I'm of negative military value, but I can make money, so sending them to Ukrainian army & Come Back Alive fund. 💸💸💸💸💸 I've never taken donations for my WP&OSS work, if you ever offered - send it to Ukrainian army now, like my life depends on it. 🙏

LLM coding discourse blends people who love to code, and see it as new toys, with people who hate to code, and see it as their escape. there is a (lack of) optimism towards tech and then there is just bitter "chating with a bot 8h a day is the future, because I need it to be".

"don't review the code, who cares!" crowd makes me think about that x-ray machine that had race conditions which were killing people.

For the next 2 years I am looking for a: performance related WordPress community centered relationship focused position. Which includes education, video production, in-person communication and travels. Please, share to someone who you believe might be looking for a person like me. Cheers 🌷

if AI that produces next word is sequential and very expensive, and AI that estimates answers to questions is parallel and very cheap, then you just give the latter every word and ask "is this the next word?" 🧐

spotify doesn't react to tapping buttons half the time anymore, but their AI coding stats are really impressive

My college roommate Dave had zero survival instincts but massive panic response. Back in 2021 when people were freaking out about supply chain shortages, he panicked and ordered a 50-pound industrial sack of dry pinto beans from a restaurant depot website. The sack arrived. Dave had never cooked a bean in his life. He read online that you have to soak them in water overnight, so he dumped the entire 50-pound bag into our communal plastic storage bin, dragged it into the hallway, filled it with water from the shower head, and went to sleep. At around 3:45 AM, we woke up to what sounded like a wet bomb going off. Beans expand when they soak. Dave did not account for bean volume physics. The plastic bin had exploded under the sheer pressure of 50 pounds of hydrated legumes. I walked out into the hall and it was just ankle-deep in cold, slimy, swollen pinto beans stretching from our front door to the kitchen. Dave was standing there in his boxers holding a soup ladle, completely frozen, looking at me like he had just accidentally summoned an ancient deity. The apartment smelled like raw starch until we moved out in May.

Tailwind acquisition is emblematic for challenges of open source, key project and the business around it got discarded in a last paragraph. Open source needs funding, but open source doesn't create funding. And unlike art it's bad for money laundering (I think? Worth trying?).

kinda surprising, given he always maintained being in sole control of the co, but if they could they had to eventually 404media.co/wordpress-automa…

the passage of time is intricately felt in discovery of things expired 10-15 years ago that work Not Great

adult friendship is basically “i love you, i’m alive, life beating my ass, talk soon.” 😭

twitter ads for normies: "would you like to generate some slop?" twitter ads for techies: "would you like to spend more money playing with your agents?"

Two days ago, Rank Math closed about a dozen security issues in 1.0.277. This plugin runs on over 4 million sites. In that same update, group[.]one (who also owns WP Rocket) now gets administrative privileges to your site. Last time, I classified something like this as a backdoor. This time, you may decide. The file: vendor/groupone/wap-client/includes/class-app-password-manager.php. What it does: When a site administrator whose site is connected to a (free) rankmath[.]com account opens "Help & Support," the plugin immediately creates a WordPress Application Password for that user. It sends that password to group[.]one's servers. Their AI agent can then act on your behalf on your site. The plugin never asks first. There is a "Terms & Conditions" box, but it does not stop the password from being created or sent. The transfer starts before the box even appears. What they can do with it: WordPress Application Passwords have no capability scopes; that password gives administrator powers. Their servers can install and activate plugins from WordPress[.]org, change settings, create admin users, and edit or delete content. They cannot immediately log into wp-admin in a browser, but they do not need to. For example, they can install a snippets plugin and then inject PHP into its settings. That is remote code execution. "WPCode — Insert Headers and Footers" by Syed Balkhi exists to do just that. The password group[.]one holds can install it and write those settings. Will they do this? Probably not. But their servers are now a hot target: they are collecting administrator passwords from a plugin on over 4 million sites. A hacker who gets that pile can hijack every site that already minted one. The password shows up on your profile as "WAP – Rank Math Support Agent". Closing the "Help & Support" tab does not revoke it. This Application Password does not expire. You cannot turn the "Support Agent" off. What you should do: If you opened "Help & Support" while connected, revoke the Application Passwords immediately. Go to "WP Admin -> Users -> Profile -> Application Passwords, and revoke anything starting with "WAP –". Extra context: I'm the founder of The SEO Framework plugin, a competing plugin to Rank Math, but without CVEs.

Pie 🥧 🤤

Surprise! TypePHP has gone open source earlier than planned 🎉 It was originally scheduled for October, but you can already find it on GitHub. Worth checking out if you’re interested! github.com/swoole/typephp #swoole #php #typephp

tried running offline LLM on my notebook, puts it into perspective that on hardware that can render a frame of modern 3D game in 17 milliseconds, takes it 2 minutes to get basic text sentence out. the computation demands (and profit prospects) of this tech are batshit.

plugins crashing with WP changing hook implementation details is good reminder that its' backwards compat commitments do NOT exist in context of modern PHP. writing modern code in WP ecosystem requires huge defensive overhead against everything coming to you from core/other.

I dig into it (ty, meditation practice /s) & it keeps me upset that this dumb shit could be the rest of my life, until I'm on the wrong side of blast radius or my body is pushed to fail last time. might be (worse & harder) life after, or not. not that it's over, that it's stupid.

So the flowers survived my brief vacation …

the wives of the world contain more market wisdom than a Bloomberg terminal

We spent months tracking down a rare SQLite corruption bug. Working with SQLite’s core developers, we found it—then uncovered a second bug along the way. The story of the rare race condition we eventually caught: tailscale.com/blog/sqlite-wa…