Recurring weakness classes in package managers
Andrew Nesbitt
• Andrew Nesbitt
Package Manager CWEs
Andrew Nesbitt
• Andrew Nesbitt
Recurring weakness classes in package managers
Pluralistic: Daily links from Cory Doctorow
• Cory Doctorow
Armin Ronacher's Thoughts and Writings
• Armin Ronacher
Martin Alderson
• Martin Alderson
A fictional scenario about what AI changes for cloud security, written because the technical version of the argument doesn't land with anyone except engineers.
We used an automatic classifier which judged sycophancy by looking at whether Claude showed a willingness to push back, maintain positions when challenged, give praise proportional to the merit of ideas, and speak frankly regardless of what a person wants to hear. Most of the time in these situations, Claude expressed no sycophancy—only 9% of conversations included sycophantic behavior (Figure 2). But two domains were exceptions: we saw sycophantic behavior in 38% of conversations focused on spirituality, and 25% of conversations on relationships.
— Anthropic, How people ask Claude for personal guidance
Tags: ai-ethics, anthropic, claude, ai-personality, generative-ai, ai, llms, sycophancy
Tedium: The Dull Side of the Internet.
• Ernie Smith
You’ve probably heard it’s futile, but that hasn’t stopped plenty from trying—some successfully, shockingly.
png-cmp is a program I built that checks if two PNGs are visually equivalent. It’s inspired by the cmp command. Here’s how you use it:
png-cmp a.png b.png
Like cmp, it silently exits if the images are identical, and gives an error if they’re different.
Unlike cmp, it checks pixel data, not binary data. PNGs can look the same but be stored differently. For example, png-cmp ignores text metadata.
I was recently doing an experiment where I wanted to check if two PNGs were visually identical, so I built a tool for it!
matklad
• Alex Kladov
Out of the box, Zig provides minimal and sufficient facilities for error handling --- strongly-typed error codes. Error reporting is left to the user. Idiomatic solution is to pass a Diagnostics out parameter (sink) to materialize human-readable strings as needed.
the website of jyn
• jyn
Writing custom Rust lints for fun and profit

I built this feature on my phone using Claude Code for web, as an extension of my beats system for syndicating external content. Here's the PR and prompt.
As with my other forms of incoming syndicated content sightings show up on the homepage, the date archive pages, and in site search results.
I back-populated over a decade of iNaturalist sightings, which means you can search for lemur you'll see my lemur photos from Madagascar in 2019!
Tags: blogging, photography, wildlife, ai, inaturalist, generative-ai, llms, ai-assisted-programming, claude-code
Eli Bendersky's website
• Eli Bendersky
Pluralistic: Daily links from Cory Doctorow
• Cory Doctorow
Construction Physics
• Brian Potter
Chilling effects in the build-to-rent sector, how fast could robot manufacturing scale up, PJM’s new interconnection queue, the backlash against battery storage, and more.
Andrew Nesbitt
• Andrew Nesbitt
Giving dependencies the same treatment the fork got