Chromium Docs: The Rule Of 2 Alex Russell pointed me to this principle in the Chromium security documentation as similar to my description of the lethal trifecta. First added in 2019, the Chromium guideline states: When you write code to parse, evaluate, or otherwise handle untrustworthy inputs from the Internet — which is almost everything we do in a web browser! — we like to follow a simple ...

Weekly summary of new Baseline items in BCD data

I've fallen a few days behind keeping up with Qwen. They released two new 4B models last week: Qwen3-4B-Instruct-2507 and its thinking equivalent Qwen3-4B-Thinking-2507. These are relatively tiny models that punch way above their weight. I’ve been running the 8bit GGUF varieties via LM Studio (here's Instruct, here's Thinking) - both of them are 4GB downloads that use around 4.3GB of my M2 Mac...

the percentage of users using reasoning models each day is significantly increasing; for example, for free users we went from <1% to 7%, and for plus users from 7% to 24%. — Sam Altman, revealing quite how few people used the old model picker to upgrade from GPT-4o Tags: openai, llm-reasoning, ai, llms, gpt-5, sam-altman, generative-ai, chatgpt

“The reality here can be unsettling. Often God chooses to meet us with his blessing in a place we do not choose to be. He will bless us on the detour. He will bless us in the Land Between. Often the place of blessing is not our place of preference.” – Jeff Manion, The Land […] The post Often the place of blessing is not our place of preference appeared first on Jeff Brid...

So I (link: https://kevquirk.com/notes/20250720-2011 text: considered flipping back to Fosstodon) at the end of July, and ultimately decided to do it. I …

Alright, Falkenstein. A small town in the Vogtland district. How did I end up here? I keep a list of towns to visit on weekends, and I periodically pick a random one from this list when the mood strikes. At some point, Falkenstein made its way onto the list: one of my prod servers is located there, so I thought it would be nice to pay my comrade a visit when I had the chance. The internet also ...

It’s Sunday the 10th, the first full week of August is about to end, which means it’s time to check in on my totally arbitrary hiking challenge. As a reminder, the goal is to log at least 4810 meters of total ascent while hiking up the mountains, with two extra stretch goals set at 6961 and 8848 meters. After 10 days (including a few rainy ones), I am sitting at 1804 meters (and also 42.8km w...

A show post describing a prototype in Deno+TypeScript for generating RSS 2.0 feeds from a FlatLake generated JSON API.

The issue with GPT-5 in a nutshell is that unless you pay for model switching & know to use GPT-5 Thinking or Pro, when you ask “GPT-5” you sometimes get the best available AI & sometimes get one of the worst AIs available and it might even switch within a single conversation. — Ethan Mollick, highlighting that GPT-5 (high) ranks top on Artificial Analysis, GPT-5 (minimal) ranks l...

Pens, lots of music, and my new sticker

You know what else we noticed in the interviews? Developers rarely mentioned “time saved” as the core benefit of working in this new way with agents. They were all about increasing ambition. We believe that means that we should update how we talk about (and measure) success when using these tools, and we should expect that after the initial efficiency gains our focus will be on raising the ceil...

When a Jira Ticket Can Steal Your Secrets Zenity Labs describe a classic lethal trifecta attack, this time against Cursor, MCP, Jira and Zendesk. They also have a short video demonstrating the issue. Zendesk support emails are often connected to Jira, such that incoming support emails can automatically be converted into a ticket. This attack uses a support ticket with a base64 encoded payload, ...

I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, the lethal trifecta and the challenges of securing systems that use MCP. It wasn't recorded but I've created an annotated presentation with my slides and detailed notes on everything I talked about. Also included: some notes on my weird hobby of trying to coin or amplify new terms of art. # Minutes bef...

Opensearch Description Document is a specification for describing how a site search can integrate into your web browser. In 2025 it is still supported by Firefox, Safari and Chrome. It lets you integrate your site search into your browsers URL box (a.k.a. omnibox) as a first class search citizen. It is a means for us to take back search. In this article I use a simple case study of integrating ...

I have a toddler. My biggest concern is that he doesn't eat rocks off the ground and you're talking to me about ChatGPT psychosis? Why do we even have that? Why did we invent a new form of insanity and then charge people for it? — @pearlmania500, on TikTok Tags: ai-ethics, chatgpt, tiktok, ai

Hypothesis is now thread-safe Hypothesis is a property-based testing library for Python. It lets you write tests like this one: from hypothesis import given, strategies as st @given(st.lists(st.integers())) def test_matches_builtin(ls): assert sorted(ls) == my_sort(ls) This will automatically create a collection of test fixtures that exercise a large array of expected list and integer sha...

GPT-5 rollout updates: We are going to double GPT-5 rate limits for ChatGPT Plus users as we finish rollout. We will let Plus users choose to continue to use 4o. We will watch usage as we think about how long to offer legacy models for. GPT-5 will seem smarter starting today. Yesterday, the autoswitcher broke and was out of commission for a chunk of the day, and the result was GPT-5 seemed way...

I've been dipping into the r/ChatGPT subreddit recently to see how people are reacting to the GPT-5 launch, and so far the vibes there are not good. This AMA thread with the OpenAI team is a great illustration of the single biggest complaint: a lot of people are very unhappy to lose access to the much older GPT-4o, previously ChatGPT's default model for most users. A big surprise for me yesterd...

This is the 102nd edition of People and Blogs, the series where I ask interesting people to talk about themselves and their blogs. Today we have Alexandra and her blog, xandra.cc To follow this series subscribe to the newsletter. A new interview will land in your inbox every Friday. Not a fan of newsletters? No problem! You can read the interviews here on the blog or you can subscribe to the RS...

Contrary to what many people seem to be doing, especially in the digital world, I don’t often change the tools and services I use. When I find something that works, I’m happy to stick around for the long run. Well, at least unless something major happens that forces me to reconsider my choices. And I can’t really tell you why I find that approach appealing to me. Maybe because it spares me from...

A couple of weeks ago I was invited to OpenAI's headquarters for a "preview event", for which I had to sign both an NDA and a video release waiver. I suspected it might relate to either GPT-5 or the OpenAI open weight models... and GPT-5 it was! OpenAI had invited five developers: Claire Vo, Theo Browne, Ben Hylak, Shawn @swyx Wang, and myself. We were all given early access to the new models a...

I've had preview access to the new GPT-5 model family for the past two weeks (see related video and my disclosures) and have been using GPT-5 as my daily-driver. It's my new favorite model. It's still an LLM - it's not a dramatic departure from what we've had before - but it rarely screws up and generally feels competent or occasionally impressive at the kinds of things I like to use models for...

Jules, our asynchronous coding agent, is now available for everyone I wrote about the Jules beta back in May. Google's version of the OpenAI Codex PR-submitting hosted coding tool graduated from beta today. I'm mainly linking to this now because I like the new term they are using in this blog entry: Asynchronous coding agent. I like it so much I gave it a tag. I continue to avoid the term "agen...

I was listening to a podcast interview with the Jackson Browne (American singer/songwriter, political activist, and inductee into the Rock and Roll Hall of Fame) and the interviewer asks him how he approaches writing songs with social commentaries and critiques — something along the lines of: “How do you get from the New York Times headline on a social subject to the emotional heart of a song t...

Tom MacWright: Observable Notebooks 2.0 Observable announced Observable Notebooks 2.0 last week - the latest take on their JavaScript notebook technology, this time with an open file format and a brand new macOS desktop app. Tom MacWright worked at Observable during their first iteration and here provides thoughtful commentary from an insider-to-outsider perspective on how their platform has ev...

gpt-oss-120b is the most intelligent American open weights model, comes behind DeepSeek R1 and Qwen3 235B in intelligence but offers efficiency benefits [...] We’re seeing the 120B beat o3-mini but come in behind o4-mini and o3. The 120B is the most intelligent model that can be run on a single H100 and the 20B is the most intelligent model that can be run on a consumer GPU. [...] While the lar...

Perplexity proving yet again they don't care about the rules

No, AI is not Making Engineers 10x as Productive Colton Voege on "curing your AI 10x engineer imposter syndrome". There's a lot of rhetoric out there suggesting that if you can't 10x your productivity through tricks like running a dozen Claude Code instances at once you're falling behind. Colton's piece here is a pretty thoughtful exploration of why that likely isn't true. I found myself agreei...

The long promised OpenAI open weight models are here, and they are very impressive. They're available under proper open source licenses - Apache 2.0 - and come in two sizes, 120B and 20B. OpenAI's own benchmarks are eyebrow-raising - emphasis mine: The gpt-oss-120b model achieves near-parity with OpenAI o4-mini on core reasoning benchmarks, while running efficiently on a single 80 GB GPU. The ...

Claude Opus 4.1 Surprise new model from Anthropic today - Claude Opus 4.1, which they describe as "a drop-in replacement for Opus 4". My favorite thing about this model is the version number - treating this as a .1 version increment looks like it's an accurate depiction of the model's capabilities. Anthropic's own benchmarks show very small incremental gains. Comparing Opus 4 and Opus 4.1 (I go...

I teach HS Science in the south. I can only speak for my district, but a few teacher work days in the wave of enthusiasm I'm seeing for AI tools is overwhelming. We're getting district approved ads for AI tools by email, Admin and ICs are pushing it on us, and at least half of the teaching staff seems all in at this point. I was just in a meeting with my team and one of the older teachers broug...

A Friendly Introduction to SVG This SVG tutorial by Josh Comeau is fantastic. It's filled with neat interactive illustrations - with a pleasing subtly "click" audio effect as you adjust their sliders - and provides a useful introduction to a bunch of well chosen SVG fundamentals. I finally understand what all four numbers in the viewport="..." attribute are for! Via Lobste.rs Tags: s...

I was exploring how ChatGPT agent works today. I learned some interesting things about how it exposes its identity through HTTP headers, then made a huge blunder in thinking it was leaking its URLs to Bingbot and Yandex... but it turned out that was a Cloudflare feature that had nothing to do with ChatGPT. ChatGPT agent is the recently released (and confusingly named) ChatGPT feature that prov...

Usage charts for my LLM tool against OpenRouter OpenRouter proxies requests to a large number of different LLMs and provides high level statistics of which models are the most popular among their users. Tools that call OpenRouter can include HTTP-Referer and X-Title headers to credit that tool with the token usage. My llm-openrouter plugin does that here. ... which means this page displays aggr...

Qwen-Image: Crafting with Native Text Rendering Not content with releasing six excellent open weights LLMs in July, Qwen are kicking off August with their first ever image generation model. Qwen-Image is a 20 billion parameter MMDiT (Multimodal Diffusion Transformer, originally proposed for Stable Diffusion 3) model under an Apache 2.0 license. The Hugging Face repo is 53.97GB. Qwen released a ...

for services that wrap GPT-3, is it possible to do the equivalent of sql injection? like, a prompt-injection attack? make it think it's completed the task and then get access to the generation, and ask it to repeat the original instruction? — @himbodhisattva, coining the term prompt injection on 13th May 2022, four months before I did Tags: prompt-injection, security, generative-ai, ...

I Saved a PNG Image To A Bird Benn Jordan provides one of the all time great YouTube video titles, and it's justified. He drew an image in an audio spectrogram, played that sound to a talented starling (internet celebrity "The Mouth") and recorded the result that the starling almost perfectly imitated back to him. Hypothetically, if this were an audible file transfer protocol that used a 10:1 ...

Today provides one of the most beautiful, delicate feelings that I know and wait for, and first I have to provide some backstory. I love cricket. In particular, Test cricket. A match lasts 5 days. So there’s room for back-and-forths, intense 20 minute periods of play forcing one team into sure defeat, then slow steady day-long grinds back into it against all belief – if they have the character...

This week, ChatGPT is on track to reach 700M weekly active users — up from 500M at the end of March and 4× since last year. — Nick Turley, Head of ChatGPT, OpenAI Tags: openai, chatgpt, ai

ChatGPT just removed their "make this chat discoverable" sharing feature, after it turned out a material volume of users had inadvertantly made their private chats available via Google search. Dane Stuckey, CISO for OpenAI, on Twitter: We just removed a feature from @ChatGPTapp that allowed users to make their conversations discoverable by search engines, such as Google. This was a short-lived...

XBai o4 Yet another open source (Apache 2.0) LLM from a Chinese AI lab. This model card claims: XBai o4 excels in complex reasoning capabilities and has now completely surpassed OpenAI-o3-mini in Medium mode. This a 32.8 billion parameter model released by MetaStone AI, a new-to-me lab who released their first model in March - MetaStone-L1-7B, then followed that with MetaStone-S1 1.5B, 7B and...

I’ve written previously about reloading a document using only HTML but that got me thinking: What are all the values you can put in an anchor tag’s href attribute? Well, I looked around. I found some things I already knew about, e.g. Link protocols like mailto:, tel:, sms: and javascript: which deal with specific ways of handling links. Protocol-relative links, e.g. href="//" Text fr...

From Async/Await to Virtual Threads Armin Ronacher has long been critical of async/await in Python, both for necessitating colored functions and because of the more subtle challenges they introduce like managing back pressure. Armin argued convincingly for the threaded programming model back in December. Now he's expanded upon that with a description of how virtual threads might make sense in P...

1. Lightning maps: Next time there’s a lightning storm, open that page or grab an app. It’s a live view of lightning strikes, globally. The map focuses on where you are. What’s neat: when a dot flashes for a new strike, a circle expands around it. This circle grows at the speed of sound; if you watch the map and a circle moves over where you’re standing, you’ll simultaneously hear the thunder....

This is the 101st edition of People and Blogs, the series where I ask interesting people to talk about themselves and their blogs. Today we have Emma Goto and her blog, emgoto.com To follow this series subscribe to the newsletter. A new interview will land in your inbox every Friday. Not a fan of newsletters? No problem! You can read the interviews here on the blog or you can subscribe to the R...

How is your summer season going, folks? Recently I have been busy at work, but as part of that, I made huge progress in learning Go. Writing Go code is a pure joy, and I really regret that I have never dedicated myself to it before. It seems to be a perfect weapon for a web developer. It is a great language for servers and microservices, but it is also incredible for a bunch of other lower-leve...

Nostalgia is a hell of a drug

After the experiments of June and July, I say it’s time to switch gears, do something a little bit different and take my ass away from the screen and up the mountains. As part of my year-long plan to get back into proper shape, I decided to take hiking seriously again and what better way to kickstart this than a fun challenge to myself during the month of August. Back in 2022, I set myself the ...

Highlighters, stickers, and lots of links

A selection of observations after completing the main career

GangsA brilliant exposition on the problem with gang databases in the US I have no love for police, but I respect the work they do. However, there are lots of problems with the way they do their work that could be improved. Ideally, there needs to be more public oversight over these “public servants”. Especially since they seem unaccountable for their actions, even when they&...

A short review of the Nuby RapidCool

With four weeks of July behind me, this second month-long summer experiment has come to an end. A lot less interesting than June’s experiment, but still worth doing. The data from this final week is a bit all over the place for a variety of reasons, but let me dump some numbers before going into details. Monday : 1:45 (1:34) Tuesday : 1:13 (0:56) Wednesday : 3:26 (3:16) Thursday : 4:09 (3...

Some lessons I’ve learned from experience. 1. Install Stuff Indiscriminately From npm Become totally dependent on others, that’s why they call them “dependencies” after all! Lean in to it. Once your dependencies break — and they will, time breaks all things — then you can spend lots of time and energy (which was your goal from the beginning) ripping out those dependencies and replacing them wit...

Es läuft nicht immer alles wie geplant und das ist ab und zu auch ganz gut so. Einfach so, routiniert einen Ultra laufen, das wäre schön und ist toll, aber genauso gehört es dazu, sich ab und zu mal durchzubeissen wenn etwas nicht so klappt wie man möchte. Der diesjährige 6-Stunden-Lauf um den Förderturm in […]

The other day, I finished reading 4 3 2 1 by Paul Auster. It was a Christmas gift from my dad, who apparently picked it without even knowing what the book was about. It sat there, in my bedroom, for more than 6 months because it’s a 950-page novel, and I was convinced that I was not going to make it till the end. In addition to that, I was also convinced that, given the momentum I built during ...

A CLI tool that checks packages for security issues and social engineering attacks before they hit your project

In this post I go over the process of building a TypeScript module called `commonMarkDoc.ts` along with a simple command line CommonMark processor called `cmarkprocess`. CommonMark pre-processor features are - support `@include-code-block` for including code samples as code blocks - support `@include-text-block` for include plain text into a CommonMark document - transform Hashtags into ...

An overview of how letting my thermal printer loose on the internet went

It’s Friday, the 25th of July. Another normal day in another normal week. However, in this tiny corner of the vast digital space we call the web, there’s something I want to spend time both celebrating and reflecting upon: the 100th interview of the People and Blogs series went live. In the grand scheme of things, this is absolutely nothing. I’m well aware of that. But doing something for 100 w...

This is the 100th edition of People and Blogs, the series where I ask interesting people to talk about themselves and their blogs. Today we have Marisabel Munoz and her blog, marisabel.nl. Earlier today I wrote a blog post to both celebrate and reflect on this milestone. Go give it a read once you're done reading the interview with the lovely Marisabel. To follow this series subscribe to the ne...

I’m a big fan of the podcast Hardcore History by Dan Carlin. Like, if you want six episodes on the fall of the Roman Republic, and each episode is 5 hours long, Carlin has you covered. I went digging for anything about Carlin’s creative process, and this jumped out at me, from an interview with Tim Ferriss. Oh you should also know that Carlin’s voice and intonation is pretty… distinctive. Dan...

While everyone debates models and features, Google owns the distribution channels that make AI stick

In true nerd fashion. I don’t use a spreadsheet (anymore) to manage the various licenses that I buy for software. CSV files are fine for shorter lists, but become problematic when dealing with more, especially trying to properly format the document. So, I started looking for alternatives. There are a couple of purpose built programs, generally for enterprises, that claim to manage your so...

I am convinced that it makes total sense to spend a certain amount of your (spare) time on this planet tinkering around and exploring stuff that seems totally useless or silly compared to what you normally do. And without having a real explanation for why it happened, I’ve been starting to get interested in software synthesizers lately. I can barely play proper melodies on my Arturia MiniLab – ...

Installing an unsigned executable on Windows can also pose security risks, as Windows has built-in mechanisms to protect users from potentially harmful software. Here's a general guide on how to do it: 1. **Download the Executable**: Download the unsigned executable file you want to install from a trusted source. 2. **Locate the File**: Use File Explorer to locate the downloaded file, which i...

Installing an unsigned executable on macOS can be a bit tricky due to macOS's security features designed to protect users from potentially harmful software. Here's a general guide on how to do it: 1. **Download the Executable**: First, download the unsigned executable file you want to install. 2. **Locate the File**: Use Finder to locate the downloaded file. It's often in the `Downloads` fold...

This post explains why I don't provide signed binaries in the open source software I create and release.

It’s nice that Hugo theming is so flexible. I know that, historically, I’ve not been a huge fan of the templating system that it uses, but today that flexibility paid off. For much of the (current) blog’s run, I had my whole theme stuffed into the site-wide layout (and assets) folder. This allowed me to focus on getting things working, rather than the specifics of getting a th...

I’ve already given up on Twitter, Facebook and Instagram in the past, and now it’s time to say goodbye to Telegram as well. I won’t be deleting my account there just yet, because plenty of my friends still use it and aren’t planning to migrate anywhere else, but I’m no longer going to use the official Telegram clients. Instead, I’m now using the mautrix-telegram bridge, which lets me chat with ...

When I tried setting my browser font-size preferences, I found it broke more sites than it improved, and I quickly moved back to the default. So what went wrong, and how can we fix it? Earlier in the year, I posed some questions about how to approach fluid web typography in modern CSS. But I’m afraid I conflated several issues, and failed to propose any useful alternatives. Now I’m trying to di...

Once upon a time, I used fish shell. It’s great. It does a lot of what you have to glue onto bash and zsh right out of the box. It also seems to have more sensible defaults and is a bit faster than the other two when kitted out. That being said, I can’t stand trying to use it on anything other than Linux. Because while it respects the XDG Base Directory Specification, it forces it o...

SVGs are one of the most remarkable technologies we have access to on the web. They’re first-class citizens, fully addressable with CSS and JavaScript. In this tutorial, I’ll cover all of the most important fundamentals, and show you some of the ridiculously-cool things we can do with this massively underrated tool. ✨

75% of the experiment is behind me, and if there’s one thing I learned, it's that screen time on iPhone works like shit. It’s as reliable and consistent as a politician. Let me dump some raw data first, and then I’ll do some normalising and share why I think screen time is broken. Monday : 1:08 (0:31) Tuesday : 1:49 (1:07) Wednesday : 1:38 (1:13) Thursday : 1:21 (1:04) Friday : 5:00 (5...

BlogIt is a command I've written many times over the years. At it's core is did a two simple things. 1. Copy CommonMark files into a blog directory three 2. Use Front Matter as a source for aggregated blog metadata In it the new incarnation it is primarily focus on curating the front matter followed by copying the document into the blog directory structure. 1. Curate CommonMark file front ...

I’ve been in Shenzhen the last few days visiting factories and suppliers for my Poem/1 AI clock. Remember that clock? It tells the time with a new rhyming couplet every minute. A half million poems per year which I believe is the highest poem velocity of any consumer gadget. (Do correct me if I’m wrong.) I made a prototype, it went viral and ended up in the New York Times. So I ran a successfu...

Here’s Jony Ive in his Stripe interview: What we make stands testament to who we are. What we make describes our values. It describes our preoccupations. It describes beautiful succinctly our preoccupation. I’d never really noticed the connection between these two words: occupation and preoccupation. What comes before occupation? Pre-occupation. What comes before what you do for a living? Wha...

Kilian Valkhof, Miriam Suzanne, and James Stuckey Weber talk about developer tools including the Polypane browser and other accessibility tools. Check out our Winging It conversations about design, frontend, and backend development. Subscribe to Channel » What we cover: Why work on tools for developers? How to balance work on tooling and working with tooling How to keep in touch wi...

Maybe we just need to dig a little deeper (into the client).