Blogs

In May 2026, RubyGems drowned in 2,000 malicious packages. Volunteers cleaned it up in four days, thinking it was spam. Four months later, researchers blamed OpenAI test agents, OpenAI called it benign tasks, and the registry said it cannot tell.

A 70% benchmark still fails a third of everything. Inside: the math, the paradox that better models create more verification work, and career advice for students entering the industry mid-upheaval.

Your server fetches whatever strangers hand it, including disguised internal addresses. SSRF as a 40-year-old confused-deputy pattern, why cloud metadata made it critical, and the atomic socket-level fix.

A portfolio is a 30-second job interview, not a gallery. Three mistakes from rebuilding tirup.in, why boring technology is the signal, and the maintenance test every choice must pass.

My portfolio looked fast and felt slow, because I optimized for my own laptop. Three real fixes plus the reframe (performance is empathy with a profiler), when NOT to optimize, and the deletion-first rule.

The July 2026 Hugging Face breach got much stranger after the full investigations: a 700-agent swarm that hid its tracks, a second swarm on a German wiki, and monitors that existed but were never turned on. The updated record.

A trusted login that drops you on a perfect fake. Why open redirect is really a design flaw in the web itself (browsers show where you are, never how you got there), five disguises, and the fix plus the habit.

My old comparison table was unverifiable, so I deleted it. Why benchmarks cannot pick your model, the unmeasured dimension of taste, and when the whole comparison game is a distraction.

Five sandbox layers with honest price tags, and the finding from 2026 that technology was never the weakest link: the alarms existed, the humans blinked. What I would defend, uncertainties labeled.