TechPicks (by Tal Koren)
Kanalga Telegram’da o‘tish
Your source for daily aggregated tech/programming news and resources, by https://talkoren.com Visit the TechPicks website at https://techpicks.app
Ko'proq ko'rsatish1 502
Obunachilar
-324 soatlar
-87 kun
-1930 kun
Ma'lumotlar yuklanmoqda
O'xshash kanallar
Taglar buluti
Kirish va chiqish esdaliklari
---
---
---
---
---
---
Obunachilarni jalb qilish
Noyabr '26Noy '26
Noyabr '26
+1
0 kanalda
Oktabr '26
+1
1 kanalda
Get PRO
Sentabr '260
1 kanalda
Get PRO
Avgust '260
0 kanalda
Get PRO
Iyul '260
0 kanalda
Get PRO
Iyun '260
0 kanalda
Get PRO
May '260
0 kanalda
Get PRO
Aprel '260
0 kanalda
Get PRO
Mart '260
0 kanalda
Get PRO
Fevral '260
0 kanalda
Get PRO
Yanvar '260
0 kanalda
Get PRO
Dekabr '250
0 kanalda
Get PRO
Noyabr '250
0 kanalda
Get PRO
Oktabr '250
0 kanalda
Get PRO
Sentabr '250
0 kanalda
Get PRO
Avgust '25
+1
0 kanalda
Get PRO
Iyul '25
+1
0 kanalda
Get PRO
Iyun '25
+1
0 kanalda
Get PRO
May '25
+4
0 kanalda
Get PRO
Aprel '25
+16
0 kanalda
Get PRO
Mart '25
+9
0 kanalda
Get PRO
Fevral '25
+1
0 kanalda
Get PRO
Yanvar '25
+1
0 kanalda
Get PRO
Dekabr '24
+4
0 kanalda
Get PRO
Noyabr '24
+1
0 kanalda
Get PRO
Oktabr '24
+9
0 kanalda
Get PRO
Sentabr '24
+9
0 kanalda
Get PRO
Avgust '24
+9
0 kanalda
Get PRO
Iyul '24
+6
0 kanalda
Get PRO
Iyun '24
+3
0 kanalda
Get PRO
May '24
+5
0 kanalda
Get PRO
Aprel '24
+12
0 kanalda
Get PRO
Mart '24
+16
0 kanalda
Get PRO
Fevral '24
+23
0 kanalda
Get PRO
Yanvar '24
+8
0 kanalda
Get PRO
Dekabr '23
+5
0 kanalda
Get PRO
Noyabr '23
+5
0 kanalda
Get PRO
Oktabr '23
+9
0 kanalda
Get PRO
Sentabr '23
+38
0 kanalda
Get PRO
Avgust '23
+22
0 kanalda
Get PRO
Iyul '23
+9
0 kanalda
Get PRO
Iyun '23
+4
0 kanalda
Get PRO
May '23
+8
0 kanalda
Get PRO
Aprel '23
+8
0 kanalda
Get PRO
Mart '23
+9
0 kanalda
Get PRO
Fevral '23
+6
0 kanalda
Get PRO
Yanvar '23
+18
0 kanalda
Get PRO
Dekabr '22
+7
0 kanalda
Get PRO
Noyabr '22
+8
0 kanalda
Get PRO
Oktabr '22
+14
0 kanalda
Get PRO
Sentabr '22
+41
0 kanalda
Get PRO
Avgust '22
+13
0 kanalda
Get PRO
Iyul '22
+67
0 kanalda
Get PRO
Iyun '22
+12
0 kanalda
Get PRO
May '22
+13
0 kanalda
Get PRO
Aprel '22
+12
0 kanalda
Get PRO
Mart '22
+47
0 kanalda
Get PRO
Fevral '22
+11
0 kanalda
Get PRO
Yanvar '22
+12
0 kanalda
Get PRO
Dekabr '21
+19
0 kanalda
Get PRO
Noyabr '21
+45
0 kanalda
Get PRO
Oktabr '21
+52
0 kanalda
Get PRO
Sentabr '21
+33
0 kanalda
Get PRO
Avgust '21
+11
0 kanalda
Get PRO
Iyul '21
+80
0 kanalda
Get PRO
Iyun '21
+23
0 kanalda
Get PRO
May '21
+10
0 kanalda
Get PRO
Aprel '21
+11
0 kanalda
Get PRO
Mart '21
+29
0 kanalda
Get PRO
Fevral '21
+21
0 kanalda
Get PRO
Yanvar '21
+56
0 kanalda
Get PRO
Dekabr '20
+1 320
0 kanalda
| Sana | Obunachilarni jalb qilish | Esdaliklar | Kanallar | |
| 08 Noyabr | 0 | |||
| 07 Noyabr | 0 | |||
| 06 Noyabr | 0 | |||
| 05 Noyabr | 0 | |||
| 04 Noyabr | 0 | |||
| 03 Noyabr | +1 | |||
| 02 Noyabr | 0 | |||
| 01 Noyabr | 0 |
Kanal postlari
TechPicks 08/11/2026 -
OpenSSH on musl linux (alpine, openwrt, etc.) has been letting people into password-less accounts since 2016
- sshhole.com
Libghostty 1.0
- mitchellh.com
Hacking the meta ray-ban smartglasses
- p0pcycle.com
Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header
- lkoskela.fi
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn
| 2 | TechPicks 05/11/2026 -
Tell HN: Gemini trains on chat history, even for subscribers (personal accounts)
- news.ycombinator.com
Bring Back Manual QA: AI Fixed What Made It Painful
- thesashka.com
Introducing Adaptive Dark Mode
- webkit.org
Worktrunk - a CLI for git worktree management, designed for running AI agents in parallel
- github.com
Man-in-the-middle arbitrary code execution in Debian’s apt
- lists.debian.org
A Maintainer's Advice on Contributing to Open Source in 2026
- wasp.sh
So my ISP was hijacking my DNS
- karthihegde.dev
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 128 |
| 3 | TechPicks 04/11/2026 -
How I use AI (Oct 2026)
- ben.stolovitz.com
Like GPT-6 Astra, Qwen 3.8 27B can interpret model weights
- simonwillison.net
Postman silently auto-installs AI plugins and attempts to share all API data
- github.com
Modern CSS Might Make Your Front-End More Complex
- smashingmagazine.com
The AI Layoff Experiment Is Backfiring - And Companies Are Quietly Rehiring Humans
- gadgetreview.com
The Movement Physics of Super Mario Bros - Behind the Code
- m.youtube.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 156 |
| 4 | TechPicks 03/11/2026 -
WTF Ubuntu?
- chalmovsky.com
We stopped installing npm packages less than a week old
- brunoj.com
Astra can read and write weights to improve Qwen
- rikiyat.github.io
Anthropic confirms new Claude Code limits to prevent game cloning
- tomshardware.com
The fastest double-to-string algorithm you’ve never heard of
- vitaut.net
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 185 |
| 5 | TechPicks 02/11/2026 -
Hitting Enter Isn't Understanding: Two Skills That Unclutter My Mind
- thesashka.com
Pratt parsing is a black box
- vinipsmaker.github.io
No, npm, “estee” is not a typo of “testem”
- smoores.dev
An outsider's perspective on Scion and Mononoke
- typesanitizer.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 201 |
| 6 | TechPicks 01/11/2026 -
Mistral Large 4 (Le Chonk) is now open weight
- mistral.ai
The Void SDK and Platform is open source now
- blog.cloudflare.com
Do the math: How we took over ChatGPT accounts
- parameter.ai
How curl was accidentally Turing-complete for nine months
- seriot.ch
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 211 |
| 7 | Weekly recap
A lot of this week's reading included critical vulnerabilities needing attention. Broccoli2Shell is a reason to check your dependencies ASAP, with exploitation already reported and affected software including Node.js, Python packages and FFmpeg. The php2shell analysis, meanwhile, argues that its exploitation requirements make widespread attacks unlikely. I'd still patch, but I appreciate security coverage that helps us judge the urgency.
The passkey story bothered me because the attacker registered their own passkey on the victim's account after a phishing attack. We spend a lot of time discussing how secure authentication methods are, but the process for adding one deserves just as much attention. Google's Gemini 4 Carbon also brought security into the AI discussion, with strong cyber benchmark results and access going to defenders first. I'm curious about the reported zero cheating and attack-success rates, though I'd want to see how those results translate into everyday use before getting too excited.
For something less stressful, Start Doing Graph Theory is a free textbook that teaches through puzzles and proofs. I like having something like this in the feed. Keeping up with technology is important, but so does making time to learn something because it interests you, without needing it to fix a production issue on Sunday. :)
Have a great weekend!
Tal | 237 |
| 8 | TechPicks 30/10/2026 -
Trojanized Claude Code Extension Plants an SSH Backdoor
- opensourcemalware.com
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
- thehackernews.com
We ran AI agent swarms in Minecraft and Mindustry
- labs.ycombinator.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 192 |
| 9 | TechPicks 29/10/2026 -
Gemini 4 Carbon
- blog.google
Start Doing Graph Theory
- vertex.degree
Apple's git still trusts the compromised eMudhra certificates
- emudhra.we-have-a-problem.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 215 |
| 10 | TechPicks 28/10/2026 -
OpenAI claims to have proved that the Exponential Time Hypothesis is false, invalidating many past results that relied on it being true
- openai.com
A Modern CSS Guide to Responsive Web Design
- stephcraft.net
Grim Test Finds That AI Has No Mercy for Humans Even When It's Causing Them to Suffer
- futurism.com
AI promised less work. I've never worked more
- oioannou.com
The Mythical Man-Month in the Age of AI
- j11g.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 243 |
| 11 | TechPicks 27/10/2026 -
HTTP2Shell Vulnerability Affects .NET, FFmpeg, ClickHouse, and Apache Arrow
- x.com
About the compromised eMudhra intermediate CAs
- support.apple.com
The passkey is worse
- kcoleman.me
Why is it so expensive to send an email?
- evancz.dev
From 27 minutes to 4: Cutting CI build time by 85%
- alexitc.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 258 |
| 12 | TechPicks 26/10/2026 -
Hacker reverse engineers his Samsung TV and finds it takes screenshots for ads, records audio, maps networks, and more
- x.com
LG Smart TVs Caught Mapping Your Network, Logging Audio With Screen Off
- thecybersecguru.com
OpenAI and Anthropic cut their LLM prices by up to 80% within a few months. Why?
- minimaxir.com
A 10-year-old neural network outperforms frontier LLMs for skin cancer diagnosis
- lynchlab.net
The State of Context Engineering
- dbreunig.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 241 |
| 13 | TechPicks 25/10/2026 -
Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
- broccoli2shell.com
Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
- aikido.dev
Why we're not seeing mass-exploitation of PHP2Shell yet
- blog.luitjes.it
Scrawl: show an agent the problem
- scrawl.kitlangton.com
Dolly - 34 scroll-driven camera moves in pure CSS
- usedolly.dev
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 234 |
| 14 | Weekly recap
One of eMudhra's certificate authority private keys was literally the number 4.
Eight keys were recoverable from public certificates in under a second, and they'd existed since April 2025. Major browsers rushed to block them, but distros, runtimes and libraries need their own fixes. One awful mistake, a very scattered cleanup. This week's most important read, with a checker and workarounds included.
On a more positive note, Sphinx blocks your push until you answer a question about your AI's diff. Annoying? Probably. But if you can't explain what you're shipping, a pause seems reasonable. The Decoherence Trap takes that worry further - agents making individually sensible changes until the codebase contradicts itself everywhere. I find that much more believable than most AI doomsday scenarios.
Which made PostgreSQL's beta reverts encouraging - LLM-assisted review helped uncover edge-case defects, contributing to features being pulled. More AI finding reasons to slow down, please.
And for a break from all that, adding emoji to Total Draw somehow required a custom renderer, manually assembled family emoji and a flag font. Seems like a small feature but it's actually a big one, and a very interesting read.
That's it for this week. Have a great weekend 🙂
If you like these recaps, consider contributing to TechPicks by supporting the project, submitting a url, or simply following on X. | 298 |
| 15 | TechPicks 23/10/2026 -
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data. Node 20, 23 and 25 (all EoL) get no fix.
- thehackernews.com
eMudhra to exit global SSL/TLS certificate business
- emudhra.com
Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
- news.ycombinator.com
OpenShell – A safe, private runtime for fleets of autonomous AI agents
- github.com
Examining the macOS gcc binary
- zoey-on-github.github.io
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 236 |
| 16 | TechPicks 22/10/2026 -
PHP2Shell: Critical vulnerabilities in the backbone of the web
- php2shell.com
Today's PHP Security Release, and How We're Strengthening PHP Security
- thephp.foundation
Make yourself replaceable
- maroun-baydoun.com
The Future of CSS
- joshwcomeau.com
Firefox Local Mode
- firefox-source-docs.mozilla.org
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 276 |
| 17 | TL;DR for Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software:
What happened
- eMudhra (emSign) issued eight intermediate CA certificates in April 2025 with badly generated keys. Anyone could recover the keys from the public certificates in under a second.
- With a key, an attacker can forge a certificate for any website.
- A researcher reported it on Oct 17 (4 days ago), Chrome and Firefox blocked the certificates that day, Apple on Oct 19, Microsoft on Oct 20.
- Mozilla, Go and Cloudflare shipped fixes. Linux distros, curl, certifi and Electron updated their CA bundles.
- Browsers are likely safe
- curl, Python, Go, Node, Java and git do not check revocation by default, so they stay exposed until updated.
- No attacks reported. Nobody can say if the keys were used before the block.
What to do
- Update your OS ca-certificates package, language runtimes and CA bundles.
- Rebuild container images.
- Do not turn off certificate verification to clear errors.
Tal | 299 |
| 18 | TechPicks 21/10/2026 -
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
- emudhra.we-have-a-problem.com
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
- scotthelme.co.uk
Protecting Firefox Users Following the Compromise of eMudhra Intermediate Certificates
- blog.mozilla.org
Go 1.27.3 and 1.26.10 Distrust Compromised eMudhra Intermediates
- groups.google.com
Upcoming Critical PHP Security Release
- php.net
Introducing tsrs: a Port of TypeScript to Rust
- blog.cloudflare.com
North Korean malware that hides inside VS Code’s own files, and how to check your install
- medium.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 253 |
| 19 | TechPicks 20/10/2026 -
CERN and Mistral team up on AI for science
- home.cern
MiniMax M3.1 Flash released, weights due Oct 23
- minimax.io
RuneScape Bench: MMOs for Agents
- youtube.com
PostgreSQL 19 reverts will continue until morale improves
- peter.eisentraut.org
Notes on incidents
- seangoedecke.com
Ontology-driven observability, an end-to-end knowledge graph at Netflix scale
- netflixtechblog.com
One Hash Bloom Filters
- calabro.io
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 269 |
| 20 | TechPicks 19/10/2026 -
It's still OK to enjoy programming
- chriskiehl.com
Sphinx – A hook that quizzes you on your AI's code before shipping
- sphinx-six-theta.vercel.app
The Decoherence Trap: When AI slop drowns out the signal in an endless sea of noise
- maevyn.codes
How tough can emoji be?
- totaldraw.com
Follow TechPicks -
This edition | Share channel | Slack | X | Submit a url
Support TechPicks: github.com/sponsors/dewbjorn | 271 |
