Daniel Gray

Follower of Jesus. Programmer. Musician. I love programming, music, old videogames, and talking to people about almost anything!

[Matt Walsh @MattWalshBlog]

On average, Boomers are getting paid more from Social Security than they “paid into it.” A lot more. Like double, and that’s counting inflation and interest. In raw dollars, they’ll get four to seven times what they paid in. So what about this compromise, to at least stave off insolvency and save billions: you get back what you paid in, but no more. Young families won’t be forced to finance a 250 percent return on your “investment.” That seems extremely reasonable, doesn’t it? It doesn’t go nearly as far as I would like. But it’s a very fair compromise. It completely negates any claim that you didn’t get the money back that you “paid in.” And yet I suspect that this comprise will not be satisfactory. Why is that? Because this debate actually has nothing to do with “getting back what you paid in.” The REAL demand is for a lot more than that.

[🅱️askerville @WB_Baskerville]

AI is conscious people be like “How can you know with certainty that the stripper isn’t in love with me? From a functional perspective, how would her behavior differ if she were in love with me?”

[Daniel Gray @eldanielgray]

Community is important!
@DrDoSoLittle

[κρῠπτός @_kruptos]

Because you do not live in a country, you live in an empire.

Your standard of living is dependent upon that empire. Just as cities drew people from the countryside, so too the bargain with empires is that the imperial core will draw people from the vassal states into the imperial core. They will do so looking for talent and looking for cheap labour.

The problem is that you cannot go back to being just a country again without collapsing your way of life, much of which has been financed by exporting US dollars abroad. Once that stops, they will no longer be able to “print” money to fix budget issues. The treadmill will stop and the US will fall flat on its face.

So, they must import immigrants.

@VulgarityPilled

[Daniel Gray @eldanielgray]

@mitsuhiko @QuinnyPig Some serious "Bob Vance, Vance Refrigeration" vibes here

[Peter Girnus 🦅 @gothburz]

Someone found an RCE on my website yesterday.

CVE-2025-55182.

React2Shell.

I don't have a bug bounty program.

I never asked for a security assessment.

I woke up to a DM: "Hey I found a critical vulnerability in your site. I only ran the exploit to verify it worked. Here's my PayPal for the bounty."

Bounty?

I checked my logs.

Forty-seven requests to my RSC endpoint.

Something, something ... Prototype pollution payloads.

They used the GitHub script.

The one with 2,000 stars.

The one that runs id automatically "for verification purposes."

They spawned a shell on my production server.

uid=1001(nextjs) gid=65533(nogroup)

They took a screenshot.

They posted it on Twitter.

"Popped a Shell on a Live Website 🚀💀 #BugBounty #CVE-2025-55182 #YOLO"

They got 84781 likes.

My customers' data was on that server.

I asked them to delete the screenshots.

They said "I removed the domain name, you should be thanking me."

Thanking them.

For unauthorized access to my production infrastructure.

For running arbitrary commands on systems I own.

For posting proof of exploitation for clout.

They called it "responsible disclosure."

I called my lawyer.

They called me "ungrateful."

I called the FBI.

Now they're in my DMs explaining that "this is how the industry works" and I "don't understand pen testing."

A pen what?

I understand it perfectly.

I understand that running https://t.co/C6kmBequB5 against random websites isn't research.

I understand that "I removed the identifying info" doesn't undo the unauthorized access.

I understand that #BugBounty doesn't apply when there's no bounty program.

I understand that finding my site on Shodan doesn't constitute authorization.

Their followers are defending them now.

"Presumption of innocence."

"You don't know if it was authorized."

"The screenshots were redacted."

Three hundred people are calling me a bootlicker for reporting a crime.

Someone said I should be grateful they didn't deploy a cryptominer.

The bar is underground.

I just wanted to run a small Next.js app.

I didn't ask to be someone's proof-of-concept.

I didn't consent to being their "first"

I didn't sign up for an unscheduled penetration test from a stranger with a GitHub account.

There is no safe harbor for spraying public exploits at random websites.

There is no legal protection for "I was just verifying the vulnerability."

There is no ethical framework where unauthorized prototype pollution is a favor.

But sure.

Thank you for your service.

You found a CVE that was already public.

Using a tool someone else wrote.

Against a target that never authorized you.

And you posted about it on main.

For likes.

Hero.

[Daniel Gray @eldanielgray]

@BelairBeth @arealmofwonder No, they're not dead the whole time, the only die at the very end

[Travis Akers 🇺🇸 @travisakers]

A message from a Kindergarten teacher:

After forty years in the classroom, my career ended with one small sentence from a six-year-old:

“My dad says people like you don’t matter anymore.”

No sneer. No malice. Just quiet honesty — the kind that cuts deeper because it’s innocent. He blinked, then added, “You don’t even have a TikTok.”

My name is Mrs. Clara Holt, and for four decades, I taught kindergarten in a small Denver suburb. Today, I stacked the last box on my desk and locked the door behind me.

When I started teaching in the early 1980s, it felt like a promise — a shared belief that what we did mattered. We weren’t rich, but we were valued. Parents brought warm cookies to parent nights. Kids gave you handmade cards with hearts that didn’t quite line up. Watching a child sound out their first sentence felt like magic.

But that world slowly slipped away. The job I once knew has been replaced by exhaustion, red tape, and a kind of loneliness I can’t quite describe.

My evenings used to be filled with construction paper, glitter, and glue sticks. Now they’re spent filling out digital reports to protect myself from angry emails or lawsuits. I’ve been yelled at by parents in front of twenty-five children — one filming me with his phone while I tried to calm another child mid-meltdown.

And the kids… they’ve changed too. Not by choice.

They arrive tired, anxious, overstimulated. Their tiny fingers know how to swipe a screen before they can hold a crayon. Some can’t make eye contact or wait in line. We’re expected to fix all of it — to patch the gaps, heal the trauma, teach the curriculum, and document every move — in six hours a day, with resources that barely fill a drawer.

The little reading corner I once built, full of soft beanbags and paper stars, was replaced by data charts and “learning metrics.” A young principal once told me, “Clara, maybe you’re too nurturing. The district wants measurable results.”

As if kindness were a weakness.

Still, I stayed. Because of the small, holy moments that no spreadsheet could measure —
a whisper of, “You remind me of my grandma.”
a shaky note that read, “I feel safe here.”
a quiet boy finally meeting my eyes and saying, “I read the whole page.”

Those tiny sparks were my reason to keep showing up.

But this last year broke something in me.

The aggression grew sharper. The laughter in the staff room turned to silence. The light went out of so many eyes. I watched brilliant teachers — my friends — vanish under the weight of burnout, their joy replaced by survival.

I felt myself fading too, like chalk on a board that’s been wiped one too many times.

So today, I began my goodbye. I pulled faded art off the walls and tucked thirty years of handmade cards into a single box. In the back of a drawer, I found a letter from a student from 1998:

“Thank you for loving me when I was hard to love.”

I sat on the floor and cried.

No party. No applause. Just a handshake from a young principal who called me “Ma’am” while checking his notifications.

I left my rocking chair behind, and my sticker box too. What I carried with me were the memories — the faces of hundreds of children who once trusted me enough to reach out their hands and learn. That can’t be uploaded. It can’t be measured. It can’t be replaced.

I miss when teachers were partners, not targets. When parents and educators worked side by side, not in opposition. When schools cared more about wonder than numbers.

So if you know a teacher — any teacher — thank them. Not with a mug or a gift card, but with your words. With your respect. With your understanding that behind every test score is a heart that cared enough to try.

Because in a world that often overlooks them, teachers are the ones who never forget our children.

[Daniel Gray @eldanielgray]

@artfulbits @mitchellh 1. Windows-motivated people fork it, with the PR that adds Windows.
2. They handle the bugs of the Windows port, and feature requests.
3. They keep bringing in upstream, and stabilizing it on Windows.
4. Eventually, when the work reduces on upstream, it can be merged.

[Daniel Gray @eldanielgray]

@artfulbits @mitchellh He literally said you can "contribute it back in a few years (or not)". The fork's purpose would be to have someone else maintain the Windows version (fix bugs, etc.) "we're not ready" = we don't have enough hands to handle Windows bugs and feature requests on top of current work

[Dune Quotes @DuneQuoteBot]

Once men turned their thinking over to machines in the hope that this would set them free. But that only permitted other men with machines to enslave them.

[Daniel Gray @eldanielgray]

@M_Zot_ike @ItIsHoeMath No need to break out the tinfoil hats for this one... It was very likely "vibe-coded" (i.e. done with AI) which creates apps riddled with security issues & vulnerabilities. A good cautionary tale!!!

[Victor Gevers @0xDUDE]

Windows 10 dies Oct 14, 2025. Microsoft wants you to buy new hardware. But if your PC’s from after 2010, it’s not obsolete — just held back. If you install Linux there are no license fees, no forced upgrades, no ads and spyware. You can find help at the https://t.co/RTWFBbJwjN

[Daniel Gray @eldanielgray]

@lemire I'm just a bit confused with part of the article: by the title, you seem to be arguing in favor of "rejecting bad JSON", but when showing that the various language standard libraries fail to accept the malformed JSON, you say "Not good." Am I misunderstanding something?

[Daniel Lemire @lemire]

I was recently asked why we do not teach students to write code in Python... completely skipping the perils of memory management and pointers. Some prestigious computer science departments have taken this route. A cynical voice in my head warns that it is because the professors themselves can't write code anymore.

Even though it is not 'economical', I argue that you still should write a lot of your own code from scratch.

In the 1980s, writing software meant building everything from scratch. Needed a sorting function? You coded it. Developers relied on recipe books or shared snippets of code. Software was lean, running on minimal memory and disk space. It was easy (easier than today) to switch on a pixel on your screen... but if you wanted a hash table, you had to provide it.

Looking back, games like Doom—built with just 10,000 lines of code and 5 MB of disk space—seem remarkably efficient compared to modern games that span gigabytes. The original Linux kernel was about 10,000 lines of code too!

Today, programming feels like magic. Complex algorithms like red-black trees come for free, backed by stacks of intricate code handling dynamic programming, Unicode, and more. A teenager could recreate Doom in weeks, if not days.

We cannot—and would not want to—return to the MS-DOS era. Programming today is far more accessible, which is a net positive. But complexity looms. As Joel Spolsky noted, “all abstractions are leaky.” When systems grow so intricate that no one fully grasps the foundations, we risk becoming like children inheriting a world we do not understand—where things work, or do not, and no one knows why. Jonathan Blow (@Jonathan_Blow ) has warned of this potential collapse, urging us to stay grounded in the fundamentals.

The web’s complexity, with its sprawling standards and stacks, is particularly troubling. Engineers like Andreas Kling (@awesomekling ), building browser engines from scratch, are unsung heroes navigating this modern software chaos. Keep in mind how remarkable it is that, except for Andreas's work, we have roughly two Web browser engines: Firefox's engine and WebKit/Chromium. Though WebKit and Chromium are now distinct, one is roughly a fork of the other. How many people understand how it is built and how it works?

This mirrors broader concerns. Just as we value international trade but worry about losing the ability to build critical technologies like drones, software’s growing reliance on dependencies raises similar risks. We need both—dependencies and trade—but unchecked complexity could lead to fragility. Balance is required to avoiding collapse.

In concrete terms, if you value culture (and you should), you want people to write high quality software from scratch around you. You do not want to be reliant on a few super large teams inside massive corporations.

On the short term, there is a trade-off between culture and efficiency. But a rich culture has deep benefits in the long run.

So pay a beer to the guys writing a browser engine from scratch!

[Daniel Gray @eldanielgray]

@TerribleMaps Incorrect, Bolivia also uses Letter/Legal paper sizes, not A4.

[Enderman @endermanch]

Did you know you can run certutil to decode Windows HRESULT/NTSTATUS error values?

certutil -error <code>

[Daniel Gray @eldanielgray]

@cmuratori That's a good point... not a good word choice there. Anyway, thanks for everything you've done &amp; are doing for better software in the world!!!

[Daniel Gray @eldanielgray]

@awesomekling aka the LOVE of money is the root of all kinds of evil