Chris Buguet

CTO @source_paris. Seed investor @SourceVC.
Hacker vaillant. Rien d’impossible.

[messed up computers @messeduppcs]

Sizes of subatomic particles

[Henri Gauthier Ⓜ️ 🇫🇷 @HenriGauthier19]

⚠️ Vous devez tous aller sur https://t.co/iF2xqIgKoQ et faire un "opt-out" du tracking Utiq.

👉Utiq, c'est une société privée qui née d'une joint venture entre les principaux fournisseurs d'accès à internet européens, autorisée par l'Union Européenne.

👉 Ils prétendent faire du tracking publicitaire éthique. Mais le mot éthique est une blague.

👉 Fonctionnement : ce n'est plus un cookie qui est déposé sur votre navigateur. C'est votre connexion internet qu'est mappé, via un identifiant intermédiaire fournit par votre fournisseur d'accès à internet, à la régie publicitaire Utiq. C'est donc une régie publicitaire sur votre connexion internet, et non plus sur votre navigateur. C'est gravissime.

👉 Ce que ça veut dire : Vous ouvrez Firefox, vous acceptez machinalement un "cookie Utiq". Vous ouvrez ensuite Google Chrome, boum vous êtes tracké : le site vous reconnait.

Contrairement aux cookies, c'est cross-navigateur. Incroyable que la CNIL et autres ne disent RIEN !

👉 Il est possible de faire un "opt-out" pour tous les sites d'un coup, et de voir au passage les consentements qui ont été déjà donné. Je clique habituellement sur "Non" sur les bannières, et j'en avais malgré tout deux 🙃

Merci à @Ced_haurus qui a levé l'alerte et qui recense tous les sites utilisant cette technologie.

https://t.co/RdLZiAkqrC

[Raphael Grably @GrablyR]

La mutuelle Alan touchée par une fuite massive de données personnelles.

Certaines particulièrement sensibles, comme le numéro de sécurité sociale.

Encore une fois, c’est via l’entreprise Almerys, déjà visée en 2024, qui a visiblement beaucoup de mal à sécuriser nos données.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Chris Buguet @codingstyle]

@MaitreAlceste

[Chris Buguet @codingstyle]

@franceinfo Vous êtes ridicules avec cette mode américaine puritaniste de merde. Il n'y a aucune loi qui vous empêche d'écrire des gros mots ou Guerre.

[Chris Buguet @codingstyle]

@GazzettaFerrari Everyone likes a good comeback.

[NASA Artemis @NASAArtemis]

Earthset.

The Artemis II crew captured this view of an Earthset on April 6, 2026, as they flew around the Moon. The image is reminiscent of the iconic Earthrise image taken by astronaut Bill Anders 58 years earlier as the Apollo 8 crew flew around the Moon.

[Arkunir @Arkunir]

Le gouvernement souhaite faire passer la loi Yadan, une loi ayant pour but de condamner en France la critique du régime israélien alors même qu’Israël vient d'adopter il y a 4 jours la peine de mort pour les Palestiniens

Il faut 500k signatures sur cette pétition pour qu'elle passe à l'Assemblée Nationale

https://t.co/PlE3FSvQy6

[Martin 🏳️‍🌈 @MartinSeys]

Orange a commencé depuis 00h
l'extinction de son réseau 2G en France. Le GSM, lancé en 1992, tire sa révérence après 34 ans de service. Un thread sur pourquoi c'est plus qu'un simple changement technique 🧵👇

[Pierre Arlais @PierreArlais]

enfin une fédération pour encadrer et promouvoir ce loisir pas assez connu
https://t.co/3gCTyjje56

[Ethan Mollick @emollick]

Its not Simcity, but business school students who were good at Civ V also turn out to be better planners, organizers, and problem-solvers in this small experiment.

[Chris Buguet @codingstyle]

@WhiteHouse

[Tim Soret @timsoret]

Flying to San Francisco today to show The Last Night in private around GDC. Last year was an absolute pleasure, met many creative heroes.

Gamedevs, platforms, angels, VCs, publishers, TV / cinema producers: hit me up. I have something special. Here for the full week.

[Chris Buguet @codingstyle]

@timsoret @oddtalesgames Ils sont chanceux à GDC 😊 Good luck Tim!

[Twoket @Twoket9]

AI devs are cooked.

I just wrote a script by hand

[Eric S. Raymond @esrtweet]

Is it weird that AI coding assistance is not giving me identity fracture?

A lot of software developers are feeling disoriented and threatened these days. Programming by hand is clearly going the way of the buggy whip and the hand-cranked auger. Which is how we're finding out that a lot of people have their identities bound up in being good at hand-coding and how it feels to do that.

That's not me. It's not me at all. Rather to my surprise, I don't miss coding by hand, not any more than I missed writing assembler when compilers ate the world and made that unnecessary. (That was in a couple years back around 1983, for you youngsters.)

Maybe the fact that I'm not feeling any of this disorientation disqualifies me from having anything to say to people who are. On the other hand...if you can learn to emulate my mental stance and be completely unbothered, maybe that would be a good thing?

So. If you're a programmer, and you're feeling disoriented, try this on for size:

I like being a wizard. I like being able to speak spells, to weave complex patterns of logic that make things happen in the world. Writing code is a way to manifest my will.

Yes, I've piled up a lot of arcane knowledge over the 50 years I've been doing this. But languages of invocation, they come and they go. Been a long time since I've had any use for being able to program in 8086 assembler, and that's okay. I have better spells now, and these days some rather powerful familiars.

What I'm inviting you to do is think of yourself as a wizard. Not as a person who writes code, but as a person who is good at assuming the kind of mental states required to bend reality with the application of spells.

And if that's who you are, does it matter if the spells are painstakingly scribed in runes of power, versus being spoken to an obedient machine spirit?

It's all one; it's all the manifestation of will. Arcane languages come and go, machine spirits appear and then diminish to be replaced by more powerful ones, but you? You are the magic-wielder. Without you, none of it happens.

Same as it ever was. Same is it ever was. And so mote it be.

[The White House @WhiteHouse]

Promises Made, Promises Kept: Slashing regulations and saving Americans trillions. 🇺🇸

[Eric S. Raymond @esrtweet]

If you are a software engineer "experiencing some degree of mental health crisis", now hear this, because I've been coding for 50 years since the days of punched cards and I have a salutary kick in your ass to deliver.

Get over yourself. Every previous "programming is obsolete" panic has been a bust, and this one's going to be too.

The fundamental problem of mismatch between the intentions in human minds and the specifications that a computer can interpret hasn't gone away just because now you can do a lot of your programming in natural language to an LLM.

Systems are still complicated. This shit is still difficult. The need for people who specialize in bridging that gap isn't going to go away.

As usual, the answer is: upskill yourself and adapt. If a crusty old fart like me can do it, you can too.