FeedCity

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection Datasette has long protected against CSRF attacks using CSRF tokens, implemented using my asgi-csrf Python library. These are something of a pain to work with - you need to scatter forms in te...

Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.

Trusted access for the next era of cyber defense OpenAI's answer to Claude Mythos appears to be a new model called GPT-5.4-Cyber: In preparation for increasingly more capable models from OpenAI over the next few months, we are fine-tuning our models specifically to enable d...

Cybersecurity Looks Like Proof of Work Now The UK's AI Safety Institute recently published Our evaluation of Claude Mythos Preview’s cyber capabilities, their own independent analysis of Claude Mythos which backs up Anthropic's claims that it is exceptionally effective at id...

OR: the Halo theory of science

Today's links In praise of (some) compartmentalization: Go with the flow (mostly). Hey look at this: Delights to delectate. Object permanence: Multitasking teens; Copyrighted dirt; NZ internet disconnection x CHCH quake; Hubble cake; Churchill's booze Rx; Fraud-resistant elec...

I'm starting to become pretty fond of Bruce. Actually, I've had a bit of an epiphany: an AI assistant like Bruce isn't just about auto-responding to tickets in an entirely autonomous manner; it's also pretty awesome at responding with just a little

Big Plans is out now on iOS and Android. We built it at Secret Lab for Bank of us, the Tasmanian customer-owned bank, as a story-based game for kids aged 5 to 8 about money. Specifically, the value of money, needs versus wants, and the basics of planning and making choices.

We loved making it. The brief was unusually thoughtful for a kids’ app: no ads, no in-app purchases, no online interaction, no marketing pitches at children. Just a small game that helps a five-year-old start thinking about how money works. There’s a parent guide that goes with it for families who want to keep the conversation going off-screen.

Ada is incredibly well designed. One way this shows is that it takes the big, monolithic features of other languages and breaks them down into their constituent parts, so we can choose which portions of those features we want. The example I often reach for to explain this is object-oriented programming.

I never truly understood object-oriented programming until I learned Ada, which breaks down object-oriented programming into separate features, like

• encapsulation,
• reuse,
• inheritance,
• abstract interfaces,
• type extension, and
• dynamic dispatch.

(Continue reading the full article on the web.)

The TL;DR is that Google engineering appears to have the same AI adoption footprint as John Deere, the tractor company. Most of the industry has the same internal adoption curve: 20% agentic power users, 20% outright refusers, 60% still using Cursor or equivalent chat tool. It turns out Google has this curve too. [...]

There has been an industry-wide hiring freeze for 18+ months, during which time nobody has been moving jobs. So there are no clued-in people coming in from the outside to tell Google how far behind they are, how utterly mediocre they have become as an eng org.

— Steve Yegge

Tags: steve-yegge, google, generative-ai, agentic-engineering, ai, llms

Research: Exploring the new `servo` crate In Servo is now available on crates.io the Servo team announced the initial release of the servo crate, which packages their browser engine as an embeddable library. I set Claude Code for web the task of figuring out what it can ...

The problem is that LLMs inherently lack the virtue of laziness. Work costs nothing to an LLM. LLMs do not feel a need to optimize for their own (or anyone's) future time, and will happily dump more and more onto a layercake of garbage. Left unchecked, LLMs will make systems larger, not better — appealing to perverse vanity metrics, perhaps, but at the cost of everything that matters.

As such, LLMs highlight how essential our human laziness is: our finite time forces us to develop crisp abstractions in part because we don't want to waste our (human!) time on the consequences of clunky ones.

— Bryan Cantrill, The peril of laziness lost

Tags: bryan-cantrill, ai, llms, ai-assisted-programming, generative-ai

Thanks to a tip from Rahim Nathwani, here's a uv run recipe for transcribing an audio file on macOS using the 10.28 GB Gemma 4 E2B model with MLX and mlx-vlm: uv run --python 3.13 --with mlx_vlm --with torchvision --with gradio \ mlx_vlm.generate \ --model google/gemma-4...

Today's links Austerity creates fascism: We can't afford to not afford nice things. Hey look at this: Delights to delectate. Object permanence: The Server of Amontillado; Flapper's Dictionary; Mastercard v rec.humor.funny; Philippines electoral data breach; A front page from ...

I built a small tool to visualise how Mixture of Experts models route tokens through different experts. It's genuinely fascinating to watch.

I quipped on BlueSky: It’s interesting how AI proponents are often like "skill issue" when the LLM doesn't work like someone expects. Whereas when human-centered UX people see someone using it wrong, they're like "skill issue on us, the people who made this" This is top of...

SQLite 3.53.0

SQLite 3.52.0 was withdrawn so this is a pretty big release with a whole lot of accumulated user-facing and internal improvements. Some that stood out to me:

• ALTER TABLE can now add and remove NOT NULL and CHECK constraints - I've previously used my own sqlite-utils transform() method for this.
• New json_array_insert() function and its jsonb equivalent.
• Significant improvements to CLI mode, including result formatting.

The result formatting improvements come from a new library, the Query Results Formatter. I had Claude Code (on my phone) compile that to WebAssembly and build this playground interface for trying that out.

Via Lobste.rs

Tags: sql, sqlite

Tool: SQLite Query Result Formatter Demo

See my notes on SQLite 3.53.0. This playground provides a UI for trying out the various rendering options for SQL result tables from the new Query Result Formatter library, compiled to WebAssembly.

Tags: tools, sqlite

Today's links Don't Be Evil: Evil genius is just a lack of shame. Hey look at this: Delights to delectate. Object permanence: FBI x Trotsky; Jakob Nielsen x headlines; Floppy disk stained glass; Zero tolerance for mismatched socks; EFF v DOGE. Upcoming appearances: Toronto, S...

Lenny posted another snippet from our 1 hour 40 minute podcast recording and it's about kākāpō parrots!

Tags: kakapo