In this pre-paid self-own, I study security vulnerability through the lens of self-flagellation. I go through a lot of trouble to make life worse for me and my antediluvian website's users (AS USUAL).

Get it or try it:
https://tom7.org/httpv/

Or read the 25-page (!) SIGBOVIK 2026 paper: https://tom7.org/httpv/httpv.pdf

Keywords: https, tls 1.2, RSA_WITH_AES_256_CBC_SHA, httpv, toxic max-security, vulnerability research

Brilliant and very funny video.

Is anyone working on a project/looking to create a project that's open to collaborators?

The last post here had many interesting commenters so I'm curious what you all could be cooking up? I hope you leave a comment

I have a decent bit of spare time and a lot of ideas, if your looking to dm me then feel free :v

• off topic below

Edit: yall are still kinda weird, We cant be getting mad at people for not saving others 2 clicks, its overly confrontational and weird. just chill we got way bigger issues bro, we need to join the united front

While the Meson build system has been capturing much of the limelight in recent years by open-source projects, the cross-platform CMake build system also shows no signs of slowing down and continues evolving with new features and functionality.

Since the CMake 4.0 release last year it has continued to iterate and last month released CMake 4.3 that brought the rather interesting import/export support using the Common Package Specification. The Common Package Specification (CPS) is a JSON-based format also being worked on by the CMake developers at Kitware for offering greater interoperability with other projects from package managers to handling software dependency descriptions for C/C++. Software Bill of Materials (SBOM) generation is also another experimental feature of the new CMake 4.3.

If you liked the post The Git Commands I Run Before Reading Any Code by Ally Piechowski, you might also like this interactive Marimo notebook that puts all those commands together and adds some nice charts 😉

Issue #8 came out a few months ago.

Just wanted to share an idea I had, in order to hope that another developer learns from my lessons, and hopefully either finds a work around or a better solution to this problem.

I wanted to find out if it was possible to locate your iPhone from your watch based on the latency of Bluetooth messages, since RSSI (signal strength) isn't available. I made a simple app, and started sending messages back and forth between my phone and app.

After much testing, the conclusion is no. Mostly because Bluetooth is amazing and the average latency for a message is 58-62ms. And because as Erik pointed out... apple just sucks.

I am hopeful PebbleOS can be updated to see RSSI or the app can expose the notification api to the PebbleKit JS.

If anyone want me to publish my code, let me know.

The raw data is here if you want to see it: https://docs.google.com/spreadsheets/d/1Yr5XX0CXh5TifsnW3yOp10ZoaA_xx0q189f_fG8rMTU/edit?usp=sharing

...and I still don't get it. I paid for a month of Pro to try it out, and it is consistently and confidently producing subtly broken junk. I had tried doing this before in the past, but gave up because it didn't work well. I thought that maybe this time it would be far along enough to be useful.

The task was relatively simple, and it involved doing some 3d math. The solutions it generated were almost write every time, but critically broken in subtle ways, and any attempt to fix the problems would either introduce new bugs, or regress with old bugs.

I spent nearly the whole day yesterday going back and forth with it, and felt like I was in a mental fog. It wasn't until I had a full night's sleep and reviewed the chat log this morning until I realized how much I was going in circles. I tried prompting a bit more today, but stopped when it kept doing the same crap.

The worst part of this is that, through out all of this, Claude was confidently responding. When I said there was a bug, it would "fix" the bug, and provide a confident explanation of what was wrong... Except it was clearly bullshit because it didn't work.

I still want to keep an open mind. Is anyone having success with these tools? Is there a special way to prompt it? Would I get better results during certain hours of the day?

For reference, I used Opus 4.6 Extended.

cross-posted from: https://programming.dev/post/48635032

Hey all, Not long ago I shared my Artix Linux installer. I wanted to take it a little bit further (And learn some more Rust along the way), and make a companion site to make setting up the script settings even easier when wanting to run the installer - so here it is. Introducing the Lazy Web

This was developed using Rust, with Actix for the backend and egui + wasm for the frontend.

I had a few considerations when developing this, I wanted the encryption to occur clientside in the frontend in order to ensure your encryption password never makes it to the server. But also I wanted the decryption process to occur when the script downloads the settings. I also wanted the identifier that you use to connect and download the settings to be short and unique.

The website and the script are both still a work in progress, and i'm open to suggestions/feedback.

Edit: Just realized that I was returning the wrong URL to the codeberg repo.. so it probably wasn't working for anybody. Sorry!

In this video Dr. Chuck explores how he sees the role of AI in programming courses. He talks about the perils of using too much AI that you never learn anything and how he designs courses in the "post-AI" world.

Hello,

I have been hosting my project on vercel and I really don't like it at least the free version. so I wanted ask is there any open source and free alterantive of vercel. of course I won't be hosting the production server there but I don't want to pay for it when I am developing it.

Thanks in advance <3

I have a small website with the git code hosted on my own Forgejo instance. I want to give my wife easy access to the code to update texts. I think using Forgejo is an easy enough interface for her to do that.

But how do I ensure that every commit is reflected on the website in a timely manner? I think webhooks are the usual answer. But do I add them to the website itself or do I run a separate service for that? If the latter, can you recommend one?

Or is there a better way? Seems kind of roundabout since the website and Forgejo run on the same hardware.

@programming I had asked a question regarding how could phones get possibly hacked, and this was the response I got. Is this a suitable forum for discussing about hacking and internet security ??

First, thank you for all of the feedback - your thoughts are appreciated and have significantly impacted the decisions that we’ve made about how we move forward.

TL;DR - We will be retiring the beta site shortly and will be removing the button to get to it and ceasing support for it.

We will not be migrating the unified posting experience to the main site. Not migrating the unified experience to the main site will obviate the need to solve the issue around the conversion of comments and answers to “replies”, because that was tied to this unified post experience.

Source [web-archive] ✨

Preview of the button "Beta"

Related: New site design and philosophy for Stack Overflow: Starting February 24, 2026 at beta.stackoverflow.com

Background: 12 YoE senior/staff eng, 7 in my current role in systems/SRE. Ex-FAANG, still in “big tech” but a much smaller company.

I have been at my current employer for about 2 years now, and I am trying to find ways to get noticed and move up. There has been a lot of complaints about a particular workflow we use that hasn’t scaled well over the years, so I thought I’d focus in there. I came up with a proposal to improve the workflow and submitted it to my principal for review.

Their feedback? “Not needed, we’ll have AI agents deal with the toil.” No strategic direction, no architectural advice on how I can integrate agents into the workflow. Needless to say I was caught off guard by this and feel as though my proposal didn’t get the attention it deserved. I did a lot of research on the architecture I proposed and I feel the response was unduly dismissive.

Now, I have no way to prove this but I feel like this is due to my C-suite pushing for AI integrations in basically everything. I understand PEs drive direction pushed from the top-down, and sometimes that may include some investor buzzwords that VPs don’t actually understand. But “use AI” is not a real strategy, IMO. Yeah, AI can streamline some tasks, but in my mind you still need to architect solutions that scale well and make sense to humans that are operating them.

Coming from FAANG, I have a lot of respect for the title of principal engineer and always strove to get there myself one day. I was always impressed listening in on design review meetings and the amount of technical breadth and depth they had to drive architectural decisions. I am disappointed that my first attempt to improve things for my company was shot down with so little forethought by a PE.

tl;dr I came up with a well-researched proposal to improve an important workflow that wasn’t scaling well, and my PE told me that we can just use AI instead of investing on fixing our tech debt.

I haven’t experienced this before. Any advice would be appreciated!

cross-posted from: https://lemmy.bestiver.se/post/1030154

Comments

Hello,

I found these learning modules from a group called the Tech Learning Collective, unfortunately the group seems mostly in hibernation.

Additionally, the service they seem to have used for these trainings, Katacoda, has since closed down.

Yet, looking at their sources on github, I see .md, .sh, and .json, files.

Is it possible to utilize these files locally, or elsewhere even, to go through these exercises?

Recognizing the file types is close to my limit on ability in that area, so any ideas, or guidance, is greatly appreciated.

Thank you very much. Have a great weekend.