Blog
Practical notes on AI tools, programming, software engineering, and technology.
GitHub's Advisory Database Hit 1,560 CVEs in May. Here's Why That Matters.
GitHub's Advisory Database processed 5x its normal volume in May. Private vulnerability reports jumped from 550 to 3,000 per week. Here's the impact and how teams should respond.
3 min read
Git 2.55 Quietly Fixes How Massive Repos Stay Maintainable
Git 2.55 brings incremental MIDX repacking, reftable improvements, and faster performance on huge repositories. Here's what changed.
3 min read
A Normal-Looking GitHub Repo Can Hijack Claude Code
Mozilla's 0DIN researchers showed how a setup script pulling from DNS can take over Claude Code via indirect prompt injection. Here's the attack and the fix.
Ethereum Clear Signing: Safer Transaction Approvals Start With Readable Wallets
Ethereum clear signing explained for users and builders: why blind signing is risky, what wallets should show, and what to check before approving transactions.
6 min read
DNS over HTTPS Explained: What It Hides and What It Does Not
DNS over HTTPS makes DNS lookups harder to watch or tamper with, but it is not a full privacy shield. Here is what changes for users, developers, and networks.
UK Crypto Firms Get a 2027 FCA Authorization Deadline
The UK crypto rulebook is moving from consultation to permission. Here are the dates, firms in scope, and checks teams should start before 2027.
Chrome WebMCP Origin Trial: Websites Need an Agent Interface Now
Chrome's WebMCP origin trial shows how agent-ready websites may expose actions and context to browser agents. Useful, early, and worth testing with care.
RAG Evaluation Checklist for AI Apps Before Users See Them
A practical RAG evaluation checklist for app developers: test retrieval, citations, answer grounding, regressions, and release gates before shipping AI features.
Small Functions, Readable Code: A Practical Refactoring Guide
A practical guide to small functions readable code, with advice on function boundaries, parameters, return values, tests, and safe refactoring.
6 min read
Next.js authentication checklist for production apps
A practical Next.js authentication checklist for production apps, covering sessions, cookies, routes, CSRF, passwords, redirects, logging, and deployment checks.
6 min read