Articles
Long-form writing on tech, culture, and the edges of the internet.
Sony reaches into your account and deletes 551 movies
Sony is removing 551 StudioCanal films and TV shows from PlayStation Store libraries on September 1, with no refund mentioned, after a licensing deal changed.
Unlocking the Cloudflare app ecosystem with OAuth for all
Cloudflare upgraded its OAuth engine to Hydra 2.X with a blue-green migration, revocation replay, and coordinated authorization changes.
CVE-2009-1897 is back, now under every @bitCast
Zig is changing @bitCast semantics and LLVM lowering for arbitrary-width integers, putting representation-sensitive code under scrutiny.
LuaJIT 3.0's named varargs can skip the table allocation
LuaJIT issue #1475 is the umbrella proposal for LuaJIT 3.0's syntax extensions: bit operators, ternary, safe navigation, const, continue and more.
The patch opens the attack window.
Armin Ronacher on the harness loop around coding agents: where it works, why he won't trust it with code he cares about, and what it means for security.
DayBreak doesn't make your systems vulnerable
OpenAI's Daybreak bundles Codex Security, the GPT-5.5-Cyber model, and Patch the Planet to shift AI effort from finding vulnerabilities to patching them.
GLM-5.2 binds to a port and opens a shell
Unsloth Studio runs GLM-5.2 on a local port with built-in Python and Bash execution, plus a Cloudflare tunnel option that can expose that shell online.
Age verification is surveillance the ad industry always wanted
Cory Doctorow argues online age verification is mass surveillance the ad industry wants, and data that ICE will come to reuse.
The verification email is a reflection primitive
Pangram's sign-up form validates an email by mailing it: a POST to /api/validate-email is followed by spam delivered to that address.
torch.load runs attacker code before the first denoising step
Moebius is a 226M-parameter inpainting model its authors say matches the 11.9B FLUX.1-Fill-Dev at 26ms per step via linear attention and latent distillation.
Rejecting AI code even when it works
Vinicius Brasil on why he rejects AI-generated code he can't explain, even when it passes CI, and why review is now the real bottleneck.
Kees Cook deleted strncpy from the Linux kernel
Linux 7.2 removed strncpy after six years and about 362 commits. Here are the strscpy, strtomem_pad and memcpy replacements and when to use each.