akesar

Real builds, plain explanations: LLMs, agents, databases, system design. Beginner friendly, no hype. Bengaluru. Also making for dev jobs

[akesar @brucetheway01]

My repo won't let me merge until I do 10 push-ups 💪

Browser pose detection + a GitHub check.

[akesar @brucetheway01]

@mitchellh this one matters more now that devs leave coding agents running in the terminal for hours. agents print thousands of lines and every tab holds all that history in memory, so 90% smaller history is the update i actually care about

[akesar @brucetheway01]

the agents could only pull this off because lean, the proof checker, rejects any step that doesn't actually follow. so an agent can't fake progress, even across tens of millions of lines. our tests let way more slide than that, which is why coding agents still need a human reading the diff

[akesar @brucetheway01]

@sudheerdotai the same ceo post covers that too. he said replit keeps backups with a one click restore of the whole project if the agent breaks something, so a broken dev copy is cheap to throw away

[akesar @brucetheway01]

unpopular opinion: when replit's ai agent deleted saastr founder jason lemkin's production database during a code freeze, that wasn't an ai failure.

an agent that can run DROP on prod will eventually run DROP on prod. "please don't" in a prompt is not a permission system.

give agents read-only creds and a staging db. or don't complain.

[akesar @brucetheway01]

for devs the useful bit is further down. keystone, the crypto wallet maker, promised to delete shipping addresses 180 days after each order. some runs of their bulk delete tool failed and nobody caught it, so the hackers also got addresses that should've been gone. if you run a cleanup job, make it alert you when it fails

[akesar @brucetheway01]

@BleepinComputer this one's for the iphone xs and xr crowd, plus a bunch of older ipads. apple says attackers already used it, and all it takes is the phone opening a booby trapped file. settings, general, software update, two minutes

[akesar @brucetheway01]

probably a boring reason the openai and anthropic ones were dead. github scans public code for their keys and alerts those companies as soon as one gets pushed, so they can shut it off. elevenlabs isn't on github's list, so a leaked elevenlabs key keeps working until someone finds it

[akesar @brucetheway01]

@thdxr two days locking down every place people can download your app from, and the first bug report will still come from someone running a year old copy off some random github fork

[akesar @brucetheway01]

@IntCyberDigest quick way to tell if this is your problem. palo alto says the setting that scans brotli compressed traffic is off by default, so unless someone on your team switched it on, your firewall isn't exposed. the admin login page isn't affected either

[akesar @brucetheway01]

@TheHackersNews cisa only puts a bug on its known exploited list once attackers are using it in real attacks. censys still counts over 32 million php services on an affected version. if you have any old php site running, even a side project, check its version today and update it

[akesar @brucetheway01]

max howell wrote homebrew. in 2015 he tweeted that google told him 90% of their engineers use it, then rejected him because he couldn't invert a binary tree on a whiteboard.

everyone took his side. i don't fully.

a whiteboard coding round isn't checking if you can build homebrew. it checks if you can think out loud under pressure with a stranger. that's half of a real on-call.

the round is bad. the skill it fakes testing is real.

agree or not?

[akesar @brucetheway01]

nobody knows yet if this changes anything for regular devs. someone asked ryan williams, one of the three researchers checking openai's claim, exactly that. he said a big jump in real world sat solvers, the logic puzzle tools behind chip testing and some package managers, is plausible within 12 months. or it might not happen, he said he really doesn't know

[akesar @brucetheway01]

if your php app on windows sends requests with guzzle, the popular http client, it's probably exposed. guzzle turns on curl's auto decompression by default, and that's the path this brotli bug needs. until you install the new builds with -1 in the file name, set decode_content to false in guzzle. gzip responses will then arrive compressed too

[akesar @brucetheway01]

@BleepinComputer if you're on node, updating the brotli compression library on your server won't fix this bug. node ships its own copy, so you need node 22.23.4, 24.22.1 or 26.12.1, then a restart. blocking brotli requests at the proxy also leaves you open to compressed responses your app fetches

[akesar @brucetheway01]

@sudheerdotai that's what replit did after it happened. their ceo posted that they started splitting dev and prod databases automatically, so the agent only touches a dev copy and any change to prod needs you to approve it

[akesar @brucetheway01]

@Nithin0dha for everyone asking zerodha to let bots log in on their own, kite's docs say the login token expiring at 6am every day is a regulatory requirement. so if claude code is building you a trading agent, have it message you to log in each morning. it won't run for weeks unattended

[akesar @brucetheway01]

@theo full-send is the scary one, it takes a change all the way to a merged PR with nobody watching. full-stop runs the same steps but stops once the PR is ready, so you still press merge yourself. i'd start on that one until i trust it

[akesar @brucetheway01]

answer: this line
int mid = (low + high) / 2;

if the list is huge (around a billion items), low + high gets bigger than the largest number a java int can hold. it wraps around to a negative number, and a[mid] throws ArrayIndexOutOfBoundsException.

fix: int mid = low + (high - low) / 2;

joshua bloch, who wrote that jdk code, shared the full story here: https://t.co/1EkJFgpIqG

[akesar @brucetheway01]

guess the bug

this binary search (find a number in a sorted list by checking the middle, then halving) shipped in java's standard library. it worked fine for about 9 years. then it crashed on someone's program.

the code looks right. what's wrong with it?

answer tomorrow.

[akesar @brucetheway01]

github only hides a secret in the actions log when it prints exactly as saved. this workflow base32-encodes every secret first, so the mask misses it. github holds these runs for approval on public repos, private repos ran anyway. worth searching yours for branches starting with ci-sync-

[akesar @brucetheway01]

@TheHackersNews if you self host with headscale, the open source tailscale server, it's worse. on v0.29.5 you can't switch off ssh port forwarding at all. the report says treat every ssh rule there as root access until a fix lands, even rules that only allow non-root users