Vincent

🌱. Attempted leader of my own thoughts. Apparently addicted to coffee.

[pnpm @pnpmjs]

should we block such flags if we detect that pnpm is executed by an agent?

https://t.co/NR0RPE1MxN

[DROID @droidbuilds]

MrBeast plans to trap 1000 vibe coders in a room without Claude

first person to center a div manually wins $1 million

[Jiahan Chen @jiahan_c]

Do you know that using GitHub CLI (gh) may expose you to supply-chain attacks?

It stores a long-lived GitHub token on your machine, which can be stolen by any malicious scripts.

This is what happened in the recent Nx Console supply-chain compromise, which led to GitHub’s internal source code being leaked.

[Vincent @_evict]

A great take. Automatically updating your dependencies can get you compromised. Not updating your dependencies too.

[Mitchell Hashimoto @mitchellh]

Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).

If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!

I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.

Feeling pretty swell about this mentality with all the supply chain attacks happening.

[Joe Fitz @securelyfitz]

@kushaldas @_evict Applied Physical Attacks #1 and #2 are available online, self-paced. Soon Applied Physical Defenses will be too:
https://t.co/jp3rlAn03Y

I ship a kit of hardware. Lectures, lab instructions, and howtos/walkthroughs are all on the course website.

[Joe Fitz @securelyfitz]

Having trouble learning hardware hacking from some clanker assistant? You probably need some hands-on time with real hardware.

Applied Physical Attacks # 1 is the perfect intro to understand what's going to happen to a hardware device the moment it gets into attacker's hands.

[Lisa Forte @LisaForteUK]

Literally everyone knows this from like age 6

[Bluewall @Bluewall]

Eveytime you update NPM packages

[vx-underground @vxunderground]

TanStack

[JFrog Security @JFrogSecurity]

🚨 SECURITY ALERT: The popular PyPI package lightning has been compromised in a supply chain attack.

⚠️ Affected Versions: 2.6.2 and 2.6.3

[Vincent @_evict]

@thorstenball Have you tried a whole roast chicken yet?

[Sourcegraph @Sourcegraph]

Today, we're announcing Sourcegraph 7.0, a release that marks the beginning of a new chapter for our company and product.

Over the past several releases, we've shifted our focus. We're doubling down on being the intelligence layer that developers and AI agents rely on to navigate, understand, and operate on large codebases.

https://t.co/mgNiHOakno

[stacksmashing @ghidraninja]

Binary obfuscation in 2026:

Just put ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FA... into your program 😎

[Vincent @_evict]

@fesshole Yet here you are poisoning your own thoughts. No need to "taint" the memory of your parents for a mere difference of political opinion. Stop polarizing the relationships with your loved ones.

[Sourcegraph @Sourcegraph]

Stop patching vulnerabilities manually. @sgjarmak walks through the end-to-end workflow: detect, fix, and verify the React2Shell (CVE-2025-55182) vulnerability using Batch Changes, Deep Search, and our MCP server.

https://t.co/ShS5RCWQwl

[Sourcegraph @Sourcegraph]

Big news! Sourcegraph & @AmpCode are becoming two separate companies.

Read why:

https://t.co/UdnF0NOg1c

[Vincent @_evict]

@thorstenball That's how we get generation Alpha into using the terminal.

[Quinn Slack @sqs]

Opus is worth it, and maybe cheaper all-in than Sonnet?

Early rough non-representative numbers, for our own internal @AmpCode usage (avg cost $ per thread):

- Sonnet 4.5: $1.83
- Opus 4.5: $1.30 (earlier checkpoint last week was $1.55)
- Gemini 3 Pro: $1.21