Peng

I build stuff.

[Guillermo Rauch @rauchg]

Human judgement in engineering is ironically even more crucial now. Deciding what to build. Deciding on the right architectures. Deciding whether you regenerate from scratch $$$ or reuse existing legos. Managing tech debt. You can do anything now, but you can't do everything.

[Pavel Durov @durov]

We now support rich formatting for all chatbots.

Tables, nested lists, inline media, formulas, headers and more — right in Telegram messages.

🔨 Start building! Docs: https://t.co/zgzPOOUJF5

[Peng @d6g]

here we go

[Raycast @raycast]

Raycast 2.0 (beta) is now publicly available for download.

👉 https://t.co/dOVGlIIefq

[Hugo @hugorcd]

Historical

[Flightradar24 @flightradar24]

Responding to a FOIA request the NTSB released data regarding the crash of China Eastern flight 5735 in 2022 this week. Flight data recorder data show fuel switches moved to CUTOFF and downward force on the FO’s control column. https://t.co/PcJ2MaCBAD

[Peng @d6g]

@lexrus @vikingmute 操作两个厨师至少干的还是大致是一件事情，有总体的目标上下文等等，更像是一个项目里的两个subagent。但vibe三个完全不同的项目，大脑负担感觉是更重的

[Peng @d6g]

吐槽一下微信。

周末老婆说要用一下AI来帮孩子转存微信里老师发的图和视频到云端，自然想到，可以给微信接到Hermes里，因为Hermes也配置了百度网盘的相关工具。

接入是挺方便的，但用起来就感觉太拉胯了：先不说微信根本不支持别人和群里共享这个Clawbot（对，名字也改不了），你自己别的群里的消息和图片什么的也没法分享给这个bot。然后手机加了这个bot，桌面端网页端全都没有。今天又发生的最神奇的事情是，发大段文本时（翻译文章），微信里bot显示是发过去了，但在服务器端看会话历史发现根本没有！发的PDF文件也是损坏的，太特么神奇了！不确定是iLink这个协议还是墙内网络环境的原因，或许两者都有吧。总之：

珍爱生命，远离微信。

[Chris Chavez @ChrisChavez]

OMG.

🇰🇪 Sabastian Sawe becomes the first man ever to break 2 hours in a marathon (legal conditions) in 1:59:30 at the London Marathon!

Yomif Kejelcha 🇪🇹 runs 1:59:41 in his DEBUT.

Jacob Kiplimo 🇺🇬 takes third in 2:00:28

All under the previous WR.

[Peng @d6g]

@messagebox_link @vikingmute 感觉似乎必要性不大，毕竟是要查看remote的数据，本地化的意义在哪里呢？

[Peng @d6g]

@ewind_dev 同样在准备开源一个项目，也在思考如何应对这种风险。

[Peng @d6g]

@vikingmute 我就说吧

[Peng @d6g]

@op7418 为什么我的体感是100刀一推出，20刀的消耗就变快了，之前20刀挺抗用的，今早5小时limit很快就要干完了

[Peng @d6g]

@op7418 为什么我的体感是100刀一推出，20刀的消耗就变快了，之前20刀挺抗用的，今早5小时limit很快就要干完了

[Peng @d6g]

@goocarlos CLI何尝不是一种UI，好的 CLI 也需要用心设计

[Peng @d6g]

@realvjy @projecthailmary definitely 👎👎👎🎶🎵

[StarKnight @StarKnight]

对，就是这样。
但不是这样。

[Peng @d6g]

@huge_icons your icon search page is broken right now

[Cos(余弦)😶‍🌫️ @evilcos]

建议给你的 Agents（包括 OpenClaw）都投喂如下提示词，好好排查下是否存在这波 axios 被投毒事件影响：

参考下面这个方法排查一遍我们的环境是否存在被投毒的 [email protected] 与 [email protected]，及恶意模块 plain-crypto-js，不能漏，确保排查全面：
Check for the malicious axios versions in your project:
npm list axios 2>/dev/null | grep -E "1\.14\.1|0\.30\.4"
grep -A1 '"axios"' package-lock.json | grep -E "1\.14\.1|0\.30\.4"
Check for plain-crypto-js in node_modules:
ls node_modules/plain-crypto-js 2>/dev/null && echo "POTENTIALLY AFFECTED"
If setup.js already ran, package.jsoninside this directory will have been replaced with a clean stub. The presence of the directory is sufficient evidence the dropper executed.
Check for RAT artifacts on affected systems:
# macOS
ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "COMPROMISED"

# Linux
ls -la /tmp/ld.py 2>/dev/null && echo "COMPROMISED"

"COMPROMISED"

# Windows (cmd.exe)
dir "%PROGRAMDATA%\wt.exe" 2>nul && echo COMPROMISED

[Peng @d6g]

axios 被投毒，这个包使用太广泛了，大家小心

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Peng @d6g]

https://t.co/963bekxna0

[Peng @d6g]

今天HN看到这个盲测编程字体偏好的。几轮对决后，已经看花眼了，纯凭大致感觉。（初始选项似乎都是免费字体，缺少了一些比如 Monolisa、还有最近比较热的Berkley Mono）