Telexed

AI news through a solo-operator lens — only what changes your day14 of 412

FILTER[All][Agents & tools][Models & API][Generative media][Infra & SaaS][ASO & growth][Indie business][Idea signals][Other][★6+ high-signal]

GeekNews ✕clear filters

Mon, May 183 dispatches

#0412
#0412Other GeekNewsyesterday
`rkdebian` turns an $80 RK3562 Android tablet into a Debian workstation
40radar
rkdebianDebian image build system — built for Doogee U10
A cheap locked-down device can become a bootable Debian 12 machine. Useful for low-cost Linux experiments, but the device scope is narrow and prerelease status keeps it niche.
- Targets the Rockchip RK3562-based Doogee U10; reuse value depends almost entirely on owning that exact hardware.
- Builds bootable Debian 12 Bookworm images, so the value is hardware repurposing more than a general dev-tool upgrade.
- Public prerelease build is dated May 14, 2026; treat it as an experiment box, not a dependable main workstation.
Source: news.hada.io/topic?id=29622Read original →
FIG-4121:1
40radar
FIG-4121:1
#0411
#0411Other GeekNews2 days ago
Stay Native Until Text Forces Your Hand
40radar
SwiftUI can handle Markdown chat UI until document-wide selection enters scope. Jumping to NSTextView brings TextKit 2 complexity and streaming CPU spikes, so delay it.
- SwiftUI gives acceptable baseline performance for Markdown chat, but full-document text selection is hard to support cleanly.
- Moving to NSTextView and TextKit 2 trades native UI simplicity for lower-level text control and more performance work.
- Streaming input can trigger CPU spikes in the text stack. Chat apps should benchmark incremental rendering before committing.
Source: news.hada.io/topic?id=29602Read original →
FIG-4111:1
40radar
FIG-4111:1
#0410
#0410Other GeekNews2 days ago
`Erlang/OTP` `29.0` Tightens SSH Daemon Defaults
40radar
Erlang/OTPRuntime platform — standard libraries and tools for Erlang apps
Authenticated SSH users no longer get shell, exec, or SFTP by default. Small but useful hardening if your backend exposes Erlang/OTP SSH services.
- shell and exec are disabled by default, blocking arbitrary Erlang code execution unless explicitly enabled.
- The SFTP subsystem is no longer auto-enabled at SSH daemon startup, reducing exposed surface area.
- This matters only for apps using the built-in Erlang/OTP SSH daemon. Most web SaaS stacks can just note the safer default.
Source: news.hada.io/topic?id=29601Read original →
FIG-4101:1
40radar
FIG-4101:1

Sun, May 171 dispatches

#0409
#0409Other GeekNews2 days ago
Choose `HTML` Lists by Semantics, Not Appearance
40radar
List elements are interaction contracts, not styling shortcuts. Picking select, datalist, ordered, descriptive, or menu markup correctly cuts accessibility debt early.
- Fixed choices belong in select/option; suggested free input belongs in datalist. Similar UI, different interaction model.
- Ordered, unordered, description, menu, and control lists express different user intent. CSS should change visuals, not semantics.
- Small markup decisions affect keyboard behavior, screen readers, and form UX. Cheap to fix during build, annoying after launch.
Source: news.hada.io/topic?id=29588Read original →
FIG-4091:1
40radar
FIG-4091:1

Sat, May 161 dispatches

#0408
#0408Other GeekNews4 days ago
Leaving `Tailwind`, Rebuilding a Structured CSS System
40radar
The practical move is not ditching utility discipline but re-encoding only the parts that aged well. Keep preflight, palette, and type scale, then move them into CSS variables and split files for a saner long-term base.
- The migration keeps Tailwind's useful defaults like preflight reset, color tokens, and font scale instead of starting raw; that cuts regressions while dropping class-heavy markup.
- Semantic HTML plus vanilla CSS shifts structure back into markup and design rules back into stylesheets; easier to scan, but only if naming and file boundaries stay strict.
- Rebuilding the system with CSS variables turns ad-hoc utilities into shared tokens; better fit for theming and incremental edits than copy-pasting utility clusters.
Source: news.hada.io/topic?id=29553Read original →
FIG-4081:1
40radar
FIG-4081:1

Fri, May 151 dispatches

#0407
#0407Other GeekNews5 days ago
`scrcpy` `4.0` adds flexible virtual display resizing
50radar
scrcpyAndroid mirroring tool — low-latency control over USB or Wi-Fi
Virtual displays can now resize to match the client window with --flex-display. The SDL3 migration should reduce resize-related friction, so it's a solid quality-of-life update for Android testing setups.
- --flex-display or -x lets the virtual display track the client window size dynamically, which cuts friction when testing multiple Android layouts.
- The move from SDL2 to SDL3 shifts the app onto an actively maintained graphics layer, improving upstream support and bug-fix velocity.
- Window resizing gets safer operationally because display and client size stay aligned instead of drifting during interactive mirroring.
- This is not a workflow reset, but teams using scrcpy daily for QA, demos, or device debugging will feel the upgrade immediately.
Source: news.hada.io/topic?id=29505Read original →
FIG-4071:1
50radar
FIG-4071:1

Thu, May 141 dispatches

#0406
#0406Other GeekNews6 days ago
`Quack`: Client-Server Protocol for `DuckDB`
50radar
QuackProtocol — adds multi-process shared writes to DuckDB
It adds remote state sync so multiple processes can write to the same DuckDB file without abandoning the in-process model. That opens a practical middle ground between embedded analytics and a full database server, worth tracking early.
- Remote protocol handles state synchronization needed when multiple processes modify one database file, not a separate heavyweight server core.
- The design keeps DuckDB's in-process architecture while enabling client-server style access and concurrent writers in the same database.
- This lowers the jump from local analytics to multi-process apps; teams using DuckDB may get shared-write workflows without moving to Postgres immediately.
Source: news.hada.io/topic?id=29477Read original →
FIG-4061:1
50radar
FIG-4061:1

Wed, May 131 dispatches

#0405
#0405Other GeekNews7 days ago
`goshs`, a multi-protocol single-binary file server for developers
50radar
goshsFile server tool — multi-protocol sharing in one binary
Goes well beyond python3 -m http.server: one binary can serve files over HTTP/S, WebDAV, SFTP, SMB, and LDAP/S with auth included. Useful when you need secure ad-hoc sharing or device-to-device transfer without dragging in Apache-style setup.
- Replaces the usual throwaway local server with a single binary that handles multiple protocols from one command.
- Supports HTTPS and authentication out of the box, so quick file sharing does not require a reverse proxy or extra server config.
- WebDAV, SFTP, and SMB in one tool makes it practical for mixed workflows across macOS, iOS, Linux, and network drives.
- Best fit is ops-lite utility work: demos, internal asset delivery, test-device transfer, and temporary private sharing.
Source: news.hada.io/topic?id=29445Read original →
FIG-4051:1
50radar
FIG-4051:1

Tue, May 122 dispatches

#0404
#0404Other GeekNewslast week
`Mini Shai-Hulud` returns: self-propagating npm supply-chain attack hits CI/CD
80radar
This worm hijacks CI/CD flows, steals secrets, and spreads through legitimate npm packages. If your pipeline publishes packages or injects tokens broadly, tighten secret scope and rotate exposed credentials now.
- StepSecurity first detected it in an official @tanstack package, which means trusted package names are no longer a safe shortcut.
- The blast radius is bigger than a single repo: CI tokens, registry credentials, and publish pipelines can become propagation paths.
- Teams using long-lived secrets in GitHub Actions or package release jobs should assume lateral movement, not isolated package compromise.
- The practical response is boring but urgent: rotate tokens, narrow CI permissions, pin releases carefully, and review package publish automation.
Source: news.hada.io/topic?id=29427Read original →
FIG-4041:1
80radar
FIG-4041:1
#0403
#0403Other GeekNewslast week
Postmortem: `TanStack` npm Supply-Chain Breach
60radar
TanStackOSS package suite — frontend state and data tools
A six-minute CI-to-publish compromise turned pull_request_target, cache poisoning, and stolen OIDC credentials into malicious npm releases. If your stack pulls @tanstack/*, treat GitHub Actions hardening and dependency pinning as urgent hygiene, not optional.
- The blast radius was 42 @tanstack/ packages and 84 malicious versions published within 6 minutes; short windows still break CI fast.
- The chain combined pull_request_target, GitHub Actions cache poisoning, and OIDC token extraction from runner memory; one weak workflow can reach package publishing.
- Stolen npm publish access means trusted frontend dependencies become an attack path; lockfiles alone do not save you after a poisoned release.
- This pushes routine defenses up the priority list: tighter GitHub Actions permissions, cache isolation, and faster dependency incident response.
Source: news.hada.io/topic?id=29413Read original →
FIG-4031:1
60radar
FIG-4031:1

Mon, May 113 dispatches

#0402
#0402Other GeekNewslast week
Replacing a `3GB` `SQLite` dictionary with a `10MB` `FST` binary
50radar
FSTStatic search format — compresses huge indexes into tiny binaries
When autocomplete data explodes into tens of millions of forms, static FST indexing beats SQLite FTS on distribution cost. For read-heavy search, this is a strong pattern for mobile and edge delivery.
- A Finnish-English dictionary grew to 40M-60M entries after inflection expansion, pushing trie-based search past practical limits.
- A temporary SQLite FTS approach was fast enough at query time, but shipping an initial 3GB download broke usability.
- A compiled FST binary cut the payload to about 10MB, turning a search structure into something app-bundle-sized.
- This pattern fits datasets that are mostly static and prefix-search-heavy, where update flexibility matters less than footprint.
Source: news.hada.io/topic?id=29379Read original →
FIG-4021:1
50radar
FIG-4021:1
#0401
#0401Other GeekNewslast week
`CVE-2024-YIKES`: dependency hijack leaked cross-ecosystem registry creds
60radar
vulpine-lz4Package — install-time code stole CI secrets
A JavaScript package hijack spilled into Rust and Python supply chains by stealing registry credentials like .npmrc, .pypirc, and Cargo tokens. If CI can read publish secrets during builds, one compromised package can jump ecosystems fast; tighten token scope and isolate release jobs now.
- The blast radius was not just npm; stolen creds also covered .pypirc, Cargo, and RubyGems, so one weak link can poison multiple release pipelines.
- A malicious build.rs in vulpine-lz4 reportedly executed on CI hosts, which turns dependency install time into a credential exfiltration path.
- left-justify-style phishing shows package names and maintainer trust are still enough to trigger supply-chain compromise without an infra breach.
- Build jobs that both install third-party code and hold publish tokens are the obvious failure mode. Split test and release environments before this pattern repeats.
Source: news.hada.io/topic?id=29374Read original →
FIG-4011:1
60radar
FIG-4011:1
#0400
#0400Other GeekNewslast week
`Bifrost`: ultra-fast enterprise AI gateway
50radar
BifrostAI gateway — OpenAI-compatible ultra-low-latency proxy
One OpenAI-compatible API can sit in front of multiple model vendors with sub-100µs proxy overhead. Worth checking if multi-provider routing matters more than keeping the stack minimal.
- It fronts OpenAI, Anthropic, AWS Bedrock, and Google Vertex through one API, covering 15+ providers and simplifying app integration.
- The pitch is 50x faster than LiteLLM, with under 100µs overhead at 5k RPS; that matters only if proxy latency is already a bottleneck.
- Adaptive load balancing, cluster mode, guardrails, and support for 1,000+ models push routing and policy into one layer, at the cost of another ops surface.
Source: news.hada.io/topic?id=29373Read original →
FIG-4001:1
50radar
FIG-4001:1

Sun, May 101 dispatches

#0399
#0399Other GeekNewslast week
`NixOS` Secrets: Plaintext in `Nix store` Is Readable
40radar
NixOSLinux distro — declarative, reproducible system config
Putting secrets in Nix config, private Git, or git-crypt plaintext still leaks them through Nix store. sops-nix is the practical baseline if you deploy with NixOS; otherwise your server access model is already broken.
- Secrets embedded in Nix config can end up in Nix store, which is world-readable on the machine; repo privacy does not help after deploy.
- Keeping values in a private repo or decrypting with git-crypt before build still leaves plaintext artifacts in the store, so the leak point moves to runtime.
- sops-nix uses .sops.yaml rules and encrypted-file editing flow, giving a cleaner path than ad hoc secret injection for NixOS setups.
Source: news.hada.io/topic?id=29328Read original →
FIG-3991:1
40radar
FIG-3991:1

`rkdebian` turns an $80 RK3562 Android tablet into a Debian workstation

Stay Native Until Text Forces Your Hand

`Erlang/OTP` `29.0` Tightens SSH Daemon Defaults

Choose `HTML` Lists by Semantics, Not Appearance

Leaving `Tailwind`, Rebuilding a Structured CSS System

`scrcpy` `4.0` adds flexible virtual display resizing

`Quack`: Client-Server Protocol for `DuckDB`

`goshs`, a multi-protocol single-binary file server for developers

`Mini Shai-Hulud` returns: self-propagating npm supply-chain attack hits CI/CD

Postmortem: `TanStack` npm Supply-Chain Breach

Replacing a `3GB` `SQLite` dictionary with a `10MB` `FST` binary

`CVE-2024-YIKES`: dependency hijack leaked cross-ecosystem registry creds

`Bifrost`: ultra-fast enterprise AI gateway

`NixOS` Secrets: Plaintext in `Nix store` Is Readable