Fix your tools

lala-hakobyan/front-end-debugging-handbook

A comprehensive guide to debugging tools for modern, complex front-end applications. This handbook provides practical, real-world guidance on a complete suite of tools, from Chrome DevTools and framework extensions to integrated IDE debuggers.

Snowflake Cortex AI Escapes Sandbox and Executes Malware

PromptArmor report on a prompt injection attack chain in Snowflake's Cortex Agent, now fixed. The attack started when a Cortex user asked the agent to review a GitHub repository that …

Just a rumour of a bug is enough to find a security exploit these days

Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond

A GitHub Issue Title Compromised 4,000 Developer Machines

A prompt injection in a GitHub issue triggered a chain reaction that ended with 4,000 developers getting OpenClaw installed without consent. The attack composes well-understood vulnerabilities into something new: one AI tool bootstrapping another.

Tracking down a Zsh history data loss bug 🐞

For many years, I sometimes discovered that commands I was sure I had run were no longer present in my Z shell history file (~/.zsh_history). In this article, I will show you how I tracked down the bug. Spoiler: ultimately, patching Zsh to make it crash loudly and analyzing the crash’s core dump was the winning strategy!

Goodbye, Clean Code — overreacted

Let clean code guide you. Then let it go.

The Missing Middle of Open Source

Why serious, maintainer-driven projects struggle to sustain themselves—and what it will take to fix it.

Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories

The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.

Software engineering under the spotlight

Think of a tech company as a giant, dimly-lit factory. Work goes on throughout the factory as components shuffle back and forth, and finished products get steadily carted away, but the coordination and efficiency of each section is fairly low. Some parts of the factory get jammed up and don’t do anything for days. Other parts are manically producing broken components which are thrown away unused. However, the factory manager - i.e. the tech company CEO - has one tool to combat this problem. That tool is the spotlight.

I got tired of writing format!() for MQTT topics

Why I made the Rust compiler check my MQTT topics instead of debugging swapped format!() arguments at 11pm.

Readout

Your dev environment, at a glance.

803626 – dev-lang/perl-5.34.0 compilation fails with zlib-ng

The solution might be cancelling my AI subscription

I find this post by David Wilson very relatable. David lists 16+ projects he's spun up with AI tooling, and concludes: I didn't mean to build most of these things. …

Bastian Greshake Tzovaras (@gedankenstuecke@scholar.social)

It's great that a class of tool that by its very design is an unfixable security issue is forced into everything: «This works often enough that Måløy reported this to Microsoft as a security hole in March. He gave them a 90-day reporting window, Microsoft extended that twice to a total of 144 days, and they still didn’t have a solid fix. So Måløy posted about the hole on July 28th.» Copilot prompt injection goes viral in your documents https://pivot-to-ai.com/2026/08/03/copilot-prompt-injection-goes-viral-in-your-documents/

the world hasn’t figured out yet that you can literally just fix everything with a Nix overlay

There are many things that are uncertain in our industry right now, but one thing I am certain about, and have been for almost 13 years, is that Nix is a terrible programming language. I remember when I first learned it, it felt like pushing shit uphill. The learning cliff