zeØ_Øn256

🇸🇬 | software gangster | cs @NTUsg 25 | 🦀 rust fan club | wave music enjoyer | open to roles in sg/sf/lon

[Max Anderson @MaxAnderson]

As someone who has personally spent $500k / mo+ on Google Ads for years, I can tell you with certainty:

This revenue growth in Search is artificial & extremely unhealthy for Google’s business long term

Search volumes are declining as legacy search is being increasingly cannibalized by non-monetized LLM queries

Google’s response?

Manufacture revenue growth via short-sighted, highly extractive, customer-hostile tactics. I.e. charge advertisers more for lower quality clicks, including clicks they do not want and explicitly did not approve Google to charge them for

A few examples to illustrate:

For all of its history until recently, Google operated on a 2nd price auction model

I.e. if you bid $5 CPC and the next highest bidder bids $1 CPC, Google charged you $1.01 for the click (one penny more than the 2nd highest bidder) rather than the $5 you bid

This was a genius move by Google early on as it incentivizes advertisers to input their true maximum willingness to pay rather than trying to play the game of bidding low and constantly adjusting to try to stay just ahead of the next highest bidder while still not paying too much

However recently, Google silently deprecated the 2nd price auction and began charging advertisers as much as their bid and budget caps allow, regardless of what anyone else is bidding

It’s a short-sighted cash grab at the expense of the long term health of the advertiser ecosystem

Making thing worse, Google also recently nerfed keyword targeting precision

Google previously had precise keyword targeting settings that allowed advertisers pick individual search phrases to bid on, defined down to the character w/ exact match or phrase match targeting

This was one of the core features that made search advertising magic, enabling advertisers to run extremely precise campaigns based on exactly what their target customer typed

But now, even if you bid on a specific term or phrase using the strictest exact
-match targeting settings, Google will show your ad across 1000’s of unrelated keywords, labeling them as as “exact match (close variant)”

The definition of “close variant” means whatever they want it to and changes constantly. The result is advertisers get billed for clicks that are totally irrelevant to their business and that their targeting settings explicitly forbid Google from targeting. Google does it anyway and there’s no ability to turn this off

So now exact match is broad match, and broad match is just meaningless spam

This is all very bad for advertisers, but for Google, it allows them to show your ad and bill you for clicks across 1000x more searches that were previously going unmonetized (mainly because they’re garbage queries no one wants)

This is how you grow revenue atop declining search volumes

Lastly, and perhaps most egregiously, Google quietly stopped respecting budget caps by a factor of 2x. For example campaigns we’ve been running for years with $1000 daily budget caps suddenly began spending $2000+ per day

And the extra spend is entirely on the garbage keywords Google arbitrarily throws in as “exact match (close variants)” which have no value to our business, but can’t be turned off

Google offers no refunds nor any recourse for overspend or spend on keywords you explicitly did not target

These are not the actions of a healthy business. These are the actions of company whose core business is in decline but desperately needs to pump quarterly earnings so Wall Street will continue to fund insane capex while hopefully looking through their rapidly deteriorating negative free cash flow

Google operated a benevolent monopoly for the better part of 25 yrs

Meaning the value Google captured from Search was but a small fraction of the value it created, and that spread produced a potential energy that justified expectations of high earnings growth far, far into the future

This is now no longer the case

At the alter of AI capex, Google is sacrificing the golden goose

[Chubbyemu @chubbyemu]

?

[John Ternus @johnternus]

We’re glowing with excitement over the new MacBook Pro. You’ve gotta touch it to believe it.

[zeØ_Øn256 @zeon256]

@farhanhelmycode and the best is?

[David Walter (Shiny Gen) @davidpwalter]

What are the top 4 Pokemon games of all time?

Emerald, Soul Silver, Platinum, FireRed

therefore..
Emerald Color was the warmup for

Platinum Emerald
All 4 regions, running on GBA
Coming soon.

[ranbla @ranbpa0]

Common pokeball knowledge: timer balls don't work on turn 247 in gen 3

[Low Level @LowLevelTweets]

ctf in 2014: run this program in a debugger

ctf in 2026: become a threat actor and exploit this 0day with no public poc

[hashcat @hashcat]

hashcat v8.0.0 released!

The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.

Release notes: https://t.co/0ffrO586PJ
Download: https://t.co/Grn4jZmAWr

[DuckDB @duckdb]

We released DuckDB 2.0 on Wednesday, leading with the Python, Java and command-line clients, plus the core extensions.

By Friday, the rest of the ecosystem caught up with the new version. All primary clients support DuckDB 2.0, including Go, Node.js, R and Rust.

Most community extensions have also been updated and rebuilt for DuckDB 2.0, and there are even new ones out there

For example, @MistralAI released their new Timestral time-series model family, and there’s already a DuckDB extension for it, contributed by Sylvain Utard! Timestral forecasts that if you’re based in Europe, you’ll have an extra hour this weekend – perfect for trying it out using our new compact syntax:

INSTALL AND LOAD timestral FROM community;

[cts🌸 @gf_256]

How to find ALL PHP bugs:

1. Compile code (e.g. to RISC-V, x86, LLVM IR)

2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it!

3. Find a LOT of bugs

Super proud of our work. A big step towards finding ALL memory safety bugs

[stacksmashing @ghidraninja]

Yes, social media is at fault for amplifying the fact that you put - and are still putting - us all at great risk.

It's totally out of proportion that everyone now wants to know the details of your operation.

Delusional.

[Josh @joshmanders]

Never deleting this app.

[stypr @brokenpacifist]

mitmproxy: use `--emudhra` to sign TLS certificates 💀

[figamin @figamin]

tired: you need to update all your devices that are connected to the internet

wired: you can now root every smart device to stop them from stealing your data and showing you ads

[Railway @Railway]

An urgent notice from the Railway team

https://t.co/niUAhTAQJM

[solst/ICE of Astarte @IceSolst]

>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
⁠>NET::ERR_CERT_AUTHORITY_INVALID⁠
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back

[John Althouse @4A4133]

Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.

https://t.co/fopoKsPulV

[Pierre @pierrecomputer]

Today we're launching an exciting new project: Highlights

Highlights is a syntax highlighter that outputs HTML. It improves on both speed and correctness compared to the existing industry standard libraries.

It's an optional drop-in replacement in Diffs, and it's ready to use today. In fact, it's already powering diffshub․com!

Check it out at https://t.co/jji0c8fzC4
OR `pnpm install @​pierre/highlights`

[@levelsio @levelsio]

I notified a friend working at a big tech corporate about the PHP vulnerability as their entire infrastructure runs on PHP

He answered

"Thanks, I'll try patch it in a few days as I'm Out of Office (OOO) now"

And this is a modern tech company, imagine the traditional companies running PHP

People won't update fast enough and the vulnerability will be out in the wild once the patch hits as anyone can reverse engineer it based on the patch

Considering this, there's gonna be so many sites hacked and so much user data exposed I think

🤯