FeedCity

The riskiest projects in open source, scored a decade early

It's a fascinating display of leverage: the ShinyHunters folks, with very limited resources and experience (their demographic will be teenagers to their early 20s), consistently gaining access to the data of massive brands. Not through technical ingenuity alone (although I'm sure there's a portion

Release: datasette-referrer-policy 0.1

The OpenStreetMap tiles on the Datasette global-power-plants demo weren't displaying correctly. This turned out to be caused by two bugs.

The first is that the CAPTCHA I added to that site a few weeks ago was triggering for the .json fetch requests used by the map plugin, and since those weren't HTML the user was not being asked to solve them. Here's the fix.

The second was that OpenStreetMap quite reasonably block tile requests from sites that use a Referrer-Policy: no-referrer header.

Datasette does this by default, and I didn't want to change that default on people without warning - so I had Codex + GPT-5.5 build me a new plugin to help set that header to another value.

Tags: openstreetmap, http, datasette

Open weights models keep frontier labs honest on price. If they disappear, we end up with a handful of oligopolists extracting consumer surplus.

“Alice laughed. ‘There’s no use trying,’ she said. ‘One can’t believe impossible things.’
I daresay you haven’t had much practice,’ said the Queen. ‘When I was your age, I always did it for half-an-hour a day. Why, sometimes I’ve believed as many as six impossible things before breakfast. – Through the looking-glass, Lewis Carrol
To stay sane, we have to accept that our climate is going completely haywire, but that it is ok to mostly ignore that since saving ourselves is apparently not cost-effective.

Release: datasette-llm 0.1a7

• Mechanism for configuring default options for specific models.

Part of Datasette's evolving support mechanism for plugins that use LLMs. It's now possible to configure a model with default options, e.g. to say all enrichment operations should use a specific model with temperature set to 0.5.

Tags: llm, datasette

Release: llm-echo 0.5a0

• New -o thinking 1 option to help test against LLM 0.32a0 and higher.

This plugin provides a fake model called "echo" for LLM which doesn't run an LLM at all - it's useful for writing automated tests. You can now do this:

uvx --with llm==0.32a1 --with llm-echo==0.5a0 llm -m echo hi -o thinking 1

This will fake a reasoning block to standard error before returning JSON echoing the prompt.

Tags: llm

The non-CVE half of package manager security

So it’s well known that Y Combinator owns some stake in OpenAI. But how big is that stake? This seems like devilishly difficult information to obtain. I asked around and a little birdie who knows several OpenAI investors came back with an answer: Y Combinator owns about 0.6 percent of OpenAI. At OpenAI’s current $852 billion valuation, that’s worth over $5 billion.

— John Gruber, Y Combinator’s Stake in OpenAI

Tags: openai, y-combinator, ai, john-gruber

[...] Between 2000 and 2024, farmers sold in total a Colorado-sized chunk of land all on their own, 77 times all land on data center property in 2028, and grew more food than ever on what was left. None of this caused any problems for US food access.

And then, in the middle of all this, a farmer in Loudoun County sells a few acres of mediocre hay field to a hyperscaler for ten times its agricultural value, and the response is that we’re running out of farmland.

— Andy Masley, pushing back against the "land use" argument against data center construction

Tags: ai-ethics, ai, generative-ai, andy-masley

I just sent out the April edition of my sponsors-only monthly newsletter. If you are a sponsor (or if you start a sponsorship now) you can access it here.

In this month's newsletter:

• Opus 4.7 and GPT-5.5, both with price increases
• Claude Mythos and LLM security research
• ChatGPT Images 2.0
• More model releases
• Other highlights from my blog
• What I'm using, April 2026 edition

Here's a copy of the March newsletter as a preview of what you'll get. Pay $10/month to stay a month ahead of the free copy!

Tags: newsletter

Some decade ago I read a good implementation of fizzbuzz. What set it apart was its excellent modularity. The original article is no longer on the web, but this is my reconstruction:

module Main where

import Control.Monad (guard)
import Data.Foldable (for_)
import Data.Maybe (fromMaybe)

fizzbuzz i =
  fromMaybe (show i) . mconcat $
    [ "fizz" <$ guard (rem i 3 == 0)
    , "buzz" <$ guard (rem i 5 == 0)
    ]

main =
  for_ [1..100] $
    putStrLn . fizzbuzz

The great thing about this implementation is that when we get the natural change in requirements – that we are supposed to print “zork” for multiples of seven – we can accommodate that change by simply adding the line that does so:

(Continue reading the full article on the web.)

Research: TRE Python binding — ReDoS robustness demo

If it's good enough for antirez to add to Redis I figured Ville Laurikari's TRE regular expression engine was worth exploring in a little more detail.

I had Claude Code build an experimental Python binding (it used ctypes) and try some malicious regular expression attacks against the library. TRE handles those much better than Python's standard library implementation, thanks mainly to the lack of support for backtracking.

Tags: security, python, regular-expressions, c, ctypes