Daring Fireball
• John Gruber
Not sure what level of prank/gag/stunt this is (note today’s date), but this is supposedly a fully functional compass that only points to the Olive Garden in Times Square.
Daring Fireball
• John Gruber
The AP:
Hershey said Wednesday it will use classic recipes for all Reese’s products starting next year, a change that comes after the grandson of Reese’s founder criticized the company for shifting to cheaper ingredients.
Running to the press never works.
(Stick to Trader Joe’s, I say.)
Link: apnews.com/article/hershey-reeses-chocolate-peanut-butter…
The Pioneering Coffee House Serving Since 1645. “In Oxford, ‘runners’ would go from coffee house to coffee house, picking up all the best news and delivering it back to customers, said Garner. You’re talking human wi-fi.”
Daring Fireball
• John Gruber
After two years off, Tom Scott is back with a new YouTube series: “I took a road trip through every county in England, and filmed something interesting in each of them.”
It's called the Bluey phone by VTech. It really commits to the idea of a minimal phone. (Affiliate Link) VTech Bluey Ring Phone: https://geni.us/HpXH MKBHD Merch: http://shop.MKBHD.com Playlist of MKBHD Intro music: https://goo.gl/B3AWV5 ~ http://twitter.com/MKBHD http://instagram.com/MKBHD http://facebook.com/MKBHD
President Trump says the US will end its war against Iran in the next "2 or 3 weeks" - but it will be up to other countries to secure the vital Strait of Hormuz. We'll look at how Australia is dealing with rising fuel costs, and whether it's a good idea for Britain's King Charles to visit Washington at this moment. Also: Donald Trump's White House ballroom project is halted; a special report from the North Sea on a plan to capture carbon dioxide; shocking news for families who had fertility treatment in Northern Cyprus; and we check in with our reporter at Cape Canaveral ahead of NASA's first Moon mission in five decades.
Release: datasette-extract 0.3a0
- This plugin now uses datasette-llm to configure and manage models. This means it's possible to specify which models should be made available for enrichments, using the new
enrichmentspurpose.
Release: datasette-enrichments-llm 0.2a0
- This plugin now uses datasette-llm to configure and manage models. This means it's possible to specify which models should be made available for enrichments, using the new
enrichmentspurpose.
Release: datasette-llm-usage 0.2a0
- Removed features relating to allowances and estimated pricing. These are now the domain of datasette-llm-accountant.
- Now depends on datasette-llm for model configuration. #3
- Full prompts and responses and tool calls can now be logged to the
llm_usage_prompt_logtable in the internal database if you set the newdatasette-llm-usage.log_promptsplugin configuration setting.- Redesigned the
/-/llm-usage-simple-promptpage, which now requires thellm-usage-simple-promptpermission.
Release: datasette-llm 0.1a5
- The
llm_prompt_context()plugin hook wrapper mechanism now tracks prompts executed within a chain as well as one-off prompts, which means it can be used to track tool call loops. #5
I want to argue that AI models will write good code because of economic incentives. Good code is cheaper to generate and maintain. Competition is high between the AI models right now, and the ones that win will help developers ship reliable features fastest, which requires simple, maintainable code. Good code will prevail, not only because we want it to (though we do!), but because economic forces demand it. Markets will not reward slop in coding, in the long-term.
— Soohoon Choi, Slop Is Not Necessarily The Future
Tags: slop, ai-assisted-programming, generative-ai, agentic-engineering, ai, llms
Nothing Works in Trump’s America — Except Racism. “Trump is objectively bad at running the government, but he’s objectively good at running a Klan rally, and his supporters value the latter so much that they forgive the former.”
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
Useful writeup of today's supply chain attack against Axios, the HTTP client NPM package with 101 million weekly downloads. Versions
1.14.1 and 0.30.4 both included a new dependency called plain-crypto-js which was freshly published malware, stealing credentials and installing a remote access trojan (RAT).
It looks like the attack came from a leaked long-lived npm token. Axios have an open issue to adopt trusted publishing, which would ensure that only their GitHub Actions workflows are able to publish to npm. The malware packages were published without an accompanying GitHub release, which strikes me as a useful heuristic for spotting potentially malicious releases - the same pattern was present for LiteLLM last week as well.
Via lobste.rs
Tags: javascript, security, npm, supply-chain
The 2026 issue of the HTML Review, “an annual journal of literature made to exist on the web”.