Reactive Programming in Lean Part 5: Stateful combinators and safety proofs
Non-pointwise combinators have knowledge of previous timesteps Up to now, every Signal we’ve seen has been stateless. FRP . map and FRP . map2 from last time apply pure functions to the value at each…
Build a Decoy MCP Server to Catch AI Agent Attackers
Your AI agent's MCP config can be a target for an attacker who reaches your machine. A decoy MCP server entry pointing at a Cloudflare Worker can reveal the attacker's presence and their intent.
A small step forward
One of my early objectives at FreightPOP is to move the SDET team to write automated tests below the UI. I said as much in my previous post:Build an automation strategy that explicitly…
When the target keeps moving
When it's easy to code, scope creeps. But not all creep is bad. I analyzed a month of AI coding, and learned that we need to measure agentic software development differently.
Map projections: a practical guide to common mistakes and how to fix them
--> --> --> If you have spent any time reading scientific journals, news outlets, or even peer-reviewed climate research, you have almost certainly encountered a world map stretched beyond…
Matrix City - The map
How do you simulate civilization when you don't understand psychology? You reach for the worst tools available and it turns out that's good enough.
I am worried about Bun
Bun is excellent software. Anthropic owns it now, Bun sits under Claude Code, and Claude Code getting worse makes me worried Bun could follow the same enshittification path.
Agentic Coding without Claude and Codex
Hello everyone! I wanted to write this article to share my experience with agentic coding without Claude and Codex, the most popular tools out there. Introduction I started dabbling with agentic…
Two New Apps!
I’m really happy to announce not one, but two new apps I’ve released this week. The first is Remaining. Remaining is an iOS app (iPhone and iPad) that helps you answer one simple…
Why Your SQL Server View Is Slow (And How an Inline TVF Fixes It)
SQL Server views can hide an expensive GROUP BY boundary. Here's the diagnosis and how an inline TVF brought a 3-minute query to 4 seconds.
Agentic Analytics: Supercharging Ad-hoc Analytics with Local LLMs
Introduction While much of the online discourse related to Generative AI is focussed on Automated code Generation. Lets look at alternate use case of it. Traditionally, Business Intelligence (BI)…
MUSIC! LIVE! CODE! FRANCE! NOW!
Grrrnd Zero Algorave 2026 is happening right now and all night long, if you’re into that sort of thing. more info over on grrrnd zero LIVESTREAM ON YOUTUBE (I’m still not a huge fan of the name of…
REFCODES.ORG change list version 4.1.2
The REFCODES artifacts version 4.1.2 have been deployed to Maven Central, see the change list for the updates ...
Writing a bindless GPU abstraction layer
Back in December 2025, Sebastian Aaltonen published a blog titled “No Graphics API” - it presented a great history of the evolution of GPU hardware, and gave an opinionated perspective on…
Steganography in large language models
LLMs are, at their core, a probability distribution over text. Each generated token is selected from a long list, with an assigned probability according to the model and the preceding context. In…
Setting up a workflow with superplanning and fizzy
I'm trying the /goal command in codex this weekend. Here's the workflow I set up: 1. First, I used superplanning to create the initial plan. Then, using the fizzy cli skill, I created each task with
Chaining ISC DHCP Server Features for Unauthenticated Root Remote Code Execution
Estimated Reading Time: 15 minutesWhile doing some code analysis of network services running as root in one of my lab VMs, I came across ISC DHCP Server (dhcpd), a common DHCP implementation in Linux…
AI Images Need Provenance, Not Just a Label
Today I built a small tool called sign-ai-media. It adds C2PA provenance metadata to AI-generated images and videos. In simple terms, it signs a media file and says: this file was created or edited…
Node.js reporting
Some time ago I wrote about a new-ish feature of Node where it parses .env files (dotenv-style) itself. Today, I’m going to mention a feature which has been in Node for some quite time, but somehow…
Breaking Apart Modules
putting the module back in...uh, module
Welcome to the singularity: Buying a narration with link-cli
Stripe's CLI gives agents single-use shared payment tokens. PodRead now accepts them.
Choose Your Own Adventure
Yesterday's specialization PR — three commits, the per-resource Params and Row classes, factory rewrites at every call site — landed in 24 minutes of commit time. The handoff document I wrote to plan…
WhoTheHeckSentThis – Add Sender Pictures to Thunderbird Mail with Zero Setup
You open Thunderbird. Your inbox is a wall of names. “David Chen” — which David? “Newsletter@somethingcorp.com” — the one you signed up for, or the one that found you? You…
Borrowed from Prisma
Prisma is the typed ORM for TypeScript: you write a schema, it generates a client. For each model in your schema, the generated client gets a typed namespace — prisma.user.findMany() returns User[] ;…
Why “Trusted Publishing” Can’t Save Us from Social Engineering
Hey Everyone! I want to talk about something that’s been bothering me since the Axios compromise. This issue goes beyond just one package. First, a quick definition: In the npm ecosystem, “trusted…
Scaling, stretching and shifting sinusoids
This is a brief and simple [1] explanation of how to adjust the standard sinusoid sin(x) to change its amplitude, frequency and phase shift. More precisely, given the general function: \[s(x)=A\cdot…
Dragoncatcher: Claude Managed Agents feature request
Live data. Read here.
Bad Weather and the Subway
Snow in Inwood, New York. Photograph by the author. Recently I’ve been looking at hourly ridership data from the New York City Subway. Last time we learned that people go to work in the morning…
How a Broken Bike Sync Led Me to Reverse Engineering My Wahoo’s Hidden Debug Mode
Reverse engineering the Wahoo ELEMNT Bolt v3 BLE protocol to unlock a hidden developer debug mode
2026-05-02, Friday
Light & Shadows There is something I haven’t mentioned here. But it is something I have poured a lot of my spare time into the last year. There will be a series on this website about it, someday… But…
2026-05-02, Friday
Light & Shadows There is something I haven’t mentioned here. But it is something I have poured a lot of my spare time into the last year. There will be a series on this website about it, someday… But…
$36,000
RetainDB side project with 81 users hit a $36k Cloudflare bill — 16B Durable Object writes from a runaway queue loop, unbatched DO writes, and a KV list scan on every request...
Follow-up on switching to eglot
Jan G sent me a two-part comment. Part one I was under the impression that when using elpaca you needed to disable use-package, and that when using elpaca-use-package, you were redefining the macro.…
Embed Arbitrary Payloads into JPEGs without Special Tools
Arbitrary binary data can be hidden at the end of JPEG files which otherwise behave normally. This article explores strategies for packing and unpacking payloads into JPEG images using standard…
How to turn an already cloned Git repository into a bare repo with worktrees
Worktrees are useful essential if you want to multitask on one project. This is becoming common with the use of AI agents, but even when not using agents it is just nicer to be able to essentially…
Maybe getting back into ABCL
I was dusting off some old scripts the other day and thought let's check how ABCL is these days... unfortunately the last stable release is still from 2023, at 1.9.3. I see there is still quite some…
FOSS activity in April 2026
Debian packages: firmware-nonfree: Bugs: replied to #1132448: firmware-mediatek: Wifi perf degraded a lot after upgrade firmware-mediatek from 20250410-2 to 20260221-1~bpo13+1 and 20260309-1 Merge…
VoIP Toolbox: Is the SIP in this PCAP OK?
VoIP Toolbox can already pull SIP call flows out of a PCAP, directly in the browser. The latest update runs sipright over every SIP message. This gives a high level good/warning/bad call indicator,…
The Geometry of Dragon Ball: A Deep Dive into SDFs and Raymarching
Today we are deconstructing the 4-Star Dragon Ball shader (available on Shadertoy here ). This shader is a good example of using 2D math to drive 3D optical effects. To understand it, we must…
Knowledge Portfolio
Came across this idea in the book - Pragmatic programmer where the author makes an analogy between financial portfolios and your own knowledge stack Diversification - Invest your time in learning…
AI 3D Model Generation for Godot & Unity (2026 Guide)
If you are exploring AI 3D model generation for Godot and Unity, read on. Turning a text prompt or a single photo into a textured 3D model is now possible entirely on your own hardware. This guide…
Using the Raspberry Pi Pico 2 as a rudimentary oscilloscope
In this post, I explore whether the Raspberry Pi Pico 2 can act as a rudimentary oscilloscope. Some theoretical considerations about the Pico 2’s ADC are presented. These are then put to the…
Good developers learn to program
Good developers learn to program. Most courses teach a language. by EvilGenius A junior who learns programming as "describe what you want to a model and accept what comes back" is learning to be a…
Using Playwright to test my static sites
Playwright is a testing library that lets you control a browser and check how the page is behaving, and it's great for testing and scripting web apps.
Kloak: kernel-space secret injection via eBPF on Kubernetes
When an application gets breached, the first thing an attacker will do is exfiltrate whatever data they can reach. From customer data to authentication tokens, secrets are target number one (goodbye…
Posting from Obsidian
After some trial and error, I finally have a working version of a personal plug-in that I created for myself that allows me to post directly to my blog without logging into Micro.blog. This post is…
A Text Input, Some Encryption, and a Submit Button
In 2011, I built something that took about a weekend.
LifeOS
I have been building apps with Claude for several weeks now. In that time I have been able to ‘develop’ five super capable apps. All in HTML/Javascript (so open in any web browser). The first was my…
VHS Shelf: Dev Log #2
Dev Log #1 I'm not sure why I was under the impression that smoothens out the hover animation would be easy? Alas, 'twas not trivial. Turns out that there are these things called tweens, which are a…