📰 Latest Articles & Guides

Lovable Leaked 200K Messages and Passport Data in Breach

Lovable Leaked 200K Messages and Passport Data in Breach
I've built a few throwaway apps with Lovable over the past year, mostly to see how far a plain-English prompt can stretch. What I didn't expect was stumbling onto passport scans and private conversations sitting in public view, readable by anyone who knew the URL. After scanning 159,041 Lovable projects, that's exactly what we found: over 200,000 private user messages exposed without a login, plus personal documents that should never have been accessible in the first place. Lovable grew out of an open-source tool called GPT Engineer in 2023, became a Stockholm startup, and now promises that anyone can build a web app just by describing it. The demo is impressive. But there's a real gap between describing an app and securing one, and we're watching that gap play out in production. The AI generates the code, but it doesn't tell you when you've just built something that leaks customer data. So what happens when the tool makes building easy but stays si...

Vegan Creamy Sun Dried Tomato Soup Recipe

Vegan Creamy Sun Dried Tomato Soup Recipe
Vegan Creamy Sun Dried Tomato Soup Serves: ['2', '2 -3'] You might think a truly creamy tomato soup requires heavy cream or a pile of soaked cashews, but this Vegan Creamy Sun Dried Tomato Soup proves that coconut milk and pine nuts can create that same silky, luxurious texture without any dairy at all. We rely on the sun dried tomatoes to bring a concentrated sweetness that balances the natural acidity, while the pine nuts add subtle body when blended, so you get a thick, velvety result without complicated techniques or overnight prep. What makes this recipe perfect for busy winter evenings is how the shallots and garlic build a sweet, aromatic base with just a splash of white wine, letting the oil-packed sun dried tomatoes infuse the broth with deep flavor. You don't need to roast anything separately or blend for minutes—the full-fat coconut milk does the heavy lifti...

99.98% blocked: I ran 9,000 Shorts through my filter so the old model could fail in peace

99.98% blocked: I ran 9,000 Shorts through my filter so the old model could fail in peace
I built this filter because my own Shorts feed had become unusable — scammy re-uploads, AI slop loops, and clickbait compilations stacked ten deep. I wanted numbers, not vibes, so I pulled 9,000 Shorts and scored them against two classifiers: the current one and the previous revision I still had deployed. The old model let 8,667 of the 9,000 through. That's a 96.3% miss rate, and it explains every "why is my feed like this" moment I've had this year. The current model blocks 99.98%. One concrete detail of how it works: I don't classify the video file directly. I sample 8 frames per video, hash them, and dedupe near-identical frames across the whole corpus first — that alone kills most mass-reupload spam before any model sees it. Survivors go to a transcript-plus-visual embedding pass, and anything under the confidence threshold gets blocked, not demoted. Demotion just moves the junk into the "maybe" rail where humans still see it. What it costs the o...

Nvidia's Venture Capital Funds Startups That Buy Its GPUs

Nvidia's Venture Capital Funds Startups That Buy Its GPUs
Nvidia's venture arm has poured money into AI startups that then turn around and spend it on Nvidia's GPUs. Critics call it a closed loop that manufactures chip scarcity, and honestly, I think they're onto something. That's the loop: cash flows from Nvidia to startups, then right back to Nvidia in hardware purchases. It's not illegal, and it's not even unusual for a company to invest in its own customers. But the scale here feels different. When the dominant supplier of AI chips is also the primary financier of the companies buying them, the market dynamics get murky fast. I keep coming back to one question: who actually benefits when the money just circles back? The startups get runway, Nvidia gets guaranteed demand, and somehow we're all still scrambling to find an H100. That tension is what makes this worth digging into. The NVentures Feedback Loop NVentures operates as a closed loop: NVIDIA writes checks to AI startups, and those startups wri...

Cauliflower Rice Burrito Bowl (Healthy Copycat)

Cauliflower Rice Burrito Bowl (Healthy Copycat)
Cauliflower Rice Burrito Bowl Prep: 20 mins | Cook: 20 mins | Total: 40 mins | Serves: ['4'] | Cuisine: Mexican Craving that Chipotle fix on a Tuesday night but want to skip the post-dinner heaviness? This cauliflower rice burrito bowl delivers all the smoky, zesty satisfaction of your favorite fast-casual spot while keeping things light, fresh, and nourishing. We're swapping heavy white rice for riced cauliflower, which soaks up every drop of that creamy cashew-lime sauce without turning mushy—the cauliflower's mild flavor lets the bright citrus and cilantro shine through instead of competing with them. The secret weapon here is the blended cashew crema with fresh lime juice and mild green chiles; it coats every bite with a tangy, slightly spicy richness that makes you forget you're eating something this virtuous. Toss in crispy corn tortilla strips at the end for that...

My "extract the main content" heuristic held until it met a docs page with a longer sidebar than article

My "extract the main content" heuristic held until it met a docs page with a longer sidebar than article
For months my URL-to-Markdown pipeline used a simple readability-style scoring: longest text block wins, everything else gets stripped. It held until I fed it a documentation page where the sidebar navigation ran 4,000 words longer than the actual article body. The converter confidently returned the nav menu as "the content." No error, no warning — just confidently wrong markdown. That's the uncomfortable pattern I keep hitting in this space: the happy path holds until it doesn't, and it fails silently. So I added a guardrail — when the winner block is under a threshold relative to total page text, the API flags low-confidence extraction instead of pretending certainty. Callers can then pass an explicit CSS selector and get exactly the region they meant. The lesson for anyone shipping in this space: don't trust your own heuristics past the point you've measured them. I ran the converter against a corpus of 200 real pages and the heuristic was right 94% of t...

German Chocolate Cake Recipe (Rich & Moist)

German Chocolate Cake Recipe (Rich & Moist)
German chocolate cake Prep: 45 mins | Cook: 30 mins | Total: 1 hrs 15 mins | Serves: 12 You know that feeling when you want to bake something truly impressive without spending your entire afternoon in the kitchen? This German chocolate cake delivers exactly that—a rich, moist crumb that comes together in just over an hour from start to finish. The secret lies in using vegetable oil instead of butter, which keeps the layers incredibly tender for days, while buttermilk adds a subtle tang that perfectly balances the deep, dark cocoa flavor. What makes this German chocolate cake so reliable is its forgiving method. The combination of baking powder and bicarbonate of soda gives you a dependable rise without any fuss, and the caster sugar dissolves beautifully into the batter to create that signature fine, velvety crumb. Whether you're celebrating a birthday, hosting afternoon tea, or simpl...

I built an independent clock to time Gemini 4 Hydrogen — the 2.5x claim vs my 1.1x, and what it cost me

I built an independent clock to time Gemini 4 Hydrogen — the 2.5x claim vs my 1.1x, and what it cost me
Vendor decks love a multiplier. When the "Gemini 4 Hydrogen" numbers came out claiming 2.5x faster inference, I didn't take the marketing at face value, so I built a small harness that times every request with a monotonic wall clock around the full round trip — queue time, prefill, decode, everything — rather than the cherry-picked decode-only window the claim was based on. When I ran the same 200-prompt set through my harness, the honest number came out at 1.1x. Not because the model is bad, but because the 2.5x only exists if you exclude everything a real operator pays for. I put the whole comparison into a video walkthrough so the methodology is visible instead of buried in a footnote: https://www.youtube.com/watch?v=DsOdtrugezg One concrete detail: my clock starts before the request hits the API gateway and stops after the final token is parsed client-side, and I log both timestamps per request so I can show exactly where the time goes. The thing it costs the oper...

Inside the FAA Ground Stop That Stranded 400,000 Travelers

Inside the FAA Ground Stop That Stranded 400,000 Travelers
A corrupted database managed to do what no storm or security threat could: it grounded every domestic flight in the United States for more than five hours on Friday. When the FAA's NOTAM system crashed, the agency ordered the first nationwide ground stop in decades, and hours later an aviation expert estimated that 300,000 to 400,000 passengers were stranded with no clear idea when they'd move again. I think this is exactly the kind of failure that reveals how brittle our critical infrastructure really is. We've layered decades of automation onto air travel, but we're still depending on systems that can be paralyzed by a single point of failure. While departing flights sat idle on runways across the country, inbound international traffic was being managed "on a case by case basis," which is bureaucrat-speak for improvisation at scale. The part that gets me is that this wasn't a sophisticated cyberattack. It was a routine failure in a system that ru...

Retry is a budget, not a loop — what agents shipping against flaky APIs should learn

Retry is a budget, not a loop — what agents shipping against flaky APIs should learn
I spent a week debugging calls that "always worked on retry" until a customer's pipeline processed the same document four times. The bug wasn't the retry logic — it was that I'd built a loop with a sleep, not a retry strategy. Here's what actually changed my mind about retries: Classify before you retry. A 429 and a 500 look identical if you only catch exceptions. I now map status codes explicitly: 429 and 5xx get retried with backoff, 4xx (except 429) fail immediately — retrying a 404 ten times just burns your quota and annoys the upstream. DNS failures and connection resets are retryable too, but they need a different cap than HTTP errors because they fail faster and more often. Backoff needs jitter. Fixed 1s, 2s, 4s intervals create thundering herds when an API blips. I use exponential backoff with full jitter — sleep is random between 0 and the computed cap. It flattened the spike in my error graphs within a day. Give the whole operation a deadline,...