1. Signing data structures the wrong way Total comment counts : 3 Summary Cryptographic data packaging needs canonical encoding and strong domain separation to prevent cross-type forgeries (e.g., signing a TreeRoot could be misused as a KeyRevoke). Traditional methods are ad-hoc. FOKS’ Snowpack embeds random, immutable domain separators in the IDL; a compiler generates code that signs the separator concatenated with the object’s bytes (the separator isn’t emitted in the final payload)....

1. The Claude Code Source Leak: fake tools, frustration regexes, undercover mode Total comment counts : 33 Summary The article analyzes leaks around Anthropic’s Claude Code, including a .map file exposing full CLI source after an npm package was pulled. It notes anti-distillation features: ANTI_DISTILLATION_CC injecting fake tools to pollute training data, gated by GrowthBook tengu_anti_distill_fake_tool_injection; and server-side summarization with cryptographic signatures to hide full reasoning. Bypasses exist via MITM or non-cli usage....

1. Fedware: Government apps that spy harder than the apps they ban Total comment counts : 13 Summary An analysis of U.S. federal apps shows pervasive “Fedware”: many government apps request extensive permissions and embed trackers, often with location, biometric, and camera access. The White House app (47.0.1) includes GPS, fingerprint, and storage permissions, plus Huawei Mobile Services trackers and an ICE tip link. FBI’s myFBI Dashboard has 12 permissions and four trackers, including Google AdMob....

1. ChatGPT Won’t Let You Type Until Cloudflare Reads Your React State Total comment counts : 8 Summary Cloudflare Turnstile runs a hidden fingerprinting program in your browser for each ChatGPT request. Researchers decrypted 377 samples and found 55 checks across three layers: browser properties (WebGL, screen, fonts, DOM, storage), Cloudflare edge data (city, IP, region), and the ChatGPT React app (routing, loaderData, clientBootstrap). The 55 values are in an encrypted inner blob decrypted by a per-request XOR key embedded as a server float....

1. Founder of GitLab battles cancer by founding companies Total comment counts : 21 Summary An osteosarcoma patient (T5 vertebra) took control after exhausting standard therapies, pursuing intensive diagnostics, creating new treatments, running parallel therapies, and scaling efforts for others. The journey is featured by Elliot Hershberg, with an embedded deck and an OpenAI Forum recording. They advocate a patient-first medical system and cite Ruxandra’s article. Data are at osteosarc.com, including a treatment timeline and a 25TB public Google Cloud data overview....

1. Make macOS consistently bad (unironically) Total comment counts : 21 Summary The piece critiques macOS 26’s UI for pervasive inconsistency and excessive corner rounding, citing YouTube as a poor example. It argues UI design follows big-tech trends, and upgrades reveal uneven corners across apps. Some users disable System Integrity Protection to edit system libraries, a risky workaround the author notes. Instead of removing roundness, the author favors uniform rounding and describes forking a solution to implement it, including compiling, signing, and loading a plist....

1. We haven’t seen the worst of what gambling and prediction markets will do Total comment counts : 33 Summary error Overall Comments Summary Main point: The discussion centers on the ethical and practical risks of online gambling and prediction markets, arguing they enable manipulation and harm and deserve bans or tight regulation. Concern: The main worry is that insiders can exploit these markets for personal or political gain, causing financial ruin and undermining trust....

1. The EU still wants to scan your private messages and photos Total comment counts : 13 Summary A post claims the Conservative (EPP) bloc plans a Thursday vote to overturn Parliament’s rejection of indiscriminate scanning. It argues this would be an attack on democracy and privacy, repeats “No means no,” and calls for action, citing contact handles @chatcontrol@mastodon.social and @fightchatcontrol, © 2026 Fight Chat Control. Overall Comments Summary Main point: The discussion focuses on the EU’s extension of the voluntary scanning regime for private communications under Regulation (EU) 2021/1232 and its privacy and sovereignty implications....

1. Autoresearch on an old research idea Total comment counts : 18 Summary An experiment applying Karpathy’s Autoresearch with Claude Code to a research problem using Ukiyo-eVG dataset (bounding-box heatmaps guiding attention). The agent edits train.py via program.md (plus scratchpad memory) in ~5-minute trials: hypothesize, edit, train, evaluate, commit/revert. It runs in a sandbox with no network access. 42 trials: 13 commits, 29 reverts; mean rank fell from 344.68 to 157....

1. We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical Total comment counts : 8 Summary A site analyzes publicly leaked audit data and reveals that Delve sold SOC 2 and ISO 27001 certifications as a service, issuing reports and badges without real audits. The leak includes 533 audit reports from 455 companies, with 99.8% identical boilerplate text. The platform offers tools to check a vendor’s compliance integrity and to download the full list....