apimade

Do one thing, and do it well.

The unix philosophy prevails!

Crazy that this particular feature we’ve all been waiting for hasn’t received first-party support by any DevEx company.

You know, the companies that say security is their number one priority, or companies that scream “developers, developers, developers”. How Google and Apple didn’t come up with something together eludes me, but then again, we have entire ecosystems and categories deployed in the areas they don’t service (auth, application control, etc).

Don’t get me wrong, I like the idea of self-hosting but there’s a reason we don’t manage and run our own email infrastructure.

I think the SaaS is dead meme is really just a “SaaS can’t be lazy anymore”. The days of offering a product that technically does something, but is incredibly poorly designed, or not well integrated, or unsupported — are over.

If your SaaS doesn’t support both Google and Microsoft; macOS and Windows; iOS and Android; automated provisioning, complex/fine-grained RBAC, customisable onboarding.. You’re dead in the water.

The moat of features has evaporated, and your only defence is good UX, stability and TCO.

AI isn’t eating SaaS. It’s eating shitty businesses.

Password Manager SaaS that have been breached are dead.

Auth providers that scale their pricing model to their investors growth expectations are dead.

Platforms and technical products that did something a script could do, with little support for real business software, ecosystems and environments are dead.

Because sometimes bad architecture is the correct architecture, and good architecture is the wrong choice.

You think we’d have Carmack’s DOOM with “best practice”? Hell no.

I’ve worked for incredibly talented people who choose the wrong technology, approach and design for problems they could have predicted or anticipated, had they seen it or a similar problem before, or had context about the organisation, customer or size of team managing the proposed solution. But they don’t.

AI is great at giving textbook and “Enterprise grade” solutions; but as code production cost reduces — I think the value of simple, digestible solutions will grow. TDD et al can also be helpful, but at a certain point it becomes too abstracted, too complicated, too hard for any one person to grasp.

At that point I think test managers who understand user journeys will be worth their weight in gold, and the real value in any solution becomes good, represented testing.

512GB memory available in October. Stellar move, Apple.

Liquidity providers like Jane Street, Citadel, et al make money on the spread. They also buy order flows from integrators, and retail investor order flows are now a product.

i.e. retail investor → brokerage platform → clearing/execution infrastructure → Jane Street → payment back toward the brokerage side of the chain.

Who captures the economic value created by retail order flow?

Jane Street.

In an ideal market, this product line shouldn't exist. Institutional investors should not be making money on the activity of retail investors.

What incentives determine where that flow is sent, and would investors receive better execution if their orders were exposed to genuinely competitive price formation rather than privately internalised by a concentrated group of wholesalers?

The regulators should be squashing any HFT related or retail order flow, but it's so opaque _by design_ that getting policymakers, or the general public, to understand that retail investors are paying some portion of tax on their $20T USD annual trades to these companies.

Granted, these order flows _sometimes_ work the other way -- and retail users get a better deal on a trade.. But would you really expect the market to be worth what it is, if that was the case less more often than not?

There is a clear and obvious conflict: the broker is supposed to seek the best execution for the customer while potentially being paid by the firm receiving that customer’s order. How can that be, when the broker's in bed with the liquidity providers?

Skip signup:

Cmd+Option+I > Console > 'allow pasting'

const onboarding = document.querySelector('#onboarding'); const app = document.querySelector('#app'); onboarding.style.setProperty('display', 'none', 'important'); app.inert = false; app.removeAttribute('aria-hidden'); document.querySelector('#prompt')?.focus();

Also, warning:

# Share chats with Bullet — helps us improve model routing and answer quality

Enabled by default.

I guess the question is; is this the late-cycle cash-out (aka harvest pricing) akin to Sun Microsystems at the dot-com peak -- or is it a repeat of the crypto pricing hijinks we've already seen from Nvidia, where they're just exploiting the lack of supply?

That's a 90% uplift since the original pricing, in a market that is already showing signs of seizing.

With Apple offering leasing options, CXMT knee-capping Samsung, all of the big tech players on a run to outspend on CapEx by the end of the year..

We're at a point where local models are exceptionally capable, model-on-silicon dies like Taalas (recently acquired by AMD) may be cutting inference cost substantially for the 90% of work we do day-to-day (similarly Alibaba's T-Head division with open-model-forward inference chips being produced domestically in China).

If we shifted all of the design/planning to cloud models like Fable 5/Sol 5.6 Ultra, and day-to-day operational inference to these chips -- it's quite likely we'll squash usage to single-digit percentages of what we're currently using. But we should also expect the model providers to take a similar approach.

In any case -- I'm keen on demand destruction, both as a consumer and someone without skin in the game.

In my experience, program requirements are mostly there for the lawyers.

If you act in good faith, communicate clearly, and conduct yourself reasonably, most companies will work with you — even when you've technically wandered outside the neat boundaries of their risk-appropriate, regulatory-reviewed policy.

That isn't protection, of course. Eventually you'll encounter a bounty program run primarily by lawyers, procurement, or someone optimising a graph trend-line.

And we know what tends to happen next.

Those programs, and organisations, develop reputations. Researchers talk. Companies get discussed at conferences, in private groups and across the community, and some become informally blacklisted.

Microsoft is a useful recent example: researchers have publicly walked away from five-figure bounties to make a point. There are excellent people working there, but organisationally Microsoft has repeatedly struggled to engage with the security community in a way that feels collaborative, rather than adversarial. Unless you're one of their paid partners, intermingled in their ecosystem.

A lot of that seems to come down to incentives: somebody, somewhere, wants the numbers to look better.

That doesn't work particularly well in an industry that, like most industries, ultimately runs on relationships, trust and specialisation.

If a company marks something critical as informational, sometimes the most effective response is a CVSS parameter argument. It's a snarky comment:

"Okay — so if I find a way to abuse your own infrastructure to message your customers, trigger a major incident and create regulatory problems for your clients, you'd prefer I treat that as informational too, and instead just report it to regulators?"

Surprisingly often, that gets the issue reconsidered.

Have you annoyed an analyst? Maybe. Does it matter? Probably not. Neither of you will remember the exchange a week later, but you might have corrected a bad risk decision on their side and you'll see a positive outcome on your side. Mistakes happen.

I generally advise companies and hackers alike to follow Kiwicon's #1 rule.

I've disclosed vulns across just about every industry — banking, healthcare, oil & gas, government, cybersecurity, etc -- and to some of the largest companies in the world, OpenAI, Salesforce and Google. I've been doing this for nearly 20 years.

Most of my research starts with: _There is absolutely no way this works_. Then it works.

I've been thinking that a lot more lately.

Companies and hackers are both heavily incentivised to reduce the friction involved in vulnerability disclosure, particularly for large organisations. The platforms are good enough now. They're email in 2007: imperfect, occasionally frustrating, but substantially better than what came before.

They make SLAs possible. They provide structure and administration. Things still go wrong — companies stop responding, analysts drop the ball, hackers can be idiots — but the model basically works.

Decentralising disclosure again would make life significantly harder for individual hackers. We'd end up back on email, probably building email-powered bounty CRMs that consume a small country's worth of tokens just to keep track of everything.

For smaller organisations, though, I wouldn't touch a public bounty platform with a 10-foot pole. Run a private program first (through the platform). Having been on the receiving end of beg bounties, automated scanner output and increasingly AI-generated slop, most smaller security teams simply cannot scale to absorb the noise.

The more interesting way to think about these platforms is that they're becoming the LinkedIn of hacking.

For hackers, the path is fairly straightforward: build a rep through useful -- but oftentimes unsolicited disclosures, get invited onto private programs, and gradually establish a profile with a strong signal-to-noise ratio.

For companies, they're increasingly a recruiting and relationship-building tool.

And for the platforms, I think there's a much larger opportunity for them in community.

They should be significantly better at understanding hackers: what they're good at, what technologies interest them, which industries they understand, and where they're located. Today, that profiling is laughably poor, to the point the questionnaires on areas by these large platforms are out of date by several years.

Then use the data.

Run small, highly targeted events: state- or city-based meetups, lunch-and-learns, product launches, bounty program launches and technical briefings. They don't need huge sponsorship budgets or prize pools. They need the actual community involved. Pay for dinner, sponsor a talk.

A lot of existing events seem to start with companies, sponsorship packages and monetary amounts, then work backwards. I think that's backwards.

As a weekend hacker, I'm far more likely to spend time on a program because something about it is interesting: you're launching an AI feature, handling financial data in a new way, using Node/GCP/a TI-82 calculator, or exposing some weird technical surface I want to understand.

And I'm far more likely to build a useful relationship with a company if I can actually meet the people behind the program. Hackers can provide much better feedback than a semi-generated report, and companies can explain far more than a stale domain list and scope document — which, realistically, we'll be ignoring 99.99% of the time anyway.. Unless it's government. I quite like my freedom.