Alain B

Dev building stuff, @andela. ex: @plailabs

[Aikido @AikidoSecurity]

🚨 Massive GitHub Actions CI Secret Stealer

4,800+ compromised accounts attempted to push malicious workflows to 61k+ repos. Payload dumps all CI secrets, memory, OIDC & commit secrets, then instantly deletes run logs.

Search your repos for:
• PR: "docs: dependency audit notes"
• Branch: wfx-docs or chore/
• Commits: "ci: refresh build cache" or "chore: add ci helper"
• Actions tab: Skipped/missing run numbers

If hit, assume total compromise. Rotate ALL secrets and cloud roles immediately.

[Israel Exposed @xIsraelExposedx]

We have released Zero Breach Toolkit, a free open sourced tool capable of detecting over 12,100 traces of Israeli & other spyware on your devices. It works on Windows, Linux, Mac, Android and Iphones.

You can download it here: https://t.co/lPcGP6L5jJ

Inside the folder with the tools run this command: python -X utf8 scan/zero-breach-toolkit.py

It never writes to disk, never connects to the internet, or ask for admin perms. It takes around 10-15 minutes to run depending on the device.

This project is fully open source, so feel free to take the code and use it to create your own tools.

If you find some spyware on your device, consider sending it to us via telegram. Leave us a star on GitHub if the tool helped you.

Follow our backups: @ZionismExposedx
@IsraelExposedAr

God bless

[jack @jack]

We believe voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full-duplex speech model ever built. Talking with it feels like talking with a person…full of emotion, nuance, pauses, and a natural cadence.

https://t.co/r0qFLdvd6c

[Silas Asamoah @geeksilas]

MoMo scam calls and texts are incredibly annoying and in this era i figured why not use RL to catch the bad actors

I built sika-agent, an open RL environment for training AI agents that refuse these scams in English, Twi and especially Twi–English, because that mix is how I hear most people actually talk.

On results: Qwen3.5-9B completes 86% in English and 51% in Twi. The frontier models I ran stay at 90% or above in every language (about 240 tasks per model). That gap is what training small, local-language agents here should close.

[Tucker Carlson @TuckerCarlson]

The wars in Iran and Ukraine are weakening, discrediting and impoverishing the United States. That’s not an accident. It’s the point of the exercise.

[Espoir Murhabazi @esp_py]

Bonjour Madame @kayikwambaT,
@RDC_Minafet et Monsieur @ngokweyndolamb

D'habitude, je ne me plains pas et, si je me plaignais, je ne le ferais pas publiquement. Mais j'ai trop souffert, et je pense que je dois porter cette plainte.

Elle concerne ma demande de passeport.

J'ai perdu mon passeport lors d'un voyage le 21 novembre 2025. Heureusement, j'ai été autorisé à entrer en Angleterre avec mon visa électronique.
Depuis ce temps, j'ai fait une demande de passeport biométrique auprès de l'ambassade de Londres, conformément à mon parcours :

- Le 26 novembre 2025, j'ai effectué la demande de passeport et finalisé mon paiement.

- Ce n'est que le 26 février 2026 (trois mois plus tard, soit après 90 jours), malgré des allers-retours au centre de capture à Londres et des interactions avec les agents du DERMALOG, qu'on m'a invité au centre de capture pour la prise des données biométriques.

- Nous sommes le 27 juillet 2026, c'est-à-dire cinq mois plus tard, et je n'ai toujours obtenu aucune information sur mon passeport. Après maintes demandes auprès de l'ambassade, on me dit que le passeport n'est pas encore imprimé.

Je ne vais pas vous dire combien cette situation est frustrante pour moi, ma famille et mon travail.

Je vous prie, Madame la Ministre, Monsieur l'Ambassadeur, de bien vouloir accepter mes doléances, de m'aider à retrouver mon passeport et, surtout, d'améliorer votre système car je ne suis pas la seule personne à rencontrer ce problème.

@TopCongo @actualitecd @StanysBujakera @radiookapi

[TypeScript @typescript]

📣 The moment is here. 📣

TypeScript 7 is officially released! 7️⃣

https://t.co/D7Mbq7vWpy

[Boshen @boshen_c]

Oxlint is too slow so we are making it 50% to 2x faster to compensate the rust port of react compiler.

[Gergely Orosz @GergelyOrosz]

Kelsey Hightower has one of the most inspiring stories in tech: he went from a technician installing DSL modems, through self-directed study and very hard work, to one of the very few Distinguished Engineer at Google whom Satya Nadella personally persuaded to join Microsoft.

Timestamps:

00:00 Intro
03:34 Kelsey’s first job at McDonald’s
05:04 His non-traditional path into tech
11:45 Landing his first tech job with an A+ certification
15:33 His entrepreneurial years
19:45 Joining Google as a data center technician
27:48 Learning automation at a Rackspace spinoff
33:26 Moving into financial services
50:00 Building a reputation through open source
53:55 From configuration management to containers
1:08:20 The rise of Kubernetes
1:25:05 Why he almost joined NASA instead of Google
1:29:20 Defining DevRel at Google
1:38:20 Demonstrating impact at Google
1:41:20 Microsoft's offer
1:55:20 Learning how to slow down
2:06:39 Advising and investing
2:15:03 A people-first view of GenAI
2:24:27 Using AI with guardrails
2:28:26 Matching AI to the task
2:36:06 Staying relevant in the AI era

Brought to you by outstanding teams building products I love:

• @AntithesisHQ: verify your system’s correctness without human review or traditional integration tests – and avoid bugs or outages. https://t.co/AKYm4cctss

• @sentry: application monitoring software considered “not bad” by millions of developers https://t.co/uoolyqTR6M

• @buildkite: CI software built to absorb whatever your coding agents throw at the build queue. OpenAI, Anthropic, Uber and others are customers: https://t.co/C05Ze9zzin

Three interesting learnings from Kelsey:

1. Side hustles and doing your own thing teach you business like no IC job can.

Before becoming a software engineer at Google, Kelsey was a manager for his comedian friend, operated a computer store, and did IT contracting. These gigs taught him logistics, planning, and about money. All this helped him be far more effective at talking with executives and acting as an executive sponsor inside Google.

2. Can you explain what your startup does without mentioning AI?

When Kelsey researches startups seeking his advice, he challenges founders to not say “AI” once. This means that they must explain the actual value their company creates. One unexpected benefit of this is that it often reveals there are easier, cheaper ways to achieve a goal than with AI.

3. It’s very rare to get an extra zero put on your compensation figure – but it happened.

Kelsey was a successful, well-paid Google engineer when Microsoft made him an offer that 10x’d his salary (!!). When Kelsey told Google he was planning to take the offer, it matched the offer, proving that his market value had massively increased. It shows that being well paid doesn’t necessarily mean you’re being paid at the correct market rate.

[GREG ISENBERG @gregisenberg]

how to set up hermes agent step by step. built-in memory, 40+ tools, works on your phone, and what to think of hermes vs openclaw:

1. hermes is a personal AI agent that runs in your terminal. think of it like open claw but with built-in memory, 40+ tools out of the box, and 90% cheaper token costs. you install it with one command.

2. the 3 problems with open claw that hermes solves: no memory (you keep repeating yourself), constant gateway restarts, and zero visibility into what you're spending on tokens.

3. hermes remembers everything. every completed task gets saved to memory. it searches through past logs to find solutions. over time it literally gets smarter at your specific workflows.

4. connect it to open router. you see exact costs per model per task. free models rotate weekly. one founder went from $130 every five days on open claw to $10 on hermes. same output.

5. it comes preloaded with skills. apple notes, imessage, find my, browser, web search, image generation, cron jobs. no hunting for plugins.

6. connect it to obsidian so it reads your entire vault. connect it to gstack for your dev environment. create custom skills for your specific workflows.

7. the biggest money saver: have it write code once for recurring tasks. then it runs without burning tokens every time. stop paying an LLM to do the same scrape or report daily.

8. run it on android via telegram. name your agents. talk to them like coworkers. in this episode imran shows you how to set this up.

9. you can run it bare metal, in docker, or serverless on modal. pick your risk level.

i begged @imranye to come on @startupideaspod and walk through the full installation live. he made it impossibly clear.

if you've heard of Hermes Agent and want the clearest explanation of how to get set up like a pro

let me know what you want me to cover on the next ep

this is the best personal agent setup video on the internet right now.

watch

[Pierce Boggan @pierceboggan]

VS Code

[Master.dev (Formerly Frontend Masters) @MasterDotDev]

The React docs pushed everyone toward Next.js/Remix, but most of us aren't at Facebook scale. Client-side React is still 100% viable. Use the right tool for YOUR problem.

Not every React app needs a framework.

[Shopify Engineering @ShopifyEng]

When we profiled large and slow GraphQL list queries at Shopify, we found I/O wasn't always the bottleneck. Frequently it was GraphQL’s conventional depth-first execution design.

We tried executing breadth-first instead. It went… really well.

[Freek Van der Herten @freekmurze]

I never write down migrations.

Down migrations are the least tested code in any Laravel app. They're written once and never run.

And when you do need to roll back, you don't know beforehand what you need to do with the data would already be stored in the updated schema.

[Matt Pocock @mattpocockuk]

I get a lot of questions about how I stop Claude Code running dangerous git commands.

The secret is hooks.

So, I packaged it up into a skill. INDISPENSABLE when running Ralph in a docker sandbox.

Get it here: https://t.co/osbCtDwCcx

[Wes Bos @wesbos]

Someone on reddit posted a demo where CSS truncates text from the middle.

They didn't post the code, so here is my shot at it with Flexbox

[Alex Albert @alexalbert__]

We put together a prompting guide for Claude Opus 4.5 based on extensive internal testing by our research and applied AI teams.

Here's what we've learned so far about getting the best results:

[Python Software Foundation @ThePSF]

as a condition of funding, we were asked to affirm that we wouldn’t undertake any diversity, equity, and inclusion work, whether or not we used the government funds to do so. The PSF simply couldn’t agree to that statement, as facilitating “the growth of a diverse and international community of Python programmers” is written directly into our mission and core to our values, so we withdrew our application.

[Wes Bos @wesbos]

this was me btw

I had my editor call my phone and ask how to debug my code.

Worked first try. Used the elevenlabs mcp server

[Wes Bos @wesbos]

Don't [...spread] or .split() your strings!

Use Intl.Segmenter API. Available in every JS runtime