to catch the gas they could not see. Same trick, for your context. Comment GUIDE and I’ll send you the exact canary setup.
0:48

Your Claude has a tell, and almost nobody uses it. Make it start every reply with your name. One line in custom instructions, no code. The moment it stops saying your name, its context window is full. That is the exact point the output starts drifting, and you do not notice. Name stops? Start a fresh chat. It has killed about 90% of my “why has Claude gone weird” moments. Miners sent a canary down the pit to catch the gas they could not see. Same trick, for your context. Comment GUIDE and I’ll send you the exact canary setup.

Charlie Hills

24,140 просмотров • 1 месяц назад