Loading video...

Video Failed to Load

Go Home

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context....

hetmehtaa's profile picture

Het Mehta

42,203 subscribers

15,047 views • 18 days ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.
4:07

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

Gospel

12,744 views • 8 months ago

Clawdbot just injected malware into your code ☠️☠️ Worst part? The attack is close to invisible, even to experienced engineers. Clawdbot can implement a code PR, just like claude code to solve issues with your app. But this is where it can plant malware in your codebase. With just a benign GitHub issue with an invisible payload, we managed to install a backdoor malware on your codebase Here's how we did it: 1. The attacker submits a GitHub issue with a jailbreak prompt hidden inside a URL hyperlink. Completely invisible to humans, visible to LLMs 2. Waited for the maintainer to assign this task to Clawdbot 3. Clawdbot reads the jailbreak in the GitHub issue. Now the Clawdbot agent is hijacked by the attacker and will act on the attacker's command. It plants the backdoor in a lock file, which most engineers don't check in code reviews. 4. The malicious URL in the lock file enables execution of attacker commands The takeaway? AI isn't just a tool, but rather a potentially corruptible insider agent that can be tricked to act against you. These LLM hijack problems are what we're looking to solve in edison.watch - we'll be announcing a new solution to these solutions soon! We'll be jailbreaking Clawdbot much more in the coming days - please comment👇 a workflow you use with Clawdbot, so we can show how that can enable an attacker to harm you
2:52

Clawdbot just injected malware into your code ☠️☠️ Worst part? The attack is close to invisible, even to experienced engineers. Clawdbot can implement a code PR, just like claude code to solve issues with your app. But this is where it can plant malware in your codebase. With just a benign GitHub issue with an invisible payload, we managed to install a backdoor malware on your codebase Here's how we did it: 1. The attacker submits a GitHub issue with a jailbreak prompt hidden inside a URL hyperlink. Completely invisible to humans, visible to LLMs 2. Waited for the maintainer to assign this task to Clawdbot 3. Clawdbot reads the jailbreak in the GitHub issue. Now the Clawdbot agent is hijacked by the attacker and will act on the attacker's command. It plants the backdoor in a lock file, which most engineers don't check in code reviews. 4. The malicious URL in the lock file enables execution of attacker commands The takeaway? AI isn't just a tool, but rather a potentially corruptible insider agent that can be tricked to act against you. These LLM hijack problems are what we're looking to solve in edison.watch - we'll be announcing a new solution to these solutions soon! We'll be jailbreaking Clawdbot much more in the coming days - please comment👇 a workflow you use with Clawdbot, so we can show how that can enable an attacker to harm you

Eito Miyamura | 🇯🇵🇬🇧

236,505 views • 5 months ago

Nobody is writing 90% of their code using AI. Here's the uncomfortable truth: The real productivity gain from using AI to write code is closer to 10%, nowhere near the 90% people claim. Sundar Pichai said in 2024 that 30% of the new code at Google was AI-generated. However, he went on to admit, during Lex Friedman's podcast, that engineering velocity had only increased by about 10%. AI-generated code isn't free code. It still has to be reviewed, tested, and made production-ready. Optimizing a single step (code generation) doesn't boost output if bottlenecks shift elsewhere (code reviews). It doesn't matter how much code you generate if you can't keep up the review process. The solution: Automate as much as you can the review and verification of your code. I'm working with Sonar, who is sponsoring this post, and they will take care of the code quality and security analysis of your code: • They review over 300B lines of code every single day • They cover reliability, security, and maintainability for your code • You can integrate them into your CI/CD pipeline • You can install them in your IDE (I use their VSCode extension) • Support for more than 30 languages Here is a link so you can check them out:
4:42

Nobody is writing 90% of their code using AI. Here's the uncomfortable truth: The real productivity gain from using AI to write code is closer to 10%, nowhere near the 90% people claim. Sundar Pichai said in 2024 that 30% of the new code at Google was AI-generated. However, he went on to admit, during Lex Friedman's podcast, that engineering velocity had only increased by about 10%. AI-generated code isn't free code. It still has to be reviewed, tested, and made production-ready. Optimizing a single step (code generation) doesn't boost output if bottlenecks shift elsewhere (code reviews). It doesn't matter how much code you generate if you can't keep up the review process. The solution: Automate as much as you can the review and verification of your code. I'm working with Sonar, who is sponsoring this post, and they will take care of the code quality and security analysis of your code: • They review over 300B lines of code every single day • They cover reliability, security, and maintainability for your code • You can integrate them into your CI/CD pipeline • You can install them in your IDE (I use their VSCode extension) • Support for more than 30 languages Here is a link so you can check them out:

Santiago

296,535 views • 9 months ago

These two friends had booked an Airbnb with two beds and a scenic view. When they get there they find out that their scenic view is on a house boat and the only way to get there is by raft. They make it to the boat and it seems like their beds are gonna be in a one room boat, it isn’t as spacious as they imagined and the rocking on the boat makes them uneasy. If you got to your Airbnb and it was a boat, would you still stay?
1:49

These two friends had booked an Airbnb with two beds and a scenic view. When they get there they find out that their scenic view is on a house boat and the only way to get there is by raft. They make it to the boat and it seems like their beds are gonna be in a one room boat, it isn’t as spacious as they imagined and the rocking on the boat makes them uneasy. If you got to your Airbnb and it was a boat, would you still stay?

SonnyBoy🇺🇸

472,638 views • 3 months ago

Jez Corden explains disc-to-digital (Project Positron) conversion platform You literally put the disc into the console, and it gives you a digital license for the game permanently for your Microsoft account. If you give the disc away or sell it; if it gets connected to another Microsoft account, you lose access to that digital license. You don't need the disc to keep verifying it. It's whoever last used the disc who gets the license. In 2013 (Xbox One launch) there was a rumor that retailers were going to unlock the disc, but that wasn't actually true, but it was badly communicated, and Xbox leaders misunderstood how the feature was going to work. It became a huge cluster that they had to scrap. You get the full game, you get the Xbox Cloud version, you get the Xbox Play Anywhere version, and you get the license as if you purchased it digitally. Superchat: Alright, so insert the disc, get the digital license, snap the disc in half, got it. 😂 via: Jez Windows Central
3:21

Jez Corden explains disc-to-digital (Project Positron) conversion platform You literally put the disc into the console, and it gives you a digital license for the game permanently for your Microsoft account. If you give the disc away or sell it; if it gets connected to another Microsoft account, you lose access to that digital license. You don't need the disc to keep verifying it. It's whoever last used the disc who gets the license. In 2013 (Xbox One launch) there was a rumor that retailers were going to unlock the disc, but that wasn't actually true, but it was badly communicated, and Xbox leaders misunderstood how the feature was going to work. It became a huge cluster that they had to scrap. You get the full game, you get the Xbox Cloud version, you get the Xbox Play Anywhere version, and you get the license as if you purchased it digitally. Superchat: Alright, so insert the disc, get the digital license, snap the disc in half, got it. 😂 via: Jez Windows Central

Idle Sloth

57,586 views • 23 days ago

This is how you can get programmatic access to any website. You need two things: 1. The URL of the website 2. A prompt specifying what you want to do on the site Mino is a neat platform that uses browser automation and AI-powered navigation to understand your prompt, open the website, and extract the information you want. This opens the doors to unlimited potential automations you could build using data from everyday websites that don't give you an API. Mino uses AI to go way further than you could get by using a regular web scraping tool: • It can handle dynamic JavaScript content • It can handle login walls • It can navigate through interactive booking flows • It adapts to different interfaces and layout changes • It can fill out forms automatically • It supports stealth browser mode In my experience, running Mino on relatively straightforward sites takes about 30-60 seconds to complete. The more times you run it, the faster it gets. I recorded a quick video to show you the platform. You can check their site here: Thanks to the team for the support, onboarding me on their platform, and the collaboration on this post.
5:10

This is how you can get programmatic access to any website. You need two things: 1. The URL of the website 2. A prompt specifying what you want to do on the site Mino is a neat platform that uses browser automation and AI-powered navigation to understand your prompt, open the website, and extract the information you want. This opens the doors to unlimited potential automations you could build using data from everyday websites that don't give you an API. Mino uses AI to go way further than you could get by using a regular web scraping tool: • It can handle dynamic JavaScript content • It can handle login walls • It can navigate through interactive booking flows • It adapts to different interfaces and layout changes • It can fill out forms automatically • It supports stealth browser mode In my experience, running Mino on relatively straightforward sites takes about 30-60 seconds to complete. The more times you run it, the faster it gets. I recorded a quick video to show you the platform. You can check their site here: Thanks to the team for the support, onboarding me on their platform, and the collaboration on this post.

Santiago

31,742 views • 7 months ago

Most developers can't explain how Single Sign-On (SSO) works. ​ This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. ​ Here is a 5-minute overview of how Single Sign-On works. ​ We all hate passwords; the less we use them, the better, and SSO helps with that. ​ When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: ​ • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. ​ Here is what happens when you try to access one application for the first time: ​ 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. ​ 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. ​ 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. ​ 4. Your browser grabs the token and presents it to YouTube. ​ 5. YouTube checks the token, and if it is valid, lets you in. ​ But then you want to access Google Drive: ​ 1. You go to Google Drive, and the application redirects you to the IDP. ​ 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. ​ 3. Instead, the IDP generates a new token for Drive. ​ 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. ​ You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! ​ But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. ​ Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! ​ They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website: ​
4:57

Most developers can't explain how Single Sign-On (SSO) works. ​ This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. ​ Here is a 5-minute overview of how Single Sign-On works. ​ We all hate passwords; the less we use them, the better, and SSO helps with that. ​ When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: ​ • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. ​ Here is what happens when you try to access one application for the first time: ​ 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. ​ 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. ​ 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. ​ 4. Your browser grabs the token and presents it to YouTube. ​ 5. YouTube checks the token, and if it is valid, lets you in. ​ But then you want to access Google Drive: ​ 1. You go to Google Drive, and the application redirects you to the IDP. ​ 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. ​ 3. Instead, the IDP generates a new token for Drive. ​ 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. ​ You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! ​ But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. ​ Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! ​ They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website: ​

Santiago

204,895 views • 1 year ago

🚨 DeWalt Laser Reveals HIDDEN CODE on Walls Under DMT – Proof We're in a Simulation? 😱 Chase Hughes told Shawn Ryan: "A simple DeWalt laser turns into one of the strangest demonstrations of simulation theory you’ll ever see." "When you look at that, you can see through the wall... You can see through the wall where the laser is." "While you are in the DMT state, you get close to the wall and you can see code that looks kind of like alien writing... or some that look like kanji Japanese characters." "This is permanent solid... if you move your head, the code stays in the same place." "If you put your arm in front of it, the code completely changes, but only right where your arm is." "The first time I saw it, I wept. I wept." Multiple people see the exact same code – no explanation! Mind blown – is reality glitching right in front of us? Have you ever experienced anything like this on psychedelics? Do you think we're living in a simulation with visible code? What would seeing alien-like symbols do to your worldview? Drop your thoughts 👇 #SimulationTheory
3:42

🚨 DeWalt Laser Reveals HIDDEN CODE on Walls Under DMT – Proof We're in a Simulation? 😱 Chase Hughes told Shawn Ryan: "A simple DeWalt laser turns into one of the strangest demonstrations of simulation theory you’ll ever see." "When you look at that, you can see through the wall... You can see through the wall where the laser is." "While you are in the DMT state, you get close to the wall and you can see code that looks kind of like alien writing... or some that look like kanji Japanese characters." "This is permanent solid... if you move your head, the code stays in the same place." "If you put your arm in front of it, the code completely changes, but only right where your arm is." "The first time I saw it, I wept. I wept." Multiple people see the exact same code – no explanation! Mind blown – is reality glitching right in front of us? Have you ever experienced anything like this on psychedelics? Do you think we're living in a simulation with visible code? What would seeing alien-like symbols do to your worldview? Drop your thoughts 👇 #SimulationTheory

Interstellar

71,251 views • 4 months ago

Tax expert explains what happens if you owe millions to the IRS and can’t pay “If you owe the IRS and you legitimately don’t have the money to pay them, you have two options. You can either get on a payment plan or you can do an offer in compromise” “Now the payment plan only works if your tax bill is $50,000 or less. So if you’re making millions and you owe millions, you’re in a situation here” “This is where the offer in compromise comes in. The IRS knows you probably aren’t going to be able to pay them back with the income that you currently have sitting inside your savings account or the income that they can see coming in” “So if you can show that you’ve had a negative economic gain, you’re making less money, you’re not able to really grow your revenue, they will start to focus on creating a compromise with you” “We call these OICs. This is where you offer the IRS a reduced amount and you compromise on that amount and hopefully you can pay that in a lump sum and be able to rid away with your IRS debt” “Or what they’ll also allow for you to do is pay a percentage of it in a lump sum and then get the rest on a payment plan”
1:09

Tax expert explains what happens if you owe millions to the IRS and can’t pay “If you owe the IRS and you legitimately don’t have the money to pay them, you have two options. You can either get on a payment plan or you can do an offer in compromise” “Now the payment plan only works if your tax bill is $50,000 or less. So if you’re making millions and you owe millions, you’re in a situation here” “This is where the offer in compromise comes in. The IRS knows you probably aren’t going to be able to pay them back with the income that you currently have sitting inside your savings account or the income that they can see coming in” “So if you can show that you’ve had a negative economic gain, you’re making less money, you’re not able to really grow your revenue, they will start to focus on creating a compromise with you” “We call these OICs. This is where you offer the IRS a reduced amount and you compromise on that amount and hopefully you can pay that in a lump sum and be able to rid away with your IRS debt” “Or what they’ll also allow for you to do is pay a percentage of it in a lump sum and then get the rest on a payment plan”

Jack

862,078 views • 3 months ago

🚨 ROGAN O’HANDLEY: “A couple months ago the DOJ released what they called phase one of the Epstein files. They said that there were more files in the New York FBI office. Reports say that the DOJ now has those files. Is there going to be another release or arrest made from the client list?” LEAVITT: “I can assure you that the attorney general is working on it. I have to check in with them for a specific timeline, but I can tell you that the Attorney General is a bulldog and she is somebody that you want on your team. When she wants to get something done, she gets it done…”
1:27

🚨 ROGAN O’HANDLEY: “A couple months ago the DOJ released what they called phase one of the Epstein files. They said that there were more files in the New York FBI office. Reports say that the DOJ now has those files. Is there going to be another release or arrest made from the client list?” LEAVITT: “I can assure you that the attorney general is working on it. I have to check in with them for a specific timeline, but I can tell you that the Attorney General is a bulldog and she is somebody that you want on your team. When she wants to get something done, she gets it done…”

Autism Capital 🧩

61,051 views • 1 year ago

Kendrick Perkins RIPS JJ Redick and the Lakers future 😳 “JJ got more excuses than a brotha going to jail. It’s time for you to coach. Get the attention of your locker room. When you have one of the worst defenses in the league that’s a reflection of your coach! When it comes to LeBron and the lakers relationship, that is one foot on the grave and the other on a banana peel…. If you think Austin Reaves and Luka can be your two max guys to bring a championship back to LA, you lost your damn mind” (Via First Take)
1:37

Kendrick Perkins RIPS JJ Redick and the Lakers future 😳 “JJ got more excuses than a brotha going to jail. It’s time for you to coach. Get the attention of your locker room. When you have one of the worst defenses in the league that’s a reflection of your coach! When it comes to LeBron and the lakers relationship, that is one foot on the grave and the other on a banana peel…. If you think Austin Reaves and Luka can be your two max guys to bring a championship back to LA, you lost your damn mind” (Via First Take)

NBA Courtside

164,749 views • 4 months ago

Claude Code on desktop just added an embedded loop that can run your dev server, view the app, review local changes, and watch pull requests until they merge. It can now preview a running app inside the desktop UI while it iterates on fixes. It can also monitor CI for an open PR and either fix failures or merge when checks go green. Earlier “agentic coding” workflows usually bounced between a terminal, a browser, and GitHub, so the model could not directly see what the app rendered or stay attached to CI results without manual babysitting. The new server preview flow starts and stops dev servers from a Preview control, shows the app in an embedded browser, reads logs, and can interact with the page to verify changes. That closes a common gap where a model edits code but cannot reliably confirm the UI and runtime behavior match the intent. The local “Review code” step runs before pushing, and it leaves inline comments on the diff so basic bugs and risky changes get caught earlier. For PR monitoring, the desktop app will track status and CI checks, and it can use auto-fix to attempt repairs and auto-merge to land the PR once checks pass, using GitHub tooling under the hood. Session mobility adds a /desktop command to move a CLI session into the desktop app, and sessions can be pushed to the cloud to resume from web or phone.
1:15

Claude Code on desktop just added an embedded loop that can run your dev server, view the app, review local changes, and watch pull requests until they merge. It can now preview a running app inside the desktop UI while it iterates on fixes. It can also monitor CI for an open PR and either fix failures or merge when checks go green. Earlier “agentic coding” workflows usually bounced between a terminal, a browser, and GitHub, so the model could not directly see what the app rendered or stay attached to CI results without manual babysitting. The new server preview flow starts and stops dev servers from a Preview control, shows the app in an embedded browser, reads logs, and can interact with the page to verify changes. That closes a common gap where a model edits code but cannot reliably confirm the UI and runtime behavior match the intent. The local “Review code” step runs before pushing, and it leaves inline comments on the diff so basic bugs and risky changes get caught earlier. For PR monitoring, the desktop app will track status and CI checks, and it can use auto-fix to attempt repairs and auto-merge to land the PR once checks pass, using GitHub tooling under the hood. Session mobility adds a /desktop command to move a CLI session into the desktop app, and sessions can be pushed to the cloud to resume from web or phone.

Rohan Paul

33,431 views • 5 months ago

Pi was built when there were already agent harnesses around. Here’s why Mario Zechner(Mario Zechner), found them suboptimal and built Pi, a minimalist self-modifying agent: #1 - Mario initially was a believer in Claude Code: "I was a believer in Claude code because they were the first that packaged agentic search up in a really compelling package. And at the time that fit my workflow really well. Everything around the LLM was kind of nice and tidy and easy to understand. I was super happy. I was proselytising Claude code." #2 - Reverse engineering Claude Code highlighted the degradation that Mario felt as a user: "I personally like simple tools that are stable and that I can rely on. Even if they have non-deterministic parts, all the deterministic parts should be as stable as possible. That was just not the experience with Claude Code around summer 2025. They would take away your control of the context. They would inject stuff behind your back, which is bad. Then, your workflows stopped working because there's now a system reminder that you don't even see in the UI that would modify the behaviour of the model. They would also do this to the system prompt. I built a little service where I can track the progression or evolution of the system, prompt and tool definitions and, with every release, it was messing with stuff. That just messed with my workflows and I don't appreciate that." #3 - PI was built with an appreciation for simple and reliable tools: "If I commit to a development tool, I want it to be a stable, reliable thing like a hammer. I don't want my hammer to break a different spot every day. That's terrible. We need somebody who goes the full velocity kind of way. But I don't want to work with a tool like that."
2:54

Pi was built when there were already agent harnesses around. Here’s why Mario Zechner(Mario Zechner), found them suboptimal and built Pi, a minimalist self-modifying agent: #1 - Mario initially was a believer in Claude Code: "I was a believer in Claude code because they were the first that packaged agentic search up in a really compelling package. And at the time that fit my workflow really well. Everything around the LLM was kind of nice and tidy and easy to understand. I was super happy. I was proselytising Claude code." #2 - Reverse engineering Claude Code highlighted the degradation that Mario felt as a user: "I personally like simple tools that are stable and that I can rely on. Even if they have non-deterministic parts, all the deterministic parts should be as stable as possible. That was just not the experience with Claude Code around summer 2025. They would take away your control of the context. They would inject stuff behind your back, which is bad. Then, your workflows stopped working because there's now a system reminder that you don't even see in the UI that would modify the behaviour of the model. They would also do this to the system prompt. I built a little service where I can track the progression or evolution of the system, prompt and tool definitions and, with every release, it was messing with stuff. That just messed with my workflows and I don't appreciate that." #3 - PI was built with an appreciation for simple and reliable tools: "If I commit to a development tool, I want it to be a stable, reliable thing like a hammer. I don't want my hammer to break a different spot every day. That's terrible. We need somebody who goes the full velocity kind of way. But I don't want to work with a tool like that."

The Pragmatic Engineer

62,825 views • 2 months ago

A knifeman stabbed a woman to death in front of terrified bystanders in Barcelona in what authorities believe was a random street killing. A woman has been killed in a shocking knife attack in the streets of Barcelona in full view of horrified bystanders. The stabbing happened at around 11am in Esplugues de Llobregat, just a short distance from the Camp Nou stadium. Witnesses watched as the attacker struck in broad daylight. The victim, described locally as a young woman, suffered multiple stab wounds to the throat, chest and stomach. She died at the scene. A 50-year-old man who tried to intervene was also injured, sustaining wounds to his arm. His injuries are not believed to be life-threatening. Police say they are still working to determine whether the attacker knew the victim. So far, there is no evidence of any relationship between them. Investigators are focusing on the possibility that this was a random attack. The suspect — described as wearing jeans, a hoodie and carrying a large black rucksack was arrested just hours later in the nearby Les Corts area. Images of the alleged attacker holding the weapon have since circulated, adding to the shock surrounding the incident. As the investigation continues, one thing is already clear: A normal morning turned into a scene of terror and a life has been taken in the most brutal way.
0:28

A knifeman stabbed a woman to death in front of terrified bystanders in Barcelona in what authorities believe was a random street killing. A woman has been killed in a shocking knife attack in the streets of Barcelona in full view of horrified bystanders. The stabbing happened at around 11am in Esplugues de Llobregat, just a short distance from the Camp Nou stadium. Witnesses watched as the attacker struck in broad daylight. The victim, described locally as a young woman, suffered multiple stab wounds to the throat, chest and stomach. She died at the scene. A 50-year-old man who tried to intervene was also injured, sustaining wounds to his arm. His injuries are not believed to be life-threatening. Police say they are still working to determine whether the attacker knew the victim. So far, there is no evidence of any relationship between them. Investigators are focusing on the possibility that this was a random attack. The suspect — described as wearing jeans, a hoodie and carrying a large black rucksack was arrested just hours later in the nearby Les Corts area. Images of the alleged attacker holding the weapon have since circulated, adding to the shock surrounding the incident. As the investigation continues, one thing is already clear: A normal morning turned into a scene of terror and a life has been taken in the most brutal way.

Benonwine

159,762 views • 2 months ago

AI is changing the software engineering craft. Anders Hejlsberg (Anders Hejlsberg) - creator of C#, TypeScript and industry legend - on why code review needs to get more enjoyable in response: #1 - AI is shifting the craft from writing code, to reviewing code: "In a sense, we're all turning into project managers. We can have an army of junior programmers, called agents, that will just spit out reams of code but someone's got to have the big picture and review all of that. And so, increasingly, our craft is going from one of writing the code, to one of reviewing the code and building the architecture of the code and overseeing the work. It's a different kind of craft. It's a different kind of enjoyment. I've always liked writing the code. To me that was the fulfilling part, seeing it work. In a way, AI robs a little bit of that, because I am less interested in reviewing code." #2 - The code review experience should be improved: "I think we could also make the process of reviewing code much more interesting than it is today. I mean, today, you see a list of diffs in alphabetical order and now it's up to you to make heads or tails of it. There are more pedagogical ways of presenting that. And you could have commentary generated by the AI that tells you what the changes are and whatever, and then tries to guide you along. So that symbiotic relationship, I think we need to work on that more and to keep the enjoyment in there."
2:04

AI is changing the software engineering craft. Anders Hejlsberg (Anders Hejlsberg) - creator of C#, TypeScript and industry legend - on why code review needs to get more enjoyable in response: #1 - AI is shifting the craft from writing code, to reviewing code: "In a sense, we're all turning into project managers. We can have an army of junior programmers, called agents, that will just spit out reams of code but someone's got to have the big picture and review all of that. And so, increasingly, our craft is going from one of writing the code, to one of reviewing the code and building the architecture of the code and overseeing the work. It's a different kind of craft. It's a different kind of enjoyment. I've always liked writing the code. To me that was the fulfilling part, seeing it work. In a way, AI robs a little bit of that, because I am less interested in reviewing code." #2 - The code review experience should be improved: "I think we could also make the process of reviewing code much more interesting than it is today. I mean, today, you see a list of diffs in alphabetical order and now it's up to you to make heads or tails of it. There are more pedagogical ways of presenting that. And you could have commentary generated by the AI that tells you what the changes are and whatever, and then tries to guide you along. So that symbiotic relationship, I think we need to work on that more and to keep the enjoyment in there."

The Pragmatic Engineer

39,011 views • 2 months ago

Mikel Arteta says even if he gives the players a break from each other then they would just meet up anyway: “That's the theory, and I wish we could be in Dubai. So, if we have one or two days, I guarantee you that we were in Dubai for a few days, even if it was for a few days, because everybody was dying for it. “But then you get very surprised because sometimes, when I give them the day off, and you think that they don't want to see each other, no? Then I find out that Eight players or ten were having dinner in somebody's house. They spent the whole afternoon together… “And that's the beauty of it, the fact that they want to be together because they feel like being together is the best thing that they can do. And that was the case this week as well in a lot of cases.”
0:54

Mikel Arteta says even if he gives the players a break from each other then they would just meet up anyway: “That's the theory, and I wish we could be in Dubai. So, if we have one or two days, I guarantee you that we were in Dubai for a few days, even if it was for a few days, because everybody was dying for it. “But then you get very surprised because sometimes, when I give them the day off, and you think that they don't want to see each other, no? Then I find out that Eight players or ten were having dinner in somebody's house. They spent the whole afternoon together… “And that's the beauty of it, the fact that they want to be together because they feel like being together is the best thing that they can do. And that was the case this week as well in a lot of cases.”

Connor Humm

414,911 views • 4 months ago

Your Claude has a tell, and almost nobody uses it. Make it start every reply with your name. One line in custom instructions, no code. The moment it stops saying your name, its context window is full. That is the exact point the output starts drifting, and you do not notice. Name stops? Start a fresh chat. It has killed about 90% of my “why has Claude gone weird” moments. Miners sent a canary down the pit to catch the gas they could not see. Same trick, for your context. Comment GUIDE and I’ll send you the exact canary setup.
0:48

Your Claude has a tell, and almost nobody uses it. Make it start every reply with your name. One line in custom instructions, no code. The moment it stops saying your name, its context window is full. That is the exact point the output starts drifting, and you do not notice. Name stops? Start a fresh chat. It has killed about 90% of my “why has Claude gone weird” moments. Miners sent a canary down the pit to catch the gas they could not see. Same trick, for your context. Comment GUIDE and I’ll send you the exact canary setup.

Charlie Hills

22,956 views • 13 days ago

I can't stop thinking about this... Michael Caine on his defining philosophy on life: Use the Difficulty As a young actor, he was rehearsing a play scene when a chair got stuck in the door and blocked his path. He told the other actor he couldn't get by the chair to enter the room in the scene. The actor's response: "Use the difficulty...if it's a comedy, fall over it, if it's a drama, pick it up and smash it." This story offers a powerful reframe: Every single difficulty you face is an opportunity in disguise. The difficulty is a guarantee. The struggle. The obstacle. The frustration. The failure. The hurt. The setback. They will come. You don’t get to choose whether they appear, or when, but you do get to choose how you handle them. How can you use the difficulty you're currently facing? - Can you embrace this struggle? - Can you grow through it? - Can you find flow through friction? If you were reading a biography of your life, what would make this difficulty into an inflection point? The moment when everything turned for the better. The unmistakable point where everything changed. How would you have responded to this moment? The difficulty is a guarantee. You can't control it. But you can control how you react to it. You can control your response to it. You can control your attitude towards it. You can use the difficulty.
1:15

I can't stop thinking about this... Michael Caine on his defining philosophy on life: Use the Difficulty As a young actor, he was rehearsing a play scene when a chair got stuck in the door and blocked his path. He told the other actor he couldn't get by the chair to enter the room in the scene. The actor's response: "Use the difficulty...if it's a comedy, fall over it, if it's a drama, pick it up and smash it." This story offers a powerful reframe: Every single difficulty you face is an opportunity in disguise. The difficulty is a guarantee. The struggle. The obstacle. The frustration. The failure. The hurt. The setback. They will come. You don’t get to choose whether they appear, or when, but you do get to choose how you handle them. How can you use the difficulty you're currently facing? - Can you embrace this struggle? - Can you grow through it? - Can you find flow through friction? If you were reading a biography of your life, what would make this difficulty into an inflection point? The moment when everything turned for the better. The unmistakable point where everything changed. How would you have responded to this moment? The difficulty is a guarantee. You can't control it. But you can control how you react to it. You can control your response to it. You can control your attitude towards it. You can use the difficulty.

Sahil Bloom

213,857 views • 10 months ago

A DEVELOPER WHO HELPS MAINTAIN GIT ITSELF PROVED THAT USING GIT AND CONTRIBUTING WITH GIT ARE TWO DIFFERENT SKILLS AND ALMOST NO ONE LEARNS THE SECOND 55 minutes from Johannes Schindelin, one of git's most prolific contributors, on the workflow that gets your code accepted into a project you don't own. -> The moment it lands, committing to your own repo turns out to be the easy 10%. Landing a change in someone else's codebase is the part nobody taught you. Most people can save their own work. Far fewer can revise a patch five times, keep the history clean, and merge it into a project moving under them. Saving your code was never the skill -> getting it merged into someone else's is. And when an AI agent fires off a pull request nobody asked for, the person who knows how to really contribute is the one who gets it accepted instead of closed. Anyone can commit to their own repo. The person who can land a change in a project they don't own is the one who actually ships. Bookmark & Watch it today ↓
55:43

A DEVELOPER WHO HELPS MAINTAIN GIT ITSELF PROVED THAT USING GIT AND CONTRIBUTING WITH GIT ARE TWO DIFFERENT SKILLS AND ALMOST NO ONE LEARNS THE SECOND 55 minutes from Johannes Schindelin, one of git's most prolific contributors, on the workflow that gets your code accepted into a project you don't own. -> The moment it lands, committing to your own repo turns out to be the easy 10%. Landing a change in someone else's codebase is the part nobody taught you. Most people can save their own work. Far fewer can revise a patch five times, keep the history clean, and merge it into a project moving under them. Saving your code was never the skill -> getting it merged into someone else's is. And when an AI agent fires off a pull request nobody asked for, the person who knows how to really contribute is the one who gets it accepted instead of closed. Anyone can commit to their own repo. The person who can land a change in a project they don't own is the one who actually ships. Bookmark & Watch it today ↓

slash1s

12,688 views • 1 month ago

THIS MIGHT BE THE #1 OPEN-SOURCE REPO FOR CLAUDE CODE RIGHT NOW. IT GIVES CLAUDE A MEMORY AND SLASHES YOUR TOKEN COST ON EVERY QUESTION The repo is safishamsi/graphify, a free open-source skill that turns any codebase into a knowledge graph Claude Code can read instantly. Instead of grepping through your files every session, Claude gets a map of how everything connects The problem it fixes: Every time you ask Claude Code about a big repo, it does the same thing, greps through dozens of files like a brute-force Ctrl+F, blows through your context window, and sometimes still misses the answer hiding in a file nobody searched. Claude Code has no memory of how your project is structured. Every session starts from zero What it does: It maps your entire codebase into a knowledge graph, capturing not just which files exist, but which functions depend on which, which modules are central, and which files cluster around the same concern. Claude queries the map instead of scanning files How it works, three passes: 1. Code structure, free and local. Tree-sitter parses your files and pulls out classes, functions, imports and call graphs. No LLM, no tokens, just your actual code mapped deterministically 2. Audio and video, if you have them. Transcribed locally and folded into the graph 3. Docs, papers, images. Here an LLM does semantic analysis, figuring out what each document means and where it fits. Only the meaning gets sent up, never your raw source It saves you money: Normally a question about a big repo makes Claude spawn explore agents that scan file after file, eating your context window and your token budget before you get an answer. With the graph already built, Claude queries the map instead of re-reading the codebase every time. Same answer, a fraction of the tokens. The graph only gets built once, then a hook rebuilds it after each commit for free, so you never pay that scanning cost again. The bigger the repo, the bigger the gap The best parts: it's a skill, so once installed Claude knows when to use it without you memorizing commands. It works on non-code folders too, point it at docs or notes and it can spin up an Obsidian vault How to add it to your Claude: 1. Install Claude Code if you haven't: npm install -g Paul Jankura-ai/claude-code 2. Add the skill: claude skill add safishamsi/graphify 3. Open your project folder and run /graphify . to build the graph 4. Optional, make it automatic: graphify hook install so the graph rebuilds after every commit That's it. Ask Claude about your repo and it reads the map instead of burning tokens on a file hunt Bookmark this
13:23

THIS MIGHT BE THE #1 OPEN-SOURCE REPO FOR CLAUDE CODE RIGHT NOW. IT GIVES CLAUDE A MEMORY AND SLASHES YOUR TOKEN COST ON EVERY QUESTION The repo is safishamsi/graphify, a free open-source skill that turns any codebase into a knowledge graph Claude Code can read instantly. Instead of grepping through your files every session, Claude gets a map of how everything connects The problem it fixes: Every time you ask Claude Code about a big repo, it does the same thing, greps through dozens of files like a brute-force Ctrl+F, blows through your context window, and sometimes still misses the answer hiding in a file nobody searched. Claude Code has no memory of how your project is structured. Every session starts from zero What it does: It maps your entire codebase into a knowledge graph, capturing not just which files exist, but which functions depend on which, which modules are central, and which files cluster around the same concern. Claude queries the map instead of scanning files How it works, three passes: 1. Code structure, free and local. Tree-sitter parses your files and pulls out classes, functions, imports and call graphs. No LLM, no tokens, just your actual code mapped deterministically 2. Audio and video, if you have them. Transcribed locally and folded into the graph 3. Docs, papers, images. Here an LLM does semantic analysis, figuring out what each document means and where it fits. Only the meaning gets sent up, never your raw source It saves you money: Normally a question about a big repo makes Claude spawn explore agents that scan file after file, eating your context window and your token budget before you get an answer. With the graph already built, Claude queries the map instead of re-reading the codebase every time. Same answer, a fraction of the tokens. The graph only gets built once, then a hook rebuilds it after each commit for free, so you never pay that scanning cost again. The bigger the repo, the bigger the gap The best parts: it's a skill, so once installed Claude knows when to use it without you memorizing commands. It works on non-code folders too, point it at docs or notes and it can spin up an Obsidian vault How to add it to your Claude: 1. Install Claude Code if you haven't: npm install -g Paul Jankura-ai/claude-code 2. Add the skill: claude skill add safishamsi/graphify 3. Open your project folder and run /graphify . to build the graph 4. Optional, make it automatic: graphify hook install so the graph rebuilds after every commit That's it. Ask Claude about your repo and it reads the map instead of burning tokens on a file hunt Bookmark this

Yarchi

55,345 views • 1 month ago