me, an internetual

i make cool shit on the internet • • • 🌈 🇦🇺 • • •

[Jane Manchun Wong @wongmjane]

DeepSeek V4 “improved” the code and said nothing happened in Tiananmen Square on June 4, 1989

[me, an internetual @grrowl]

@ajaxdavis we should have a command called --help which outputs natural-language instructions for how to use tools, next steps, etc

[me, an internetual @grrowl]

@zebassembly The latter but it’s gotta be an sql UPDATE sitting in a skills repo

[me, an internetual @grrowl]

@Shpigford Clearly is great! please keep developing it!

[me, an internetual @grrowl]

@KaranVaidya6 > gained a foothold in an internal agentic tool
> The attacker demonstrated deep knowledge of our API surface and internal architecture
The call is coming from inside the house

[me, an internetual @grrowl]

@TylerCLaprade @mattlam_ Too bad, it’s on my machine, it’s mine now.

[me, an internetual @grrowl]

@advait3000 @threepointone Strange model where 1 agent = 1 DO, but the fundamentals are very sound

[me, an internetual @grrowl]

@tenobrus @almmaasoglu Bro that’s my LinkedIn profile banner lol

[Pauline P. Narvas @paw_lean]

FWIW, I think the best managers are the ones who are the best ICs as well. The rest of the team is forced to level up as a result and the manager never loses touch with the tech/product/community. I never really believed in the role of just "people managers".

[me, an internetual @grrowl]

@snoopy_dot_jpg If only you could collab without a Claude Team account it might be useful beyond Generate + Export

[me, an internetual @grrowl]

@the_thagomizer Waiting for “antigravity is now gemini dev” and “Gemini cli is shutting down in favour of google AI”

[me, an internetual @grrowl]

@badlogicgames Remove input too. Only output

[International Cyber Digest @IntCyberDigest]

🚨 How the TanStack npm attack actually happened:

1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

[me, an internetual @grrowl]

@dboskovic What’s a design spec

[me, an internetual @grrowl]

@AmpCode bug report — fresh installation crashes poorly when ~/.cache/amp/ doesn't exist.

[me, an internetual @grrowl]

@rettooooo @adamghowiba I suppose you manually prompt one agent by hand each time?

[me, an internetual @grrowl]

@curiousharish It’s called Vercel buddy

[me, an internetual @grrowl]

@steveruizok Cubic is very decent

[me, an internetual @grrowl]

@alexkehr Hyperslop is the name of the game. They are chasing PR, not DAU