What AI thinks a DBA does all day is a calm, orderly, deeply reassuring Tuesday. It has backups, documentation, proactive health checks, and apparently a door that closes. I asked. Then I wrote down my actual Tuesday. Its day has six items. Mine has thirteen.I asked it to describe a typical day for a database administrator. It answered instantly, with the confidence of something that has never been cc’d.One Tuesday, according to the job description and according to Tuesday.What AI Thinks HappensWhat Actually Happens9:00. Review overnight backup jobs and monitoring alerts.9:04. Somebody asks whether the database is slow. The database is not…
Author: drweb
TL;DR — Key Takeaways isolated-vm, a popular Node.js sandbox considered more secure than vm2, has a critical flaw that lets malicious code escape its isolation and potentially hijack the host process for remote code execution. The bug is in the C++ glue code that transfers data between V8 isolates, where a time-of-check-to-time-of-use flaw in ExternalCopy can turn a seemingly safe ivm.Reference into a full guest-to-host escape. With isolated-vm used by more than a million projects/downloads a week—including AI and automation platforms—developers should urgently upgrade to versions 7.0.1 or 6.2.0 and scrutinize how their sandboxes could cross security boundaries. Developers for…
TL;DR — Key Takeaways Tessl Code Review targets a growing bottleneck in agentic development: AI-generated code is arriving faster than human reviewers can keep up. The tool stores review standards as versioned files in the repository, giving teams control over the criteria used to assess pull requests. Tessl reviews the full pull request context, including surrounding code, team standards and previous discussion, rather than only analyzing the latest diff. Every team that has turned coding agents loose on real work has run into the same wall. The agents write fast. They write a lot. And somewhere between the tenth and…
TL;DR — Key Takeaways PQC migration starts with discovering where vulnerable cryptography exists—not simply swapping algorithms. Cryptographic dependencies can hide across source code, libraries, containers, CI/CD, Kubernetes, cloud services and SaaS platforms. SBOMs help map software components, but CBOMs and cryptographic inventories provide deeper visibility into keys, certificates, protocols and algorithms. CI/CD pipelines can continuously collect cryptographic metadata and connect it to builds, images and deployed workloads. A living inventory is essential for crypto agility, migration prioritization and reducing “harvest now, decrypt later” risk. Post-quantum cryptography is often framed as an algorithm replacement exercise. The discussion usually moves quickly toward…
TL;DR — Key Takeaways Waterfall is becoming useful again in the LLM era, not as a slow bureaucratic process but as a lightweight control structure for fast AI-generated work. Waterfall 2.0 follows five stages: vision, ADRs, prototypes, architectural skeleton, and code plus tests. Backtracking becomes a strength. LLMs can regenerate earlier artifacts quickly, making it practical to revisit assumptions without weeks of rework. A shared knowledge corpus is central, bringing requirements, ADRs, source code, schemas, diagrams and telemetry into one context. The engineer’s role shifts toward orchestration and validation, with humans managing context, checking outputs and making trade-off decisions. Waterfall…
TL;DR — Key Takeaways Traditional SRE metrics can stay green while an AI system is failing customers. Latency, uptime and error rates do not measure whether an LLM is giving correct, grounded answers. Production-grade AI needs evaluation at three stages: before release, during CI and on sampled live production traffic. Use a layered evaluator stack. Cheap deterministic checks can run broadly, while more expensive LLM judges and human domain reviews should run selectively. The best eval sets come from real production failures. Customer complaints, anomalies and low-confidence traces should be promoted into permanent regression tests. For RAG systems, retrieval quality…
There’s a element in HTML now. Looks like Chrome led it up and got it into Chrome first. Now we’re in the ol’ 🤷♀️ state on when we’ll get it elsewhere. But the process certainly involved other browser makers, so that’s good. Manuel Matuzović has a good intro blog post. The element doesn’t behave right within an so embedding a demo here doesn’t make sense. You can see a small demo here, and the code is here. Here’s what I think you should know: It’s a with an enforced design. It’s got a map icon and text that says “Use…
Josh Tumath: Have you ever noticed that when you increase the system text size in your iOS or Android phone’s accessibility settings, the text gets bigger everywhere except on the web? On Safari and Chrome, it makes absolutely no difference. New thing: This isn’t page zoom, which scales everything, it’s just respects the text-only scale settings from the system itself. Great idea. I’ll definitely be playing with this.
TL;DR — Key Takeaways Hackers compromised the maintainer account for the popular arrayref Rust crate, pushing malicious releases that used a typosquatted dependency to execute an information-stealing payload at compile time. The attackers carefully staged the campaign—including fake developer accounts and yanking legitimate versions—to trick developers and CI systems into “updating” to the poisoned release. Researchers say the attack’s infrastructure overlaps with recent North Korean-linked supply-chain campaigns, raising the possibility that the operation is tied to a broader nation-state effort. Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the…
Every once in a while, the platform drops something that makes you want to build strange demos again, or at least weirder ones. The new HTML in Canvas API is a perfect example of one of those moments. The promise is simple and exciting: take native HTML, render it into canvas workflows, and then apply visual effects with 2D Canvas, WebGL, or WebGPU. In other words, you can keep real semantic elements in your markup while treating their rendered output as pixels. Support Status (Important) To enable it, go to chrome://flags/#canvas-draw-element and turn on the “Canvas Draw Element” flag. After…