A fantastic white paper on code sandbox security with a really important vector that I hand't considered: patch cadence arxiv.org/pdf/2606.08433
arxiv.org
Chad
@chadfennell.com
The Ted Lasso of Engineering Consultants Elixir, Ruby, TS, Infra, AI Automation/DX, Positive Energy, Dad Jokes https://sandboxicon.com
Upgrade Rails immediately, kids, this is a big one. github.com/rails/rails/...
Possible arbitrary file read and remote code execution in Active Storage variant processing
### Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process envi...
github.com
Over the past couple of years, I noticed a lot of devs (myself included) were pretty fuzzy about what people mean by "sandboxes" for agents and dev spaces. Recently, I had the idea to turn some of that research into a website for fun if not profit: sandboxicon.com
sandboxicon.com, shared kernel, or its own?
A field guide to container and VM isolation, and what your AI coding agent actually runs with by default. Every claim is labeled by how well it's sourced.
sandboxicon.com
Nothing new under the sun and all that www.preprints.org/manuscript/2... Cognitive Offloading Is a Cognitive Universal We show how ecological niche construction...& the ability of LLMs to demonstrate fluent language use in the absence of extra-linguistic input all exemplify this offloading process
preprints.org
For better or worse, the kind of things I think about while hiking. Conversations, projects, and ideas rattle around in my head and I try to take a step back and think hard about funamentals. I enjoy nature and stuff too. chadfennell.com/lab/5-heavin...
The Unbearable Lightness of Software
Developers often reject systems on the basis of 'heaviness.' But is heaviness the right criterion for selection?
chadfennell.com
Bumped into BEAR INFO up in the Muir Wilderness area this week😂 "If you see a bear, chase it like you are trying to catch it and eat it, Get mad. Be mean. They will run away in terror - Charlotte Lake Ranger" RIDE IT LIKE A WILD STALION. DRIVE IT INSANE BY INSCESSANTLY TALKING ABOUT THE WORLD CUP
Whether it's AI use, politics, or business - the opinions of people in the arena will always carry more weight for me than those on the sidelines.
Old enough to recognize this as a data center
ARIatHOME never fails to put me in a good mood. NYC is a such a gift. www.youtube.com/watch?v=GGUl...
Is SHREDDING in PUBLIC Like This Even LEGAL??
YouTube video by ARIatHOME
youtube.com
🚀 Dear Elixir developers! 💜 Please help test Mishka Chelekom Headless Components! Your feedback will help us find bugs and get ready for release. 🐛✨ Our biggest release yet is almost here, with even more features on the way! 🎉🔥 Thanks for your support! 🙌 #ElixirLang
💥 Elixir PSA: update Plug *immediately* to the latest possible (1.20.1) The latest CVE makes it trivially easy to DOS a plug based server. cna.erlef.org/cves/CVE-202... This one is a doozy stay safe out there and keep your deps updated! #elixir-lang
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
This project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).
cna.erlef.org
Some brain droppings on Complexity and Polyglot Programming chadfennell.com/lab/4-polygl...
On Polyglot Programming
Build a toolbox and fill it full of tools.
chadfennell.com
firecracker level isolation w/out firecracker hassles - very promising microsandbox.dev Plus, secrets stay on the host (like Deno's new offering). More of this plz.
microsandbox - Every agent deserves its own machine
microsandbox runs lightweight microVMs locally on your machine. Programmable networking, custom filesystems, secrets that never leak.
microsandbox.dev
I've made a Kubernetes that runs in the browser, and today we're open sourcing it. The hope here is to make super interactive and visual web content about Kubernetes much easier to write, and we have a whole bunch planned this year. Repo: github.com/ngrok/webern... Demo: webernetes-demo.ngrok.app
It's easy to get tunnel vision as an adult, particularly in a busy chaotic environment. We start hammering things into the shapes of previous problems we solved out of convenience and sometimes...despiration.
Admiral Ackbar: It's A Trap Meme
Alt: Admiral Ackbar: It's A Trap Meme
static.klipy.com
Woooooot!!!
Davide Aversa@davideaversa.it · 2mo agoI always liked Elixir, but I never gave it a real shot because I never really enjoyed working with dynamic languages. In recent years, they have done amazing work on gradual typing, and now I officially have zero complaints. elixir-lang.org/blog/2026/06...
An educational frozen dessert called "Popcyclical" that comes in the shape of Pope Leo with a wrapper that has the MAGNIFICA HUMANITAS Encyclical written in Dr. Bronner's font. Papa paparum est, poppa of poppas, Pope of Popes. #free_product_ideas
A Zoom plugin called "FATALITY" that allows you to murder one avatar a day. #free_product_ideas_thursday
TIL Firewalla's Wake on LAN implementation just works with my home dev box. I can wake it up remotely with a click on the Firewalla app.
Will Ferrell Enjoys Hot Coffee
ALT: Will Ferrell Enjoys Hot Coffee
static.klipy.com
At work, we got our app compiling without warnings on #ElixirLang 1.20-rc.6. The new type system discovered ~500 issues that 1.19 did not. - Most were just dead code (handling patterns that could never actually match in practice) - A handful were outright bugs. (See below)
🚨 Update hackney 🚨 A **bunch** of vulnerabilities I reported in hackney were just disclosed. Please upgrade to 4.0.1 ASAP. I know this is gonna start dependency hell so please take some time for this. Please RT for reach. #ElixirLang cna.erlef.org/cves/
List of Issued CVE’s
This project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).
cna.erlef.org
Been on Kagi for a while now and I'll give up a lot of other services before I give up this one. No going back. arstechnica.com/gadgets/2025...
Dumping Google’s enshittified search for Kagi
Enough is enough: I’ve jettisoned Google in favor of a search engine that doesn’t treat me like a product.
arstechnica.com
Hey Elixir friends, funny how getting a feature down to a simple one-line call takes two weeks of design work. Sharing what that looked like for Hologram realtime.
