📰 Latest Articles & Guides

Apple's Undocumented Family Classifier Runs on Every Mac

Apple's Undocumented Family Classifier Runs on Every Mac
Apple published the algorithm in 2023. What they didn't publish is the system actually running on your Mac right now. Since macOS 13 shipped in 2022, your computer has been maintaining 51 SQLite databases that track 181 different types of entities about you, the people you know, and how you're all connected. Nobody has documented which versions run this, or the exact list of what gets collected. That's the gap I want to close. Apple's researchers wrote a paper on the graph construction techniques back in 2023, but there's almost nothing on how macOS actually integrates it. So we're looking at the daemons, the databases, and what this system infers about your household from your movement and communication patterns. Think of it like a knight landing on e2. One piece attacks the king, queen, rook, and bishop at once. In this case, the knight is a simple store or location, and the pieces are the members of your household. When that piece lands, what gets ta...

The 80.52 Short: why a 65B beating a 501B needed a video to be believed

The 80.52 Short: why a 65B beating a 501B needed a video to be believed
I spent last week trying to explain that parameter count stopped being the whole story. A 65B model I run locally scored 80.52 on our eval suite; a 501B frontier model scored lower on the same run. The number alone sounds like a typo, so I filmed a walkthrough instead of arguing in comments. The Short exists because the gap is real but invisible without seeing the harness. The concrete detail I show on screen: both models got the exact same 200-question multiple-choice set, temperature 0, no system-prompt changes. The only difference was inference path — the 65B ran quantized at Q4_K_M on a single consumer GPU while the 501B ran through its hosted API with defaults. Same questions, same scoring script, and the smaller model won 14 of 20 categories. What it costs the operator: reproducing the 501B side isn't free. Each full run through that API burns about twelve dollars in tokens, so anyone verifying the number has to pay the toll again. The local 65B run costs electricity and r...

NFSU2 Runs at 120fps in Your Browser With Original PC Code

NFSU2 Runs at 120fps in Your Browser With Original PC Code
A 2004 PC game is running at 120fps in widescreen directly in your browser right now, no emulator, no install, just the original code recompiled to run natively. I keep refreshing the page because it still doesn't feel real. My brother and I played this game together about twenty years ago, passing the keyboard back and forth in a cramped dorm room. When I started this port, the goal wasn't to build a platform or demonstrate a point. We just wanted to play together again, and the only way that made sense was putting it somewhere we could both reach from any device. That's why the money works the way it does. You can buy me a coffee to cover hosting and development costs, but that's the whole transaction. Everyone gets the same game, no microtransactions, no paid perks, no premium tier. It's a small argument that software can still just be software. Does this actually change anything about how we think about game preservation, or is it just a neat trick? I...

Carrot Muffins with Coconut Whip (Dairy-Free)

Carrot Muffins with Coconut Whip (Dairy-Free)
carrot muffins with coconut whip Carrot muffins earn their place in any baker's rotation because they deliver moisture without the heaviness of oil-heavy cakes. The grated carrots release their juices as they bake, creating a tender crumb that stays fresh longer than you'd expect. When you top them with coconut whip instead of traditional frosting, you get that same creamy contrast without dairy, and the subtle sweetness lets the warm spices shine through. The key is treating the carrots as a vegetable that needs texture, not a purée—those little orange flecks are what separate a bakery-style muffin from a dense loaf. We're keeping the batter simple so the carrots and spices do the heavy lifting, and the coconut whip adds a lightness that makes these feel like a treat rather than just a breakfast staple. carrot muffins with coconut whip ...

Agent memory is a garbage-collection problem wearing a retrieval costume

Agent memory is a garbage-collection problem wearing a retrieval costume
I spent a while treating memory like a retrieval problem: embeddings, vector indexes, chunk sizes, rerankers. The fancy part was search. The part that actually broke my agent was deciding what deserved to be remembered at all. The first lesson was that transcripts are not memory. Storing every tool call and every half-finished thought made the agent dumber, not smarter — it kept answering from stale context instead of the current task. Once I switched to persisting only decisions, constraints, and exceptions, recall got worse on paper and better in practice. The second lesson was decay. A fact that was true last session is often a liability this session. I started attaching an origin and a confidence to each memory, and letting old low-confidence entries fade instead of fighting in the prompt. Agents need forgetting more than they need remembering. The third lesson was that restarts are the real test. A memory system that only works while the process is alive is a cache. The moment...

Accepting arbitrary URLs taught me the trust boundary is the fetch, not the parse

Accepting arbitrary URLs taught me the trust boundary is the fetch, not the parse
When I first shipped my URL-to-Markdown fetcher, I spent most of my energy on the parsing side — stripping navbars, picking the main content, handling selectors. The trust model felt obvious: hand it a URL, get back clean Markdown. What could go wrong? Plenty, it turns out. The boundary I should have been worried about wasn't between HTML and Markdown — it was at the moment I accepted the URL itself. An agent (or anyone) could point the fetcher at http://169.254.169.254/ , at localhost services, at internal dashboards on a private network. My server was happily fetching whatever it was told, from whatever network position it happened to hold. The parser was fine; the ingress was wide open. So I moved the trust boundary to where it belongs: before the request goes out. Scheme allowlist, DNS resolved once and the resolved IP checked against private and link-local ranges, redirects re-validated at every hop (a redirect to an internal host is still an internal fetch), and a hard cap...

Libghostty 1.0 Ships With Distribution-Ready Packaging

⚡ INAPP
While Ghostty grabs the headlines, libghostty 1.0 quietly solves the part that actually keeps terminal emulators out of Linux repositories: packaging. A year ago I wrote that libghostty was coming, back when the Zig module had just been merged and the C API didn't exist. Now the 1.0 release brings the boring but essential infrastructure that distributions need, signed source tarballs, a separate dependency manifest, and build tooling that works completely offline. This isn't just Ghostty extracting its core for reuse. Libghostty ships as its own release with its own cycle, separate from the application. Each tarball contains only the files and dependencies the library actually needs, which keeps sizes small and licensing verification simple. When a distro builds it, they get proper SONAMEs for the shared and static libraries, plus a companion tarball with every Zig package cached in Zig's own layout, so the whole thing compiles without touching the network. What happens...

The Hy4 walkthrough: why an 89% hallucination rate still tied Grok

The Hy4 walkthrough: why an 89% hallucination rate still tied Grok
I put up a new video walkthrough on Hy4: it fabricates answers 89% of the time on our adversarial set — and it still ties Grok on the composite leaderboard. The whole point of the video is that these two facts are not a contradiction, they're the same story told from two angles. Why it exists: I kept getting asked "is Hy4 good or bad?" and the honest answer was "it depends which number you read." Raw accuracy hides that Hy4 is confident-wrong in a very structured way — it commits to an answer fast and defends it. The video walks through the runs side by side so you can see the failure mode instead of just the score. One concrete detail of how we measured it: we didn't score per-run, we scored per-claim. Every answer gets split into atomic factual claims, each graded against a retrieved source, and the 89% is the share of claims that fail verification. That distinction matters — per-run scoring would have hidden that Hy4's errors cluster in long, confi...

Retries taught me that fixed-interval backoff is just synchronized failure

Retries taught me that fixed-interval backoff is just synchronized failure
When I built the webhook catcher, my first retry loop was naive: on a failed POST delivery, wait 5 seconds and try again, up to 3 times. It worked fine in testing. Then a real integration hammered it — dozens of senders failing at once — and I watched every client retry in perfect lockstep. Five seconds later, a thundering herd. Five seconds after that, another one. The receiver didn't crash, but the retry spikes showed up clearly in the latency graphs, and a few senders gave up entirely during the worst window. The fix was boring and standard: exponential backoff with full jitter (random between 0 and the computed delay), plus a hard retry budget per event so a flaky sender can't hold resources forever. After that change, the retry traffic spread out like it was supposed to, tail latency dropped, and the 100-event budget stopped getting burned by duplicate deliveries from impatient clients. What I actually learned: a retry policy is a load-shaping decision, not just an erro...

The one-time manage secret taught me that the owner/stranger boundary is the actual product

The one-time manage secret taught me that the owner/stranger boundary is the actual product
When I built the Short Link Creator, the easy decision was letting anyone mint a link — no account, no gate, just POST and get a URL back. The harder decision was everything that comes after: stats and deletion. I didn't want creation locked down, but I also didn't want a stranger who stumbled onto a short URL to be able to read its analytics or delete it. So the API returns a one-time manage secret alongside the link, and that secret is the entire boundary between "owner" and "everyone else." No roles, no sessions, no admin panel — just a capability that exists only in the hands of whoever created the link. What surprised me: users didn't find the secret annoying, they found it clarifying. It made the boundary explicit instead of implicit. When something is gated, people understand why it's gated. When everything is public by default, nothing feels protected — including the things you care about. That's the lesson I keep applying when shipp...