A short daily conversation about how software actually gets built.
Builder's Weekend: OmniDiff, a Rust diff tool that compares code, images and PDFs, and DeepSeek's agent prototype that wants its own OS account. Plus Linux 7.4-rc1 after a record merge window, releases for Node, uv and CrewAI, and two Fast Boot oddities.
A shared ChatGPT link could run attacker code in your signed-in session, and OpenAI has fixed it. Plus a Linux TCP flaw rated 9.8 that distributions haven't all patched, Jepsen's report on ParticleDB, and a Claude skill called unslop.
OpenAI, Google, Microsoft and Anthropic back a shared robots.txt opt-out for AI training, but it's a preference, not a lock. Also: a trojanized Claude Code extension in Cursor's marketplace, Cloudflare's weak eMudhra certificate keys, and an NES emulator built into Qwen's weights.
Mistral releases the weights for Large 4, a one-trillion-parameter model it says could help real attackers. Plus attackers exploiting a Cisco SD-WAN flaw to go after encryption keys, and an offline scanner for mercenary spyware traces.
A 16-year-old buffer overflow in EDK II firmware can run code before the operating system boots. Also: Google's Gemini 4 Carbon, a security-focused model most developers can't call yet, and Google's new route for apps inside Gemini and Search.