Rory Street

Technology/.Net geek and Senior Technical Architect at RippleRock. The views expressed are my own and not those of my employer.

[Julian Harris @julianharris]

A new form of honeypot? Create a Passwords.XLSX file and put an adversarial prompt in it.

Interesting containment measure if an adversarial language model tries to process a code base

https://t.co/l4GerX2FPH

@LowLevelTweets not sure if you saw this pattern

[Addy Osmani @addyosmani]

https://t.co/BkYXbsx92x

[Emmett @emmettshine]

https://t.co/8WQIPRC93q

[GitHub @github]

No more waitlist. The GitHub Copilot app's technical preview is now available to everyone currently on Copilot Pro, Pro+, Max, Business, and Enterprise plans.

This agent-native desktop experience lets you decide what agents work on, how they work, and what ships. Go from issue to merge all in one place. ✨

[Daniel Beauchamp @pushmatrix]

Everyone's talking about AI-generated HTML.

But have you tried giving your sites a zero-config API for saving data, file storage, AI, websockets, etc?

We did this at Shopify. Runs on a single VM that costs $200/month, and it's changed the way we work.

We call it Quick 👇🧵

[🏴 uɒɹɥəɯ @mehrandvd]

Just watched @shanselman and Mark Russinovich drop one of the most important truths about AI in engineering, and it needs to be said louder:
"AI isn’t killing engineering, but it is quietly killing something far more dangerous: the junior pipeline."

Here’s the reality most companies have already learned:
AI delivers its best results when senior engineers work with it.
Their judgment, intuition, and experience are what turn AI from “helpful” into “game‑changing.”

But AI has also replaced almost every junior‑level task, scaffolding, debugging, boilerplate, testing, and many teams have stopped hiring juniors altogether.

And that’s the real danger.
If juniors disappear today, there will be no seniors tomorrow.
No juniors → no mid‑levels → no seniors → no architects → no one left who can actually guide AI safely.

We’ve seen this firsthand too.
That’s why we are heavily investing in our #cs_internship open-source program, to keep a strong flow of junior talent and give them a real path to grow into the next generation of senior engineers.

Because the future of engineering depends on the people who aren’t seniors yet.

#MicrosoftBuild
https://t.co/4pMdm3vZwY

[David Fowler @davidfowl]

Native containers in Mac and Windows, took > 10 years but here we are.
https://t.co/q4NalsDaHM

[Microsoft Developer @msdev]

During the #MicrosoftBuild keynote, @cassidoo took the stage to demo the new GitHub Copilot app, showing how agents, multi-model reviews, custom UI canvases, and enterprise-ready deployment through Rayfin come together in one workflow.

[Oren Melamed @OrenMe]

The GitHub Copilot app is now available for more people, good time to try it

I'm learning new things every day, for example the way it renders the plan with updates is absolutly beutiful!

[Rohan Varma @TheRohanVarma]

We just launched Sites into Codex!

Software creation was always about more than writing code. Sites in Codex fundamentally gives the power of end-to-end software creation to every user, no matter their technical fluency.

These Sites are fully deployed to a URL, private to workspaces, come with authentication, can have static files, and can store dynamic data in databases.

It is in preview for business and enterprise teams and will be rolling out to all workspaces over the next day. Give it a try by typing @ Sites into Codex and ask it to build anything!

This project took a massive amount of effort across hundreds of people at OpenAI - proud that we were able to get this out and excited to see what you all build with it!

[Adam Jacob @adamhjk]

The Pipeline Is Dead, Long Live the Agent Mesh - Webframp is on an absolute tear lately. https://t.co/9JBXrTbNuV

[Jeff Cross @jeffbcross]

GitHub’s report today confirms that the compromised Nx Console extension was used as the initial access vector in this attack.

This is a difficult thing to read as the CEO of Nx, and I want to be direct about it: we take responsibility for the role our software played in this incident.

I’m grateful to the GitHub, Microsoft, and independent security teams that moved quickly to investigate, contain, and share information publicly.

This incident highlights that there need to be deeper, more fundamental changes to how we and other maintainers need to think about securing developer tooling and open source distribution. We are already making major changes to our publishing, automation, and extension security posture, and we’ll continue sharing those changes publicly as we implement them.

We’re also beginning conversations with other high-profile open source maintainers about how we can work together on some of the deeper structural problems around software supply chain security. A lot of the assumptions the ecosystem has operated under for years no longer hold.

Our focus right now is supporting affected users, hardening Nx, and helping push the broader ecosystem toward stronger supply chain security practices.

Updates and guidance:
https://t.co/szBoQ3doaX

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Cloudflare @Cloudflare]

Cloudflare's security team spent the last few weeks testing Anthropic's Mythos against fifty of our own repositories. What we learned about offensive AI, why faster patching is the wrong reaction, and what the architecture around vulnerabilities has to look like next. https://t.co/RSrRtIhgaV

[albina @enjojoyy]

Turn any website into an AI-readable design system. Here's how:

Google recently introduced the DESIGN.md specification: a file that helps AI agents understand a product’s design system.

So we built a free tool for designers.

Paste any website URL and Masumi’s DESIGN.md Generator extracts the brand’s colors, typography, components, spacing, and visual rules into an editable DESIGN.md file.

Your designer can review it, tweak it, and hand it to Claude Code, Cursor, Codex, or any AI coding agent so the generated UI stays on-brand.

Links below

[NeowinFeed @NeowinFeed]

By David Uzondu - The RPCS3 team has decided that it has had enough of AI slop code and has banned the undisclosed use of AI in pull requests.
#RPCS3 #AI https://t.co/A3CFnPXOwu

[Rory Street @RoryTweet]

I’ve been playing with Ollama and Qwen 2.5 Coder after a work colleague mentioned it. Qwen isn’t bad at all. But what seems not to work to well for me, is trying to use through GitHub Copilot chat in VSCode. In agent mode it’s just giving JSON responses.

[TLM13 @accuratetlm13]

Ok but what if @FisherPrice designed @awscloud

[psmon @webnori]

Running Gemma 4 On-Device in .NET

A Journey of Failure and Success

⸻

🎯 What We Wanted

“On a user’s PC, without internet, without a separate server like Ollama,
we want to directly load Gemma 4 in a .NET app and generate tokens.”

more:

https://t.co/dDwvFFWpC4