Note di Matteo

L’unica arma efficace che le aziende private e le pubbliche amministrazioni possiedono non risiede nell’ingaggio di un singolo super-hacker a costi esorbitanti, ma nella costruzione di una solida e pervasiva cultura della sicurezza. La difesa di una catena di supermercati, di un’industria manifatturiera o di un ente locale non è una questione puramente economica o di budget inaccessibili; è, al contrario, una stringente questione di competenze diffuse.

Giancarlo Rosa in Perché ci hackerano il frigo?

Multi‑Ratio Video Resizing for Mobile Feed and Marketing. Netflix spiega come ha costruito un sistema di cropping dei suoi contenuti per la fruizione verticale, tenendo conto delle parti salienti della scena e dei personaggi che stanno parlando. L'output viene revisionato dagli editor umani che possono apportare modifiche.

OVH VPS Stock Status (vps-in-stock.ovh), e cioè: non sono praticamente mai in stock:

it's as simple as i do this for fun, and i don't find giving an ai all the fun at poking at something instead of doing it myself fun. put it another way, i like using my brain

i like coding, i like staring at devtools, binary ninja, or whatever else for hours, i like exploring weird library source code and tracing it with nothing but github code search and a dream, it is fun to me. i don't do anything on this blog for money, i do it for fun, the money part is just a nice side effect

[...] i think that people have been way too lost in this wave of ai everything, that they are disregarding doing things themselves by a whole lot. it is still extremely fun to just, write code yourself, debug things yourself, stare at minified js bundles for hours at a end, cycle through random interesting looking subdomains, it's all fun! and i feel people have forgotten that a bit

xyzeva, security researcher, in so i guess everyone uses llms to think now.

È uscito Video.js 10, il player video per il web più popolare, riscritto completamente e pensato per l'era dei componenti.

AI may be a great calculator, but in business, intelligence is mostly judgment. Judgment depends on context, and the answer varies with which human or which model you ask. Perhaps most importantly, AI does not understand accountability, trust, culture, unwritten rules, ethical trade-offs or fairness, all of which shape reputational risk and ultimately drive revenue growth and profit margins.

(Apollo)

Da Twitter, il pannello arrivi e partenze dell'aeroporto di Trapani palesemente vibecoded 😢:

Scrivevo un anno fa I grandi temi nell'AI negli ultimi 4 anni. Mi sembra il momento di integrare con il 2026:

• 2022: ChatGPT
• 2023: Multimodality
• 2024: Modelli di reasoning
• 2025: Agenti e browser AI
• 2026: Agenti autonomi

I browser AI come prodotti sono essenzialmente morti ma gli agenti si sono evoluti in agenti autonomi (Claude Code/Cowork, ChatGPT Work/Codex, ChatGPT dots, Claude Duet, Grok Bot, ecc.), grazie agli LLM che sono diventati più intelligenti e veloci anche in abbinamento ai modelli di decisione (Jev). Il trend è che invece che aprire il browser o il terminale per chiedere di eseguire un task, si assegna un task a un agente che poi sceglie il miglior modo per portarlo a termine.

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and http://Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

(@fiveoutofnine)

Le istituzioni e gli accordi europei in un diagramma di Eulero:

(di Rob Hoeijmakers, da Threads)

I think good products carry something of the people who make them. Their experience, what they care about, and how they think things should work. You might not know who those people are, but you can feel their perspective in the product.

Karri Saarinen, CEO di Linear, in Someone behind the software.

Un lorem ipsum dolor sit amet in TreC+ (fascicolo sanitario del Trentino):

JPEG XL vs AVIF for web use-cases. Confronto tra AVIF e JPEG XL con gli encoder attuamente disponibili. AVIF vince quasi sempre per conversione lossy, JPEG XL vince quasi sempre per lossless.

Spaceship (brand secondario di Namecheap) ora vende i domini at cost, senza obbligo di usare i loro servizi o nameserver:

AI makes projects with weak engineering culture fail much faster.

Florian Herrengt in AI is removing the middle class of software engineering.

Il tizio che ha installato un registratore in una sala conferenze di OpenAI è stato trovato tramite ChatGPT:

A chatbot account tied to Alfozan’s spouse, which shared identifiers with his own account, submitted prompts between Sept. 24 and Sept. 30 about building, installing, obscuring, and remotely accessing a recording device, prosecutors said. Queries included how to “build a continuous audio recorder” and “encrypt the SD card,” prosecutors claimed. On Sept. 27 and 28, the account asked about the specific device that was later found, including its unique MAC address.

Reminder della inesistente privacy dei chatbot AI, no matter what they say.

Very often, we found that the role of the engineers was to tell Claude “no.”

Anthropic in Redesigning source control at Anthropic.

I took a break this summer from paying attention to AI. I thought that when I came back, I'd feel left behind. But when I came back, I realized that nothing has really changed.

There's new models, there's new techniques, there's new agents. But in the end, making great products, increasing revenue, and building the business—it's still hard.

It's clear the tools are getting better, you can do more, you can do it faster. But I think the more important question is: are we actually making better things with these tools? Are our teams getting better with these tools?

I don't think that answer is clearly yes.

There's a lot of emphasis now on toolmaking and using tools and building systems. But I think in the end, as product people, our job is to make something great.

Lenny Rachitsky, CEO di Linear.

working at a higher level of abstraction has always required understanding the lower level ones, I don't think coding agents changes this

Thariq Shihipar, engineer @ Anthropic.

many people really loved the craft of writing software and realized that the quality of software products was a partial derivative of the quality of the codebase. people would go out of their way to only work for founders who understood this and made this core to their companies. [...]

In this new age of ai agents, I couldn't be more excited that I can build products faster and at a higher quality than I ever could before. [...] everyone has been given superpowers! [...]

on the flip side, it feels dissociative to know that the craft of writing software itself is dead, after spending close to two decades doing it. [...]

I've had my last debate over linting, my last conversation about how many weeks we should spend cleaning up tech debt, my last PR where I wrote every character by hand, and my last bug fix that took hours of reading through thousands of lines manually to find the one line with no tests that broke things.

and so I empathize with the mathematicians who have lost the craft of mathematics that defined their working hours, their passion, and for many, their identities.

yes, most of the work they did, as viewed by outsiders, was a means to an end: to get the solution! but they, like software engineers, have lost part of the craft that felt core to the work.

Ben Williams, founder di Hansel.so.