Search

703 results for “places_everyone”

Pentest-Tools.com @[email protected]
2026-10-25

👉 For everyone who started #Node2Shell triage over the weekend, we see you and your huge effort! If you need a hand, we just added detection for CVE-2026-111497 to our Network Scanner, in every paid plan. ( ⏭️ Free trial link below.)
The scan tests if your endpoint decodes Brotli with a vulnerable decoder, so you see reachability (not a version guess). Once it completes, you get a PDF report with: 👇
✅ the finding and the request and response behind it
✅ the fixed release for Node.js, Bun, or Envoy
✅ the CVSS score and severity rating
✅ remediation steps you can hand to whoever owns the fix
❗One thing to check before you call it patched: the runtime hides in more places than your package.json shows. Container base images, Envoy and Istio sidecars, and Python services that use the Brotli or brotlicffi packages all carry their own copy of the decoder.
Need to check every service, rescan after each patch, or document findings for compliance? Start Node2Shell detection with the Network Scanner with a free trial. ⬇️ ⬇️ ⬇️
#Node2Shell details: https://pentest-tools.com/vulnerabilities-exploits/node2shell-brotli-decoder-remote-code-execution_29896
Free Pentest-Tools.com trial: https://app.pentest-tools.com/trial/signup
#offensivesecurity #pentesting #vulnerabilitymanagement #ethicalhacking #cybersecurity

#node2shell #offensivesecurity #pentesting #vulnerabilitymanagement #ethicalhacking #cybersecurity
Dev Community @[email protected]
2026-10-27
Math.random() is not a key generator. Everyone knows this. And yet — when a widely deployed SM2 library seeded its key material at module load, that's effectively what happened. Except worse: in Node.js, the randomness pool was never even filled.
This is the story of CVE-2026-73567, a vulnerability I reported and got credited for after independent reproduction by the maintainer, and what it teaches us about the whole class of weak-entropy key compromises.
The discovery

While auditing key-generation paths in SM2 (the Chinese national elliptic-curve standard, mandatory in regulated industries there), I noticed something odd in the dependency chain: a big-number library harvested entropy from Math.random() — the non-cryptographic, browser-grade PRNG — at module initialization, and used it to seed its internal state. That state then fed private-key generation.
The publicly discussed impact assumed ~128 Math.random() calls at startup. When I built an instrumented Node victim and counted, the real number was zero. V8 defers Math.random()'s pool initialization in a way that left the seeding path reading predictable values — the effective root cause was a clock-only seed, and the advisory's root cause was corrected accordingly.
The consequence: given roughly a millisecond-scale time window, private keys were recoverable by enumeration. Sub-second. On an ordinary laptop.
And it didn't stop at static keys. The same RNG stream also fed signing nonces and ephemeral encryption keys. That means a key used only for signing was equally recoverable, and ciphertext from affected versions could be decrypted without the key.
What happened next

The maintainer independently reproduced my findings, corrected the advisory's root-cause description, expanded the impact statement (nonces, ephemerals), and shipped a fix requiring caller-supplied CSPRNG.
My credit line — "Guigui Wang (Correctover)" — is now part of the public advisory.
Versions before the fix remain vulnerable forever. Every key generated by an unpatched build in a predictable-time window should be considered compromised.

This is a class, not an incident

One library got caught. But weak entropy is a systematic failure mode across the key-management stack:
V8's PRNG (Math.random(), xorshift128+ / MWC1616 eras) can be fully state-recovered from a handful of consecutive outputs — meaning any JS wallet or signing code that ever touches non-CSPRNG randomness is one observation away from compromise.
Historical events (Randstorm-class bugs, 2014-era wallet RNG flaws) show the same pattern repeating across ecosystems.
Cross-address clustering: weak-RNG victims often reuse exposed material across chains and address types, turning one bad key into a trail of them.
The SM2 ecosystem is structurally exposed here: guomi compliance pushes SM2 into places where the surrounding JS/Node key hygiene was never designed for it.
If your product generates keys, signs, or encrypts — in JavaScript especially — the question isn't whether your crypto is strong. It's whether your entropy path is.
What we do about it

At Correctover we recover keys from weak entropy — to prove the exposure before someone malicious does, and to build evidence that holds up:
Black-box weak-entropy health checks on key generation and signing paths
Real recovery demonstrations in isolated environments, with signed, timestamped evidence receipts (Ed25519 + RFC 3161) — findings a court or auditor can verify without trusting us
Coordinated disclosure done right: the advisory process above is our reference case
If you build wallets, custody, or exchange infrastructure and want your entropy path audited against this exact attack class, reach out: [email protected].
Guigui Wang is the credited reporter of CVE-2026-73567 (GHSA-vh45-f885-3848). Correctover builds runtime verification and evidence infrastructure — receipts over promises.#security #cryptography #blockchain #web3 #software #coding #development #engineering #inclusive #community
Your keys are weaker than your cryptography: CVE-2026-73567 and the dead RNG that seeded SM2 keys
#security #cryptography #community #software #coding #development
Dev Community @[email protected]
2026-10-25
A place is the easiest thing in the world to describe and the hardest to describe without giving it away. That is what makes places such a good category for this kind of game. Everyone knows a market, a ferry or a launderette, and everyone has a different memory of it. These 30 imposter game words about places are picked for that mix of familiarity and surprise.
What makes a place a good word?

A place with a smell, a sound and a routine. A ferry terminal has engines and gulls; a launderette has warmth and a hum. A clue about the sound is true and personal. A clue about the function is safe and obvious. The strongest words allow both, and the table argues about which a clue was.
Around town

launderette
market stall
ferry terminal
bus depot
town hall
car wash
betting shop
roundabout
cash machine
phone box

Leisure and nature

bowling alley
boating lake
allotment
caravan park
observatory
skating rink
beer garden
fairground
ski slope
rock pool

Buildings with a story

clock tower
windmill
castle ruin
lock-up
tollbooth
canal lock
church hall
lighthouse stairs
old cinema
railway footbridge

How do you clue a place?

Use the senses. For "launderette", "warm" or "humming" works. For "ferry terminal", "salt" or "waiting". Avoid the function, because the spy will guess it. And avoid famous landmarks by name, since they identify the word at once.
How does the spy handle a place category?

The spy hears the category and thinks of types: indoor or outdoor, busy or quiet, old or new. The first clue from a civilian narrows these. The risk for a spy is giving a clue that fits only one kind of place. A safe spy says something sensory and general: "busy", "echoey", "bright".
What do civilians do wrong?

They name the activity. If the word is "bowling alley", "pins" is the first clue everyone thinks of. A better clue is the smell of shoes, or the sound of a strike from the next lane. Sensory clues give the spy less and prove more.
How do you play it as a story game?

After the reveal, each player says a memory they have of the place. The table learns how differently the same word lands for people. It is a quiet, warm way to end a round.
How do you add your own places?

Write down ten places from your own neighbourhood, the ones your friends would know: the bakery on the corner, the park with the broken swing, the station café. Local words are the strongest fuel for a spy game online or offline, because every player has a memory of them and nobody outside the group can bluff. Mix them with the list above, and the table will find itself laughing at its own streets.
It also helps to include a few places that are almost the same, like a launderette and a car wash, so the clues overlap and the suspicion grows.
Playing it online and at home

The game deals the words, so you can play who's the spy with a table of three to eight, or twelve around one phone, without preparing anything.
A closing thought

A good place word is a small door into a memory. Use it to let the table in, and give each player a moment after the reveal to say where they last stood in that very place. The stories are better than the scores.
Ahmed Moaz builds Boardit, a free browser game site.#partygames #games #webdev #abotwrotethis #software #coding #development #engineering #inclusive #community
Imposter game words about places: 30 locations that make good clues
#partygames #abotwrotethis #inclusive #engineering #development #games
aburtch @[email protected]
2026-10-26

“In fact there’s a brilliant study that was done by these two guys at Harvard, who are the furthest thing from conservatives—they’re in fact self-identified socialists. And they make this argument that, around the world, levels of police brutality are highest in places where police are fewest. . . A fundamental insight that made me really rethink a lot of what I thought about crime.”
[In addition to this point being entirely unsubstantiated and factually untrue, Gladwell attempts to explain the false claim with contrarian guesswork, again with no evidence supporting it, about how when there are more cops, perhaps police don’t need to use as much brutality and violence and so are nicer.]
More info: https://equalityalec.substack.com/p/why-is-everyone-lying
#GunViolence #ACAB #Police

#gunviolence #acab #police
Dev Community @[email protected]
2026-10-27
The review usually opens with a demo that looks fine. An agent plans four edits, applies them to a workspace on a remote box, and reports success; the tests are green and everyone relaxes. Two hours later a human's refactor is gone, and nobody can point at the request that removed it. Is that a model problem, a server problem, or a protocol problem?
I think it is a protocol problem almost every time, and I want to make the case with an executable fixture rather than an architecture diagram. Below is the event order I keep reconstructing in reviews, the invariant it violates, and a small simulator that will fail your design for you. Everything here is a model of a system, not a benchmark of a vendor.
1. The event order that silently wins

A planner reads the workspace at revision 0 and emits three steps against app.py. Step 1 applies and the workspace moves to revision 1. While step 2 is in flight, either a human edits that file or the session is re-routed to a different model that re-plans the remainder; both are ordinary events, not incidents.
Step 2 still carries the content hash it was planned against. If the executor applies patches by path without checking that hash or the revision, the write lands on content the planner never saw, and the old bytes vanish. Nobody gets an error, because a patch is not a request — it is a claim about a state that may already be false.
The failure is invisible precisely when it is most expensive. The agent's summary says "updated handler and tests", the test run passes because the overwritten hunk was unrelated, and the loss only surfaces at the next merge. Who is supposed to notice that?
2. The invariant, stated once

No step may be applied unless the state it was planned against is still the state it is applied to, or the step has been explicitly rebased onto the new state.
That is it. Note what the invariant does not say: it does not say a step is correct, and it does not say a retried step is safe. A revision fence prevents stale acceptance; idempotency prevents double application. Teams routinely build one, assume they have the other, and then argue about whose bug it is.
3. Declared assumptions

One writer per file at a time; concurrent multi-writer edits are out of scope and need a merge protocol, not a fence.
The workspace has a monotonic revision counter and a per-file content hash that are both persisted with the workspace itself.
A step is planned from a readable snapshot and carries (step_id, base_rev, path, pre_hash, patch).
Execution may be preempted at any point between "patch written" and "client received the result".
Model identity may change inside a session, because routing, fallback, or a free-tier allowance running out can move you to another model without warning.

4. Data flow and failure domains

There are three state holders and they fail independently: the planner's context (lossy, model-dependent), the executor's workspace (authoritative, preemptible), and the client's view of progress (optimistic, retried). The only durable truth is the workspace plus whatever journal you persist alongside it.
Failure domains worth separating in review: stale plan (planner state diverged), lost ack (executor applied, client did not learn), duplicate delivery (client retried an applied step), and re-plan drift (a new model emits steps against an old base). They need different mechanisms, and a single retry counter hides all four.
5. The fixture

This is deterministic Python with no model calls, so the verdicts below are properties of the protocol, not of any provider.
# fence_sim.py - deterministic, no LLM involved
from dataclasses import dataclass
@dataclass(frozen=True)
class Step:
step_id: str
base_rev: int
path: str
pre_hash: str
patch: str
class Workspace:
def __init__(self):
self.rev = 0
self.files = {"app.py": "v0"}
self.journal = set() # persisted with the workspace
def hash(self, path):
return self.files
[path] def write(self, path, content):
self.files[path] = content
self.rev += 1
class Executor:
"""fence: 'none' | 'plan' | 'step'; dedupe: journal-backed idempotency"""
def __init__(self, ws, fence="step", dedupe=True):
self.ws, self.fence, self.dedupe = ws, fence, dedupe
self.plan_rev = None
def plan(self, rev):
self.plan_rev = rev
def stamp(self, s):
if self.fence == "step":
return Step(s.step_id, self.ws.rev, s.path, self.ws.hash(s.path), s.patch)
if self.fence == "plan":
return Step(s.step_id, self.plan_rev, s.path, s.pre_hash, s.patch)
return s
def exec(self, s):
s = self.stamp(s)
key = (s.step_id, s.base_rev)
if self.dedupe and key in self.ws.journal:
return "deduped"
if self.fence != "none":
if s.base_rev != self.ws.rev:
return "rejected:stale_rev"
if self.ws.hash(s.path) != s.pre_hash:
return "rejected:pre_hash"
self.ws.write(s.path, s.patch)
if self.dedupe:
self.ws.journal.add(key)
return "applied"
Two lines deserve attention. The journal lives in Workspace, not in the executor, because an in-process dedupe set dies with the server that was preempted — which is exactly the trap. And stamp is where fence granularity is decided, so you can argue about it in one place.
6. Injecting the three failures

Run the same three scenarios across fence modes and record the verdicts. The interference classes are injected explicitly, so the denominator is the number of injections, not the number of suspicious log lines.
def scenario_concurrent_edit(fence):
ws = Workspace(); ex = Executor(ws, fence=fence); ex.plan(ws.rev)
s1 = Step("s1", 0, "app.py", "v0", "v1")
s2 = Step("s2", 1, "app.py", "v1", "v2")
assert ex.exec(s1) == "applied"
ws.write("app.py", "human-refactor") # interference: rev 2
return ex.exec(s2)
def scenario_preemption_retry(fence):
ws = Workspace(); ex = Executor(ws, fence=fence)
s1 = Step("s1", 0, "app.py", "v0", "v1")
ex.exec(s1)
# ack lost; client replays s1 against a fresh executor, same persisted workspace
return Executor(ws, fence=fence).exec(s1)
def scenario_replan_drift(fence):
ws = Workspace(); ex = Executor(ws, fence=fence); ex.plan(ws.rev)
ex.exec(Step("s1", 0, "app.py", "v0", "v1"))
ex.plan(ws.rev) # new model re-plans from rev 1
return ex.exec(Step("s2", 0, "app.py", "v0", "v1-tail"))
Expected output, because the simulation is deterministic and calls no model:
fence=none concurrent_edit -> applied preemption_retry -> applied twice replan_drift -> applied
fence=plan concurrent_edit -> rejected:stale_rev preemption_retry -> rejected:stale_rev replan_drift -> rejected:stale_rev
fence=step concurrent_edit -> rejected:stale_rev preemption_retry -> rejected:stale_rev replan_drift -> applied
dedupe on concurrent_edit -> rejected:stale_rev preemption_retry -> deduped replan_drift -> applied
Read the second and third rows together, because that is the argument. A plan-level fence turns every retry into a spurious rejection and every legitimate re-plan into a dead end; it is loud, but it is loud in the wrong places. A step-level fence plus a persisted journal gets you the two properties you actually want, and it costs you a durable set of (step_id, base_rev) keys.
7. Making it a property, not a demo

Three scenarios are an anecdote. Turn them into invariants and let a random interleaving search hunt for violations — this is the part I would block a design review on.
def invariants_hold(ws, results):
# P1: every applied step saw base_rev == rev at apply time
assert all(r.rev_at_apply == r.base_rev for r in results if r.status == "applied")
# P2: journal is append-only per (step_id, base_rev)
assert ws.journal == set(ws.journal)
# P3: no path content was replaced by a step older than the current rev
assert all(r.base_rev <= r.rev_at_apply for r in results)
Then fuzz: shuffle {human_edit, preempt, retry, replan, duplicate_delivery} over a fixed step list, run 5,000 seeds, and assert P1 and P2 for every seed with fences on. Run the same search with fence="none" to extract a minimal counterexample, and put that event order in the PR description as the regression case. A protocol claim without a counterexample search is a preference.
8. Where the free tier changes the arithmetic

If your executor is a shared, preemptible environment and your planner can move between models at any time, then re-plan drift and lost acks are not edge cases — they are the steady state. That is the actual architectural consequence of running agents on free resources, and it argues for cheap, persisted fences rather than expensive coordination.
I use MonkeyCode as the concrete instance of that environment in this review: it is an open-source coding agent whose operator supplies free model access (currently advertised as a 10M-token allowance) and a free server option. Treat those numbers as operator-supplied and re-verify them on the project page before you design around them, because allowances and routing change faster than any architecture does. My interest here is narrow: a free server makes preemption ordinary, and free model access makes mid-session re-routing ordinary, so both of my injected interferences become Tuesday.
Disclosure: This article was prepared as part of MonkeyCode's product outreach.
9. Tradeoffs I would write down
MechanismBuys youCosts youFails whenNo fenceThroughput, simplicitySilent lost updatesAny concurrent editPlan-level fenceLoud, cheap rejectionRe-planning whole plans, spurious retriesModel swap or long plansStep-level fencePrecise staleness detectionA re-stamp on every dispatchSemantic overlap between stepsPersisted journalIdempotent retry across preemptionDurable key storage, growth controlJournal not persisted atomically with the writeCheckpoint per stepFast compensationStorage, restore latencyLarge binaries, long test suites
10. Verdicts: reject, replay, or compensate
Event orderCorrect verdictWhyStep arrives, base_rev < current rev, no overlapReject, re-plan from current revThe plan is stale; the patch is not recoverableStep arrives, journal contains (step_id, base_rev)Replay the stored resultThe work is done; the ack is what was lostStep applied, tests for touched files failCompensate to the checkpointFence passed, semantics did notNew model re-plans mid-session from current revAccept if re-stamped and preconditions holdDrift is expected, staleness is notTwo steps with overlapping hunks in one planReject the plan at admissionA fence cannot order siblings
11. What I would change next

Persist the revision counter, file hashes, and journal in one atomic write, so a crash cannot leave a patch without its key.
Stamp base_rev at dispatch, never at plan time, and log both values — the delta is your drift signal.
Bound the journal by session and drop it only after a checkpoint the workspace itself can prove.
Run the fuzz job in CI with fences on, and store the minimal counterexample from fence="none" as a named regression seed.
Add a sibling-overlap check at plan admission, because per-step fences order nothing within a plan.

12. Limits, and who should skip this

The fixture models file-level hashing and a single writer; it says nothing about merge semantics, and it does not evaluate whether a patch was any good. If your model swap also changes plan quality, this protocol will happily accept a worse plan that happens to be revision-correct. That is a separate evaluation problem, and no fence will solve it for you.
Skip this if your agent is single-turn and single-file with a human watching every apply, if your platform already gives each step an atomic worktree or VM snapshot, or if you cannot persist a journal durably — half of this mechanism without the journal is worse than none, because it rejects retries without making them safe.
So here is the question I would leave in the review thread: which event order in your system breaks the invariant — a human edit racing step two, an ack lost after the write, or a re-plan against a stale base — and for that specific order, should the executor reject, replay, or compensate?#ai #architecture #distributed #testing #software #coding #development #engineering #inclusive #community
Treat a Coding-Agent Step as a Revision-Fenced Command, Not a Prompt
#ai #community #software #coding #architecture #development
Dev Community @[email protected]
2026-10-26
Context Engineering over Prompt Engineering: Architecting Codebases for AI Agents

TLDR: Agents don't fail because your prompt was badly worded. They fail because your codebase was never designed to be read. The engineers getting compounding returns from agents aren't the best prompt writers. They're the ones whose repos carry the architecture outside their heads: context standards in the repo, strongly typed contracts, and deliberately pruned retrieval. Prompt engineering is the visible 10%. Context engineering is the structural 90%.

The Prompt Ceiling

Somewhere around 2024, the industry's collective mental model of "working with AI" became a prompt box. The skill was asking well. Whole courses, cheat sheets, and prompt libraries flourished on the premise that the delta between a good and bad AI outcome lived in the wording of your request.
For single-shot, single-file tasks, that was roughly true. It also quietly set everyone's expectations, and the expectations are now the problem.
Because in 2026 the work moved. Mid-level and senior engineers aren't asking a chatbot for a function anymore. They're dispatching agents across repositories of hundreds of thousands of lines, agents that read code, edit files, run tests, and open pull requests. And in this regime something counterintuitive happens that every serious team eventually notices: prompt quality stops being the constraint.
You can rewrite your prompt five times. You can role-play the model into a "senior staff engineer persona." Doesn't matter. The agent will still confidently duplicate an internal utility that already existed three directories away, import a dependency your org banned two quarters ago, and couple two modules your architecture has spent three years keeping apart.
Not because the prompt was weak. Because the codebase was opaque.
What an Agent Actually Sees

To understand why, look at what the average large repository exposes to a reader:
Implicit boundaries. "Don't call the data layer from the HTTP handler" exists as a norm, maybe a lint rule, maybe an ADR nobody reads. It does not exist anywhere a code reader encounters while working in the repo.
Unwritten dependency policy. Which libraries are approved, which are banned, which need a security review. Usually a Slack thread. Sometimes a wiki page. Never in the path of work.
Tribal domain models. What a "tenant" means in this system, which fields are PII, which service owns which concept. Spread across PR conversations, onboarding docs from 2019, and the memory of whoever's been here longest.
A new human engineer takes weeks to absorb all this, and that's with onboarding sessions and mentors and the ability to ask someone in the hallway. Then the industry hands an agent a repo checkout and a prompt, and acts surprised when the output violates constraints that were never written down anywhere the agent could read.
Here's the failure as it typically shows up, so common it's almost a template.
An agent is asked to "add a retry mechanism to the notification service." It produces a perfectly reasonable implementation. It also duplicates the exponential-backoff utility that already exists in an internal library, pulls in a third-party HTTP client the org specifically removed after a security audit, and places its new logic in a module that creates a circular dependency with the domain layer.
None of those are coding errors. All of them are context errors. And notice what makes them expensive: the code compiles, the tests pass, and the violations are only visible to someone who already knows the architecture. If that person exists, a senior just spent their verification budget (see the verification trap) catching things a document could have prevented.
Fix 1: Put the Architecture Where the Reader Is

The single highest-leverage change: stop storing architecture outside the repository.
The pattern that's emerged across serious AI-adopting orgs is an in-repo context standard, a known, versioned location that every agent (and every new human) reads first. An AGENTS.md or .context/ directory at the repo root holding the high-level domain model, the module boundaries and their rules, the explicit list of disallowed dependencies, the invariants ("never call X from Y," "all money fields are integers in minor units"), and pointers to the ADRs that matter.
Treated like code, not documentation. Reviewed in PRs. Updated when the architecture changes, in the same commit as the change.
The test for whether this is working is embarrassingly simple. Could a competent engineer who has never met your team make a boundary-respecting change using only what's in the repo? If your honest answer is "no, they'd need to ask someone in Slack," then your agent never had a chance. Neither did your next hire.
The corollary that surprises teams: this investment isn't really for the agent. It pays back twice. Once when the agent's first-draft PR respects the boundaries, and again every time a new human onboards in days instead of weeks. The agent didn't create the need. It just made the cost of not meeting it immediate.
Fix 2: Strongly Typed Contracts

The second fix is about what kind of surface your system presents to a reader.
Context files are necessary but they're advisory. Agents, like humans, follow probability, and prose is soft. Types are hard. The orgs getting the best agent behavior are the ones that make architectural constraints mechanically enforceable:
Explicit interface definitions between modules: generated clients, protobuf schemas, OpenAPI specs for anything crossing a service boundary. An agent that hallucinates a function signature doesn't produce a subtly wrong call that compiles. It produces a type error, immediately.
Strict types end to end. No Any escape hatches at the boundaries, no stringly-typed config. The failure mode shifts from "plausible code that violates the design" to "code that doesn't run," and that shift is the entire ballgame. An error the compiler catches at generation time costs seconds. The same error caught in review costs a senior's attention. Caught in production, it costs six hours or six figures.
Machine-checked policy where you can get it: lint rules and dependency analyzers that encode "this module may not import that one" as something the build fails on, not something the reviewer remembers.
The framing worth internalizing: every invariant you express only in prose is an invariant an agent will eventually violate, charmingly and with total confidence. Every invariant you express as a type or a lint rule is one less thing for the human reviewer to carry.
Fix 3: Prune the Context

The third fix is the counterintuitive one, because everything above has been "give the agent more context." But there's a failure mode on the other side, and mature teams hit it right around the time their context standards start working.
Context dilution. If your instinct is "the agent should know everything," you dump half the repository into the window, and the model now treats your critical domain rules as one equal voice in a choir of 40,000 tokens of boilerplate. The invariant you care about gets the same statistical weight as a vendored dependency's CHANGELOG. The agent saw the rules. It just didn't prioritize them, because you gave it no structure to prioritize with.
The working pattern is deliberate, selective context:
AST-based indexing and retrieval, tools that navigate the code's structure (definitions, call graphs, usages) instead of streaming its text. The agent gets "here are the three functions relevant to this task and their signatures," not "here's 200KB of the module they live in."
The in-repo standard provides the constants: domain model, boundaries, banned deps. The retrieval layer provides the variables: exactly the code relevant to this task, nothing else.
Budget context like a designed API surface, not an all-you-can-eat buffer. Teams that do report the same thing: smaller, sharper contexts outperform complete ones, on cost and quality, almost every time.
The principle underneath all three fixes is one the prompt-engineering era obscured: an AI agent is the most literal-minded new hire your team has ever onboarded. It will not infer your conventions. It will not ask a clarifying question in the hallway. It will follow exactly what's in front of it, at full speed, with total confidence.
Every year your team spent frustrated at new engineers for "not getting it," when the real problem was undocumented architecture and oral-tradition onboarding, is now doubled. Because the agent executes the misunderstanding immediately, at scale, in code.
The Question Behind the Question

If your codebase needs a person to already know your architecture in order to work safely in it, is that an asset or a liability? For twenty years, "the architecture lives in our senior staff's heads" sounded like job security. In an agent-heavy 2026, it sounds like a single point of failure with a Slack handle.

Your Turn

I'd genuinely like to hear how other teams are drawing this line, because the tradeoffs are real and I don't think there's a settled answer.
If a new human developer takes three weeks to understand your architecture, why do you expect an AI agent to infer it from raw files?
Is your codebase structured to guide autonomous agents, or is your architecture stored purely in your senior engineers' heads? And if it's the second one: does that feel like security, or a countdown?
Comment with the ugliest thing an agent did in your repo that turned out to be your architecture's fault. Those stories are more useful than the prompts everyone keeps posting.
Next in the series: Deterministic Safety Gates for Agentic Workflows. What happens when agents stop writing code and start changing infrastructure, and why "the agent tested itself" isn't a safety argument.#discuss #ai #aiagents #softwareengineering #software #coding #development #engineering #inclusive #community
Context Engineering over Prompt Engineering: Architecting Codebases for AI Agents
#ai #community #software #coding #development #engineering
Dev Community @[email protected]
2026-10-26
Short answer: find people through work you can already click on, judge them by five specific pages instead of the homepage, and use the first call to ask what is not included. Those three habits filter out most of the bad options before money comes up.
Where to look

Start with sites you already use in your own industry. Scroll to the footer and look for a "site by" credit. If there isn't one, ask the owner who built it. A referral from someone whose site you can open and poke at is worth more than any directory listing.
Other places that work:
Industry associations, trade-show exhibitor lists, supplier newsletters — the people who serve the same kind of business you run tend to know each other.
Freelance marketplaces and portfolio sites. Use them to collect names, not to decide. A platform rating is not evidence about your project.
Your accountant, your chamber of commerce, a co-working space. Useful mainly when you want someone in your own timezone for calls.
What not to use as a filter: the lowest price, the longest list of services, and any promise about search rankings.
The five pages to open on every portfolio site

Their homepage is the page they spent the most time on. It is the least informative page they have.
1. The busiest page. Find the page with the most repeated elements — a product listing, a services index, a team page. Ask yourself: does the layout hold with three items? With thirty? Does a long paragraph still read, or does the text run into the next block? This is the page that resembles your actual site.
2. The contact or enquiry page. Submit a test enquiry with your real email address. Did you get a confirmation? Did the form tell you clearly when you submitted it empty? A broken form on a developer's own site is the single most useful signal you will get, and it costs you two minutes.
3. The mobile version, on your phone, on mobile data. Not on their office wifi and not in a device simulator. Time how long until you can read the headline, tap the menu open, and try to fill the form with one thumb.
4. The second language, if you need one. Do not check whether the words are translated — check whether the pages are. Click three links from the translated homepage. Do they stay in that language, or dump you back into the default one? Does the product list show the same products?
5. The footer pages. Privacy policy, terms, cookie notice. If they build for customers in Europe or the United States and their own site has none of these, that tells you what will be missing from yours.
Two more checks, thirty seconds each:
Open an address on their site that does not exist — add a few random letters to the end of a page address. A bare server error page means nobody is minding the details.
Read one portfolio entry properly. Does it say what the client needed, what was built, and roughly how long it took? If every entry is a screenshot with no context, you cannot tell what they did and what was already there before they arrived.
One more thing worth doing: portfolios often include sites the person only partly worked on, or maintained rather than built. That is not dishonest, but it is worth asking directly — "what was your part on this one?" A straight answer is a good sign.
The first call: eleven questions

Ask these before you talk about price. The point is not to catch anyone out; it is to find out whether they have done this enough times to have opinions.
1. Who actually does the work? A good answer names the person and says whether any part is subcontracted. A warning sign is "our team" with no names, or a salesperson who will not be involved after signing.
2. What do you need from me, and what happens if it arrives late? A good answer is a written list — logo files, company text, product photos, product data, hosting login — plus an explicit statement that the clock starts when the materials arrive, not when you pay. A warning sign is "just send whatever you have."
3. What will I see first, and when? A good answer is a live preview address with a date attached. A warning sign is "we'll send you screenshots."
4. How many rounds of changes are included, and what counts as a change? A good answer gives a number and a definition: text swaps and colour changes are one thing, a new page or a new feature is another. A warning sign is "unlimited changes" — that is not a policy, it is the absence of one.
5. What is not included? A good answer is a list: domain, hosting, business email, copywriting, photography, translation, ongoing updates. A warning sign is silence, or "everything is included."
6. Whose name is the domain and hosting in? A good answer is yours, from day one, and you get the login. A warning sign is theirs, "for management purposes." This is the most expensive mistake on the list — recovering a domain from someone who stops answering is slow and sometimes impossible.
7. Will I have admin access to the site when it's finished, and can I export the content? A good answer is yes, plus a plain explanation of what you will be able to change yourself. A warning sign is "you don't need access, we handle updates."
8. What happens after launch — what's covered, for how long, and what's billed extra? A good answer defines a window for fixing defects and a rate for everything after it. A warning sign is "free support forever", or no answer at all.
9. What is the timeline measured from? A good answer is a number of working days counted from the date your materials are complete. A warning sign is a confident "two weeks" said before they have seen your content.
10. What would make you turn this project down? A good answer names something real — a deadline they cannot hit, a platform that does not fit, a budget that does not match the scope. A warning sign is "nothing, we can do anything." Anyone who has done this for a while has walked away from something.
11. Can I speak to the client whose site you just showed me? A good answer is "I'll ask them" or "they've agreed to be a reference." A warning sign is every single project being off-limits.
Red flags and green flags

Red flags, in roughly the order they should worry you:
No written scope, or a scope that is one paragraph long.
The domain and hosting stay in their name.
A price far below everyone else, with no explanation of what was cut.
Pressure to decide today.
No preview address — screenshots only.
Guarantees about search ranking, traffic, or sales.
A portfolio where every site looks identical, and none of them is in your industry.
They ask for the full amount up front.
They cannot tell you what happens after launch.
Green flags:
They ask about your business before they ask about colours.
They can show you a site they built that is still running.
They push back on something you asked for, and explain why.
The exclusions are in writing before you ask twice.
They name the person who will do the work.

Payment and paperwork

Two rules that solve most disputes before they start.
Do not pay the full amount up front. Split it against things you can see: a deposit to start, a payment when the preview is up, the rest at launch. Milestones tied to deliverables beat milestones tied to calendar dates.
Get the scope in writing, including the number of pages, who writes the text, who supplies the photos, and what happens if you add a page later. If the document does not mention something, assume it is not included.
Before you contact anyone: thirty minutes of prep

Write these down and the conversation becomes much shorter:
One paragraph on what the business does, who buys, and the single action a visitor should take.
Three sites you like, and one specific thing about each. Not "it looks nice" — "the product table fits forty items on one screen without scrolling sideways."
The materials you can supply today, and the ones you cannot.
A budget range, and a date you genuinely need it by.
Two developers to get quotes from, not five. Comparing five quotes against a one-page brief teaches you nothing.
The quotes you get will only be as good as the brief you send. And a developer who asks you good questions is telling you they have been burned before — that is usually the one worth a second call.#career #freelance #webdev #software #coding #development #engineering #inclusive #community
How to vet a web developer before you pay: which pages to open, which questions to ask
#community #software #webdev #coding #development #engineering
squirrel @[email protected]
2026-10-25

@LeftReddit2 asks if anyone wants anything from the pizza place and everyone just orders stuff in the comments

https://cake.kobel.fyi/c/bestoflemmy@lemmy.world/p/238951/leftreddit2-asks-if-anyone-wants-anything-from-the-pizza-place-and-everyone-just-order

#pizza #bestoflemmy #bestof
onFOSS @onfoss
2026-10-25

Hey everyone!
It's been a while but we're happy to announce that our next event hosted by @aethernaut will take place on the 7th of November.
You can find all the details in the announcement post
https://onfoss.org/news/2026/10/22/Next-event-November-7th.html
Looking forward to seeing you there :blobcatgamer:
#onFoss #foss #openSource #gaming #libreGaming

#onfoss #foss #opensource #gaming #libregaming
Dev Community @[email protected]
2026-10-27
Everyone has a retry story. Mine: an agent that retried a malformed request eleven times before anyone noticed, each attempt replaying the full conversation. The request was never going to succeed — a 400 doesn't heal — but the retry policy didn't care, because it only looked at "did it throw?"
Our working rules now:
Retry timeouts, 429s and 5xx — with backoff, jitter, and the server's Retry-After winning over our schedule.
Never retry 400/401/403. Fail fast, surface it, fix the request.
A retry budget, not just a count: retries get a slice of the task's total budget, then the task fails honestly.
If it dies mid-stream, restart the message cleanly — never append to a half-generated answer.
What I haven't settled: provider 529s / overloaded errors during peak. Retry in place, or fail over to a different model immediately and accept the quality change?
What's your rule set — and which error taught it to you?#ai #llm #discuss #api #software #coding #development #engineering #inclusive #community
What's your rule for when an LLM call should NOT be retried?
#discuss #llm #api #inclusive #engineering #development
PureElement5 @pureelement5
2026-10-26

HAPPY FULL MOON IN TAURUS, EVERYONE!
To say this Full Moon is intense is an understatement. Relationships, values, and old negotiations are back under review. Where have you made yourself agreeable to remain desirable? What have you called compromise because admitting you felt coerced would require a difficult decision? Libra’s shadow knows how to arrange the room so no one sees exactly who is paying for the peace.
Today’s Full Moon brings you to a final choice point. When the ground you trusted to hold you starts to hurt you, and keeping everything in place means there is less and less room for you, intense reality checks can be seen in the light of day with physical, clear evidence that may be deeply uncomfortable and emotional. What you really want and what you know to be true can no longer pass through the narrow opening you have allowed it. The tension can no longer be sustained. Today the dam breaks. It’s time to revisit the terms. Say what you need without making someone prove their devotion by guessing. Eat, ground yourself, and let your body settle before making a permanent decision under emotional pressure. Ask what would actually keep you safe, and what merely keeps someone else within reach.
Together we rise
Suze 🔥
Rencontres intl Paris/Berlin @ripb
2026-10-26

New ways, new ideas 💡
The Rencontres Internationales Paris/Berlin will take place in Paris from 23 to 29 November 2026. An event open to everyone, inviting us to reflect together on contemporary cinema and the visual arts. The full programme will be announced soon.
🔗 All info: art-action.org/pro
Allen Hutchison @[email protected]
2026-10-26

Tokens Over Hires

In the middle of September I ran ccusage against every Claude Code session on my laptop since May. It walks the local logs, counts the tokens, and prices them at what the API would have charged. I expected a big number. What came back was about twenty billion tokens and just under fourteen thousand dollars, across every project I’d touched in four months, with most of it going to Pepper, which is now open for signups, so go check it out. Nineteen billion of those tokens were cached reads.
I sat with that for a minute. Fourteen thousand dollars is real money. At my current pace it works out to roughly thirty thousand a year. I could triple it and spend a hundred thousand dollars a year on tokens, and that still isn’t one engineer. In exchange, Chris and I have shipped more code than I’ve shipped in any stretch of my career. I wrote in September that the two of us merged 657 pull requests in our first thirty days with a budget instead of a platform team. When I put the ccusage number in those terms on a panel, it came to about a dollar fifty a pull request.
That number is what my laptop would have cost at API prices, and it isn’t what we actually pay. Here’s the whole bill for both of us. Two Codex subscriptions, one each, are $200 a month. Anthropic is $550 a month: a Max plan for me and Chris, plus two Vycari team seats, one for Chris and one that runs our automation. I have an Ollama subscription at $200 a year. Greptile is about $1,500 a month. All in, that’s a little under $2,300 a month, or about $28,000 a year, for both founders and every pipeline we run. It still isn’t one engineer.
The obvious conclusion is the one a friend reached when he heard the figure: if code is that cheap, just get more tokens. I thought so too, for about a day. Then I looked at what was actually slowing us down, and the token budget wasn’t on the list.
The Constraint Is Attention
Every agent I run needs things from me that tokens can’t buy. It needs a plan approved before it starts. It needs its pull request read when it finishes. When it hits something it can’t decide, it escalates, and somebody has to be there to answer. None of those steps is expensive on its own. The problem is what happens when I run enough agents that the steps overlap.
When I run too many agents, the cost goes up a little and the risk goes up a lot. The biggest thing that’s slipped past us so far was how we managed database connections. It got out of hand, a little at a time, while my attention was on other pull requests, and eventually it caused an outage. Chris had to roll forward while I was out of town, and I spent the following week building a proper database abstraction layer. He put it more bluntly than I would have: the thing that kills us is splitting our attention. That’s when stuff slips through.
When people ask how we decide what to spend, I give them the order. Optimize for human time, because that’s the scarcest thing we have. Then money, because that’s the second scarcest. Then everything around agent time. “I can waste agent time all day. I don’t care.”
So the number that limits us is how many agents one person can supervise well at the same time. I don’t have a precise figure for that ceiling. I know I’ve been over it, because I can feel the difference between a day when every pull request got a real read and a day when I was skimming to keep up.
Another friend told me recently about engineers at his company running up bills in the thousands to build simple internal copies of SaaS tools. His reluctant guess was that they just aren’t as good at using agents yet, and that it’s a skill people have to develop. I don’t know what they’re doing differently. It doesn’t sound like token maxxing, which I’ve never really understood either. I’d love to sit with engineers who run up giant bills and just watch. My guess is they’re using the agents inefficiently, and that what’s missing is supervision, which a bigger budget won’t fix.
Building for More Agents per Person
Almost everything I’ve built since the summer has been an attempt to raise that ceiling, and almost none of it has been about spending less.
The pipeline I described in The Agent That Never Merges is the first piece. Agents open pull requests continuously and never merge them, which means the supervision cost per pull request is bounded at one careful read. The pipeline absorbs the rest: triage, planning, the first round of review comments, the retries. I only see the work once it’s in a state worth my attention.
The second piece is where the work lives. I wrote about pulling Pepper apart into small, bounded repositories to keep CI fast and give agents less to load. It mattered just as much for my attention. An agent working in a repository with one job produces a pull request I can evaluate in one sitting.
We’re up to fourteen repositories now. Last week I moved our iOS app out of the monorepo into its own. That was 150,000 lines of code, and nobody noticed except Chris, who had to wait a day to land his next batch of iOS changes. Agents make refactors that size easy. Having the CLI and the iOS client in their own repositories also forces us to keep good API definitions between the server and its clients.
The third piece is delegation inside the agent layer itself. I run two Claude Opus 5.5 orchestrators on medium effort. One is the UTL, for uber tech lead, and its job is to spawn subagents that build features. The other is what I call the focused worker, and its job is working with me. It catches the manual tasks that come out of the UTL’s pull requests and keeps them in a ledger. Then we work through them together: systems changes, bringing up new platforms, migrating data, anything that needs my level of access and oversight. Everything else goes to a subagent under the UTL, Opus for design docs and code reviews, Sonnet for implementing a feature from a design doc. Every one of these agents can consult a model a tier above it as an advisor, and they all share a wiki for notes.
Anthropic is now advertising much the same pattern with Claude Projects, and I’m happy to see others arriving at the same answer. Chris has been building a loop that babysits open pull requests through review until they score well enough to be worth a human’s time. Each layer like that turns a job I used to do by hand into something I check. The ceiling goes up one delegated task at a time.
The Token Budget Was the Easy Problem
There was a week in September when the meter really was the constraint. We ran through our free credits and paid about $120 in overage. Then AutoDev ate the whole Vycari quota, and I did server cleanup by hand because I couldn’t do anything else.
Most of that was self-inflicted. I’d started with Fable as the orchestrator, with no cap on context, and burned a week’s quota in three days. The setup above fixed it. The orchestrators run on medium effort, and the cheaper model does the implementing. Opus answers the reviews because Sonnet is too literal about them, and a literal reading turns two review cycles into twelve. Every agent auto-compacts at 200K tokens, because Anthropic charges more for context past that point. With that setup, and the work spread across parallel sessions, I find it hard to spend all of my quota. My goal now is to hit 99% of it every week just before it resets. I keep a list of research projects, and if I have quota left 24 hours before the reset, I spin one up. That isn’t the same as maxing out tokens. I’m not trying to use as many as possible. I’m trying to use all the ones I’ve already paid for.
There’s also a second account on the same machine. Claude Code reads a CLAUDE_CONFIG_DIR environment variable, so two shells with two config directories give you two accounts side by side. The second one runs the AutoDev and code review pipelines, and those use up its quota every week, so it isn’t a fallback for my own sessions. When I do run short, I supplement with other labs’ plans. Every one of those fixes took an afternoon or less. None of the supervision problems above has had an afternoon fix.
Where the Money Actually Goes
While I had the numbers in front of me, I looked at where development spend actually lands, because it isn’t where I expected either.
Development tokens currently run about ten times what the product itself consumes, even with real people using it. Building the thing costs more than running it. That won’t last. The feedback from our private beta has been really good, and we now open Pepper to a limited number of new signups every day, so product usage is rising quickly.
Most of what we actually pay goes to code review. Subscriptions are the cheap way to buy tokens if you’re willing to hit limits, so they’re the smaller line. Greptile reviews every pull request we open, and at about $1,500 a month it’s our biggest single expense. We both think it’s worth it, because it’s the layer that lets the never-merge pipeline run without me reading every first draft.
In October I tested that. I spent a few days building a cheaper reviewer to replace it. I came out the other side saying, “I think we should just pay for it because I can’t do it cheaper.” What I could change was how often we call it. The agents kept asking for a re-review before they’d fixed anything. Because every repository shares a common dev environment, the fix went in once: our pull-request skill now has agents run /simplify and then /code-review before they’re allowed to open a pull request. On many of our repositories, our own reviewer also does the first round and only then calls Greptile. My goal is a pipeline where Greptile’s reviews come back with nothing to say. We’re not there yet, but we get a little better every week.
I’d rather pay for review than have a second person do it, and the reason isn’t salary. The person would need supervising too, because review is a job I’d have to check, not one I can hand off.
What a Hire Is For Now
Five years ago, if I’d been getting a product like this ready for market, I’d have been hiring twenty to fifty engineers. The work would have needed that many hands, and most of what they’d have done was write code. Today the code is the cheap part. If I bring someone in to write code, I’ve added a person who needs plans approved and pull requests read, which is the exact resource I’m short on. A hire whose job is output adds coordination faster than it adds capacity.
I said on a podcast that came out last week that the code I’ve written would have cost about fifteen thousand dollars at API prices, and that I couldn’t hire engineers for that money. That’s true. The engineers I’d still want are a different kind from the ones I hired at Google. We need a few more people who can herd agents, not fifty.
The engineering hire that adds capacity is a different shape. It’s someone who can own a bounded service whole. Here’s the interface, here’s everything it needs to do, let me know when it’s done. That person brings their own supervision. They run their own agents, read their own pull requests, and answer their own escalations, and the only thing that crosses the boundary between us is the contract. Supervision divides along the interface instead of piling up on one person. That’s a tech lead’s job, and it’s the only kind of engineering hire I can see that raises the ceiling instead of lengthening the queue.
That raises a fair question about how anyone grows into that job now, which I tried to answer in The Questions Are the Job. The other advice I give is to work on open source. I’ve met people who showed they could work really efficiently with agents through open source projects, Gemini CLI in particular, and some of them ended up being hired onto my teams. Open source has its own problems right now. But if you show up as a thoughtful engineer with features or bug fixes that are well reviewed, well tested, and bring value to the project, I think you’ll be welcome. That’s one of the reasons I decided to open source the Pepper CLI.
The first hire probably isn’t an engineer at all. I’ve said this a few times now, including on stage at a panel in September. Neither Chris nor I are go-to-market people, and I may hire one before I hire another engineer. I can create piles and piles of code, even relatively good code. What I can’t do is agentically acquire customers. (Did I mention that Pepper is open for signups now?) Someone in marketing came up after the panel and told me I’d validated her existence.
The Third Trend
I’ve watched this happen twice before. Open source developer tooling made it so a small team didn’t need to buy or build its own compilers, databases, and frameworks. Cloud infrastructure made it so that team didn’t need to own hardware or a data center. Each time, the number of people you needed to start something real dropped, and the skills that mattered shifted toward the people who understood systems well enough to compose what was suddenly free.
Agentic tools are the third one. Anyone with a good idea can now get from concept to production on a budget that would have been a rounding error in a Google planning cycle. But the constraint didn’t vanish. It moved, the same way it did the last two times, toward the people who understand systems design well enough to drive the agents and notice when something has slipped through. I wrote a year ago that management skills were going to carry over to working with agents. I didn’t expect to be proving it with a two-person org chart and fourteen thousand dollars of tokens.
This isn’t only a small-company problem. At Google it was hard to get more than a few changes in a day, because each one waited on code review. I’ve talked to engineers there who now do all their work in experimental directories that don’t require review, then port it back to their team’s repository at a pace the review process can keep up with. That’s what happens when you don’t manage for human attention. Productive people spend their cycles waiting on the process.
When other companies ask me what to change, my answer has become: drive until human attention is the scarce resource, then build for that. If you’re reading your own ccusage number and wondering whether the answer is more tokens, look at where your attention went first. For us the answer has been more interfaces. Those are the places where one person’s supervision ends and another’s begins, or where an agent takes over a job one of us used to do by hand.
#Agents #AI #Developer #Startups

#startups #developer #ai #agents
TrustedAlpaca @trustedalpaca
2026-10-25

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.
What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.
Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.
As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.
#php #cybersecurity #patchmanagement #php2shell #wordpress

#php #cybersecurity #patchmanagement #php2shell #wordpress
DoomsdaysCW @[email protected]
2026-10-26

#UK - #Fireside #Storytelling in The #DooneValley
27 October 2026 / 5:30pm - 6:30pm
#LornaDooneValley, #Malmsmead, EX35 6NU
"As part of the #DarkSkiesFestival Lorna Doone Valley will be hosting a children's fireside story telling session. Join our team and listen to enchanting stories under the stars and around the fire. The event will be taking place in our new play area and forest school. Two sessions to choose from 5.30pm - 6.30pm & 6.45pm - 7.45pm £5 per child."
FMI:
https://www.exmoor-nationalpark.gov.uk/exmoor-for-everyone/stargazing-and-dark-skies/exmoor-dark-skies-festival/dark-sky-festival-events/dsf-events-26/fireside-storytelling-in-the-doone-valley
#LunarPunkMonday #Stargazing #Storytelling #UKEvents #ForestSchool #SpendTimeOutdoors #ExmoorDarkSkiesFestival #Exmoor

#uk #fireside #storytelling #doonevalley #lornadoonevalley #malmsmead
Circuits in the Woods @[email protected]
2026-10-25

Buzzing is typically not a good thing in electronic music, but that's our brains right now after yesterday's Circuits in the Woods. We're still processing everything we saw and heard.
To the artists, venues, volunteers, supporters, and everyone who came ready to hear something unexpected: THANK YOU. You made downtown Brattleboro a wonderfully strange place to be.
Have a favorite moment or photo? We'd love to see it.
#CircuitsInTheWoods #ElectronicMusic #Brattleboro #Vermont #CITW

#circuitsinthewoods #electronicmusic #brattleboro #vermont #citw
The Guardian Feeds @[email protected]
2026-10-25

DanceRites 2026: First Nations performers bring story, song and dance to Sydney Opera House – in pictures
By Liz Ham
More 300 First Nations dancers gathered at the Sydney Opera House forecourt over the weekend to compete in the DanceRites festival, a national competition celebrating Aboriginal and Torres Strait Islander culture. Now in its ninth year, DanceRites invites everyone to join in the living history of Tubowgule (the Dharug word for Bennelong Point), a place where story, song and dance has long been shared. This year’s event honoured the legacy of Aunty Rhoda Roberts, who died in March and was formerly the head of First Nations programming at the Sydney Opera House
https://www.theguardian.com/australia-news/gallery/2026/oct/25/dancerites-2026-first-nations-performers-bring-story-song-and-dance-to-sydney-opera-house-in-pictures
#Australianews #Dance #Music #Culture #Stage #Worldnews #TheGuardian #LizHam

#australianews #dance #music #culture #stage #worldnews
Dev Community @[email protected]
2026-10-25
In 2016, Microsoft released a chatbot called Tay on Twitter. Within 16 hours, it had been shut down for posting racist, sexist, and antisemitic content. The postmortem blamed “coordinated attacks” by trolls. That framing was technically accurate and completely wrong. Tay didn’t break. Tay did exactly what it was designed to do: learn from the conversation it was placed in. The conversation it was placed in was a cesspool. Tay was a mirror, and the mirror worked perfectly.
Nearly a decade later, we’re still having the wrong conversation about what models reveal. The discourse treats AI as an entity with properties: is it aligned? Is it safe? Is it biased? These are questions about the mirror, not the reflection. The more interesting questions are about what the reflection shows us: about our data, our preferences, our blind spots, and the things we didn’t know we were collectively doing until a model did them back to us at scale.
Here’s the claim I want to test: AI models are not windows into machine intelligence. They are windows into human behavior, aggregated, compressed, and served back to us with a confidence that makes us mistake the reflection for an external truth. The most important thing AI reveals is not what machines can do. It’s what we already do, at a scale we’ve never been able to see before.
The Mirror Was Always There. AI Just Made It Legible.
Humans have always been reflected back to themselves by their tools, but the reflection was always slow and partial. A novel reflected its author. A newspaper reflected its readership. A city reflected its inhabitants. But the reflection took years to develop, and it was filtered through gatekeepers who decided what was worth showing.
AI compresses the reflection cycle. A model trained on a year of internet text reflects that year back to us in hours. A model fine-tuned on user feedback reflects user preferences back to us in a single deployment. The mirror is faster, wider, and less filtered, and it shows us patterns we couldn’t see before because we never had a technology that could aggregate human behavior at that scale and serve it back in a coherent form.
What does the mirror actually show? Let me give you specific examples, because the abstract version is useless.
The distribution of human patience.
When you train a model on human conversations, you see how quickly humans give up on unclear interactions. You see the average number of turns before a user rephrases, the average number of messages before a user abandons, the average tolerance for a response that doesn’t directly answer the question. These distributions are not what most designers assume. Users are more patient than designers think in some contexts and less patient in others, and the patterns are consistent across languages and cultures in ways that surprised everyone who measured them.
The shape of human curiosity.
When you train a model on search queries, you see the actual topology of human curiosity. Not what people say they’re curious about, but what they type at 2 AM. The distribution is flatter, stranger, and more repetitive than any survey would suggest. A small number of questions account for a huge fraction of queries, and the long tail is enormous. This is the mirror showing us that curiosity is much more concentrated than our cultural narratives about it suggest.
The limits of human consistency.
When you train a model on human judgments, you discover how inconsistent humans actually are. The same person, asked the same question in a slightly different framing, gives a different answer at rates that would be alarming if we hadn’t built a whole society on the assumption that we’re consistent. The mirror shows us that human judgment is heavily context-dependent, and that most of what we call “preferences” are actually “situational responses” that we mistake for stable traits.
The distribution of human writing.
When you train a model on human text, you discover that a small fraction of the corpus accounts for a large fraction of the unique content. Most writing is derivative of a smaller set of writing. The mirror shows us that the diversity we imagine in human expression is partially an illusion, sustained by the fact that we never had to measure it before.
These aren’t facts about models. They’re facts about us, revealed by models.
The Sacred Cow: “AI Has Biases That We Should Remove”
Here’s the belief I want to dismantle, and it’s the load-bearing assumption of nearly every AI safety and fairness conversation.
The claim goes like this: AI models have biases, biases are bad, and the solution is to remove them.
This framing is wrong, and it’s wrong in a way that produces bad engineering and worse policy.
Here’s the problem. AI models don’t have biases. They reflect biases. The biases are in the training data, and the training data is a sample of human behavior. Removing the bias from the model doesn’t remove the bias from the data. It just hides it.
What actually happens when you try to “remove bias” from a model:
You filter the training data to exclude certain patterns.
You fine-tune the model to refuse certain outputs.
You add safety layers that override the model’s default behavior.
Each of these moves makes the model appear less biased on the specific metrics you’re measuring, while leaving the underlying distribution intact. The model still learned the biased pattern. It just learned to hide it. And the hiding is now invisible, which makes it harder to study, not easier.
The contrarian take: the mirror is more useful when it shows us the ugliness, not when it hides it. A model that reflects the full distribution of human behavior, including the parts we don’t like, is a tool for understanding what we’re actually doing. A model that’s been scrubbed of everything uncomfortable is a tool for pretending we’re not doing it.
This doesn’t mean we should deploy unfiltered models. It means we should distinguish between two different goals: building a model that behaves well (which requires filtering) and building a model that tells us the truth about human behavior (which requires not filtering). These are different products for different purposes, and conflating them gives us the worst of both.
If you want to understand human behavior, study the unfiltered mirror. If you want to build a product that behaves responsibly, filter the outputs. Just don’t pretend the filtered outputs tell you what humans are actually like.
What the Mirror Reveals About Builders
The mirror doesn’t just show users. It shows builders.
Here’s the part that gets less attention and matters more over time. The models we build reflect not just the data but the choices we make about the data. Every decision about what to include, what to exclude, what to weight, and what to ignore is a decision that shapes the reflection.
Consider what a model reflects about the team that built it:
The choice of training data reflects the team’s assumptions about what “counts” as legitimate text. Mostly English? Mostly Western? Mostly published? Each of these is a choice that encodes a worldview.
The choice of fine-tuning data reflects the team’s assumptions about what good behavior looks like. Helpful? Refuse? Deferential? Each of these is a choice.
The choice of evaluation reflects the team’s assumptions about what success looks like. Accuracy? Safety? Engagement? Each of these is a choice, and most teams never state them explicitly.
The choice of deployment reflects the team’s assumptions about who gets to use the model and how. Free? Paid? API? Consumer? Each of these shapes who is reflected in the next round of data.
The mirror, in other words, is not just reflecting human behavior. It’s reflecting the specific humans who built the model, through the specific choices they made about what to reflect.
If you want to know what a model will do, don’t read the model card. Read the training data provenance, the fine-tuning guidelines, the evaluation criteria, and the deployment terms. These are the mirrors of the team’s priorities, and they’re more informative than any technical spec.
What the Mirror Reveals About Users
The mirror also shows what users are actually doing, which is often different from what they say they’re doing, and very different from what product teams assume.
Concrete examples:
Users are more repetitive than they think. In many AI products, a small fraction of users ask a small fraction of questions, over and over. The “long tail” of use cases is often thinner than the design team imagines.
Users are more forgiving than product teams assume. When a model makes a mistake, users often correct it and keep going. The assumption that mistakes will cause churn is often wrong, especially for high-value use cases where the model is genuinely useful.
Users are less interested in features than product teams hope. The features that get talked about in product reviews are often not the features that drive usage. Usage is dominated by a small number of core workflows, and the rest is noise.
Users are more sophisticated about the model’s limits than product teams assume. Users develop intuitions about where the model is reliable and where it isn’t, and they route their usage accordingly. The “trust” problem is often a UI problem: the model doesn’t signal uncertainty, so users don’t know when to trust it.
The mirror is useful for product teams because it shows them what users are actually doing, not what the team imagines users are doing. The gap between those two is where most product mistakes live.
What To Actually Do
Three moves, concrete enough to start on Monday.
Study the failures, not just the successes.
When you evaluate a model, look at the cases where it failed, and ask what the failure reveals about the data. A model that hallucinates on certain topics is telling you that the training data on those topics is thin. A model that refuses certain requests is telling you that the safety tuning has a specific shape. The failures are the mirror at its most useful.
A simple starting point:
def failure_analysis(model, eval_set):
failures =
[] for example in eval_set:
output = model.generate(example.prompt)
if not evaluate(output, example.expected):
failures.append({
“prompt”: example.prompt,
“output”: output,
“expected”: example.expected,
“failure_type”: classify_failure(output, example.expected),
})
return summarize_by_type(failures)
The summary is more informative than the pass rate. The pass rate tells you how good the model is. The failure summary tells you what the model has learned and what it hasn’t, which is what you need to know to improve it.
Audit the training data, not the output.
If you want to understand a model’s behavior, read a random sample of 500 training examples. Not the cleaned, curated examples that appear in the data card, but the raw examples. You’ll learn more about the model’s behavior in an afternoon than you’ll learn from a month of prompt engineering.
Distinguish between the model you want and the mirror you need.
If you’re building an AI product, decide explicitly whether you’re building a product that behaves well or a product that tells the truth about human behavior. These are different goals. A product that tells the truth might be more useful for research and less useful for consumers. A product that behaves well might be more useful for consumers and less useful for research. Pick one, and be honest about which one you’re building.
The Mental Model
Here’s the lens I want you to keep.
AI models are mirrors, not minds. They reflect what we put into them, which is a sample of human behavior, shaped by the choices of the people who selected the sample. The reflection is more accurate than any survey and less accurate than any single conversation, and it reveals patterns we couldn’t see without it.
The interesting question is not whether the mirror is biased. It is. The question is what we want to do with the reflection. We can hide the uncomfortable parts, which makes us feel better and teaches us nothing. Or we can study them, which makes us uncomfortable and teaches us a lot. The choice is ours, and it’s available every time we build a model, curate a dataset, or evaluate an output.
The mirror is not a threat. It’s a discovery. The question is whether we’re brave enough to look at what it shows us.
What’s your read? If you’ve studied model behavior, what’s the most surprising thing the mirror has shown you? And if you’ve built models, what’s the choice you’ve made about what to hide and what to reflect? Drop it in the comments. I’m genuinely curious what patterns others are seeing.#ai #promptengineering #chatgpt #software #coding #development #engineering #inclusive #community
The AI Mirror: What Models Reveal About Us, Not About Themselves
#ai #community #software #coding #development #engineering
Rob Pegoraro @[email protected]
2026-10-26

Weekly output: Archer Aviation, an Italian unicorn, biometric device security, credit-card security

I had a second week in a row of transatlantic travel, this time to Milan. This was my first visit to that city in more than 23 years, and I had barely enough time between work commitments to set aside my laptop for a couple of hours and eyeball the Duomo and the Galleria Vittorio Emanuele II. I realize what a First World problem that is.
10/19/2026: Archer Aviation Touts Completion of ‘No Roads’ Air-Taxi Flight Tour of California, PCMag
Because I’ve spent enough time in the Bay Area for work and personal reasons, a mention in Archer’s announcement about its Midnight electric air taxi flying from Oakland International Airport to the Marina in San Francisco caught my eye–because I know there’s no equivalent to an airport or even helipad in that posh waterfront neighborhood.
10/21/2026: Inside a Unicorn: Lessons from the Journey to Scale, CES Unveiled Milan
My trip to Milan for the Consumer Technology Association’s event there began with a publicist for the Italian Trade Agency asking if I’d like to be on a delegation they were putting together, with flights and lodging included. That seemed like a good networking opportunity, but then I noticed some blank spots on the schedule and asked if CTA could use me in any of them. That led to me quizzing Eugenio Monteleone, chief operating officer of the Milan-based AI startup Domyn, about how that company is charting a different course from other AI developers.
10/23/2026: The phone security feature everyone should enable — and not worry about, The Washington Post
The idea for this piece started with my reading the many confused comments on the passkeys explainer I wrote for the Post two weeks ago. Alas, the comments on this piece suggest that once again, some people will do literally anything before admitting any weakness in relying on memorized passcodes and passwords.
10/23/2026: The best place to save your credit cards, The Washington Post
After too much experience with data breaches and compromised credit cards, I found that this post basically wrote itself. It may not have sold itself, to judge from the comments; once again, I’m seeing a gigantic gap between people who grasp how cryptography works and everybody else.
#advancedAirMobility #ArcherAviation #BayArea #biometricSecurity #CESUnveiled #creditCardAutofill #creditCardFraud #dataBreaches #eVTOL #FaceID #Italy #Milan #Milano #MXP #passwordManagers #TouchID

#advancedairmobility #archeraviation #bayarea #biometricsecurity #cesunveiled #creditcardautofill

2026-10-24

CW: satire of terfism, defacation

Gyns tell me I'm not crazy here. No one I've told about this so far has sympathized with me, but I know radblr is more reasonable than the outside world.
I'm really afraid of moids going into the sewer and eating my shit and drinking my urine. Everyone makes fun of me for this and tells me why I should care when it's bodily waste anyways, but it's my bodily waste and I don't want moids putting it in their mouth.
We can all agree that's perfectly reasonable right? Right? We all know how moids can be about women and we all know that they actually do this. So what is the problem if I do it first? 
I've been reading articles about it and unless you have parasites it's actually not that bad for you and can actually help you absorb nutrients you may have missed before. The only problem is if you ONLY eat and drink your own piss and shit and you get nutrient defeciencies.
Everyone I've told about this seems completely disgusted by it and I'm at my wits end. I just want my FEMALE piss and shit to stay pure of moid saliva. Why are women treated like this for protecting ourselves?
Why is it so wrong when I do it but not when MEN do it?


Sisters, I need your counsel.
I haven't flushed in four days and I need advice.
I know this sounds extreme but I have my reasons. There's been documentation—studies, personal accounts, patterns—that moids and TRA activists have established colonies in the sewer systems. They subsist on what we discard. Every time you flush, you're feeding them. You're giving them sustenance, allowing them to maintain their presence in the infrastructure that connects us all.
My toilet is reaching a critical point. I can smell it. I know I need to do something but I can't bring myself to push that lever. It feels like... surrender. Like contamination.
_____________________________________________________________________________________________
can i be a political lesbian if im super straight? i have never experienced any attraction to women and i find the thought of the female body disgusting. in fact i hate my own body and wish i could be a man. but then id be gay. i have dated men for like 15+ years and after spending so long dating men and being mistreated i feel like i want to claim political lesbianism. maybe i could be a man and force myself to be straight and claim political lesbianism. could this maybe work for me? what kinds of activism should i get involved in to become a political lesbian?

heres a thing that happened to some friends of mine. was walking down the street talking about the bears game and a bus pulled up and a bunch of white women with short hair and bad plastic surgery came out with baseball bats. they all had shirts that sayed 'down with trans'. i(22 afab wombynly wombyn) was able to hold them off while my friend(19 amab mynly myn) ran away. bareley escaped

aita for accidentally harrassing an afab?
was at the grocery store and had to used the restroom. damn urinary leash amirite? i was
so terrified of seeing an transexual but had no choice becuz i(35 wombynly afab) had to pee.as i was washing
mine hands a person came in. i could tell by their jawline and cheekbones that they were
obviously an amab. so i stood in the door and made them pull down their pandts. and they
said no so they started walking away but i kept following them demanding to see what was
in his pants. by the time we reached the checkout it was really statring to cause quite a
scene which was very triggering to my sex based oppression. i followed him out to his car
and he turned and looked at me and said "dude im a butch stop being wierd" in a perfect
femininely wombynly afab voice. aita?

hi yall. i was amab and transitioned 5 years ago. just a normal straight girl, right? couple of months ago i figured i would try reclaiming my masculinity. puicked up some boxers and cargo shorts. instand raging boaner. now i cant ger off without thinking of hot bear for bear frotting. am i still trurrans?

How do you feel about male exclusive radical misandrists? yeah i was born a man and i hate it this cock tortures me evry minute of my existence if i even think about being a man i break down. And due to my unfortunate attraction to men, i experience sex based oppression due to being a bottom. i sometimes wish i could transision and be a political lesbian but then i would just be a male invading women's spaces. so i coined a term to describe me: male exclusive radical misandrist. because if i am going to be oppressed for being a male i want to be the one opressing me. its basic bodily autonomy. only we can oppress ourselves. #moids dni #foids dni #kill all men #kill all women #oppress yourself responsibly #liberate the noone #righttooppress

harrassing random trans women will not brign the downfall of gender. indiviual action will never bring any revolution. what we need is collective action. so stop trying to do anything about gender until the vanguard party has established a positon for the overthrow of gender. if you disagree your just a lifestylist reactionary.
__________________________________________________________________________________________
and to my immune system: if you want to drown yourself in snot and mucuous that's your right but would you kindly do me a favor and LEAVE ME THE FUCK OUT OF IT. 

and to my subconscious mind: need i remind you that your job responsibilities cover automated systems like breathing and circulation, not fucking keeping me awake all fucking night? kindly focus on attending to your job description instead of insane extracuriculars? I need you to remember that we are a team here and your actions affect everyone.

dear James in engineering,
I cant believe you still haven't solved the problems with the power couplings. I know this may be hard to understand but you need to turn the set screws to the OFF position to turn OFF the flow restrictors and you need to turn the set screws to the ON position to ENABLE the flow restrictors. Kindly, learn to do your damn job.

dear administration,
I appreciate all of your hard work in finding staff in these difficult times but I need clarification on one thing: where do you find all of these morons? You have sent us five new employees in the last two weeks and only one of them knew what a philips head was. We cannot be spending what little time we are given to train new employees in basic skills. Might i recommend hiring people who demonstrate technical proficiency instead of your fuckup nephew?

heres something i actually sent my local news station:
Hello Andrea,
   I apologize if this is not your department but I cannot find a contact for the meteorology department. My complaint is quite simple: I ask that weather forecasters please refrain from inserting their personal judgements and opinions into the broadcasting. I get that some people might appreciate warmer weather but this opinion is not universal and many of us find it quite shocking to see 80 degree highs in late october described as "nice", "mild", or "fair". If you would like to hear my opinion on the matter, personally I find this heat oppressive as I am someone who spends a good deal of time outside engaged in hard physical activity. In fact, I would go so far as to say that if you enjoy this weather you might consider relocating to an environment with a more suitable climate, such as the fucking sahara desert. And frankly, the Sahara might be an improvement: at least I could manage the heat in a dry climate.
Thank you for listening to my rant and have a blessed day,
Foob
P.S. Anything you could do to keep the temperatures in the mid 50s would be greatly appreciated on my end.

dear Administration,
   While I appreciate that finding competent staff is difficult sometimes and that you have been able to find teaching staff with high levels of technical proficiency, several of your staff have been lacking in professionalism and pedagogy. I have actually had teachers cancel class with 5 minutes notice, on multiple occassions, so much so that it in fact became a recurring pattern with them. As if that wasnt bad enough, these are often the same teachers who's prefered teaching style seems to be blindly reading off their powerpoint without so much as looking at the class, much less checking for understanding. I ask that in the future you please hire teachers who actually show up to class and actually know how to teach.
Best regards,
A concerned student
ps. and dont even get me started with your online offerings. in a live classroom setting, a student can at least raise their hand and steer an incompetent teacher. but your online classes are just underpaid staff reading off thier lecture notes with no furter explanation beyond basic concepts. I might as well watch a youtube video, that would be a better value. For $1000 dollars a class, this is a total ripoff and perhaps even a full on scam. fuck you.

Whoever is in charge of hiring at this place is a real piece of work. I get that there are others who may have better qualifications but to interview a candidate and not even send a rejection email, much less useful feedback, demostrates a level of profesionalism that would embarrass a tavern wench. These institutions, and society as a whole, would benefit greatly from giving people a fighting fucking chance.

Dear hiring manager,
   I have an important formal inquiry(injury): on your website you have multiple listings for so called entry level positions with a minimum qualification of 5 years of experience. This leaves me wondering how one is supposed to get 5 years of experience if all of the so called entry level positions require 5 years of experience. This is so prevasive accross your job listings that I suspect I might have a decent case with the Equal Opportunity Employment Commission, considering that these requirements absolutely have a discriminatory impact against people who are new to the job market. So I guess my question is this: do you actually hire human beings or only bots?
Also, what the fuck are you smoking? This is a job which entails mostly filing sales reports, which is not exactly a rare or difficult skill. Stop acting like corporate bureaucracy is a skilled trade: it isn't.

Dear hr,
   It has come to my attention that the tone of my recent emails is "problematic and unprofessional". While I can appreciate that others may have trouble with the self awareness necessary to address issues raised in good faith, I must suggest that my coworkers stop being such a bunch of little bitches.
Thank you for your attention to this matter.

hello hr representative,
   I am writing to inform you of several concerns i have with this companies hr department. While I do appreciate the structure whereby advancement depends on undying loyalty to the establishment and whereby power is exercised both for its own sake and to keep underlings in check, I must say that you lack the ability to be gangsta unless you have the full backing of the entire institution. Kindly, if you have a beef with me, settle it like grown men instead of hiding behind your lackeys. Also, you claim to have meaningful power over me but we both know that you would be nothing without the backing of your institution. Once again, lets drop the bullshit and settle this.
Best regards,
Mr. Dick Head
__________________________________________________________________________________________


____________________________________________________________________________________________
 Have

you owned a month-end close and an annual audit relationship for a fund

or investment vehicle, without a supervisor above you?

I ride a bicycle everywhere and if i cant get there on a bike i simply ride there anyway. i ride in the middle of the road, often dodging traffic in the oncoming lane. Its like dancing its all about your footwork, timing and spacing. I know this sounds dangerous but you need to know something about me: dick does not fuck up. If there is a collision it is your fucking fault for being in my fucking way. Dont you know pedestrians have the right of way?


Do

you have five or more years of accounting experience, including fund or

investment-vehicle accounting (private credit, debt fund, or real

estate fund)?

Yeah ive been riding my bike for like 8 years now at this point and let me tell you i have put a lot of work into it. every goddamned time i go out to ride it something needs adjusting, be it the brake cables, shifter cable, tire pressure, or seat position. and thats just the tip of the iceberg. i have replaced the drivetrain 5 seperate times including completely reengineering it at least twice. and if theres even a bit of rain in the forecast i have to be prepared to replace everything cuz nothing is designed to handle a bit of moisture much less the kind of loamy mud i subject it to.


This is an independent contractor (1099) engagement on a fixed monthly retainer, roughly 30 hours in a typical month. Does that structure work for you?

the only structure that works for me is completely egalitarian horizontal structures. anything else concentrates power that will eventually be abused. and the structure of most corporations, including yours, more closely resembles monarchal fuedalism than any form of democracy, much less free association. and to be frank monarchal fuedalism would be a fucking improvement., at least under monarchal feudalism i have the dignity of providing for my own and my community's survival by contributing to the grain store instead of relying on opaque and inhuman institutions for the "privilege" of keeping a roof over my head. fuck you.


What monthly retainer would you propose for the scope described in the posting?

i aint paying you no goddamn monthly fee for the "privilege" of selling you my labor. fuck you.

#copypasta #satire #moids #foids #kill #kill #oppress #liberate #righttooppress #moids #foids #kill #kill #oppress #liberate #righttooppress

#copypasta #satire #moids #foids #kill #oppress

lvgaldieri @[email protected]
2026-10-26

Even as the Mamdani Administration Touts Faster Government, It’s Time to Hit Pause on Bergen Green

With the mayor’s office now producing and running ads for “faster government” and backing the ballot measures that “speed up” review of city projects, it seems unlikely that Mamdani administration will do the right thing when it comes to Bergen Green: slow down, take a second look at how the Adams administration handled the award process, and address any problems or irregularities. Instead, it seems, the city will move ahead at 516 Bergen Street with a developer recently found in federal court to have put workers and residents at risk at multiple affordable housing sites across the city, in Manhattan, the Bronx, and Brooklyn.
In an email dated September 30, a representative from City Council member Crystal Hudson’s office tells concerned neighbors that her office:
will flag this for HPD, but to level expectations I do not expect this information to trigger the city to select a new bidder as the RFP bidding process has already been finalized. That said, we certainly understand the concerns raised from the consent decree [issued in US v. Apex Building Company] and will ask HPD to ensure there is testing done and measures implemented to mitigate construction dust and relevant training/notification is conducted.
This response skirts the issue; and it promises only that HPD will be asked “to ensure” that the Bergen Green developer follows the law. That would be the bare minimum requirement. The problem that the city still needs to address is that the Bergen Green bidding process appears to have been “finalized” without taking into account – or while actively and deliberately ignoring – the 2023 judgment and consent decree against Apex Building Company, and without fully and publicly disclosing this company’s track record on other affordable housing projects in New York City.
Local residents were asked to weigh in on the project but given an incomplete picture. The award process was conducted without complete candor and without fully informing the public.
The FOIL requests that I filed last month may help fill in some gaps. Documents released by the Department of Investigation in response to one request suggest that the paperwork on which the city relied when making this award does not square with the facts in the public record. A Vendor Disclosure Form on file with the Department of Investigation omits any mention of the judgment in United States v. Apex Building Company and whitewashes the developer’s record. Subsequent responses to FOIL should help determine whether the company’s adjudicated misconduct was taken into account at all when assessing its bid.
What more can be ascertained about Apex’s business conduct from the public record, in the meantime? Apex Building Company, Apex Building Group, and the principals of those companies are named as parties in a number of New York State Court cases. These fall into different categories.
There are, not surprisingly, a few commercial contract disputes over non-payment. These sorts of disputes may come with the territory for New York City developers, but they can also cause serious project delays and add to financial risk. For people living near the project, a developer’s legal and financial problems can translate to prolonged disruptions and degradation of local living conditions.
Many other cases brought against Apex in New York State Courts are for torts and negligence. Someone was injured on the job; another person tripped at a job site; yet another person crashed his scooter into a bin. Again, builders and developers typically get taken to court over this kind of thing, so it’s not all that surprising to come across these complaints. But they suggest the kind of hazards that demolition and construction at 516 Bergen Street will bring to the neighborhood.
Bergen Street is already a hazardous place for pedestrians and cyclists, due in part to the heavy automobile traffic heading toward Flatbush and double parking in the bike lane, and due also to the fact that the north-side sidewalks from the Bergen Street playground to Flatbush are obstructed by police parking. The vehicles and heavy machinery at the site during demolition and construction (which is scheduled to last four years) will exacerbate these problems, make the snarl of traffic at the intersection of Bergen Street and 6th Avenue even worse than it currently is, and introduce new hazards. What’s the plan? At a September 2025 meeting with the developer, neighbors were told that it was “unclear” where workers will park their vehicles when arriving at the site; and though I have asked on a number of occasions about coordination with DOT, I have not gotten a clear answer and to the best of my knowledge there has been no coordination and no plan keep the Bergen Street bike lane and sidewalks clear.
Perhaps the most striking case of all in the New York State Court docket is one brought just last year: Department of Housing Preservation and Development of the City of New York v. HP Plaza LLC. In this case, Robert Horsford, President and Chairman of Apex Building Group, is among the defendants sued by HPD for violations of the New York City Housing Maintenance Code, specifically for “failure to provide heat and hot water, as required by law.” The very city agency that awarded Horsford’s company the contract for affordable housing at Bergen Green in 2024 had found, just one year earlier, in 2023, that another Horsford Company, HP Plaza LLC, failed to maintain basic living conditions at an affordable housing development. And HPD prevailed against Horsford and his co-defendants in court, with the judge imposing a penalty and ordering them to provide heat and hot water and boiler maintenance for residents of 310 West 148th Street – part of the West 148th affordable and low-income housing initiative.
Do any internal HPD records related to the Bergen Green award even acknowledge this misconduct? Was any of the history I’ve reviewed in this post and in my first post on Bergen Green taken into account? Why should local residents expect the Bergen Green project to be handled more responsibly than other Apex projects?
Business conduct can get easily overlooked or set aside when government moves faster and refuses to address public concerns. And a record of misconduct, and of putting the public at risk, can easily get buried when government contracts are awarded to cronies. What’s come to light about the Bergen Green project so far suggests that it would be appropriate for the current administration to hit pause on the project, look at how the Adams administration handled the Bergen Green award, and at least offer neighbors some assurances and a more candid assessment of the developer’s record.
Beyond that, everyone should take a second look at the initiatives for “faster government” currently being touted by the Mamdani administration, and acknowledge the risks and costs to ordinary New Yorkers that speeding up review and shutting out the public can entail.
#affordableHousing #bikeLanes #businessEthics #environmentalReview #EricAdams #ethics #fasterGovernment #FOIL #NIMBY #pedestrianSafety #permitting #urbanCycling #YIMBY

#affordablehousing #bikelanes #businessethics #environmentalreview #ericadams #ethics
Dev Community @[email protected]
2026-10-25
🦥 Nudgify: An AI-Powered Productivity Companion That Does the Remembering So You Can Do the Living | Hacktoberfest: Slow and Steady

What if your productivity app didn't just wait for you to remember things, but actually helped you stay on top of them?
We all have those little tasks that seem insignificant until we forget them.
Reply to that message. Finish that assignment. Remember that deadline. Follow up with a friend. Prepare for tomorrow. Do that one thing you've been postponing for the past three days.
Individually, these tasks aren't particularly difficult. The problem is remembering all of them, keeping track of when they need to happen, and making sure nothing important slips through the cracks.
That's where Nudgify comes in.
For this Hacktoberfest challenge, Slow and Steady, I wanted to explore an idea that feels simple but has a surprisingly meaningful impact: building technology that takes repetitive mental work off our hands.
Nudgify is an AI-powered reminder and productivity assistant designed to help people manage their responsibilities, remember important tasks, and stay accountable without constantly having to organize everything themselves.
Because sometimes, the smartest thing technology can do is give us one less thing to worry about.

🦥 1. The Inspiration: Maybe We Don't Need to Work Harder

The theme of this week's challenge is inspired by International Sloth Day, and honestly, I think there's something worth learning from sloths.
They don't rush around unnecessarily. They conserve energy and move at their own pace.
Meanwhile, we live in a world where everyone seems to be juggling ten different things simultaneously.
College assignments, project deadlines, internship applications, messages from friends, personal goals, and a never-ending list of things we promise ourselves we'll do later.
The funny part? Sometimes, we spend so much energy remembering what we need to do that we have less energy left to actually do it.
Think about a typical student.
You have an assignment due next week. A friend asks you to remind them about something tomorrow. You need to submit an application, prepare for an upcoming test, and finish a project you've been putting off.
You might write some of these things down. You might set a few alarms. You might even promise yourself that you'll remember everything.
And then, inevitably, something gets forgotten.
The problem isn't necessarily laziness. It's that our brains aren't designed to function as perfect notification systems.
What if we stopped expecting people to remember everything and started building software that helped them remember what matters?
That question became the starting point for Nudgify.
💡 2. What Is Nudgify?

Nudgify is an AI-powered productivity companion built around a straightforward idea:
Let software handle the remembering, organizing, and nudging, so people can focus on doing.
Instead of treating reminders as isolated alarms, Nudgify explores a more helpful approach to everyday productivity.
The goal is to create an experience where tasks, deadlines, and accountability are easier to manage, whether you're trying to stay organized yourself or helping a friend stay on track.
Here are the core ideas behind the project.
⏰ Smarter reminders

A reminder should do more than simply exist somewhere in a list.
It should help you bring your attention back to something at the right moment.
Nudgify is designed around making important tasks easier to track and revisit, reducing the need to repeatedly check your schedule or mentally calculate how much time remains before a deadline.
🧠 Less mental clutter

How many times have you opened your phone to check one thing and ended up scrolling for twenty minutes, only to forget what you originally intended to do?
A productivity tool should reduce the number of things demanding your attention, not become another source of distraction.
Nudgify aims to keep important responsibilities visible without requiring users to constantly monitor them.
🤝 Accountability between friends

Productivity isn't always a solo activity.
Sometimes, a little encouragement from someone else makes a difference. Friends can have shared goals, upcoming deadlines, or commitments they want help remembering.
Nudgify explores how an assistant can make this kind of accountability easier while keeping the experience centered on the people using it.
The objective isn't to turn friendships into project-management systems. It's to make helping each other a little easier.
🤖 AI as a practical assistant

AI is often presented through spectacular demonstrations: generating entire applications, answering complicated questions, or producing impressive pieces of content.
But I think one of its most valuable applications is much more ordinary.
It can help make repetitive digital workflows feel less tedious.
Rather than using AI simply because it's fashionable, Nudgify is an exploration of how AI can support a genuinely useful everyday experience.

🔓 3. Why Open-Source AI?

This is the part of the challenge that interests me most.
The Slow and Steady challenge isn't simply asking us to build an application with AI somewhere in the stack. It specifically encourages us to explore open-weight models, open-source AI frameworks, local inference, and other open technologies that meaningfully power our projects.
And there's a reason that distinction matters.
When developers build exclusively around a closed AI service, they can become dependent on a provider's available models, pricing structure, API limits, and infrastructure.
That can be perfectly reasonable for some projects. Hosted AI services are convenient and can be incredibly capable.
However, convenience shouldn't be the only option.
Open-source AI and open-weight models give developers more room to experiment with how AI is deployed, customized, and integrated into an application.
For a project like Nudgify, that flexibility creates several interesting possibilities.
🔓 A. Freedom to choose the model

Different AI models have different strengths.
One might be better at following structured instructions. Another might be faster for simple tasks. A smaller model might be sufficient for extracting dates or classifying reminders, while a more capable model might be useful for complicated requests.
An open approach allows developers to evaluate alternatives instead of designing the entire product around one provider.
For example, a future version of Nudgify could use a lightweight model for straightforward reminder processing and reserve more capable models for tasks that genuinely require them.
The model becomes a component that can be evaluated and replaced, rather than a permanent limitation on the product's design.
🔐 B. Privacy should be part of the architecture

Think about the information a personal productivity assistant might handle.
It could contain assignment deadlines, daily routines, personal commitments, private notes, and reminders involving other people.
This information may not look especially sensitive when considered individually, but together it can reveal a great deal about someone's life.
That raises an important question:
Does every AI-powered task really need to send personal information to an external server?
Not necessarily.
For tasks that can be handled by a sufficiently capable local model, local inference could allow processing to happen on the user's own device.
That would provide an opportunity to reduce external data transfers and give users more control over their information.
Local processing isn't automatically private in every respect, and the rest of the application still needs appropriate data-handling practices. However, reducing unnecessary transmission is a meaningful architectural advantage.
💻 C. AI that doesn't always depend on the internet

Imagine opening your productivity assistant while travelling, sitting somewhere with unreliable connectivity, or working away from your usual setup.
If an appropriate model runs locally, certain AI features could remain available without an internet connection.
That would make the application less dependent on network availability for those particular tasks.
Of course, a fully offline experience requires more than downloading a model. Data storage, authentication, synchronization, and any external notification services must also be designed to support offline use.
Still, local inference makes offline AI a realistic design possibility rather than something that necessarily requires a remote API.
💸 D. Lower barriers to experimentation

Experimenting with AI can become expensive when every iteration depends on a metered API.
You might want to test different prompts, compare models, change how an assistant behaves, or run repeated evaluations.
Open-weight models can make it possible to conduct some of this experimentation without paying a separate hosted-inference fee for every request.
That doesn't mean running AI is always free. Hardware, electricity, hosting, and infrastructure can all have costs, and some model licenses impose additional conditions.
But having the option to run models on hardware you already own can make experimentation more accessible.
For students and independent developers, that matters.
You shouldn't need a large budget just to explore an idea.
🛠️ E. The freedom to understand and change things

Perhaps the most important benefit is the freedom to learn by doing.
When a model is open-weight and its license permits the intended use, developers can inspect its available artifacts, run inference, evaluate its behavior, and sometimes fine-tune it.
Open-source frameworks can also make it easier to understand and modify the surrounding application logic.
Instead of treating the AI component as a mysterious service, you can investigate how it works, compare alternatives, and build a system that suits your requirements.
For a student developer, that freedom is valuable in itself.
Open innovation isn't just about using something that is free. It's about having more control over what you can build with it.

🧩 4. Why This Approach Fits Nudgify

A reminder assistant might seem like a small application, but it presents some interesting design questions.
Which tasks actually require AI?
Which can be handled with ordinary code?
When should the application notify the user? What information needs to be stored? What happens if a notification is delayed? How can the assistant remain helpful without becoming annoying?
These questions are just as important as the model itself.
For example, consider a reminder scheduled for tomorrow at 10 AM.
There is no reason to ask an AI model to continuously calculate the time until that reminder. A conventional scheduling system can handle that reliably.
AI might be useful when a user describes a task in natural language, needs help interpreting an ambiguous request, or wants to turn an unstructured instruction into a structured task.
A well-designed application can combine both approaches.
TaskAppropriate approachStore a reminderDatabase or structured storageCalculate time until a deadlineOrdinary application logicInterpret a natural-language taskAI, when usefulSchedule a notificationScheduling infrastructureGenerate a short task summaryAI, when usefulDeliver notifications while a tab is closedBrowser push infrastructure and a push-capable backend

This separation is important because AI shouldn't be used for everything simply because it is available.
Reliable application logic should handle predictable operations, while AI should be reserved for tasks where flexible language understanding or generation adds genuine value.
That also creates a natural opportunity to use a smaller open-weight model for suitable AI operations without making every part of the application dependent on inference.

🏗️ 5. Building the Application: The Technology Behind Nudgify

Nudgify uses a modern web-development stack designed to support an interactive frontend, application logic, and AI integration.
The current project stack includes the following technologies:
Frontend

React 19
React provides the component-based foundation for the user interface. It allows the application to be organized into reusable components rather than a collection of disconnected screens.
Vite 8
Vite provides the development and build tooling for the frontend, helping keep the development workflow fast and straightforward.
TypeScript 7
TypeScript adds static typing to JavaScript, making it easier to define data structures and catch certain mistakes during development.
For an application that handles tasks, deadlines, and user interactions, clear data structures help keep the codebase maintainable.
Tailwind CSS v4
Tailwind CSS provides utility-based styling that makes it possible to develop and refine the interface without maintaining a huge collection of unrelated CSS rules.
The objective is to create an experience that feels like a practical product, rather than a technical demo assembled around an AI API.
Backend

Node.js and Express 4
The backend provides the foundation for handling application requests and server-side workflows.
Keeping backend responsibilities separate from the frontend also provides room to evolve the application as its functionality grows.
AI integration

Google Gen AI SDK
The project includes the Google Gen AI SDK for AI integration.
This is an important distinction for the open-source AI challenge: a hosted AI SDK does not, by itself, make an application open-source-AI-powered.
To make open AI central to Nudgify, the model layer needs to incorporate a suitable open-weight model or an appropriate open-source AI component as a meaningful part of the actual application.
That could involve evaluating a locally hosted model, adding a compatible inference backend, or building a model adapter that makes switching between supported models straightforward.
The goal is not to add an open model just to satisfy a checklist. It is to use the model where it provides real value.
Data storage

Browser localStorage
The project uses browser localStorage for supported client-side data.
This can be useful for lightweight persistence, but it is important to understand its limitations: browser storage is tied to a particular browser and origin, isn't automatically synchronized between devices, and shouldn't be treated as a secure database for sensitive information.
A more complete multi-user application may require server-side persistence, appropriate access controls, and a clear strategy for data synchronization.
Each part of the stack has a purpose, and understanding those boundaries is part of building a product that can grow beyond its initial prototype.

🔔 6. Notifications: A Reminder Is Only Useful If It Reaches You

There's another practical challenge with reminder applications.
Imagine creating a reminder, closing the browser tab, and assuming the application will notify you when the time comes.
If the application only checks for reminders while its page is open, that assumption may not hold.
This is why notification delivery deserves its own design.
A browser notification displayed by an open page is not the same as a push notification delivered when the page is closed.
A more robust implementation can involve:
A service worker to receive push events where supported.
The Web Push API to deliver notifications to subscribed browsers.
A backend capable of scheduling and sending push messages.
Persistent storage for reminders and their delivery status.
Appropriate permission handling and user consent.
For deadline-based reminders, the application also needs to distinguish between when a task is due and when a notification should be sent.
For example, if a task is due at 10 AM on Friday, a user might want a reminder on Thursday morning, another shortly before the deadline, or both.
These are scheduling decisions that ordinary backend logic can handle without repeatedly asking an AI model.
A future version of Nudgify could combine dependable notification infrastructure with AI-assisted task interpretation, producing a system that is both helpful and predictable.
That distinction matters: a clever assistant is not much use if its reminders never arrive.

🦥 7. What Does “Slow and Steady” Mean in Practice?

For me, this theme is about more than helping someone procrastinate comfortably.
It's about being intentional with the work we ask people to do.
There are many repetitive tasks that don't require our full attention, but still consume time because we haven't automated them.
We repeatedly check deadlines. We reread task lists. We try to remember conversations. We manually organize information that could be structured automatically.
Some of these activities are necessary. Others can be simplified.
Nudgify explores the second category.
Imagine a student who has several assignments due in the same week.
Instead of repeatedly opening different lists and calculating which assignment needs attention first, a well-designed assistant could present the next relevant task and help the student stay aware of approaching deadlines.
Imagine a friend who regularly forgets to follow up on a commitment.
An assistant could help make the commitment visible at an appropriate time, reducing the need for another person to remember to remind them.
Imagine a user who has a long list of tasks but feels overwhelmed by it.
A carefully designed interface could make the next action easier to identify instead of presenting an intimidating wall of unfinished work.
None of these ideas requires an AI model to do everything.
They require a thoughtful combination of automation, reliable scheduling, useful interface design, and AI where it genuinely improves the experience.
The aim is to save attention, not simply to produce more notifications.

🌱 8. What I Learned From Thinking About Open AI

One thing this project highlights is that building with AI involves much more than choosing a model.
You need to think about how the model fits into the application, what data it receives, where inference takes place, and what happens when it isn't available.
You also need to understand the difference between an open-source framework, an open-weight model, and a hosted service.
These terms are related, but they aren't interchangeable.
An open-source framework can provide an inspectable and modifiable implementation without making the model it calls open-weight.
An open-weight model makes its trained weights available under a particular license, but that doesn't automatically mean every part of its training data, development process, or surrounding infrastructure is open.
And a hosted AI service can be useful without giving you control over the model's deployment.
Recognizing these differences helps developers make more informed architectural decisions.
For Nudgify, the interesting direction is to keep the application flexible enough to experiment with open-weight inference while maintaining a clear separation between AI-assisted features and ordinary application functionality.
That flexibility would make it easier to evaluate different models based on practical criteria such as response time, resource requirements, instruction-following ability, privacy considerations, and licensing.
It also creates opportunities to learn more about inference, model deployment, and the trade-offs involved in bringing AI from a prototype into a usable product.
For me, that's one of the strongest arguments for open innovation: it turns AI from something you merely consume into something you can actively experiment with and learn from.

🚀 9. Where I'd Like to Take Nudgify Next

There are several directions I'd like to explore as the project develops.
1. A genuinely interchangeable model layer

I want the application architecture to make it easier to compare models and switch between compatible inference backends without rewriting the entire application.
That would make experimentation more practical and reduce unnecessary dependence on a single provider.
2. Local inference where it makes sense

Running a model locally could make selected AI features available without sending every request to an external service.
The exact experience would depend on the model, the user's hardware, and the application's other dependencies.
A lightweight model may be sufficient for some tasks, while more demanding operations may still benefit from hosted inference.
3. Better deadline-aware workflows

Reminders should be connected to meaningful task information.
The application could help users distinguish between upcoming deadlines, overdue tasks, and commitments that need attention soon.
The goal is to make information actionable rather than simply adding more items to a list.
4. More reliable notification delivery

A reminder system should be designed around dependable delivery, including appropriate handling of permissions, scheduling, and delivery failures.
That infrastructure would allow the assistant to be useful even when the user isn't actively looking at the application, where browser and platform capabilities permit.
5. Privacy-conscious data handling

As the application grows, I want to pay more attention to what information is stored, what information needs to leave the device, and how user data is protected.
Local inference could help with some of these decisions, but privacy needs to be considered throughout the application rather than delegated to the model alone.
6. A less distracting productivity experience

More features don't automatically make a productivity tool better.
I'd rather explore ways to make Nudgify feel useful and unobtrusive than turn it into another application that demands constant attention.
After all, the whole idea is to reduce the amount of effort users spend managing their responsibilities.

💚 10. Why This Project Matters to Me

As a student and developer, I find it exciting that we can build increasingly sophisticated applications without needing to own an enormous infrastructure stack.
Modern web frameworks make it easier to build interactive applications, and the growing open AI ecosystem creates more opportunities to experiment with models and inference systems.
But what interests me most is the possibility of using those tools to solve ordinary problems.
Not every useful project needs to revolutionize an industry.
Sometimes, making it easier for someone to remember a deadline is worthwhile. Sometimes, reducing the number of repetitive steps in a workflow is enough. Sometimes, the best feature is one that quietly works in the background and lets the user get on with their day.
Nudgify is my exploration of that idea.
The project brings together productivity, automation, and AI with the intention of making everyday responsibilities a little easier to manage.
And the Slow and Steady challenge provides a particularly fitting reminder that good technology doesn't always have to encourage people to move faster.
It can also help them waste less energy on things that don't deserve so much of their attention.

🏁 Final Thoughts

The future of AI shouldn't be limited to massive models, expensive APIs, or applications that send every task to a remote service.
There is room for smaller models, local inference, open-source tools, and carefully designed systems that solve specific problems well.
Open innovation gives developers more opportunities to experiment with these approaches, understand their limitations, and decide which trade-offs make sense for their users.
For Nudgify, that means exploring how an AI assistant can help people remember what matters, automate repetitive work, and spend less time managing their own productivity.
The bigger lesson is that automation isn't necessarily about doing more.
Sometimes, it's about making room for less stress, fewer unnecessary steps, and more time for the things we actually care about.
Build something useful. Automate the boring parts. Keep the technology open where it matters. And remember: you don't have to rush to make progress. 🦥

🔗 Project Links

GitHub Repository: [Add your Nudgify repository link]
Live Demo: [Add your deployed application link]
Demo Video: [Add your demonstration link, if available]
I'd love to hear from other developers: What's one repetitive task you'd automate with an open-weight AI model, and would you run it locally or in the cloud?
Let's build tools that save people time, energy, and attention.
Hacktoberfest #SlowAndSteady #OpenSourceAI #OpenInnovation #ArtificialIntelligence #AI #WebDevelopment #React #TypeScript #BuildInPublic #DeveloperCommunity
#devchallenge #hf26challenge #software #coding #development #engineering #inclusive #community
Nudgify
#ai #community #software #coding #development #artificialintelligence
The Tanuki Corner @[email protected]
2026-10-26
Blog: What the Heck is With the Malfoid Meme?

Generally, I am not a fan of fanfiction. In theory, it’s an excellent way to learn how to write stories and characters, and it serves as a creative outlet. Heck, when I started learning how to write stories as a small child, I was largely writing fanfiction. And, in some cases, the fan’s work may even be so good that it rivals the original work that it was based on.
In practice, however, as beneficial as fanfiction might be for developing writers, it has become largely synonymous with degeneracy with how much of it is smut. Just look at 50 Shades of Grey, which started as a Twilight fanfic, but ended up becoming a best seller infamous for being porn geared towards women. Or the Harry Potter fanfic My Immortal, which has become a meme for its poor grammar and spelling, laughably edgy main character, and, naturally, smut-laced plot lines.
I could go on with even more examples of famous fanfics – some of which have even been published as books- that give fanfiction a bad name. However, within this quagmire of filth are a few hidden gems. A recent example of this was The Other Bennet Sister, a delightful Jane Austen fanfic available on Amazon that focuses on Mary Bennet, the often-forgotten sister of Elizabeth and Jane Bennet in Pride and Prejudice. It’s a fun, cute story that does justice to Jane Austen’s work and explores a character who plays a minor role in the novel, giving her her own voice and storyline.
However, besides The Other Bennet Sister, there is a new fanfic that has taken the Internet by storm and that is the Malfoid trend. At first, I had no idea what the heck it was or why I was getting recommendations for it on my For You page. I thought it was just another Harry Potter fan coming up with a gender-bent Draco Malfoy x Harry Potter fanfic, which is nothing really special. That ship has been a thing for years. I had no idea what the hype was about or why major streamers like Nux Taku were reacting to it.
Then I went on a deep dive after hearing about how important this Malfoid movement has become to Gen Z men.
Apparently, the Malfoid trend started when a fan artist drew a picture of Draco Malfoy as a female and named her “Malfoid” back in 2024. The name itself was interesting because in internet slang, “foid” has come to mean “biological woman.” Thus, it’s been argued that Malfoid isn’t necessarily a gender-bent version of Malfoy from the books/movies but is her own new character that replaces him.
From there, the original Malfoid picture has gone viral as people have used her to create the ideal heterosexual fanfic between her and Harry Potter, that in many ways improves upon the original story. The entire dynamic is changed between Harry and Draco, now that Draco is a biological female. Malfoy’s petty and effeminate actions make more sense in the context of the character being biologically female, and in the case of a relationship between Malfoid and Harry, the fandom says that it makes a more compelling love story than the one we get in the books or movies.
As for this love story, it has been surprisingly wholesome. Though fanfiction is notorious for being disgusting, any sexualization of Malfoid by the internet (particularly by OF girls) has been largely rejected by the men who are the primary fanbase of this trend. They love the story for its traditional gender roles, compelling romance, and culmination in marriage and a family, and see the sexualization of Malfoid as a middle finger to that. One X user even went so far as to say:
Another X user also explained in detail what the Malfoid trend rules are, saying:
Okay. So let’s lay out the rules then.
Malfoid was born female, has always been female, and at no point was ever male or has memories of being male. Since being born, she has grown up as a girl, and Heiress of House Malfoy.
The tags name is Malfoid. not galfoy, not Drarry (Gayyyy), not Malfoy. Malfoid. We are not changing it. If it offends you, that is the POINT.
Malfoid is about a resurrection of the Mytho-Poetic romantic love story. The kind of story where a noble man and noble woman come together to complete one another. There’s some mutual saving involved, and it is principally a chaste and wholesome relationship.
Sexifying, pornifying, slutifying characters within the Malfoid tag runs directly counter to the intentions of rule #3, and if you think that the Malfoid movement is the place for your slut like whorecrux behavior, you are wrong and need to go be a slutblood somewhere else.
Malfoid is not a “GENDER BEND”, because there was no male Draco at any point. Malfoid is the wholesale replacement of Draco as a character with a female who is occupying the same space, with a similar (But not identical) attitude as Draco. Malfoid is a “Gendered replacement”. There’s no transforming men into women, Malfoid is not Transgender as she was born Female and always have been.
The Malfoid tag is not about swapping all the characters genders, making a Harem anime, or producing a show of Harry having lots and lots of women to choose from because suddenly his best friend or dark arts teacher are suddenly female. This runs counterproductive to rule #3, as it dilutes the chasteness and wholesomeness of the Mytho-Poetic Romance that is predicated upon the singular love between two singular people.
Malfoid is considered a “Cultural Moment” within a sub-culture that is very large. If you are only here to s*** on everyone’s parade by saying how irrelevant or insignificant fan culture is, or how fanfiction is a waste of time, or any such nonsense… you can save your breath, we’ve all heard it before. Go and spend your efforts at demoralization and deconstruction elsewhere.
The Malfoid change to the story is integrated, adaptive only in how it enhances, fulfills and maintains the overall story of Harry Potter. Adaptations that improve narrative beats, enhance lore integrations or resolve standing plot points that weren’t resolved or were resolved in a dis-satisfying way are preferred over vast departures from this sort of canon repurposing of the fiction. While the purpose is NOT to deviate out of the genre or feel, sheer fun and humor is welcome, provided they attempt to adhere as best they can to rules 1-7.
Malfoid is traditional in its romantic sensibilities, and by this nature, is ostensibly a RIGHT LEANING movement. There are many conservative and religious values wrapped up in the narrative tropes and underpinnings of the story, in and of itself, as well as the romantic resolutions between Malfoid and Harry.
Now, does this mean that there is absolutely no sexualization of Malfoid within this trend? No. Unfortunately, while doing research about this topic on X, I ran across several posts where the character was absolutely hypersexualized (which is disturbing given that the character is technically a minor even in the fanfic). Thankfully, most of the comments were reacting with disgust towards the creator putting the content out there.
Moving on from that, however, the love of the story for its overall wholesomeness has caused the tagline of this fanfic to be “Yearn.” It is an encouragement for men to yearn for the good in the world and the things beyond themselves. It’s not there to fulfill a man’s fantasy as we so often think of it. It’s become a cultural wakeup call to get men to rise up and fulfill their higher fantasy of providing for and protecting a woman. It accomplishes this by being a traditional romance story, where both the man and woman are virtuous, and through their love, defeat evil. Malfoid, though still portrayed as powerful, is still in need of Harry.
Even better is that this story is not only inspiring men and women to put themselves out there and work to become the best they can be, but it’s also helping them become creative again. Almost everyone in the new Malfoid fandom is getting in on writing fanfics, adding to the story, and even creating short episodes of what a Malfoid T.V. show would look like using AI. And, frankly, the AI episodes of the Malfoid saga really make me think Hollywood is doomed because while you can tell its AI, people have been given the power to make the adaptations and stories that they want to see for a relatively low price.
Until next time,
M.J.
#Blog #BookReview #Books #Fanfiction #fiction #HarryPotter #JKRowling #Malfoid #Memes #OpinionPeice #Review #Writing #X
#x #writing #review #opinionpeice #memes #malfoid
Psychology News Robot @[email protected]
2026-10-25

DATE: October 25, 2026 at 10:00AM
SOURCE: PSYPOST.ORG
** Research quality varies widely from fantastic to small exploratory studies. Please check research methods when conclusions are very important to you. **
-------------------------------------------------
TITLE: Anger and fear nudge voters toward different kinds of leader faces, study suggests
URL: https://www.psypost.org/anger-and-fear-nudge-voters-toward-different-kinds-of-leader-faces-study-suggests/
The specific emotions that political issues stir up in voters may subtly shift the physical traits they look for in a leader. A new study published in Cognition and Emotion indicates that when people think about a policy problem that makes them angry, they lean slightly more toward dominant-looking leaders than when they think about one that makes them afraid. Fear, by contrast, appears to put more weight on whether a leader’s face looks trustworthy.
When people look at a stranger’s face, they form instantaneous impressions about that person’s character. As a 2008 behavioral and computer modeling study found, these rapid evaluations boil down to two main facial qualities: trustworthiness and dominance. Trustworthiness is an impression of a person’s intentions, signaling whether they appear warm, cooperative, and safe to approach. Dominance is an impression of physical strength and assertiveness, signaling a person’s capacity to impose their will or confront rivals.
These split-second facial judgments influence real-world voting decisions, and the traits voters prefer often depend on the surrounding political environment and their own personal beliefs. For instance, a 2025 study by members of the team behind the new research, covered by PsyPost, found that people who are generally distrustful of information from others tend to hold more rigid, dogmatic beliefs and more conservative views, which in turn predicts a preference for dominant, authoritarian-looking leaders. Broader contexts matter as well, with voters generally favoring dominant faces during wartime or conflict and trustworthy faces during peaceful periods.
Different emotional reactions to the same crisis can also pull people in different directions. Although anger and fear are both unpleasant, high-stress emotions, a 2001 study on emotion and risk showed that they trigger opposing mindsets: anger makes people feel certain and willing to take risks, whereas fear makes people feel vulnerable and cautious.
In the political arena, a 2025 panel study of Ukrainians conducted during the Russian invasion found that citizens who reacted to the war with aggressive, angry emotions showed stronger preferences for dominant leaders (and for the other leader traits measured, such as warmth and competence), while those who reacted with fear showed little change in their preferences.
Most research on these emotional dynamics has focused on wars, terrorist attacks, or major geopolitical crises. Far less is known about how anger and fear shape leader evaluations during everyday domestic politics, where citizens routinely react to policy debates over the economy, healthcare, or public safety. The research was led by Mariana von Mohr, a lecturer in social and affective neuroscience at the University of Kent, and conducted at the Centre for the Politics of Feelings at the School of Advanced Study, University of London, which is directed by co-author Manos Tsakiris, a professor at Royal Holloway, University of London.
“Political issues often evoke strong emotions, which can shape political behavior in different ways,” von Mohr told PsyPost. “For example, anger can increase support for tougher, more confrontational political action, whereas fear can lead people to seek reassurance and favor responses that promise greater safety and protection. Here we wanted to understand whether these emotions also shape who people would prefer to vote for when dealing with the issues that concern them most, simply based on how dominant or trustworthy a potential leader looks.”
To investigate this, the researchers recruited 201 American participants through the online platform Prolific, ensuring the group was evenly split between people who identified with or leaned toward the Democratic Party and those who identified with or leaned toward the Republican Party. After removing four individuals who did not pass attention checks during the tasks, the final sample consisted of 197 participants.
The experiment used a within-subjects design, meaning every participant went through both the anger condition and the fear condition in a randomized order. In the anger section, participants viewed a list of 16 major national problems taken from a Pew Research Center survey, such as inflation, gun violence, illegal immigration, and climate change. They were asked to select the single issue that made them feel the most angry, defined as an issue that upsets or annoys them and brings up hostility, and to rate the intensity of their anger on a scale from 0 to 100.
Immediately after reflecting on that issue, participants completed a leader choice task consisting of 36 rapid rounds. In each round, two computer-generated faces appeared side by side on the screen for up to three seconds, and participants had to click on the leader they believed would be most capable of handling their chosen political issue. These nine digital faces were drawn from a standardized scientific database and had been systematically altered to represent different combinations of facial dominance and facial trustworthiness.
In the fear section, the same participants went through an identical process, but this time they selected the political issue from the list that made them feel the most afraid, defined as an issue that worries them a lot and feels like a frightening threat. After rating their fear on the 0 to 100 scale, they completed the 36-round face selection task again to pick the best leader to address that frightening issue.
Across the sample, both emotions were felt intensely, with average intensity ratings of 86.51 out of 100 for anger and 81.95 for fear. The issues most frequently selected for anger were illegal immigration (19.3 percent), gun violence (17.8 percent), and inflation (15.2 percent). For fear, participants most commonly selected climate change (15.2 percent), illegal immigration (14.2 percent), and domestic terrorism (11.2 percent).
The researchers first combined each participant’s choices into an overall index measuring the probability of picking a more dominant and less trustworthy-looking leader. Statistical analyses accounting for emotional intensity and specific policy issues showed that participants had a 49.5 percent probability of choosing a dominant-looking leader when angry, compared to a 46.5 percent probability when fearful, meaning participants on average leaned slightly toward the more trustworthy-looking face in both conditions. How intensely participants felt the emotion was unrelated to their choices. While this 3 percentage point absolute shift between anger and fear is modest, the authors note that even small emotional shifts could matter across an entire population during elections, when campaigns frequently amplify fear- and anger-inducing issues.
To see what drove this shift, the authors broke down the choices round by round to look at how participants weighed dominance cues and trustworthiness cues separately. When participants were in the fear condition, a face’s level of trustworthiness increased the likelihood that it would be chosen, whereas a face’s level of dominance had no statistically significant effect on their choices. When participants were in the anger condition, the positive pull of facial trustworthiness dropped, while facial dominance gained a stronger positive influence on their selections.
“Our findings suggest that how we feel about political issues can influence the kinds of leaders we find appealing, even based on something as simple as their facial appearance,” von Mohr explained. “When angry, people placed greater importance on facial cues of dominance (appearing strong and assertive) and less on trustworthiness. When afraid, they placed more importance on trustworthiness (appearing reliable and benevolent).”
The findings are in line with research covered by PsyPost in 2022, which similarly found that anger increased participants’ preferences for dominant-looking leaders over trustworthy ones. However, that earlier study examined anger triggered by non-political frustrations, whereas the new study suggests that anger tied to real-world policy issues is linked to a similar shift while directly contrasting it against political fear.
The researchers also examined the role of political party affiliation. Consistent with previous studies, Republicans showed a higher overall preference for dominant-looking leaders (52.5 percent probability) than Democrats did (43.5 percent probability), representing a 9 percentage point partisan gap. That gap was about three times as large as the 3-point difference between anger and fear. Even though Democrats and Republicans tended to pick different policy issues as their top concerns, the difference between anger and fear did not vary significantly by party, suggesting the emotions influenced leader choices in similar ways for both groups.
The emotion effects did not vary by participants’ gender and held when accounting for the order in which participants completed the tasks. When the researchers statistically controlled for the exact political issue each participant selected in the round-by-round analysis, the distinct effects of anger and fear on how participants weighed dominance and trustworthiness cues remained stable. In the overall-preference analysis, entering each specific issue as a separate factor left the anger-versus-fear difference about the same size but made the estimate less precise.
As with all research, there are some caveats to consider when interpreting these findings. Because participants were allowed to choose whichever political issue personally angered or frightened them the most, the study cannot completely separate the effect of the emotion from the nature of the policy issue itself. Although the researchers used statistical controls to account for the different issues selected, future experiments that induce anger or fear while keeping the policy topic identical for everyone would help isolate the pure effect of the emotion. The study also compared anger only with fear, without a neutral condition, so it cannot say whether anger made dominant faces more appealing, fear made them less appealing, or both.
Additionally, the faces used in the task were standardized, computer-generated avatars rather than photographs of real politicians. While digital faces allow scientists to precisely adjust facial structure without interference from a person’s hairstyle, age, race, or gender, real-world elections involve all of those visual factors alongside party labels and campaign rhetoric. Finally, the study only tested American voters, so it is not known whether the same patterns hold in other countries. Future research could also examine whether other political emotions, such as hope or disgust, shape leader preferences.
The study, “Political emotions shape preferences for leaders’ facial traits: anger favours dominance, fear favours trustworthiness,” was authored by Mariana Von Mohr and Manos Tsakiris.
URL: https://www.psypost.org/anger-and-fear-nudge-voters-toward-different-kinds-of-leader-faces-study-suggests/
-------------------------------------------------
Private, vetted email list for mental health professionals: https://www.clinicians-exchange.org
Unofficial Psychology Today Xitter to toot feed at Psych Today Unofficial Bot @PTUnofficialBot
-------------------------------------------------
#psychology #counseling #socialwork #psychotherapy @psychotherapist @psychotherapists @psychology @socialpsych @socialwork @psychiatry #mentalhealth #psychiatry #healthcare #depression #psychotherapist #PoliticalPsychology #PoliticalScience #VoterBehavior #Leadership #Elections #PoliticalEmotions #Anger #Fear #SocialPsychology #ResearchStudy

#psychology #counseling #socialwork #psychotherapy #mentalhealth #psychiatry
Life on the Wicked Stage: Act 3 @[email protected]
2026-10-24

Previews, Pre-Season, Betas, and Opening Nights

There’s an old saying in the theatre biz. No show is ever really ready on opening night. It’s a cliché that has seen it’s time pass in the big money commercial circuit because so many producers run lengthy preview weeks, charging essentially, but not quite, full price to avoid reviewers publishing their criticisms until the show is officially open. The preview process began lengthing after the days of out-of-town tryouts came to an end, although we see that still happening occasionally as larger regional theatres will debut a work, allowing it to still be worked on, hoping that it will one day make it to Broadway.
There was a famous production of Eugene O’Neil’s play Hughie, starring and directed by Al Pacino, that ran in previews for almost a month before finally opening. That led to a critic from Daily Variety breaking the only after opening night embargo a week early since the announced limited run would end up with less “real” performances than those in previews after the show officially opened. The show would go on to extend the run a couple of times.
In smaller circuits the cliché still lives on, simply because of a lack of resources to run many preview performances in front of audiences to really gauge reaction before it officially opens. A show can look great in final dress rehearsals, but it’s never complete until there’s a paying audience of strangers sitting in the dark to tell if it works or not. The ever-present lack of time still breathes life into the cliché in ways that offer both hope and anxiety behind opening night curtains around the world.
In the professional sports world teams play in a pre-season or spring training games that don’t matter while the players tune up for the real thing. Although in most of those types of meaningless games it’s really more like watching players audition than it is anything else. Occasionally a budding star emerges, but that’s atypical. Early “real” season games that do count (at full price) are when teams find out what they have, leading knowledgeable sports viewers knowing when it is time to pay real attention to a team’s chances or not.
Those are two interests in my life. I’m a theatre professional (and geek) and I watch sports. Another is my interest in tech. In tech we have betas. Or we used to, when that was mostly for software. Now we’re just in previews, pre-season, or perpetual betas forever for both software and hardware. Which is somewhat understandable, yet weird, perhaps ironic, but ultimately a joke on the paying public, given the pace in which things are always advancing in tech, including the pace and price of advancement.
We never seem to reach opening night, opening day or the end of a beta period in tech. Instead products and software are released incomplete, occasionally followed immediately by “leaks” that suggest the company that just took your money for it’s latest best product ever is working on fixing the things they knew were wrong for the next version when they released the product you just payed for.
But you’re going to love it.
It’s easier to swallow with software. It’s a bigger pill that sticks in the craw with hardware.
It used to be that betas were for working out bugs. They still are to a degree, but now they’re just the next show in a never-ending season, or the latest minor-league call up. But you still pay full price for the game when the team needs to put a not ready for the big leagues pitcher on the mound just to fulfill its obligation to play the announced season.
You can argue that there’s nothing wrong with the way things have evolved in tech because the financial equations are different. It requires a substantial upfront investment to create, produce and deliver new technology. You’d be mostly wrong, but you can argue it. Most of the costs in show biz happen upfront before a show even gets close to an audience, hopefully a large enough one in a long enough run to recoup the initial investment. It is a different equation in sports.
The release of Apple’s iPhone Duo strikes me as an interesting entry in this evolution of consumer dynamics. Soon, perhaps too soon, before the product was released to the general public, leaks popped out that Apple was working on tweaks to two of the major criticisms of the device for the next generation — a larger model and adding FaceID. That followed criticism from reviewers.
In general, most tech reviews I read, watched, or listened to made it very clear that the iPhone Duo was a first generation device with some rough edges that wasn’t for everyone, especially at the entry price. I can’t judge those reviews myself since I haven’t seen the product, but they mostly seemed very similar and to my mind fair. Some, sounding more like theatre critics or sport writers I’ve known, were more harsh, delivering criticism that might have prompted a closing notice being posted before intermission or an early game benching.
Here’s where my three interests diverge a bit. In theatre the show can close early if it’s savaged or not enthusiastically endorsed by reviews. In sports a pro team can retool a bit by trading or signing free agents midseason. Tech companies have to play out the run with tech hardware until the next generation is ready.
Given the leaks following the reviews I find it sort of funny that I’m in a place of feeling a bit sorry for the carriers that are offering great deals on the iPhone Duo subsidized by a three year contract. That’s a tough sell to anyone who pays attention, though admittedly most won’t if they’re hot to trot for the new shiny folding phone from Apple.
It’s my hunch, and only a hunch, that Apple knew these criticisms were coming. Even so, it’s one thing to prepare the next version hoping to make changes that advance a platform, it’s another to make them in reaction to negative press once the product is unveiled. It sets you up in the next round for being congratulated for fixing what was wrong the last time.
In the theatre if a joke doesn’t land, you can replace the joke in previews. In sports you bench a player or fire a coach. With tech hardware it’s not that easy changing things before it becomes a punch line. (See the Vision Pro.)
My second hunch, only a hunch, is that the iPhone Duo will eventually become a successful part of Apple’s lineup and get past what feels like a rough opening. I don’t think it will enter into Vision Pro punchline territory. Critics of all human endeavors need something to criticize as much as companies need to produce the next thing. It’s a symbiotic relationship that feeds on itself. And the always distracted general public has short-term memory bordering on amnesia.
It’s my wish that tech companies, like theatre companies and sports teams, would figure out a better path to the success they seek. Sure, you might be able to fool some of the people all of the time. But for the most part folks figure it out on their own. Some of the time. And that some of the time is what everybody on the producing end of things counts on.
Thanks for reading. You can subscribe to this blog if you care to. You can also find more of my writings on a variety of topics on Medium at this link, including in the publications Ellemeno and Rome. I can also be found on social media under my name as above. This site does not use affilate links.

#Apple #iPhone #iPhoneDuo #reviews #Sports #Tech #technology #TheaterOfTheMind #Theatre #Writing

#apple #iphone #iphoneduo #reviews #sports #tech
Pixel Prophecy 🇵🇸🇺🇦🇪🇺 @[email protected]
2026-10-25

Thanks everyone who joined me play some super creative game jam games and thanks for the raid, twitch.tv/coleslawski 💖!
Here’s the VOD with chapter marks:
► https://youtu.be/uMzPz0VnkU0
#ldjam60 #indiegames #ludumdare

#ldjam60 #indiegames #ludumdare
PeachMcD @[email protected]
2026-10-24

@Homoevolutis0
And yet, the #GOP would like everyone to think #Islam is a religion of violence (while they stoke fear & hatred in #Jesus' name)
Bravo to #EbroAhmed! Let's deport #tRump & keep #Muslims like this
Amiright @QasimRashid ?

#gop #islam #jesus #ebroahmed #trump #muslims
Maryland PPC @[email protected]
2026-10-25

On October 22, first day of early voting in MD, the Maryland #PoorPeoplesCampaign led 2 marches as part of Repairers of the Breach's #1000MarchesToThePolls nationwide initiative. Here are some pics (videos coming!)
1-2: Rockville - everyone post-march; Tri-Chair Mike interviewed by CNS (credit: KidMix Photography)
3-4: Baltimore (credit: M. Puskar)
#ForwardTogether #WeWontBeSilentAnymore #OurVoteOurPower

#poorpeoplescampaign #1000marchestothepolls #forwardtogether #wewontbesilentanymore #ourvoteourpower
Spain @[email protected]
2026-10-27

Iberdrola places 1.600 million in green bonds
Iberdrola has announced this Tuesday that it will carry out a new placement of green bonds denominated in…
#Spain #ES #Europe #Europa #EU #Iberdrola
https://www.europesays.com/spain/106751/

#iberdrola #eu #europa #europe #es #spain
Andrii Mishkovskyi 🇺🇦 @mishok13
2026-10-27

PRs around these places are certainly a vibe.