ABC @Ubunta

Libraries causing the issue - next 15.1.6 - react 19.0.0 and react-dom 19.0.0

For 4 days, our Claude & OpenAI API keys kept leaking. We rotated them. They leaked again. Checked the cluster, logs and code. Asked AI to find what was compromised. Plenty of confident answers, none right. Around $250 burned. Then one small detail stood out: only keys inside the running pods leaked. The key on my laptop never did. So the problem wasn't the keys. It was something running on the server. The culprit was an unpatched vulnerability in our Next.js / React stack that allowed remote code execution without logging in. Attackers could read whatever the affected process could access, including our keys. The fix took 10 minutes. Finding it took 4 days. So: - Keep your frameworks patched, not just your own code. - Close the hole before rotating keys, or you're handing over fresh ones. - Compare what leaked with what didn't. That small difference was our biggest clue. The AI part was interesting. The agents went through everything but missed it. I still had to ask the right question and point them towards the right comparison. AI helped do the work. In this case, the direction still came from a human.

Amazon Prime lowered its price after a court ruling. Unbelievable. I’m sure they’ll recover the difference with more ads. 😂

Been playing with Jev this week. My first thought was a Bloom filter: a fast cheap check before the expensive work. It's not the same though. A Bloom filter gives a hard guarantee; Jev gives a confidence score. So I stopped comparing and started testing. I work on real-world oncology data. Our AI agent plans and runs analyses on Datawarehouse, and the big model burns a lot of time on small calls. Simple count or survival analysis? Ask the user or work it out? Days or months? Did I actually answer the question? That's exactly Jev's territory. So I'm testing it on routing, ask-or-act, and plan checks. The big model keeps the reasoning, and all data access rules stay deterministic. The real question is whether the confidence holds up on clinical data.

I recently started working with a well-known healthcare data vendor. They need at least 2 weeks to set up the aws infrastructure—before they can even begin copying the data to S3. AI may be taking some jobs, but certain traditions remain untouchable. It’s strangely comforting to feel frustrated again. I finally feel like a software engineer.

My @OpenAI API key was somehow compromised, and I became curious: what could someone actually do with a stolen key? The logs led to me the project named Stratum—a genuinely intelligent Rust project aimed at the Docker ecosystem, used gpt-6-astra (ofcourse) Most secret scanners inspect small configuration files. Stratum targets the large 20–500 MB Docker image layers that people rarely unpack and inspect—yet may contain 5–6× more exposed credentials. The engineering is impressive: - Streaming image-layer downloads - RocksDB with column families and prefix-range scans - Snappy and Zstd compression - Cryptographic validation for BIP39, secp256k1, Base58Check, and CRC16 - JWT classification, entropy checks, and placeholder deny-lists - Content-addressed caching to reuse findings across images It does not stop at finding secrets. It can live-test exposed OpenAI and Anthropic keys, read OpenRouter credits, derive wallets from leaked private keys, and check balances across seven blockchains. It even uses a pool of Docker accounts to work around rate limits and scan roughly 700,000 layers per day. Beautiful engineering—but essentially a high-performance loot scanner. 🔥 Now I need to figure out how my key was compromised in the first place! 😅

i checked and realized my vibe code error Correction: @abimaelmartell was right, the 275s was a bug in my method not the library. pages= filters after whole-document work — pages=1 and pages=8 both take ~278s. So "137s/page" and "36 hours" are wrong. Real: 947 pages in 6.9 min vs my 6.2. Pretty Competitive. What stands: 66.6% of numeric values missing from the markdown, and no cell geometry. That's the actual blocker for citing a number in a regulated doc.

I tried pdf-inspector on a 947-page clinical listing to see if it could replace my current PDF table extraction pipeline. For my use case, readable text is not enough. I need to know exactly which table cell a value came from: page, table, row, column, and the exact bounding box. In regulated documents, that matters because a citation should highlight the actual number supporting a claim. My current extractor uses pdfplumber/pdfminer for table structure and PyMuPDF for text and geometry. After some optimisation, the full 947-page extraction dropped from ~55 minutes to 6.2 minutes, while keeping cell geometry and row context. pdf-inspector had one very impressive result: classify_pdf processed all 947 pages in 0.65 seconds and correctly identified the document as text-based. But Markdown extraction was a different story. Two pages took ~275 seconds. Based on that result, a simple projection for 947 pages would be around 36 hours. More importantly, Markdown does not preserve the cell-level provenance I need. I also saw separate table cells getting merged into one Markdown cell. So I would definitely consider pdf-inspector for PDF classification, OCR routing, and document inspection. But for evidence-grade clinical table extraction, I am staying with the current pipeline. Maybe in the future, will test Per-cell geometry and much faster page extraction.

Link github github.com/firecrawl/pdf-…

First Claude went down, so I switched to Codex. Then Codex went down too. 😅

Claude is back to basics and down again!

I wanted to see how far a small open-weight model can go on regulated data workflows if I give it skills instead of moving to a bigger model. Setup: 27B dense model at Q6, 2 consumer GPUs, fully local, no fine-tuning. 5 SKILL md files: cohort specs, value sets, index/washout logic, bias review, ledger classification. Constrained JSON output. Every code, count and number comes from a tool call, not from the model. I have not tested it deeply yet. But what I saw is good enough to keep going. Most of the improvement seems to come from the skill and context layer. The main problem so far is the wrong skill getting loaded. I think adding skills might be enough for a lot of these tasks. Worth trying before moving to a bigger model.

So technically, @duckdb is joining AWS… and now I’m genuinely not sure how to react 😅

DuckDB @duckdb

2 months ago

Today, @ducklabs_com is joining @awscloud. The move is expected to be completed by early September. Joining AWS gives DuckLabs the resources and reach to bring DuckDB, DuckLake, and the Quack protocol to many more developers and organizations – and to pursue ideas at a scale

69 351 2K 275K 277

Had Claude Code run Codex as an independent reviewer. Read-only sandbox, full session log — every command it ran, replayable after the fact. Good: I can prove exactly what it looked at. Less good: that proves provenance, not correctness. Still had to verify the findings myself.

Claude CLI remote control complexity is almost zero — one command and it mostly just works. Comparatively Codex remote control feels very old-school Windows Vista 😅 Too many steps around start, pair, connect, and you still don’t really know if it will work this time or not. For something like remote control, I would prefer much less process and much more predictability.

I am extremely impressed by Qwen-3.8 for Agentic Coding, so I am setting up a GPU System for Local LLMs — and somehow that has become one of my core reasons to travel to India - 2× used RTX 3090 24GB. They are way cheaper in India, and if I really need more VRAM I can add a second one later. - Ryzen 5600 + AM4 + 64GB DDR4 is cheaper in Germany. - Will still size the motherboard + PSU for 2×3090, so upgrading later is easy. - Energy cost is way cheaper in India, even after considering air conditioning. For remote access, I will use an encrypted WireGuard/Tailscale tunnel. Upload speed from India is also not that bad, and I have already tested the same setup with my 3060 sitting there — network was honestly not the biggest hurdle. Currently my 2013 Mac running Linux handles the GPU server remotely, and I hope to continue using it as the little management box 😅 Might also add PiKVM + UPS, because debugging a GPU server from 6,500 km away is probably where things get interesting.

Link chromewebstore.google.com/detail/trendab…

My old new-tab extension died, so I vibe coded my own. It's on the Chrome Web Store. Quietly pleased about this one It puts GitHub trending, Hacker News, Reddit, Lobsters and arXiv in one tab. The part I use constantly: click anything and just ask. A repo with 2,000 stars today — what is it actually for? A Hacker News thread with 400 comments — what did people land on? I used to open the thread and skim for ten minutes. Now I get it in the same tab, without leaving. Your own API key. No backend.

Link chromewebstore.google.com/detail/trendab…

Read a scaling-law post today and finally got a frame that stuck. Think of a model like a student. You can grow the brain, hand them more books, give them longer per question, or put them with a tutor. Brain size is shelf space. It's how much the student holds, not how many steps of reasoning they carry before losing the thread. Dense models blurred those together. MoE splits them into separate numbers. Then economics. The student doesn't sit one exam, they sit millions and you pay every time. That's why the open-weight releases keep training small models way past the point that looks sensible. Expensive once, cheap forever after. And the recent ones make the last dial obvious. Same base, same architecture, same parameter count as the previous version. More post-training. Real gains. Scaling AI Models has multiple dials. They don't have to move together.