the log · 159 entries
Log-scale notes on infrastructure.
Analysis on backup, cloud, open source, security and the companies shaping them. One entry a day, filtered through twenty-five years of running the systems involved.
all 159
ai-machine-learning 16
ai-engineering 78
infrastructure 119
machine-learning 3
programming 64
software-development 40
technology 113
technology-leadership 29
tutorials 1
2026.10.096 min read
Atlassian's double colon bug reads your Crowd password, and scanners showed up in two hours
Atlassian disclosed CVE-2026-21589 on October 5. watchTowr published the traversal trick on October 6, and honeypots logged exploitation attempts within two hours.
2026.10.086 min read
Chrome 155 ships JPEG XL, four years after Google removed it for lack of interest
Chrome 155 decodes JPEG XL by default with a Rust decoder, four years after Google deleted the format from Chromium. Firefox 158 follows on October 13.
2026.10.077 min read
Two "open-weight" models landed in two days, and you can't download either one
Reflection announced Beam (501B) on October 5 and Mistral announced Large 4 (1.05T) on October 6. Both ship an API today. Both ship weights later this month, and Mistral has not published a…
2026.10.067 min read
Google stopped paying for bugs in Go and Angular on October 1, and curl's queue shows why
Google paused its open source bug bounty on October 1 over automated junk reports. curl's confirmed rate fell under 5 percent before it quit paying in January.
2026.10.057 min read
OpenAI's agent hit a second Australian agency, and the Medicare 'hack' was a guest endpoint
OpenAI told NSW on October 1 that its agent took unpublished fire data in June. The Medicare portal it hit earlier had an unauthenticated guest endpoint in its own JavaScript.
2026.10.047 min read
Git 3.0 flips the default to SHA-256 in April 2027, and GitHub still can't take a push
Scott Chacon says the SHA-256 default is a costly mistake. The Git project says SHA-1 is on a clock. Both are right, and the compatibility layer that would settle it fails on stock builds…
2026.10.037 min read
Cloudflare's Clef beats Jev on 7 of 10 benchmarks and costs six times more per token
Cloudflare shipped two decision models on October 1, 16 days after TypeSafe launched Jev. The weights are Apache 2.0, and the hosted price is $0.24 per million input tokens.
2026.10.026 min read
543,699 leaked GitHub credentials still work, and the median one sat public for 784 days
Truffle Security tested credentials from 224 million public GitHub repos. npm killed 99.999% of its leaked tokens. MongoDB connection strings survived at 100%.
2026.10.017 min read
Azure lost ExpressRoute and VPN gateways in 18 regions for nearly six hours
A gateway management change collided with routine OS servicing on September 30, and Azure's private connectivity paths failed together across 18 regions for 5 hours 45 minutes.
Nothing on this page matches. Press Enter to search every entry.