Hubert Behaghel

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

Prof. Donald Knuth opened his new paper with "Shock! Shock!" Claude Opus 4.6 had just solved an open problem he'd been working on for weeks — a graph decomposition conjecture from The Art of Computer Programming. He named the paper "Claude's Cycles." 31 explorations. ~1 hour. Knuth read the output, wrote the formal proof, and closed with: "It seems I'll have to revise my opinions about generative AI one of these days." The man who wrote the bible of computer science just said that. In a paper named after an AI. Paper: cs.stanford.edu/~knuth/papers/…

@nixcraft I somehow held the line with the mandatory yearly "config weekend" to recover from the inevitable config bankruptcy. That is until the vibe coding era. Now my nix setup has never been better. I feel 20 😎

By age 40, a Linux user stops trying to install Arch on a toaster just to prove they can. They finally settle on Debian Stable or Mint because they realize they no longer have the "mental bandwidth" to spend 6 hours configuring stuff/fix broken systems just to check their email

@fortelabs Here is the kicker: your life was never about you. Once you internalise this, your sadness will go away to never return.

I turned 40 a couple months ago, without much fanfare Since then I’ve had a lingering sense of sadness, and I think I’ve finally put my finger on the source My whole life, from my teens through my 20s and 30s, I felt like I was preparing for a future life I’d one day lead That feeling of anticipation always kept me hopeful, and excited, and motivated to invest in my future by educating myself and delaying gratification But 39 is the last age that can in any way be considered young. It’s an extended youth, from which I seem to have been dropped directly into middle age from one year to the next At 39 you can still be “mature for your age.” You can “have your whole life ahead of you.” You can still be a prodigy, precocious, or “gifted” But not at 40. At that age, you aren’t “adulting” – you’re simply an adult That’s the first layer of sadness – that the space of possibilities of who I could become feels like it’s sharply contracted. The light cone of my potential future evolution has gone from a floodlight to a spotlight. The second layer of sadness is realizing that I’ve arrived at the “center stage” era of my life. I can feel distinctly that the modern world is “optimized” for this particular age range. All the institutions, systems, financial mechanisms, social conventions, etc are designed for and targeted at this age. It’s like a “default age” for humans, neither young nor old That may sound nice, to be catered to in that way. But it also means I’m entering a period of “peak demand” for my services Our kids are small and we hope to have a third, so we’re “in the thick of things” on the family front The business is taking off and I finally have the reputation, experience, network, and resources to go after the big goals I’ve always dreamed of. So the work front is intense and demanding as well And now my parents are starting to face the health problems of old age, and I can see that’s only going to increase the burden on them and me in the coming years It’s okay, and I’m prepared and well-resourced to handle it all. But I can also feel the last semblance of innocence disappearing. The weight of societal responsibility settling firmly on my shoulders. I’m proud that I’m ready to shoulder it, but also sad that the carefree version of myself now must take a backseat And the third layer – that my inevitable death is slowly coming into view It's no longer a theoretical idea. I can guess approximately when it will be, and even start to imagine what the world will be like at that time, since I've already lived an equivalent amount of time This is the boring, classic fear of mortality. Which is no less burdensome for being shared with all humans

@paulg I wouldn't say it's an absolute truth. Many universities have become ideological echo chambers that corrupt the young mind. Being in debt at 25 could mean never daring to start a business. Even if you're not made for it, I'd argue the lessons will exceed anything theoretical.

Don't drop out of college to start or work for a startup. There will be other (and probably better) startup opportunities, but you can't get your college years back.

@mitchellh +1 In my field (trust online, IDV) , it's called reusability of transactions. It also has major virtuous effects on cost and data protection.

So many web experiences would be soooooo much better if they focused solely on load times for a little bit. Example: I order to-go coffee from a local place a few times per week and adding an item to your cart blocks any other interaction and takes seconds. Loading the checkout page takes seconds. Apple Pay processing takes seconds. I make the same order every time, almost 100 times per year! Having a one-click (or two with Apple Pay) "reorder" that loads in milliseconds rather than seconds would improve QoL so much. But this happens so much! What happened to web performance. 😭 (There are still some shining stars out there, but an exception and not the norm)

@aloiscochard That I'm French, grew up in Lyon and my middle names are Joseph Marie... it all only adds to the plot 😉

This is fascinating, I can't wait to see more. ... and I'm sure my friend @behaghel will enjoy as well 😀

New Open Source law in Switzerland Switzerland mandates software source code disclosure for public sector: A legal milestone joinup.ec.europa.eu/collection/ope…

@paulg @henhaohank Not asymptotical convergence but oscillatory. The derivative often points in the wrong direction.

@henhaohank You're right about the first two, but "wrong side of history" is reasonable. It assumes that we converge on the truth about historical events, which is not far wrong.

"Read the room" is not advice for being right. It's advice for being popular. So when people give it, they're also implicitly telling us which they think is more important.

@joelbasson @osanseviero @MistralAI @kyutai_labs @AIatMeta @GoogleDeepMind Fair point. It's not a tech hub. The potential is good. It had a solid trend going for it until COVID hit with its consequences.

@osanseviero @MistralAI @kyutai_labs @AIatMeta @GoogleDeepMind Barcelona, a tech hub? I don’t think so. What’s their total tech market cap? Doubt if they even hit €20b

The ML ecosystem in France is on fire🔥 It has amazing talent and resources. Here are 10 facts you might not know: 1. There are great research labs - from @MistralAI and @kyutai_labs to large ones from @AIatMeta and @GoogleDeepMind. The Llama 2 and CodeLlama authors are based in France! 2. Did you know sklearn is maintained by @Inria (a top national research institution). 3. Companies such as @OVHcloud and @Scaleway are European leads in computing and hosting. 4. There is the Jean Zay supercomputer with 28 petaflops, where @BigscienceW Bloom was trained. 5. @huggingface has its largest office there🤗. 6. There is @joinstationf, the world's largest startup campus with 1k+ startups, and 42, a very interesting CS school. 7. It has top CS universities. Maybe they don't have international renown or prestige and they don't invest as much in marketing, but they are really top, and their alumni are really, really strong. 8. A thriving startup ecosystem, @MithrilSecurity @photoroom_app @giskard_ai ChainLit @zama_fhe and many others. 9. Unlike SF, it's not in a tech bubble. E.g., the fashion industry is very strong. There are many art collectives. A good example of the power of this is Obvious Art (obvious-art.com), a collective of researchers and artists working with ML. 10. It's very well located in Europe; quick train ride away from other tech hubs such as London, Barcelona, or Zurich, as well as strong universities (EPFL, ETH, UK unis, etc).

@SoVeryBritish You're going to like how we call them in French: camemberts. I don't think you're going to resist it yourself now that you know.

Settle a debate. What are these called?

🛬 The Veriff Fraud Report 2024 has landed. Our world-renowned fraud experts shed light on the state of online fraud - and what you can do to prevent it. Access the report here: veriff.com/resources/eboo… 📩 #fraudprevention #identityverification #verifffraudreport2024

@mipsytipsy When we judge our elderly, the context matters. The first gen of techies that brought their craft to the corporate world were often managed by folks who had literally no clue. Arrogance there was, less yet than the alternative. Compassion even more so.

Hard disagree. Everyone should have an engineering manager who actually wants to be a manager, and finds the role personally challenging and fulfilling. The layers of arrogance and contempt for the craft of management in this Jobs quote are...I don't even know where to start.

@GergelyOrosz @stkenned We had that on SmallTalk in the 70's. Amazon has had the ability to clone a full environment for roughly 20 years. Agreed it's highly desirable. Not sure it's meant to be hard. Maybe something went wrong.

How is the developer experience at Google, compared to the rest of the industry? @stkenned worked at Google for 11 years - before moving to Replit - and wrote a post sharing stuff that Google probably had for a decade. Stuff like this: But what about outside Google? (cont'd)

@mfrachet @FabienToulme Super état d'esprit, vous avez déjà tout compris ! Ma petite Marine vient d'avoir 13 ans. Elle est une école de vie à elle seule. Mon travail nous a poussé à Londres puis à Barcelone. Elle parle anglais et baragouine l'espagnol. Continuez de choisir la joie, le reste suivra.

@FabienToulme Même si tous les jours ne sont pas simples, le temps fera son œuvre. On va se bouger pour avoir une vie chouette 💪

On a appris que notre fils, né il y a 1 mois, était porteur de trisomie 21. Le monde s’est arrêté, le ciel s’est écrasé sur nos tronches et la notion du temps est devenu abstraite.

@ygrenzinger Je dirais même plus : NP complet. Le contexte, l'humain, dès qu'un paramètre change, tu n'as plus de certitudes sur ton approche. Un peu comme les enfants. Au bout du 6eme, tu voudrais croire que tu t'y connais. Mais non.

Le management c'est hardcore ou c'est moi qui suis nul ? :/

@mitchellh I know what you mean. I can't help it, the idea resonates. Now, it's unreasonableness may have a lot to say about why your idea hasn't caught up.

@behaghel Man, I haven't heard/thought of IndieWeb in what feels like 15 years (I'm sure it was much more recent than that). Yeah, a really noble effort, but I think broadly unreasonable for various [annoying] reasons.

The idea of using verified domains as a username is so obvious in hindsight its shocking no mainstream app I know of did this before. Proving domain ownership has been used for so many other things of course, just shocked domain-as-identity is effectively nowhere until now…

Learning NixOS Module System: blog.behaghel.org/journal/2023/0…

@GergelyOrosz My experience is that it's often worse: the new Head is out of their comfort zone, recreates it without even realising a) the damages b) the vacuity because that's just how it should be in their worldview.

"Our company has a new Head of Engineering, who now wants to roll out daily standups for all teams. What is your take?" That this approach is as effective as eg mandating all teams to do 2-week sprints. Curb a bit of autonomy and mandate the "how"... solving what, exactly?