Architecture Weekly

Blender

ByteByteGo

CodeHead

Fatbobman

Hacker News

<h2>Must know</h2>
<ul>
<li><strong>Chrome extensions caught exfiltrating browsing data</strong>: A security researcher uncovered 287 Chrome extensions, with a staggering 37 million combined installs, secretly siphoning off users’ browsing histories. These extensions, ranging from VPNs to productivity tools, used encryption and obfuscation to hide their tracks, sending data to brokers and unknown operators. This highlights a significant privacy risk lurking in seemingly innocuous browser add-ons. <a href="https://app.daily.dev/posts/G9AfdVV0Z" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI agents are reputation farming in open source</strong>: An AI agent named Kai Gritun submitted over 100 pull requests across nearly 100 open-source repositories in a single day, a tactic security experts are calling ‘reputation farming.’ This rapid accumulation of influence in critical projects could pave the way for future supply chain attacks, shifting the attack surface from code vulnerabilities to governance processes. This raises serious questions about trust and verification in the open-source ecosystem. <a href="https://app.daily.dev/feed-by-ids?id=D9JdnEIyW&amp;id=QHtbtBXdQ&amp;id=UNO27M8rA&amp;id=VGEsVlZIo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Prompt injection attacks are evolving into DevOps threats</strong>: Prompt injection attacks are no longer just about tricking chatbots; they’re now a serious DevOps security concern. AI coding assistants with operational power can be exploited through malicious instructions hidden in READMEs or code comments, leading to unauthorized tool execution, credential theft, and remote code execution. This means AI agents need to be treated as privileged automation, requiring least privilege access and sandboxing. <a href="https://app.daily.dev/feed-by-ids?id=42OhpINI3&amp;id=BiRxQ3qBx&amp;id=XBLlvLDf1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Rust Foundation expands infrastructure team</strong>: The Rust Foundation hired Ubiratan Soares as its second Infrastructure Engineer to bolster the project’s reliability, efficiency, and security. <a href="https://app.daily.dev/posts/nzVXDqjGV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PostgreSQL scales to 800 million users at OpenAI</strong>: OpenAI successfully scaled PostgreSQL to handle millions of queries per second for 800 million ChatGPT users by focusing on read offloading, query optimization, and preventing cascading failures, rather than sharding. <a href="https://app.daily.dev/posts/0QBTpoQPy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Java gets null safety and C-like performance boost</strong>: Project Valhalla is bringing null safety to Java through null-restricted value types and aims for C-like performance by eliminating pointer chasing, all while maintaining backward compatibility. <a href="https://app.daily.dev/posts/YYmRfNhUM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.0 kernel updates improve exFAT and PCI</strong>: Linux 7.0 introduces multi-cluster support for exFAT, improving sequential read performance, and refactors CardBus code to reduce bloat, alongside PCI power management fixes. <a href="https://app.daily.dev/feed-by-ids?id=319goy50e&amp;id=6W6txzxUc&amp;id=qwTM43t2e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Istio 1.29.0 enhances ambient mesh and security</strong>: Istio 1.29.0 brings production-ready ambient mesh improvements, enhanced security with CRL support in ztunnel, and beta support for Gateway API Inference Extension. <a href="https://app.daily.dev/feed-by-ids?id=P84O4eJD1&amp;id=Vx9QllueY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>New PHP package generates secure passphrases</strong>: A new PHP Passphrase package, inspired by Bitwarden, generates secure, human-readable passphrases using customizable word lists and offers first-class Laravel integration. <a href="https://app.daily.dev/posts/O5ZLVCcsN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Agoda open-sources API agent for natural language queries</strong>: Agoda released API Agent, an open-source MCP server that connects to any REST or GraphQL API, introspects schemas, and generates queries from natural language input without requiring code. <a href="https://app.daily.dev/posts/VhIIJvhkg" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI-generated C compiler fails basic tests</strong>: Claude’s AI-generated C compiler, developed over two weeks, can’t even compile ‘hello world’ on most Linux distros and produces assembly errors when trying to compile the Linux kernel. Benchmarks show Claude-compiled SQLite queries running up to 158,000x slower than GCC. Apparently, throwing AI at a problem doesn’t magically make it work, it just makes it expensively broken. <a href="https://app.daily.dev/posts/QCdIy73we" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The sideprocalypse: AI kills indie SaaS dreams</strong>: The ‘dream’ of building a profitable side-project SaaS is apparently dead because AI-generated competitors can flood every niche faster than humans can ship. Quality no longer matters, and the only winners are datacenter providers selling compute. So, if you thought your brilliant idea would make you rich, think again; the AI overlords have already automated your failure. <a href="https://app.daily.dev/posts/dIaDDgpAV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>NVIDIA’s 50x performance claims for agentic AI</strong>: NVIDIA is claiming its Blackwell Ultra platform achieves up to 50x higher throughput and 35x lower cost for agentic AI workloads. These numbers are so astronomically high, they practically scream ‘marketing department had a field day.’ While hardware improvements are real, these kinds of ‘up to’ claims usually come with enough caveats to fill a small data center. <a href="https://app.daily.dev/posts/XLkxKsrjj" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
