标签：#r

It's not abnormal for projects to go weeks, or dare I say months, between dependency updates. And when people finally do update, they do it in full force: everything at once, without checking anything. That habit has always carried risk, but in the new world of AI agents doing the updating, it collides head-on with a very real threat: supply chain attacks. The problem: install is an arbitrary code execution feature The package ecosystems we all depend on have spent the last few years demonstrating exactly how bad this can get. In September 2025, chalk and debug , part of a batch of eighteen packages with over two billion combined weekly downloads, started shipping a crypto-clipper after one maintainer's npm account was phished through a fake 2FA-reset email. Days later, the Shai-Hulud worm chewed through hundreds of packages on its own: its post-install script stole npm tokens from every machine it landed on and used them to publish more infected versions of itself. And a couple of weeks before either, the Nx compromise put a post-install payload on developer machines that prompted locally installed AI coding CLIs like Claude and Gemini to hunt down wallets and credentials for exfiltration. That last one should make every agent owner sit up straight: our own agents, conscripted as burglars. The pattern is consistent: a malicious version goes live, does its damage for a few hours or days, then gets caught and pulled. Based on this, I decided, not to do updates till a set of rules have been met. These rules, I have decided to burn them into Claude skills and let my agents deal with them. AI Agent Skills: paranoia as a config file In Claude Code, a skill is just a markdown file with instructions the agent loads when a task matches. This gives me way to encode my hard-won paranoia once and have it applied every single time , by something that never gets tired, never gets sloppy on a Friday afternoon, and never thinks "eh, it's probably fine." I wrote two of them, for no

This isn't a wish for the internet to stop — just a moment to imagine what it'd mean to breathe without it. Not everyone, but a huge percentage of the world now relies heavily on the internet. What if it were unavoidably shut down for just 24 hours? How long would those hours actually feel — and how much would they reshape our daily routines? I see the irony everywhere already. The moment a page hangs, I instinctively dial a USSD code to check my data balance. I know someone who pings google.com just to see if he's still connected — using the internet to check whether the internet is still there. The first hour would probably be spent staring at the network icon, refreshing pages, waiting for life to resume. That's when we'd notice how much of the day quietly depends on the cloud: deliveries stall, payments freeze, navigation disappears, businesses pause. Millions would discover just how many invisible gears keep everyday life moving. Then the smaller shifts. Looking at the sky to guess the weather instead of opening an app. Realizing the only people who "exist" are the ones actually in front of you. Sitting in a room where the loudest sound is the silence of the feed. Maybe one day, staying offline will be a skill of its own. Have we gotten so used to consulting the network before taking a step that we've stopped trusting our own judgment? Perhaps 24 hours of silence wouldn't just be an outage. It would be a reminder — that before the cloud, there was memory. Before search engines, there was curiosity. Before notifications, there was presence. And before constant connection, we still knew how to walk on our own. If you asked me, What cloud or internet service would you miss most for a day? For me, I don't remember the last time I went 48 hours without Gemini.

This came from an idea that had been knocking around in my head for several years. I had been collecting opening lines of famous works and thought it would be cool to see one everyday as I opened the browser. I tried different styles but landed on the simple background with the text, let the words speak for themselves. Over time i've added more quotes I believe now there are close to 60, so hopefully you can refresh a few times and get a fresh one every time. I hope you guys like it, enjoy!

submitted by /u/matijash [link] [留言]

X's head of product, Nikita Bier, admitted in a post on Monday that X's algorithm was "missing" data about surfacing posts from people who you've followed back. Now, he says a tweak will "boost visibility of your posts to your mutuals," hopefully enhancing the sense of community instead of highlighting and spreading random arguments, but […]

Marc Lou read a tweet, slept on it, and woke up still annoyed. The tweet, from Pieter Levels, was about all the fake revenue screenshots on X. By the next evening Lou had built a thing to fix it. By the day after that, the thing had made $20,378. That is the part everyone retweets. I want to walk you through it, and then I want to show you the line in his own year-end letter that complicates the whole legend. The setup Lou got fired by Tai Lopez in November 2021, was broke and depressed, and moved to Bali. He started shipping tiny products in public, copying the playbook of, yes, Pieter Levels. His breakout was ShipFast , a Next.js starter kit that did $40,000 in its first month in September 2023. By December 2025 he was running 15 startups generating about $84,900 a month, with cumulative revenue past $2.26 million, per his verified TrustMRR data. The reason I trust his numbers more than most is that he verifies them through Stripe on his own product, TrustMRR , which brings me to the 24-hour story. The moment something worked, absurdly fast TrustMRR exists to kill fake MRR screenshots. You connect a read-only Stripe key, and it shows your verified revenue on a public page nobody can edit. Lou built it in a day on top of his own boilerplate, which is the cheat code here. He was not starting from zero, he was starting from ShipFast. "TrustMRR is 24 hours old and was built in 24 hours." @marc_louvion on X He monetized it with sidebar ad slots. He listed them at $299 a month, then raised the price each time one sold, all the way to $1,499. In his newsletter he wrote that within three days every slot was gone and the side project had made $20,378. He called it the third fastest-growing thing he has ever built. Five days in, he posted the run-rate dream out loud. "20/20 spots filled! TrustMRR went from $0 to $18,380 MRR in 5 days. That's $220,000 ARR if I'm allowed to dream a little" @marc_louvion on X It kept going. By December 2025 TrustMRR was his single biggest inco

New York has become the first state to temporarily halt approval of large data centers, as Gov. Kathy Hochul argues the AI-driven building boom shouldn’t come at the expense of higher electricity costs, water supplies, or local control.

submitted by /u/cachebags [link] [留言]

The Iranian government exploited well-known flaws in cellphone networks to locate and then strike U.S. military personnel in the build-up and beginning of the war.

New York’s data center moratorium may become the blueprint for anti-AI movement.

The only way to go fast is full YOLO mode in your coding agent. I've got the local sandbox figured out (pro tip: Incus VMs work great) but I wanted to keep my agents from doing things like inadvertently blowing up my cloud services or chasing a prompt to POST to some random website. I struggle most with this on my side projects where my permission model isn't quite as robust as it is at the office. I started with a firewall on the Incus container but every time the agent needed access to somethi

“We have no choice but to address the challenges created by these massive facilities,” New York governor Kathy Hochul said. The executive order will pause construction for one year.

Health officials have not confirmed a source yet—and there may be multiple sources.

The RingConn 3 actually looks like real jewelry, not a wearable -- but its fitness tracking and headache detection features are disappointing.

submitted by /u/IanisVasilev [link] [留言]

I wanted to run AI from inside the JVM. I started out with the standard REST sidecar, ripped that out to use Project Panama (Foreign Function & Memory API) in the new JDK versions to interface directly with llama.cpp. I still wasn't happy with how that functioned, so I built libargus.cc to get a clean ABI to expose a structured API up in the JVM landscape. It still uses Project Panama to interface directly with llama.cpp, whisper.cpp, and ggml compute graphs. I have zero-allocation on the hot pa