AURpocalypse:
1,500+ Arch packages backdoored in a coordinated attack
Starting May 27, attackers adopted hundreds of orphaned AUR packages
and injected malicious PKGBUILDs. The most sophisticated payload used an
eBPF program — delivered via a rogue npm dependency called
“atomic-lockfile” — to steal GitHub credentials, SSH keys, browser
cookies and chat-app data. Over 1,500 packages were compromised across
multiple waves of increasingly obfuscated code. The incident lays bare
AUR’s structural fragility: 107,000+ packages in a shared namespace
where orphaned projects can be silently claimed, maintainers admitting
“our chance at catching absolutely everything is very small,” and a
security model that assumes users actually read PKGBUILDs — which they
don’t.
ATProto
has no instances — just portable hosting and apps
Dan Abramov explains Bluesky’s protocol’s core departure from
ActivityPub: there are no “instances” at all. Users have portable
hosting (like an RSS feed) that any independent app can draw from,
enabling genuine identity portability and a competitive app ecosystem
over a single social graph. The analogy is the original RSS/reader split
— content lives where you put it, and multiple readers compete on
features without controlling the data — making it structurally richer
than Mastodon’s federated-copies model.
Why LLM-written
incident reports are dangerous
Lorin Hochstein argues that having LLMs generate incident reports
defeats their entire purpose. Writing a report forces engineers to
confront the fuzzy mental model of what actually happened — “Writing is
Nature’s way of showing you how sloppy your thinking is.” LLMs produce
plausible reports that may be factually wrong, and unlike code there’s
no test that catches a wrong incident report. Reviewers won’t scrutinize
work they assume AI produced efficiently, and the institutional learning
loss compounds invisibly.
Project
Valhalla arrives in JDK 28 after a decade of work
Java’s longest-running language project reaches preview in JDK 28
(March 2027): value classes — “codes like a class, works like an int.”
Value objects are immutable, skip heap allocation and enable dense array
layouts that eliminate Java’s perennial pointer-indirection memory
penalty. The 197,000-line integration across 1,816 files is the largest
single JDK change in memory. Phase 1 still allows null value types;
non-nullable types and specialized generics — needed for
ArrayList<Point> to actually flatten — come
later.
The colors that
exist beyond your screen’s gamut
A perceptual-science essay that starts from cone-cell biology:
screens were built around the trichromatic system but still fall far
short of nature, the biggest gap in saturated cyans and vivid greens.
The author maps real-world locations where these “impossible” colors
appear — forest canopies filtering sunlight, bioluminescent bays,
structural iridescence in feathers and butterfly wings, green traffic
lights (actually turquoise). A piece that earns its insight by working
from first principles rather than just stating a fact.
A woman returns to her village in
Qlailah, southern Lebanon, after displacement. Photo: Zohra
Bensemra/Reuters-3d576f5629e9b4f3f6753e9cb20c25c3.jpg)
Black smoke rises from Gazprom Neft’s Moscow refinery after Ukrainian
drone strikes, June 18. Photo: Getty Images
Bissan, evacuated as a premature
baby from Gaza for treatment in Egypt, is reunited with family in Deir
al-Balah. Photo: Mahmoud Issa/Reuters
The feedback-loop problem with
AI-generated operational documents. Source: Surfing Complexity
A vivid natural scene illustrating
colors beyond the sRGB gamut. Source: moultano.wordpress.com