Faiz

Saya tulis kod.
Believes he has a creative mind, and wanted to show it to the world.
#WisconsinBadgers Malaysian chapter | dulu Puncak Alam, now Kajang

[Faiz @sayhellotofaiz]

@dolpheyn Share prompt for diagram

[The Futurizts @TheFuturizts]

PERKESO's recent communications made one thing clear:

👉 You’re going to pay for the new SKBBK benefit, whether you like it or not.

So, to get your money back, you need to be 100% aware of what you can claim.

I've read their 14-page FAQ.

Let me break it down for you. 🧵

[Dan Go @CoachDanGo]

I wore an Apple Watch, Whoop, Oura, and Fitbit Air at the same time for a week.

I expected the data to be similar but did not expect this.

Here's what every wearable owner needs to know:

[Sudo su @sudoingX]

anyone running a 16gb card, stop scrolling. @pupposandro and @davideciffa got qwen 35b-a3b down to 13.3gb, measured on a 3090 gpu.

which means a model you literally could not load before now fits, running around 100 tok/s, near what you'd get with every expert resident on a 24gb card.

the clever part is the thing everyone gets wrong about moe. it only touches ~3b of its 35b params per token, routes to about 8 of 256 experts, but you still pay full vram to keep all of them around in case they're next.

luce spark learns which experts your traffic actually hits, pins those hot, and streams the rest from ram hidden under the matmuls so there's no speed cliff. one flag, and it tunes itself warmer every restart.

this is the kind of work that quietly drops the whole local inference tier down a card. don't let it scroll past.

[Faiz @sayhellotofaiz]

@azwan_ Banggg marah sapa ni bang ahaha

[Faiz @sayhellotofaiz]

@kusyuk Razer kat shah alam ke tuuu

[Faiz @sayhellotofaiz]

@izqalan Huh jap berkait ke isu fpx? Kami ada guna pbtpay, down sejak semalam sebab ni ke? Baru tadi dah ok...

[International Cyber Digest @IntCyberDigest]

🚨 How the TanStack npm attack actually happened:

1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

[Gracie Hartie @graciehartie]

@kanjiro1922 It’s true. Ppl who measured it can tell you.

Besides, the function of the balls is to keep the sperm cool.

[Faiz @sayhellotofaiz]

@MyMaybank i have a complaint on Secure2U activation. Seems like not all Maybank ATM have that option? I went to Petronas Prima Saujana Kajang...

I went to Tesco Kajang Maybank ATM got that option. Haish... 🤨

[Lenny Rachitsky @lennysan]

My biggest takeaways from @simonw:

1. November 2025 was an inflection point for AI coding. GPT 5.1 and Claude Opus 4.5 crossed a threshold where coding agents went from “mostly works” to “almost always does what you want it to do.” Software engineers who tinkered over the holidays realized the technology had become genuinely reliable.

2. Mid-career engineers are the most vulnerable—not juniors, not seniors. AI amplifies experienced engineers by letting them leverage decades of pattern recognition. It also dramatically helps new engineers onboard. Cloudflare and Shopify each hired a thousand interns because AI cut ramp-up time from a month to a week. But mid-career engineers who haven’t accumulated deep expertise and have already captured the beginner boost are in the most precarious position.

3. AI exhaustion is real and underestimated. Simon runs four coding agents in parallel and is mentally wiped out by 11 a.m. He’s getting more time back, but his brain is exhausted from the intensity of directing multiple autonomous workers. Some engineers are losing sleep to keep agents running. This may just be a novelty issue, but the underlying dynamic—that managing AI amplifies cognitive load even as it reduces labor—is a real tension. Good companies will manage expectations rather than expecting 5x output indefinitely.

4. Code is cheap now. This simple idea has profound implications. The thing that used to take most of the time—writing code—now takes the least. The bottleneck has shifted to everything else: deciding what to build, proving ideas work, getting user feedback. Since prototyping is nearly free, Simon often builds three versions of every feature when he’s getting started.

5. The “dark factory” is the most radical experiment in AI-assisted development happening right now. A company called StrongDM established a policy: nobody writes code, nobody reads code. Instead, they run a swarm of AI-simulated end users 24/7—thousands of fake employees making requests like “give me access to Jira”—at $10,000 a day in token costs. They even had coding agents build simulated versions of Slack, Jira, and Okta from API documentation so they could test without rate limits.

6. "Red/green TDD" is the single highest-leverage agentic engineering pattern. Having coding agents write tests first, watch them fail, then write the implementation, then watch them pass produces materially better results. The five-word prompt “use red/green TDD” encodes this entire workflow because the agents recognize the jargon.

7. “Hoarding things you know how to do” is one of Simon's other favorite agentic engineering patterns. Simon maintains a GitHub repo of 193 small HTML/JavaScript tools and a separate research repo of coding-agent experiments. Each one captures a technique, a proof of concept, or a library he’s tested. When a new problem arrives, he can point Claude Code at past projects and say “combine these two approaches.”

8. The "lethal trifecta" makes AI agent security fundamentally unsolved. Whenever an AI agent has access to private data, exposure to untrusted content (like incoming emails), and the ability to send data externally (like replying to email), you have a lethal trifecta. Prompt injection—where malicious instructions in untrusted text override the agent’s intended behavior—cannot be reliably prevented. Simon has predicted a “Challenger disaster” for AI security every six months for three years. It hasn’t happened yet, but he’s pretty sure it will.

9. Start every project from a thin template, not a long instructions file. Coding agents are phenomenally good at matching existing patterns. A single test file with your preferred indentation and style is more effective than paragraphs of written instructions. Simon starts every project with a template containing one test (literally testing that 1 + 1 = 2) laid out in his preferred style. The agent picks it up and follows the convention across the entire codebase. This is cheaper and more reliable than maintaining elaborate prompt files.

10. The pelican-on-a-bicycle benchmark accidentally became a real AI benchmark. Simon created it as a joke to mock numeric benchmarks—get each LLM to generate an SVG of a pelican riding a bicycle, and compare the drawings. Unexpectedly, there’s a strong correlation between how good the drawing is and how good the model is at everything else. Nobody can explain why. It’s become a meme: Gemini 3.1’s launch video featured a pelican riding a bicycle. The AI labs are aware of it and quietly competing on it.

Don't miss our full conversation: https://t.co/ghZZeyvWBZ

[Gunhoe @gunhoe2u]

@flaviocopes Sounds familiar… https://t.co/3YGDByQ93A

[Moshe Siman Tov Bustan @MosheTov]

Finally got to do the flow chart for the Axios incident...
https://t.co/jZxLeMWtQf

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[مُحِبُّ الله اَلعَيدروس. ☀️ @ibjela]

4 movies yang boleh ajar korang pasal bank dan riba better than any Islamic banking Shariah advisor could:

[Chuah Kee Man @keemanxp]

For Claude users who want to add "Claude Skills" for translation into Bahasa Melayu (Malay) to better align with DBP (Dewan Bahasa dan Pustaka) standards. Link: https://t.co/yNJyk8sOEI

Do let me know if there are any improvements needed. Hope it's useful.
#ClaudeAI #claudeskills #BahasaMelayu

[Amjad Masad @amasad]

Software isn’t merely technical work anymore. It’s creative.

Introducing Replit Agent 4. The first AI built for creative collaboration between humans and agents.

Design on an infinite canvas, work with your team, run parallel agents, and ship working apps, sites, slides & more.

[Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk]

IS WHATSAPP SPYING ON YOU?

Look at this homelab log. What do you see?

The user tried to block Meta, and WhatsApp started screaming. It’s hitting these domains 4-5 times a SECOND. If you think End-to-End Encryption means you're private, you’re being played.

The Tracking Breakdown:
* https://t.co/X5xfTdbKgt: Meta calls this "De-identified Telemetry." Translation? They’re "anonymously" tracking every time you open the app, how long you stay, and what device you’re on. They don't need to read your texts when they can track your heartbeat.

* https://t.co/v386iC0Ka3: This is the Meta Social Graph. It’s mapping who you talk to and how often. They’ve built a web of your entire life, and this log shows the app trying to update that web in real-time.

* The Battery Killer: Notice the spam? When you block their reports, the app goes into a fever dream trying to reconnect. Your phone is getting hot and your battery is dying because Zuckerberg wants his data back.

Remember privacy truly doesn't exist
Be paranoid

[VraserX e/acc @VraserX]

Seedance 2.0 casually inventing Neymar’s F1 career arc. 🤣

[Crystal @crystalsssup]

Kimi K2.5 + Seedance 2 is a perfect workflow.

One prompt = A 100MB Excel storyboard generated with images and prompts, which you can use in seedance.

I just tested with Hitchcock's Psycho iconic shower scene. My prompt:

I would like to create a derivative work of the shower murder scene from Psycho. Could you provide a storyboard breakdown, including the prompt for each shot, and generate previews for me? Please present this in a table and give me an Excel file.