Posts

Analysis of 10,000 Malicious GitHub Repositories

Image
I found 10,000 repositories on GitHub that distribute Trojan malware. They aren't forks of a single malicious project, and they aren't all coming from one bad actor. They're spread across different contributors with different names, all just sitting there in plain sight. I stumbled into this by accident. I have a project on GitHub and wanted to see if search engines had indexed it, so I typed the project name into Google. My repository showed up in the results, but it was surrounded by a weird pattern of others that looked almost identical in structure but served a completely different purpose. It's a clever play on trust. We tend to treat GitHub as a safe harbor for code, but these repos use that reputation to trick developers into downloading payloads. I spent some time digging through the data to see how deep the hole goes. The results are honestly a bit unsettling. The scale of the infection The campaign hit 10,000 repositories. The attackers didn't ...

Switzerland Lifts Ban on New Nuclear Power Plants

Image
Switzerland is finally admitting that its decades-long moratorium on nuclear power might have been a mistake. For years, the strategy was simple: move away from the atom. But the reality of a fragile grid and the pressure of energy security are forcing a quiet, pragmatic reversal. It's a classic case of policy meeting physics. I find it interesting that this shift is happening now. We've spent the last few years talking about a total transition to renewables, but the Swiss are realizing that wind and solar can't always keep the lights on when the temperature drops. They aren't rushing back in with blind optimism, but they are acknowledging that baseline power matters more than political purity. The question is whether they can actually build new capacity fast enough to matter. Nuclear projects are notorious for sliding timelines and ballooning budgets. Can Switzerland actually pull this off without spending the next twenty years in a construction stalemate? T...

SpaceX and Cursor AI: Vertical Integration of Software

The most ambitious aerospace company in history isn't buying a launch provider. It's buying the interface where its software is written. When SpaceX acquires a tool like Cursor or a similar AI-native IDE, they aren't just adding a line item to their procurement list. They're attempting to own the actual cognitive process of how their engineers build flight software. I've seen plenty of vertical integration in my time, but this is different. Usually, companies buy the factory or the raw materials. Buying the editor is an attempt to optimize the loop between a developer's thought and the machine's execution. It's a bold move, but it's also a bit weird. There's a fine line between "optimizing the workflow" and creating a proprietary black box that makes it impossible for any one engineer to actually understand the system. The real question is whether this actually speeds up the cadence of launches, or if it just creates a massive depen...

Reliable Agentic Coding with Local LLMs and Gemma 4

Image
Local models used to be toys. They were slow, a pain to set up, and generally useless for anything beyond basic text completion. For a long time, the gap between a home-run model and a frontier API wasn't just a distance, it was a wall. I remember thinking that local LLMs were essentially a hobby for people who liked tinkering more than actually getting work done. That changed for me with GPT-OSS, but the recent Gemma 4 releases are where things actually get interesting. I've been using the 26b implementation in LM Studio, and for the first time, agentic coding loops actually work. I'm seeing about 75% of the accuracy and speed I get from the top-tier frontier models. It's not a perfect replacement, but it's close enough that I've stopped reaching for the cloud for most of my development questions. I've started treating my local setup as a personalized, lightning-fast version of Google. It's particularly useful for the grunt work that doesn'...

How Malware Uses Fake LinkedIn Job Offers

Image
Fake job offers are the perfect delivery vehicle for malware. They don't rely on some obvious "Urgent: Your Account is Locked" scare tactic. Instead, they target your professional ambition and the basic trust you have in someone who says they want to pay you a lot of money to solve a hard problem. Last week, I got a LinkedIn message from a recruiter at a small crypto startup. We chatted for a few days. She described a broken proof-of-concept they needed a lead engineer for, which sounded exactly like the kind of mess I enjoy cleaning up. Then she sent me a public GitHub repo to review. I didn't clone it to my machine. I've seen this movie before. Instead, I spun up a throwaway VPS on Hetzner and pointed Pi at it in read-only mode, using only file-reading tools. It turns out the "broken proof-of-concept" was actually a very clever trap. The Social Engineering Hook Attackers don't start with malware; they start with a persona. They build L...

Does Iroh 1.0 Eliminate the P2P Networking Tax?

Image
Peer-to-peer networking usually feels like a tax you pay in engineering hours. If you want to move data without a central server, you're suddenly dealing with NAT traversal, DHTs, and the general nightmare of figuring out why two computers can't see each other. It's a lot of overhead for something that should be simple. Iroh handles this by treating decentralized data transfer like a standard API. It doesn't pretend the complexity isn't there, but it hides it behind an interface that actually makes sense. I've spent enough time with P2P stacks to know that the "magic" usually breaks the moment you hit a restrictive firewall, but Iroh's approach to connectivity feels different. The real question is whether this abstraction actually holds up when you're scaling beyond a few nodes. It's one thing to move a file between two laptops on the same Wi-Fi, but it's another to maintain that performance across a fragmented network. The P...

Why Reflowable ePub Outperforms Proprietary eBook Formats

Image
We've spent the last few years rushing toward proprietary formats and interactive PDFs, pretending that "rich media" is what makes a document better. It isn't. Most of the time, it just makes a file harder to open and impossible to read on a phone. We've forgotten that a reflowable, open standard is actually what a reader wants. I've spent a lot of time fighting with fixed-layout documents. There is nothing more frustrating than pinching and zooming on a mobile screen just to read a single paragraph of text. It's a lazy way to handle design that puts the burden on the user instead of the author. The industry seems to think that adding a few embedded videos or fancy animations justifies locking content into a closed ecosystem. But the real win isn't in the bells and whistles. It's in the ability for text to adapt to whatever screen it happens to be on. The question is why we're moving backward when the tools to do this right already ex...