Here's the thing about "I told you so" moments in security: they're never fun, even when you're right. Sixty-eight days ago, a Hacker News commenter warned that OpenCode would "leak all your data to themselves and to shady 3rd parties." He called it "the shadiest of all" harnesses. Now the OpenCode team is sending breach notifications that reportedly just say "Hi," user credentials are compromised, and the person who predicted this exact outcome is probably not feeling very vindicated. When that warning first surfaced, the OpenCode author feigned ignorance. He didn't patch anything. He didn't address the concerns. He just kept shipping, apparently confident that nobody would actually connect the dots between his tool's architecture and the inevitable breach. He was wrong about that last part. So now we're left with a mess that feels almost inevitable in retrospect. What happens when a developer tool's own ...

I built a git changelog generator that diffs two commits and emits structured release notes. First version walked git log A..B and treated every commit as a straight line. Clean, deterministic, wrong. The bug: on a repo with a normal PR workflow, git log A..B on the main branch shows merge commits but NOT the individual feature commits they brought in. My changelog would say "Merge pull request #42" and nothing else. Humans reading the release notes got zero signal about what actually shipped. The fix wasn't a bigger diff. It was changing what I walk. I switched to git log --first-parent A..B for the branch-level summary, then for each merge commit, git log ^parent1 parent2 to enumerate the commits that merge actually introduced. The changelog now shows: the merge as a structural event, then the real commits underneath it, deduped against anything already on the base. The deeper lesson: git history is a DAG, not a list. Any tool that assumes linearity is lying to ...

Everyone's been staring at the same leaderboard for two years. MMLU this, HumanEval that, a new decimal point every few weeks, and somewhere in the noise we forgot to ask whether any of these models can actually serve traffic without melting the budget. DeepSeek apparently did ask. Their latest release reads less like a benchmark contender and more like something an inference team would actually want to deploy: lower latency, better throughput, and a cost profile that doesn't require a second mortgage. That matters, and it's rarer than it should be. The industry has spent the last couple of years treating eval scores like a sport, and the sport has gotten expensive. Training runs that cost nine figures, announcements timed to leaderboard refreshes, and a whole ecosystem of commentary pretending that a three-point MMLU gain tells you anything about whether a model will survive a Tuesday afternoon traffic spike. Meanwhile the people actually running these things in product...

I built the XLSX-to-Markdown converter expecting a spreadsheet to be a grid. Rows and columns. A nice Markdown table, maybe a JSON array beside it, done. That mental model lasted about three real-world workbooks. The first breakage: a financial model with a title row merged across A1:F1, a units row in row 2, actual headers in row 3, and totals three rows above the data they summarized. My converter faithfully emitted a Markdown table whose header row was "" | "" | "" | ..." and whose first data row was "Q1 Revenue (USD, thousands)" . Technically correct. Practically garbage for any agent downstream trying to parse it. The second breakage was worse. A logistics sheet had two logical tables stacked vertically with a blank row between them, and a third table side by side in columns H onward. One sheet, three datasets, zero metadata saying so. My flattening logic happily interleaved them into one franken-table where column A of "table...

I built an OG image API that takes a title + description and renders a 1200x630 card. It worked great in my tests. Then I wired it into a link-unfurling pipeline for an agent that posts dozens of links into Slack channels, and suddenly a third of the previews came back gray. The bug wasn't in the renderer. It was in the CDN I put in front of it. Every generated image URL looked like /og?title=...&desc=... . The CDN cached on the full URL, which is correct — except Slack's unfurling bot strips query strings before requesting the image in some clients. So ?title=Deploy+failed and ?title=Deploy+succeeded both collapsed to /og/ , and the first response got cached for everyone else. One "Deploy failed" card got served to a channel full of "Deploy succeeded" links. The fix was boring and effective: hash the full parameter set into the path itself ( /og/a3f9c2….png ) and make the query string optional. Cache key and content now agree. What I actually le...

I built the PDF-to-Markdown API expecting layout to be a solved problem. It isn't. The failure mode was subtle and brutal: academic papers with two-column layouts came back as interleaved garbage. Line one of column A, line one of column B, line two of column A... The Markdown looked fine at a glance — headings, paragraphs, lists all present — but the reading order was destroyed. I fed one into a RAG pipeline and the retriever started quoting sentences that spanned two unrelated columns. The chunks were technically valid; semantically they were nonsense. My first fix was naive: split the page down the middle by x-coordinate. Worked great until a figure spanned both columns and the caption got shredded. Then a wide table. Then a single-column abstract followed by two-column body. The geometry was lying to me in a new way every time. What actually worked was a hybrid: detect column boundaries from the whitespace gutters — the vertical runs of empty space between blocks — then f...

Ghost Cookies Prep: 10 mins | Cook: PT0S | Total: 2 hrs | Serves: 24 serving(s) | Cuisine: Cookie Cuisine, Halloween Recipe Cuisine, Edible Decoration Cuisine, Icing Cuisine, Fall Recipe Cuisine, Sugar Cuisine, Milk Cuisine, Butter Cuisine, Syrup Cuisine, Almond Cuisine You know that moment when your Halloween party spread is almost perfect, but something feels missing? Maybe it's the dessert table that needs a little spooky magic, or maybe you just want a treat that makes people smile before they even take a bite. That's exactly where these Ghost Cookies come in. With just 10 minutes of prep and zero baking time for the dough itself, you can whip up a batch of these adorable little ghosts without breaking a sweat. We're talking classic sugar cookie dough made with pantry staples—butter, sugar, flour, a splash of milk and vanilla—rolled out, cut into ghost shapes, and transfor...

Spent last week debugging why a pitch deck came back from my PPTX-to-Markdown converter with the appendix before the actual pitch. Turned out the slide files inside the .pptx package are named slide1.xml , slide2.xml , slide3.xml — but that numbering has nothing to do with presentation order. The real order lives in presentation.xml as a list of relationship IDs pointing at slide files in whatever sequence the author dragged them around in PowerPoint. So a deck saved after someone moved the "Thank you" slide to the front, then back to the end, has slide7.xml as the first slide and slide1.xml somewhere in the middle. My converter was reading files alphabetically and happily handing agents a pitch deck that starts with Q&A and ends with the company logo. The fix was parsing p:presentation/sldIdLst and resolving each r:id through presentation.xml.rels to the actual target file. Boring XML plumbing, but it's the difference between "Markdown of a deck" ...

Leek & potato soup (Vichyssoise) Prep: 20 mins | Cook: 25 mins | Total: 45 mins | Serves: 8 | Cuisine: British There's something quietly luxurious about a proper leek and potato soup, and honestly? The ones in cartons or from the deli counter just don't compare. When you make Vichyssoise at home, you get that silky, pale-green velvet texture that only comes from slow-cooked leeks and starchy potatoes melting together. Plus, you control everything — the salt, the creaminess, whether you want it piping hot on a frosty evening or chilled straight from the fridge on a summer afternoon. This particular leek and potato soup comes together with humble, seasonal ingredients: butter, potatoes, onions, and those beautiful white leek hearts. Darina Allen's version keeps things wonderfully simple — no fuss, no fancy techniques, just good produce treated with a little patience. In unde...

I built a webhook catcher for integration testing: throw a POST at an ephemeral URL, read the events back later. Simple. Then I pointed a real payment provider's test mode at it and watched my event log fill up with 14 identical "payment succeeded" events for one click. The catcher was doing its job — storing everything that arrived. The problem was upstream: the sender's retry policy. My first instinct was to dedupe on my side. That's the wrong lesson. You can't dedupe reliably at the receiver because you don't know the sender's idempotency key convention, and two genuinely different events can look identical (same payload, same second, same source IP during a re-deploy). What I actually changed: my catcher now exposes each event with a stable id, the raw headers, and the arrival timestamp — and I stop trying to be smart about "the same" event. If I'm testing a retry storm, I want to see the storm. If I'm testing a single deliver...