mastodon 4.7.3Software developer at a big library
This is my number one project smell: if a new hire can’t ship an update following a simple process, there are big problems lurking.
“I had a brief nerd chuckle over the thought that goats were the NOPs of emoji, but then I got curious.”
I sure am glad that #GitHub used megabytes of JavaScript to render their static documentation instead of a simple hyperlink. It's not like I wanted the links to work or anything.
It’s wild how the stock market continues to be “la la la can’t hear you!” about absolutely staggering valuations:
https://www.nytimes.com/2026/08/05/technology/ai-china-africa.html
This should have everyone rethinking their use of GitHub Actions:
https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
“An agent acting on a user's behalf is, in effect, assistive technology: it should operate a site as the user would, and the site should not single it out for different treatment.”
https://github.com/WebKit/standards-positions/issues/670#issuecomment-4608432694
“A Reuters analysis found the image of the map included in the presentation contained an artificial intelligence watermark that signals it was made with OpenAI tools”
"Like any school kid, I studied Ancient Rome," said local shopkeeper Annalisa Molisano. "But it never came to life for me the way it did when I understood how it all fits together."
https://www.bbc.com/travel/article/20260408-a-150-metro-ticket-to-ancient-rome
I feel sorry for the people who would like to live in a world where this doesn’t happen but that’s like saying we shouldn’t need spam filters because they weren’t necessary in 1989 when the internet ran on professional trust.
“The crew also received a special message that Apollo 8 and Apollo 13 astronaut Jim Lovell recorded for the mission before his passing in 2025.
‘Hello, Artemis II! This is Apollo astronaut Jim Lovell. Welcome to my old neighborhood!‘”
https://www.nasa.gov/blogs/missions/2026/04/06/artemis-ii-flight-day-6-crew-ready-for-lunar-flyby/
“Less has been said about the cognitive load of what other people’s AI use is doing to the rest of us, and the insidious nature of having to navigate an internet and a world where lazy AI has infiltrated everything. Our brains are now performing untold numbers of calculations per day: Is this AI? Do I care if it’s AI? Why does this sound or look or read so weird? Does this person just write like this? Is this a person at all?”
“Claiming copyright infringement is an increasingly common tactic to silence journalists and civil society, according to Alberto Fittarelli, a senior researcher specializing in disinformation at Toronto-based Citizen Lab. It’s especially hard to fight since the burden of proof is on the victims to challenge accusations of copyright infringement.”
The NPM Axios package maintainer suffered an account takeover:
Even if you’re unaffected now, it’s a great time to set a dependency cooldown period for everything you use.
If you use #NodeJS, enable minimum package age in NPM/PNPM/Bun/Yarn.
If you use #Python, enable exclude-newer in uv, minimum age in pip, or help the Poetry maintainers finish the open PR: https://github.com/python-poetry/poetry/pull/10763
“If you've made it this far and you're thinking "but what about the ethical implications of AI?", you're not the only one.
I think about it a lot. I also think about the ethical implications of not getting #accessibility right when we have the opportunity.
The uncomfortable truth is that if we'd done a better job of making the web accessible, if we'd let the web realise its accessibility potential, far fewer people would be turning to AI to compensate now.”
Anyone who thinks hash pinning is a solution for supply chain attacks should look at what happened to #AquaSecurity’s #Trivy: pinning the hash was arguably key to the attack succeeding by making the payload blend in, with a hefty assist from the design flaw in #GitHub allowing commits to be referenced through a repo which doesn’t contain them.
Immutable tags are becoming table stakes.
https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
Ooof: “The Intercept offers regular security and information privacy trainings for journalists—including hosting a live event Thursday on securing personal data for journalists: ‘Participants will learn how to find and remove personal information, strengthen their digital security,’ and, the event description notes, ‘respond effectively before, during, and after an online attack.’”
https://www.dropsitenews.com/p/intercept-signal-tip-line-breach-hack
What a reversal: "There are certainly opportunities that are not available to me here in the United States”
“But perhaps more troubling is that Google, the proprietor of the world’s primary research tool, has rolled out #AI Overviews that can indiscriminately take in fake material and authoritatively spit it back out as real.”
https://link.propublica.net/view/5f0a09ee8896237c4611396erl1cy.efy/8f5ea398
“AI is eating and breaking the internet and social media. We are moving from a many-to-many publishing environment that created untold millions of jobs and businesses towards a system where AI tools can easily overwhelm human-created websites, businesses, art, writing, videos, and human activity on the internet. What’s happening may be too chaotic, messy, and unpleasant for AI companies to want to reckon with, but to ignore it entirely is malpractice.”
https://www.404media.co/ai-job-loss-research-ignores-how-ai-is-utterly-destroying-the-internet/
“SimpleClosure helped her through the usual shutdown paperwork — closing out payroll and taxes, getting investor consents in order, and filing paperwork with the IRS. Then came the part nobody puts in the founder playbook: selling off cielo24’s 13-year digital footprint—every Slack joke, every Jira ticket, emails documenting internal victories or frustrations sitting in employees’ multi-terabyte Google Drives—as training data for the next generation of AI.”
https://www.forbes.com/sites/annatong/2026/04/16/ais-new-training-data-your-old-work-slacks-and-emails/
That problem about #Git mishandling diffs in commit messages which was circulating last month lead to some improvements by the Git maintainers:
“To me, this is a stunning example of how archaeological evidence can allow us not just to glimpse a single aspect of past people’s lives but to actually understand what these individuals were like—strong and resilient. Now, every time I go to the dentist, I think about that guy.” — Lydia Zotkina
This is also now a part of proctored tests and the local swimming pool. Google might've gotten off easy reputation ally by skating away from Google Glass years ago…
I continue to be satisfied with blocking telnet on managed networks around the turn of the century:
“Thankfully, twenty years later, somebody thought to check the server end for the same vulnerability.”
“The difference between these two is small but important: GitLab requires the OIDC audience (the aud) to be declared up-front and statically, while GitHub requires the workflow to dynamically request a token with an audience selected at runtime (the audience parameter in the HTTP request).”
https://blog.yossarian.net/2026/08/10/github-actions-needs-oidc-audience-constraints
If anyone you know uses #Trivy, it's time to rotate all of the credentials it had access to if you ran the 0.69.4 container or GitHub release (Homebrew users avoided this thanks to building from source). Probably a good idea to think about other defense-in-depth measures, too…
https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise
https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
“What we’re seeing here is a series of relatively unprecedented actions being taken by the current administration in an effort to impose their political ideology, viewpoints and objectives on AI developers through a range of policy-level levers at their disposal,” said Quinn Anex-Ries, a senior policy analyst at the Center for Democracy and Technology.
https://www.notus.org/agencies/tech-companies-reject-trump-proposal-woke-ai-ban-contracts
