November 9th, 2026 × #Reddit#WebDev#AI#Security
Reddit Closing it’s Doors
Reddit forces logins to starve the AI scrapers, ARC gets sunset, and a new terminal called Rex wants to replace your whole setup. Plus CSS Tricks gets a new owner, Redact tries to replace React, and a certificate authority's private key turns out to be the number four.
wesbos Host
stolinski Host
w3cj Host
- Double the news and CJ on the boards
- Hex: free local voice dictation that almost streams
- Everybody wants to be your computer's front door
- Raycast keyboard hides dictation behind a paywall
- The new AI design meta is rounded corners and gaps
- Rex: Mitchell Hashimoto-adjacent terminal with its own multiplexer
- Reddit forces logins to stop AI scraping and slop bots
- r/opensource bans AI and gets 3,000 comments of hate
- CSS Tricks gets a new owner after DigitalOcean drops the ball
- Sub Vocal glasses let you dictate by silently mouthing words
- ARC browser is officially dead
- Pico CSS is no longer maintained thanks to AI
- TanStack Redact: a smaller drop-in React replacement
- Cloudflare ports TypeScript to Rust with TSRS
- Agent Desktop lets agents use your whole computer
- Claude subscriptions work in OpenCode again, officially
- Touchscreen OLED MacBook Pros: worth the upgrade?
- Discord makes public server content discoverable
- Two weeks of CVE chaos: PHP, Brotli, Linux, GitLab
- A certificate authority picked the number four as its private key
- Apple Music 404 iPod and Visit Norway's fancy outhouses
Double the news and CJ on the boards
Wes Bos
What's up everybody? Welcome to Syntax Live. We got a packed show for you. We weren't here last week, so we've got double the news for you on, anomaly releases hex. We got to talk about the MacBook pros of touch screen and tropic returning to open code, Rex, and a different thing than Hex.
Wes Bos
Arc is good for dead. Good. Sorry. Dead for good. Reddit is closing this. So we got tons of stuff to talk about today. My name is Wes. With me as always is Scott and CJ. How are doing guys?
Scott Tolinski
Doing good.
Scott Tolinski
Randy is out today, folks. So CJ is manning the boards. So let's all wish him a lot of luck because it's... He's gonna be doing double duty here.
Wes Bos
Lots of things over here. Click on. Lots of things to chime in on.
Scott Tolinski
Yes.
Scott Tolinski
Yes. Yes. And it's like kind of raining and storming outside. So maybe CJ is gonna lose access to one of his 18 Internet connections he has.
Guest 2
At least one will stay up, hopefully. Yeah. At least one.
Guest 2
Yeah. Nick. Let us know if you can if you can see us on YouTube as well. It looks like we were having issues there, but I think it's resolved. But
Scott Tolinski
hopefully, it's good. Chime in if we're having any issues of any kind. CJ would love to know. Cool. So let's kick it off.
Scott Tolinski
First one that we have for you today is Hex Hex from anomaly anomaly, the folks behind open code and Hex is basically a dictation app, local voice dictation, hold option, and say what you mean Okay. So one thing that I I liked a lot about this this demo page initially and and folks this might be a little loud so I'll refresh I saw this and was initially excited as the words were streaming into the inputs thinking that, like, oh, like Mac OS dictation, it's gonna be, like, as you're as you're speaking.
Hex: free local voice dictation that almost streams
Scott Tolinski
But sadly, in my experience, that is not the case. It is just basically a a free voice dictation alternative here. Yeah. I've been using Hex, and it's nice. It's free. It works well.
Scott Tolinski
The cool thing about hex... And let me bop this over here. Basically, it's working like any other voice dictation. You hold option, whatever the thing pops up. And it's got a really cool little bar up top here showing your voice. It's it's nice because it stays out of the way, and it's relatively small. That's like something that a lot of them are like, oh, let's make this bad boy big.
Wes Bos
But it does not stream the text into the inputs. So it doesn't do that. There is... We can get that. That's like the Mac OS dictation does that. And it's so good to see what you're saying as you're saying it. It is.
Scott Tolinski
There is some interesting little sound effects when you... I don't know if you guys could hear that click.
Scott Tolinski
Can you hear those clicks? No. There's, like, weird clicks when you hold down the dictation button, which you can probably turn off. But overall, I would say I've been using this. The default model is Parakeet.
Scott Tolinski
You can download larger models or different models if you so care to do that and you're not having good results. You can do the the output changing. Sorry. Where is that? Where you're giving it words? Yeah, I don't I don't see where that is right now. You can give it words. So like century
Wes Bos
to change to say, commonly said things. A lot of these also will have like it will like run it through a quick little LLM pass where if you were to goof up, like, I'll often be like, I'm going to the... No.
Wes Bos
I will be going to... Know, like, if you correct yourself, then it will actually correct itself in the text, which is a very nice feature.
Wes Bos
Personally am in super whisper, but there's just there's so many of these applications, and it's unbelievable. Like, if you think of it, like, there's a company called what? Whisper Flow that is, like, worth bazillions of dollars from these things. Whereas like there are many free ones out there, you know, handy.computer is is another free one that a lot of people use and everybody probably in the comments will be like, I just made my own. Yep. Yep. This one's kind of cool. There's a
Scott Tolinski
there's this tell your your agent how hex should write. So basically, again, taking a pass at, like, actual writing here. So, like, talk like a pirate on Fridays. And then whenever you dictate on... I I don't know personally how well I would use this. Maybe I would say like, yeah, remove ums and like and and stuff like that. That it removes stuff like that. That's one that I need to have it read. Yeah. Have it removed those things. I do kind of like that vibe. I wonder how I would use this. Maybe, like, hey. Make this cohesive instead of rambling.
Scott Tolinski
So, yeah, that... That's one thing. I I think it's pretty good in my use case. It's it's reliable. I was having issues with super whisper being reliable or whisper flow being reliable.
Scott Tolinski
That's like the one thing I cannot have with voice dictation is for it to not work when I need it to work at that given point. Yes.
Scott Tolinski
There's also this whole annotations and screen recording business, which I don't necessarily maybe it's not for me, but record your screen drawn and then talk over with a shortcut. Know what? They're good if you were for business kind of sharing. Yeah. Like, cool app, cool features,
Everybody wants to be your computer's front door
Wes Bos
right? Probably well designed. But what they're doing here really is they're trying to get into the game of being the main thing on your computer.
Wes Bos
They're trying everybody's trying to kill Raycast as the thing where your your entry point to your computer.
Wes Bos
OpenAI did this. They automatically turned on their I don't know. What what do they have? Like this little dinosaur or something pops up. I had to turn it off immediately. It's super obnoxious. And then OpenAI or Anthropic did it as well, where they put the little the little lobster run around your computer.
Wes Bos
All of these are are super annoying.
Wes Bos
But everybody is trying to eke their way into being the entry point on your computer because if they can get that, if they can be like the first place where you go to do something on your computer, whether it's take a screenshot and annotate something, then putting that into your LLM is going to be the next thing. Whereas like your your initial input to doing something on your computer right now is not open code.
Wes Bos
When you want to like build something, when you want to like run a task, absolutely open up internal, open up open code, run those all day long. They want to get a step closer to this type of thing. And I guarantee that this is their stab at being in that space because they're probably seeing all of these other companies, all of their competitors rolling out a very similar thing. And this is a very first good way to get it on people's computer where it's like, look, really good free dictation.
Scott Tolinski
Yes. Yeah. Totally. There's also a number of cool little lab stuff in here. Record calls and keep transcripts.
Scott Tolinski
There's voice filter. This live text will made me excited. Again, I was hoping that it would stream in, and it kind of does. But when you do this, and let's do the dictation, I can show you what it does. It just kind of puts it directly below here, and it's slow enough where it's not going to be that useful, not like the Mac OS one. And it doesn't put it into the input that you're typing in. So it still just has it up here. And not bad. Certainly not bad, but not good enough for me to wanna use.
Scott Tolinski
So, yeah, I I I think it's good. I mean, I'll I'll use it. I don't... I'm not using anything else currently. I'll hook it up to my foot pedal and and have it work like that.
Scott Tolinski
Pair key to ultra is an option here. There's a number of things in this this whole thing. You could say comma or hashtag or whatever. Yeah. But... Yeah. All the... All that normal stuff. On on that note of Raycast, did you see they released a keyboard for their mobile app?
Wes Bos
No. I thought they had that for a while. I've never had any luck with third party iOS keyboards, so I haven't even checked it. Have you ever had Like, like, a Bluetooth keyboard or what? No. No. No. Like a like a Yeah. Software keyboard. Oh, an app keyboard. Okay. Okay. And, yeah, I did I did use it. And I... It's... I don't know if you'll be able to even see this. Aesthetically,
Raycast keyboard hides dictation behind a paywall
Scott Tolinski
it's really nice looking.
Scott Tolinski
It's the nicest looking one of these keyboards.
Scott Tolinski
The big problem with the Raycast keyboard is that they hide dictation behind a paywall when...
Scott Tolinski
Come on. Every... Can't have a hide a feature that the core I like because I understand needing a paywall for the Raycast app, but you can't hide a core feature like dictation that every other keyboard has behind the wall. So does it have swipe as well? I don't know. Never use swiper.
Wes Bos
No. CJ, you swiper?
Scott Tolinski
I'm a Swiper. You gotta be. Gotta be at this point. If you don't use Swipe, I'm immediately...
Wes Bos
You're just like like, your your phone is a toy to you. You know? You're not seeing Swipe. I'm not like this. I'm usually just dictate... Dictating everything into it. Yeah. But, like... Yeah.
Wes Bos
You got to like swipe it around. I, a huge swipe user, huge dictation user. And that's why I worry about moving to something else.
Wes Bos
Somebody in the chat. Hold on. There's a really good one here. It says, I feel like I'm missing the value prop of these. The native voice input for Cloud Code, and I think Cursor as well, last I checked, is pretty good. That's...
Wes Bos
That therein is the is the problem is that they... People don't want to use on. And maybe I'm wrong about this. People don't want to use the individual text voice input for every single app. Yeah. Just want to have it in anything. I want to dictate it into Notion. I want to dictate it into my Slack, into text messages, into absolutely anything. And you can use...
Wes Bos
I'm I'm assuming this is the same thing with cloud as well. You can use the, Codex ChatGPT one globally as well, which is, again, everybody wants to be that button press, that that shortcut on your computer, which is pretty gutsy of them to just take the option key.
Scott Tolinski
You know, it's obviously gonna break some other stuff. Yeah. I think... I mean, you can obviously set it to... But you're you're so right on that. Also, actually, in that same regard, let me even pull up the hex.
The new AI design meta is rounded corners and gaps
Scott Tolinski
There's a new meta folks for AI design. The new meta, and this has been this way for a little bit, is the circle area or this... The circle area, the rounded corner area here, the sidebar here, and then the gaps.
Scott Tolinski
So that's the same thing. This is Rex, which another app will look at. This same design is in everything.
Scott Tolinski
I got access to the o m p terminal app called turn same business. There... It's like that is what everybody is is landing on right now. This is the current meta. Is this rounded corners within a slight gap just like this small border. Yeah. That's it right there. Maybe some box shadows too. Right? I like it. I like that look. I do too. It looks good. It looks better than the previous slop outputs that we've been having. And it looks better than the iOS or the macOS chat app. Either way, let's talk about Rex. We done with hex? You guys got more to say here. Done with hex. Smooth to Rex. Alright. Folks, this is something different.
Rex: Mitchell Hashimoto-adjacent terminal with its own multiplexer
Scott Tolinski
This is not hex. This is Rex. And what what Rex is... I'm gonna I'm gonna keep I'm gonna keep goofing these up. It's basically, it's a terminal app from Michael Hashimoto, the creator of Ghostie. And... Mitchell. Mike. Did I say Michael? Holy cow.... Hashimoto.
Scott Tolinski
Bro, we've been talking about Michael Jackson all week. Mitchell Hashimoto, folks.
Scott Tolinski
He... Oh, he also made Ghosty, and that's it. That's the only thing he's ever made. No. Just kidding. He also created HashiCorp, which was acquired by IBM for $6,400,000,000.
Scott Tolinski
So,
Wes Bos
he's been around. He's done all kinds of stuff.... Guy really cares about performance, and Ghosty is an awesome terminal app, but we
Scott Tolinski
want more. We yearn for more. We yearn for more. And the terminal has evolved in how we're using it. And, well, now we have Rex from Super Logical, which uses Libghosty to do the terminal stuff behind the scenes. It's a next gen terminal app. I got access to it. You are looking at it right here.
Scott Tolinski
Now what is Rex do that's interesting? It has its own multiplexer, and it's multiplexer like TMUX or anything like that can create new pains and, you know, your AI has access to the the the rec CLI that can then therefore create pains in your AI can control this thing completely.
Scott Tolinski
So it's a multiplexer that's made for modern stuff. So it's not TMUX. And as far as I know, it's not a TMUX fork.
Scott Tolinski
It it is just its own multiplexer.
Scott Tolinski
Now the app itself, as far as terminal apps go Can you say what what this... What is this for before we get into the features? Like, why somebody be excited about this? Yeah. Well, I'm trying to... That's actually what I was just saying that those are the features. It's a terminal app. It's a terminal app with features. So, like, it replaced it... It would replace iTerm, it would replace Ghosty, that kind of thing? Yes. It would replace Ghosty, iTerm, Alucriti, whatever all those apps are. Yes. More...
Wes Bos
But it's more than that, right? It's barely. Is it a herder replacement?
Scott Tolinski
It is also a herder replacement. Yes. But I'll get to that, Wes. Okay. There's a lot of features. We know, like, where this where this thing sits before we get into the features. We wanna, like, I wanna understand what it is. And I intentionally didn't look into it too much. It sits in replacement of your terminal app, whatever that may be. The additional features, though, are are where it sets apart. And that multiplexer is a big part of that, Wes. So that is the that is the the basis for which all this works. The the herder likes stuff. It has integrations with hooks into your agents so that way it can alert you as to the status of any of your agents. So let's say if you have multiple agents running in the sidebar, it'll be able to show you directly in the sidebar. So I can just say, like, hey. Think for one sec. Who knows what the heck this thing is gonna say? Oh, okay. Well, I'm not even logged in. Well, either way, it would come back and it would say... It would it would show you that it was waiting. Just like Hurter does, same sidebar. Now the killer feature that Hurter has that this also has is that it's a long running server. Meaning that if I close the terminal app, it does not stop my my, REX server from running. The process is running. And likewise, if I have a REX server running on another machine, same deal. So that way, if you visit the REx server remote address from any of your machines, whether that is, one machine to another or on mobile, it's always gonna connect to those sessions regardless if the terminal app is currently open. So, again, that's what makes it special is the fact that it has that server the same way that Herder does. So this would replace Herder in your flow.
Guest 2
Yeah. To me, that's that's the killer feature, though. Like, at least the term... ITerm doesn't do that, and I always have to worry about accidentally closing a tab or, like, closing the window. So the fact that it's running in the background, I can always come back to it. Like, that's that's the ideal flow. Because you also have, like, SSH connections and Mhmm. Just... That's... That is how I use the terminal. So, yeah, I like that. Yes.
Scott Tolinski
A lot of great stuff there. And so for for the most part, I just got access to this, like, two days ago, but it does seem really nice in practice. And terminal UIs are always terrible. So it's not just a fancy UI, though. It has that nice server integration. It has the integration with your agents to do those things. But there's also a quite a bit more in here besides, like, controlling the UI and changing the interface and making it look nicer. Yes. That's always great. You can put your tabs anywhere you want them. You can have it configured to your liking. You can make this thing look really good or however you wanna make it look. I think it's really neat in terms of aesthetics.
Scott Tolinski
If we're talking about the details, they've definitely sweated the details here. You can even, like, tune the animation styles, and you can have trackpad gestures and things like that.
Scott Tolinski
Swipe stuff. I I keep saying stuff like that. I gotta stop saying that. So you got all this stuff. It's really great. The themes, everything looks good. Yada yada yada. Aesthetically, man, this thing rips. Big fan.
Scott Tolinski
Yeah. You can import all your new PCs.... Past,
Wes Bos
like, two e at some point into a GUI.
Wes Bos
Because, like, this seems awesome where, like, you can you can use all of your existing things, but you still have the limitation of everything is in the two e. Whereas, like, sometimes desktops, apps are are much better of a UI.
Scott Tolinski
And I'll tell you in one way in particular that they're better for me is that just straight up reading monospace text and everything's the same line, everything's the same,
Wes Bos
you know. Image embeds?
Scott Tolinski
Yes. I mean, you can do image embeds in in terminals, and I, you know, I've certainly have that going. But, like, the thing that everything in terminal is, like, one line monospace font. It's really hard for me to read personally. So I I need things a bit more typographically organized to to really read well.
Scott Tolinski
But you have all the stuff you'd expect notifications.
Scott Tolinski
I have remote host setup. So I have my Mac mini setup. So it's really super easy for me to just pop open a new session and connect with that one. And again, if this remote connection gets removed just like Orca or just like t three code or just like Herder, you just reconnect it, whatever, and it just pops back in. The one thing that I found a little bit odd is that they want you to sign in with Tailscale where Rex has its own Tailscale host, which I I found to be weird because I would imagine most people who are using Tailscale already have it set up on their, like, computer running, and this doesn't work with that. You have to, like, kinda jump through some hoops. And in fact, when I went to do it, even pasting the instructions, my agent was like, I can't do that. And I was like, yes, you can.
Scott Tolinski
So you can sign it in as a separate tail scale node if you want, but I I don't I don't necessarily see the value in that. I already have tail scale running everywhere. I don't wanna do another sign in for this. So either way, I... It's it's really good. And in fact, it is going to replace the other terminals for me. It's gonna replace Ghosty for me because it is just a nicer experience to use, And it has the stuff I have baked in without having to, you know, even think about starting up a herder process or whatever. It's just the terminal. It's just here. All of my interfaces are connected. And when I get access to the phone app, which I don't have access to just yet Mhmm. All all my stuff will just be there and easy. So I I do like this. I I think it's really cool. Again, one thing that I actually didn't even get into is that there's a whole scripting side of things.
Scott Tolinski
So you can script the whole thing with Lua, or you can set up automations.
Scott Tolinski
There's... You can listen for events so you can listen directly for Rex events and then do things on those events.
Scott Tolinski
And because of this, your agents can work really well to build stuff with it. There's also a whole describe API.
Scott Tolinski
So, if you do Rex API describe, it's going to output the exact input and output schema. So if you had an agent and you were saying, I'm looking to build something on Rex, it would be able to go through and easily, hey, what is that method? Describe that method. Got it. Okay. Let me build on top of it.
Wes Bos
The thing I love most about these types of things is the having the skill for letting your agent use it. Right? Like very often I will say, hey, do something x y and z, open a Vite server or whatever. And it just does it in the background. And then that that thing is headless.
Wes Bos
And if you want to, like, open the terminal to look at logs or if you want to open the terminal to just simply click on it, you you don't really have access to that. Right? So by using... And this is not new in in REx, but if anyone has not tried this workflow, anytime you ask it to do something, say just open up a new terminal in a pane below and run X, Y, and Z. And it's so nice to like, able to like go into the terminal and see exactly what it's doing, get the outputs, You can run stuff yourself,
Scott Tolinski
if you want, and it can read the actual output. It's just a great way to work. Yeah. Yeah. And there's a whole example of, what agents can do. You can tell agents, run the tests besides you and fix whatever fails. Right? And it's going to actually just like you would with TMX or any of these other skills that you can have, you can see it physically popping open those panes and doing that work directly inside of of wrecks.
Scott Tolinski
Switch my Mac to this session and make the text bigger. And and, like, it just... There's a skill control plane for AI within this thing that does exist within herder, and it does exist within t mux as well. But it's nice that it's all built inside of one editor, and I don't have to fuss with it. People are like, you know, with any of this stuff, they love fussing with it. I don't wanna fuss with my terminal. I don't wanna fuss with it. Dak, in the
Wes Bos
chat on access, check the taxonomy section of the docs. They may be going beyond a two e.
Wes Bos
Interesting.
Wes Bos
I like it. I like it.
Scott Tolinski
Cool. Maybe going beyond the TUI. Yes. I I would approve of that.
Guest 2
Is it paid? Or will it be open source?
Scott Tolinski
Or People in the chat say it's it's free forever.
Guest 2
But Oh, okay.
Scott Tolinski
I haven't seen any price thing.
Wes Bos
What... So Super Logical is this company that has been formed to make products. This seems like Rex is the first product.
Wes Bos
I don't know what it doesn't say what, like, if anything is going to be made, they were very they will very likely have some sort of hosted software.
Wes Bos
Like if you take a look at like where warp is going right now, like warp is in a very similar space to this. And they're in the right now they're in the like software factory type of thing, you know, hosted sandboxing.
Wes Bos
They may very well go that route.
Wes Bos
I bet they probably are not even too focused on that right now. They're probably just trying to figure out how to make the most badass kickass software possible, and then they'll they'll they'll figure it out at at some point. Yes. Yeah. Yeah. It's a...
Scott Tolinski
Oh, somebody says super logical website is built on top of Svelte. Shout out Svelte. Hell, yeah. Yes.
Wes Bos
Now you know it's good. Yes.
Scott Tolinski
Cool. And you don't have to log in to use it, which was one of the things people are always grumping about. You don't have to log in to use this. You just you just use it. Yeah.
Wes Bos
Alright. Let's talk about Reddit.
Wes Bos
You guys ready for Reddit?
Reddit forces logins to stop AI scraping and slop bots
Guest 2
Let's do it. Reddit is
Wes Bos
closing its doors. So let me tell you what we mean by that. Reddit took, I don't know, couple of about a year ago, Reddit took $60,000,000 from Google, to allow Google to use their data in their like search summaries. Right. You search something, you get the little summary that comes up. And as much as I us like tech guys say, say we hate it.
Wes Bos
It's actually pretty good. It's pretty good. It's like for a lot of quick little queries, it actually is pretty good. And a lot of that data of, of like what happens when you do X, Y, and Z, a lot of that comes from Reddit. Right? So Reddit took that money.
Wes Bos
Then they, they don't see people actually click through to Reddit to read it anymore. So their traffic has like gone quite down. Their stock has dropped 29%.
Wes Bos
And I think in addition to that, Reddit is just getting absolutely hammered. Like every website with any valuable information, they're getting absolutely hammered by agents just scraping them for data so that when somebody queries how to do X, Y, and Z, they can use that as context in the the results. Right. And we're starting to see, like, cracks on that is if you search, if you ask Claude to, like, solve something, it will not find Reddit threads. And, like, at one point, I was just, like, doing a little bit of googling myself and asking Claude some questions. And I, like, clearly didn't know the answer. And I was just reading a Reddit thread, and I was just like, hey, like, this guy says that you can do it this way. They pasted the URLs, like, well, I can't access Reddit, you know, and it's making Claude probably significantly worse because it doesn't have access to to that information. Right. So Reddit is now making everybody sign in. They have this whole thing on they posted on Reddit about, they're making everybody log in. They've done this like kind of hard armed you into this for a while now where you visited the website, they want you make open the mobile app.
Wes Bos
But the big one was that the Reddit experience was on desktop, on the website was always it it was always available openly, and they're they're gonna start closing that. And they posted this big long thing on Reddit being like, need to personalize your your x, y, and z, blah blah blah, about how you can have a better experience in Reddit when you're when you are totally logged in. And I think the reality is that they want you to be signed in so they can serve you customized ads and they want to stop all of these people from some scraping all of the data from it because like the big ones like Claude, they have to like respect Reddits being like, hey, don't scrape us. If you don't pay us, you can't scrape us, you know, and we're starting to see that on a lot of websites. You know, Amazon doesn't like you using agents. Taobao, another one, you can't use an agent without getting your account locked.
Wes Bos
A lot of people are starting to like, hey, we're not simply just going to be the fountain of information while our business goes into the ground.
Wes Bos
We need you guys to pay us. So I don't know. What do you guys think about this?
Scott Tolinski
Yeah. Well, it would be... I I think that's totally fine. Honestly, I'm never not logged into Reddit. I I always have Reddit login. So for me, not being logged in is not a problem. I I don't have any any issues with that personally just because I've been a user of that site for, like, a Yeah. A billion and a half years.
Scott Tolinski
I will say, though, what I hope is that this doesn't kill some of the third party apps, which they have been desperately trying to kill. They've been trying so hard to kill all of the apps, whether that is increasing the API pricing or just now this, you're not gonna be able to scrape it or whatever. Yeah. The the the Reddit native mobile app sucks big time.
Scott Tolinski
It's it's not good. And I'm sorry, Reddit devs, if you're listening. The the the mobile native app, it's just no good. And so I am using a third party app and I really hope this doesn't
Wes Bos
end up coming to bite bite me there. Well, Daniel in the chat who works on a third party Reddit app, I think he was the guy that initially informed us of the, like, react native loophole where if you sign in with a web view, you can then close that web view and use that as a portal back and forth between that. They've they've been sending emails to a lot of the third party app developers and being like, hey, they wanna shake them out of the the whole situation as well, partially because, like, that's a way for all of this data to leak. And, like, I think personally, yes, I don't care if I have to be logged into Reddit to use it. I don't I don't care. But I I do think that the experience on an agent when you cannot access these websites that are a huge fountain of information, same thing with, like, Facebook groups. There's lots of very good data inside of Facebook groups.
Wes Bos
If an agent can't access them, if Google can't access them, then a lot of that data is then lost to time. And we saw that when like forms and like photo bucket shut down. And I think we're starting to see it again.
Guest 2
Yeah. Don't like it, but I know it's needed.
Guest 2
I'm a longtime Reddit user.
Guest 2
I'm actually not logged into Reddit in a lot of places just because I don't want the cookie tracking and all of that.
Guest 2
And I, like, search for something, I find the results, and then click into Reddit to read the answer, I'm not logged in. But I get it. Like you said, like every other app is doing this as well, and it's kind of gotten to the point where you kind of have to, otherwise you don't have a business model. Because if Claude is just the only interface into Reddit, you're never actually going to Reddit. You're never actually seeing their ads or anything else. Yeah.
Guest 2
And also, like, the the death of third party apps and APIs, like, that also really gets to me. I've never installed the Reddit mobile app. I always use a third party one. If you're on Android, Red Reader is a really good one. But I imagine with this new lockdown, we're going to see apps like that go away as well. So... I think another aspect of this is they need to stop the bots from
Wes Bos
posting slop on... Oh, true. Know, because it's it's it's ruining. And, like, really, the... One of the best ways that you can detect a bot is by analyzing every single mouse move, every single click, everything that it does.
Wes Bos
And if you are if somebody is using a third party application, you're simply just getting like API calls like list posts, create posts like thing. And you cannot detect bots over API traffic. You must have all of these companies that try to detect bots do not tell you what they're detecting because they don't want to give away their secrets. But I even find myself now when I'm doing a captcha, I like try to move my mouse around a little bit more than I normally would. Oh, I do that too. Yeah. You know, you're walking out of a, you're like walking out of a store when you didn't buy anything, you're like, I am not a shoplifter! Like you're trying to make it very clear that you're not a shoplifter. I'm doing that now with these websites of captchas being like, I clearly am a human. Look at me second guess what is a bus in my caption.
Scott Tolinski
Yes.
Wes Bos
Oh, is it is this a bus? Let me think. Let me move over to this one. Yeah. No. Then it like the puzzle piece. No. I'll go back a little bit. Yeah. There there is a much higher success rate when you do that. So I think I think it is true. And it's not to say that you couldn't script that, but it's crazy. You need every single one of these little things. Like, even I I, like, put my Grock bot on Taobao, which most other agents are blocked. Grock... I don't think Grock cares about any of these. Like, please do not use me as an agent. But, like, my whole account got, like, locked, and I had to, like, go through this massive unlocking step priority because it detected that I was programmatically using traffic.
Wes Bos
And I just wanted it to, like, search for me.
Wes Bos
Yeah. So you're totally I a bad couple bad couple months of people blocking agents.
Guest 2
Sorry, CJ. Go ahead. No. It's all good. I I think it's it starts with Reddit, but more people are gonna do it. It's exactly like you're saying. I mean, people are gonna build bots that are, like, using a browser, but there's so much that gets left behind when a user is using a web browser. Like, you've got your cookies, like, all the requests coming through. And if that stuff isn't happening, it's gonna be so much easier to detect that this this was a bot. Like, the way that I use Reddit will likely be detected as bot traffic because I'm not logged in. I automatically delete my cookies. I only, like, click on it through, like, search result links.
Guest 2
But you're totally right. That is how a bot behaves. And so but I I like the idea of getting... Making it harder for bots to post, though. That that's that's gonna be a nice cleanup because over the past couple of years, this has been inundated. You're basically just talking to bots when you're in in the comments on most websites Same these same with, like, Reddit as well. Or not Reddit, Twitter. Oh, Twitter's the worst. Yeah. The replies are are awful.
Wes Bos
And, like, you you gotta think that...
Wes Bos
I'm very curious to talk to people that are working on this type of stuff because you look at it, and you're like, this account has posted 40 times in the last fifteen minutes with, like, a generic one line reply.
Wes Bos
And you can't you can't detect that. And it's probably harder than we're thinking.
Wes Bos
But it and also, I think they probably are fine with letting five bots through without accidentally marking one person. Because I posted about it. A couple of people that work out Twitter replied, like, we're working on it. But then all these people that, like, were wrongly detected as bots get caught up in it. They're all like, somebody said, go to, like, Twitter help on Reddit. And you... I went there and you just see all these people being like, I I was marked as spam even though I didn't. And it's probably because they've got, like, a setup like CJ would or they have browser extensions or they're doing some little light automation on top of that and then boom, ban hammer.
Scott Tolinski
Does feel like they aren't trying very hard, though, to get rid of the bot. Does, honestly. Yeah.
Wes Bos
Yeah. If I just glance at the first three words of a post
Guest 2
and know that it is AI, come on. Come on. But there there is some incentive to make it feel like the site has traffic. There there is that. Not to get, like, all conspiracy theory out. Absolutely. I think that's conspiracy theory, CJ. Yeah. Like, it adds to their daily active users. Like, any place you go, it looks like the site has activity. So there's... It... It's it's puts a push and pull in order to decide, like, what they actually do about the bot traffic.
Scott Tolinski
So Yes.
r/opensource bans AI and gets 3,000 comments of hate
Scott Tolinski
On that same note as Reddit closing in that regard, another community on Reddit has also closed.
Scott Tolinski
And that is the our open source, which is the largest Reddit open source community, has shut its doors to anybody who even glances at the word AI.
Scott Tolinski
They've made it very clear that you can't even use... If you if you do not speak English well, you cannot even use AI to translate your text, and they suggest that maybe this isn't the community for you if you do not speak English well. They literally say that. I think they've lost their mind over at open source. When you can't even talk about the Linux your screen? Sorry. No. I'm not. I'm just talking in general. If you cannot even talk about the Linux kernel contributions or anything in regards to any of that stuff, you are out of your mind. You... You've you've taken the exact opposite stance of open source in general and have closed it down. It's it's crazy to think like, oh, I'm in charge of an open source community.
Scott Tolinski
Let me just make it as least little open as possible. I understand they have a hard problem with inundated with AI. I think that's it. That's obviously it.
Wes Bos
Nailed. Everybody has everything that's open source version and everyone makes a new open source version of something and then abandons it a week later.
Scott Tolinski
Yes. It's it's obviously it.
Scott Tolinski
But in in the same regard to say, like, oh, if you don't speak English well, you cannot... You're not a welcome member of this community. Like, you gotta look at that at some point and be like, oh, yeah.
Scott Tolinski
We're we're not... We're doing something dumb here. You know? I don't know. It feels like crazy to me that somebody could re... I mean, it... It's a Reddit moderator, folks. Yeah. Reddit mods. Nothing new here. Exactly. They're they're power hungry. Power hungry mods. Also potentially disconnected from the industry or reality.
Guest 2
Because, like, if you... If you're actually working a job right now, like, you know how much AI there is. There's very few companies at this point that aren't using AI in some way.
Guest 2
So they're like some neckbeard, unemployed, just just on a power trip, I think. Yeah.
Scott Tolinski
Yeah. Yep. It's wild. This post was nine days ago, and it has 3,000 comments and zero upvotes net. So people were not happy about this Yes.
Guest 2
I've never seen numbers like that. That's crazy. Yes. They
Scott Tolinski
were like, Oh, you could root for these other all these other open source communities that will actually allow AI. I'm like, Okay.
Scott Tolinski
Yep. Wild. Wild stuff. Wild choice. Little aside,
Wes Bos
Marco in the x chat says Hex can stream text now in labs.
Wes Bos
So we'll have to try that. I really like the way that...
Scott Tolinski
Oh, Hex. I was thinking like Rex? Hex. Sorry. We talked Hex. Yes. The dictation app. It can stream The text
Wes Bos
one thing I really like about the Mac OS dictation is that you can, like, edit the text and then continue talking. You know? It's kind of kind of fluid. And they have, like, a fancy UI where they underline it with blue. I don't know if that's UI is available via Mac OS APIs for everybody else because I haven't seen any better implementation.
Wes Bos
The other thing is that the the Mac OS
Scott Tolinski
implementation sucks. I would be interested. Like, the next version of Mac OS will just Sherlock all of these apps. If we get a confirmation in the chat of where the heck that is in the labs for Hex because I see the, live text, which is the one that we showed off on stream, and it's not quite... It's not streaming into the input. It's streaming into a little top bar.
Wes Bos
Oh, I see. That's not bad, though, because you can at least see what you're saying. Yeah.
Wes Bos
But, yeah, you want it, like, you want it stuck directly in and formatted in the app that you're you're typing into. And I understand why they can't do that, because they have to then go back and edit the text input after the fact. Mac OS can do it. Yeah. I bet the APIs are not available. Right. Nobody's done it yet.
Guest 2
Yeah. You need some kind of accessibility to, like, change where the cursor is or or whatever else. So... Yeah. CJ, what do got for us? Sorry. We've been making CJ push the buttons all day. Pushing buttons all day. I am talking about CSS Tricks. So CSS Tricks has a long history. I think if you've been in the web dev scene, you know CSS Tricks.
Guest 2
And it's changed hands many times.
CSS Tricks gets a new owner after DigitalOcean drops the ball
Guest 2
So Jeff Gram is officially the new owner of CSS Tricks. Jeff Gram also has a long history with CSS Tricks. They they posted... Created posts for it. But to recap the history of it, it was purchased by Digital Ocean in 2022 from Chris Coyer, The famous Chris Coyer who was on Mad CSS made it pretty far.
Guest 2
But it was originally their site. Digital Ocean purchased it, and then they didn't do much with it. We've talked about this acquisition a lot on Syntax.
Guest 2
It didn't feel like goodwill to the community because they weren't putting a lot of effort into it. Like, lot of... It kind of felt like CSS Tricks was dying.
Wes Bos
And... I think they saw it as, a like a huge whale of content clicks where the math math, where they could just buy the whole thing, try to keep it running, or somebody working there was really passionate about it, and then they moved on. Everybody else was like, Why do we own a CSS blog now?
Guest 2
Yeah.
Guest 2
And, I mean, if you think about DigitalOcean, it used to be... I don't know if this is the case, honestly. I haven't feel like I haven't visited their tutorials in a while because I use AI for a lot of stuff. But it used to be that, like, if I was trying to figure out how to use something on Ubuntu, Digital Ocean had the guide for that. So that's definitely the space they were trying to get into. Yeah. Yes. But it's good news. So Jeff is... Has acquired it. He is now the owner, and he's got big plans for it. So he's got the keys to the castle.
Guest 2
And, yeah, he's gonna... I guess if you didn't know as well, CSS Tricks also has the ability for you to submit articles. That's how they get some really high quality content.
Guest 2
People that are experts in the community can write an article and then say, hey, CSS Tricks, will you publish it? And so it's not necessarily, like, just staff editors. You get a lot of posts from experts in the community.
Guest 2
And, I mean, just to mention, like, if you've ever visited this page that tells you about CSS Grid, that's CSS Tricks. Or this one about Flexbox.
Guest 2
For the longest time, this was my go to page when I was writing CSS. Oh, yeah. It's a classic. Classic.
Guest 2
So, yeah, good news over here. And they published their first article since that announcement this morning. It was a bit of a rick roll.
Guest 2
What's important? The final issue on CSS Tricks. And then they're like, trick or treat. It was a trick, but also a treat because it's not the final issue.
Wes Bos
Yeah, good news. CSS tricks all around. I'm excited about this. Yes. Don't know if you said it not, but Jeff, the guy who is now the owner of it, he's been working there for Yeah. Ever. Like Yeah. Forever. Right? And, like, he's the one that was... It kept going. And then he posted, like, couple of weeks ago, like, Digital Ocean's not paying my bills. You know, they had contracted him to keep it up, and and then they just stopped paying him. He couldn't get in touch with anyone, which is, again Great. Digital Ocean. Come on. You're so much goodwill. How do you not know?
Scott Tolinski
How do you drop the ball like that? Drop the ball. I just wanna say I am so thankful every single day that I did not take the offer from Digital Ocean on LevelUp tutorials.
Scott Tolinski
Oh, yeah. That's all I'll say about that. I'm very thankful all the time that I made that choice. So shout out to me. Speaking of, this show is brought to you by Sentry, and they're pretty great. We love them.
Guest 2
They are the world's best air monitoring platform, and we couldn't do what we do without them. So thank you very much to Sentry who bought Syntax and didn't mess it up. So great. Yes.
Scott Tolinski
Yes. They did not mess it up. They've... Yes. They've done nothing but
Wes Bos
give us resources. Shut up. Hyped up.
Scott Tolinski
Yes. Yes. Yes. Hype it up. Up. Cool.
Scott Tolinski
What else we got? We got a ton of stuff to talk about, guys. So... What's next? Yeah. Yes. I got one here. This is a...
Sub Vocal glasses let you dictate by silently mouthing words
Wes Bos
One of these, like, Twitter videos, like, where people launch their startup.
Wes Bos
And this one is kind of hilarious. It's called sub vocal, which is a pair of glasses that you can wear.
Wes Bos
And instead of you dictating or instead of you typing, you'll be able to just mouse the words that you're saying, like, fair problem because, like, we're talking a lot about how do you do voice dictation in an office space, right? There's these, like, like cones you can put over your mouth that people use in courtrooms, you know, or you get these tiny little mics and you you whisper to them as you're going. So this company has figured out that via electrolysis or...
Wes Bos
Basically, they're attaching little things to your face and trying to detect how your mouth is moving as you are silently saying the words and you're then dictating it. And I was just sitting there being like, I don't know if it's because I'm trying to say something, but that seems exhausting to have to, like, mouth it without actually saying it. I actually don't hate it when I was practicing it. Yes. I think it's cool. But...
Wes Bos
So, like, they raised a little bit of money, and they're they're gonna build something out, which is awesome. People are clowning on them because it's... Well... I think they did... Well... Hold on. Let me let me show you the actual glasses.
Wes Bos
I think they did this on purpose. You want to have a really big launch video? Anyone who actually cares about this clearly knows that this is not the end game here. Like, this guy looks so goofy with these on. Look at this. They picked like... The goofiest looking guy in the goofiest looking glasses
Scott Tolinski
to do a goofy looking Because
Wes Bos
then people are clowning on you, and it it gets you in front of people that actually know what's going on. Like, if you're an investor for this type of thing, you can see past the goofy glasses and be like, we can make we can make this look sick. The vibes are off. No. I I think it was pretty funny. Anyways, all of this to say, I was like, oh, man. I bet I could build this. And before I could even get my Amazon cart purchased, two people come out here. So this Joe Blow said, does it with Apple earbuds? Because there are tons of sensors in your Apple earbuds. Slightly different, but he shows a little proof of concept of using the data inside of the Apple earbuds to do exactly or not exactly, maybe the same or similar things. Like, the idea is that you, like, train it on what these waves look like and the data looks like, and then you'll be able to detect what word you're saying. And then somebody else came out and did it entirely just with camera video or what? With a camera, which is like lip reader. Yeah. Tesla driving of...
Wes Bos
What is this called? Sub vocal, where you just do it entirely over video, which maybe that could not could be done. He obviously shows a little demo, and it kinda makes sense, but kind of an interesting space of dictating without actually saying words.
Wes Bos
Yes.
Guest 2
Yes. I'll say for me, this is, like, something I've always wanted because I I do not use text to speech in public. I don't have my speaker on in public. And it's so... I hate it when, like, you're in public and someone is talking, like, to their phone or they're, like, blasting music.
Guest 2
So anything that will get those people to not be loud in public, I'm I'm all here. I don't know if you're helping those people, man. Those Yeah. Those people have no concept
Wes Bos
of the world around them, or they're just speaker phone, uncle on the the chat, just yelling at the phone all day long. Those people are not gonna be using these goofy glasses. Yeah. I guess that's true. Yeah.
Wes Bos
Because there already is a solution, and it's put the phone on your ear.
Wes Bos
You know? Right. We
Guest 2
have the technology.
Guest 2
Yes.
Scott Tolinski
Have the Yes.
Scott Tolinski
Or headphones, folks, too. I mean, I guess headphones isn't gonna be that that much better. Yes.
Scott Tolinski
Also, ARC is dead.
Scott Tolinski
Folks,
ARC browser is officially dead
Wes Bos
the beloved browser, ARC. I'm so glad I never tried it. Yes.
Scott Tolinski
Unfortunately, this browser was wonderful, and it gave us so many years. The biggest bummer about all of this is the fact that the mobile app was actually very good still. So...
Scott Tolinski
And and Arc hadn't really seen any active development in over a year, and it was just pro... Into Dia.
Scott Tolinski
And so now Arc is sunsetting.
Scott Tolinski
Scroll to read more. They're basically... Their whole thing is basically that Dia has evolved and is now filling the space that Arc filled, and that most of the best features from Arc are now in Dia.
Scott Tolinski
Sadly, Dia sucks. I've used Dia a whole bunch. I'm sorry, Josh.
Scott Tolinski
It's very nice that you hand signed your name here. I was a huge fan of ARC, and I I really wanted to believe in Dia.
Scott Tolinski
But my gosh, Dia is a bit of a clumsy experience. The AI gets in the way. It's slow. I found a number of Dia things to be constantly being a pain to me. Yeah. So sadly, ARC is gone. And with it is, in my opinion, any any usage of any of these browsers. So Yeah. What we've talked about this before. I'm currently using Helium.
Scott Tolinski
People like Zen, but Zen is kind of like a skin deep version of Arc. It looks like Arc. It has a number of the same features, but it's not Arc.
Scott Tolinski
It's also Firefox based, which you can miss me with that. And I just...
Wes Bos
Yeah. Yeah. There isn't a replacement for Arc. There just isn't. I'm sorry, folks. A couple takes I've seen on these things is, like, these, like, new browsers with AI tacked onto it is not the move. Like, the the new browser is going to be Codex or Claude or OpenCode or whatever. Like, we're... We keep building these bridges between the browser and our AI agents.
Wes Bos
And quite honestly, it makes a lot more sense for these just to be the same thing. Maybe not for everything, but I can see a world where your agent and your browser is just the exact same thing.
Wes Bos
Even right now, I'm just like, I'm hopping between it. You know, I've got the browser in my codecs. I've got my agent browser. I've got my actual browser to use, and then I got to sign in to all of them. Then I have three other computers that I have to do the exact same thing, and I'm just spending my whole day signing in.
Scott Tolinski
Yeah.
Scott Tolinski
Is my my... Yeah. I'm not a project manager. I'm a signer in or I'm a authenticator.
Scott Tolinski
That is what I'm doing as well. Yes. Is
Guest 2
ARC the one that brought us vertical tabs? Were they the first to do it? They
Scott Tolinski
weren't necessarily the first. They perfected it.
Scott Tolinski
Tabs in No, in they they're so good. They did it so well that Chrome added it to the vertical tabs and Chrome. To Firefox added it to Edge added it. The the vertical tabs and Chrome suck too, though. They they took all the long wrong lessons from it. They were like, oh, what if we just made them vertical? They didn't, like, take into account of any of the nice things. Like, the ARC vertical tab thing, you could two finger swipe into different profiles and have all of your profiles and then, tabs that are are... Like, your bookmarks are essentially pinned there. If you pin tabs in Chrome, it keeps them active and open all the time. If you pinned a tab in ARC, it was just essentially a bookmark.
Scott Tolinski
The command palette in ARC always reopen the tab instead of, automatically creating a new tab. So, like, there was just so many nice things about ARC, and I just... I feel sad. Yes.
Guest 2
Sad news.
Scott Tolinski
Rest in peace, ARC. You will be missed. Rest in peace. Yes.
Guest 2
Cool. Can I cover a couple of web dev stories? Please.
Scott Tolinski
Let's do it. It's gonna be a... What kind of show do you think this is, CJ?
Guest 2
I don't know. I don't know. I have to ask permission for everything, I guess. But... Yeah. First up, pour it out for my boy, pico CSS.
Pico CSS is no longer maintained thanks to AI
Guest 2
And if you're not familiar with this, this is this was one of the best, like, minimal classless CSS frameworks.
Guest 2
And so I use this all the time for, like, prototypes, quick demos.
Guest 2
The idea is you add it to the page, and then you don't need any CSS classes. It styles everything semantically. So, like, with this markup down here, your UI would look like what you see above. And so they had semantic styles for everything, like toggles and checkboxes and inputs and all the stuff that you might need. So I use pico CSS a bunch, but they just announced that it is no longer maintained. Version two point one point one is their final release.
Guest 2
And mainly the reason being AI can just generate this stuff.
Guest 2
It doesn't make sense to maintain a library when everyone's just generating their CSS anyways.
Guest 2
So sad news. At the same time, they're still gonna keep it up. Like, picocss.com stays up. It'll still be on npm. It'll still be on JS deliver, so sites won't start breaking if they were using the CDN.
Guest 2
But again, one one more casualty to this new era of AI.
TanStack Redact: a smaller drop-in React replacement
Guest 2
Another bit of news is Tanztack introduced Redact. And so this is something that Tanner talked about, I think, even, like, months ago, but didn't really, like, release it officially. But it's essentially a reimplementation of React. It's a smaller replacement for it, and it is a drop in replacement. So if you have an existing React app, you can just remove the React dependency, add Redact instead, and it is much smaller. So they're showing in their their stats here that with TANSTEK start using React, it was a 109 kilobytes, but with Redact, 62 kilobytes. So you're saving 43%.
Guest 2
With Vite, you're saving 70%, vNext close to 30%. And Next. Js, you're saving 20%. It's actually baffling to me that you can actually replace React in Next. Js with Redact. I'm sure there are still some things to be added. Not absolutely
Wes Bos
everything works. But But, man. They released it. Yeah. Like Like like, Next JS uses all of the low level weird edge case caching suspense APIs.
Wes Bos
And the fact that you can just swap it out and it's,
Guest 2
what, 20% smaller. Is that... Am I reading that right? Yeah. That's what... You're saving almost 36 kilobytes. That adds up a lot if you have lots of users, lots of page loads.
Wes Bos
That is crazy.
Wes Bos
I would like maybe we should have him on the podcast to talk about how he actually built this. Yeah.
Guest 2
It was in the early days of Slop Forks.
Guest 2
He mentioned that was like... What's V NeXT? You can. Yeah. They have that in the table here too. And you save 28%.
Wes Bos
Yeah.
Wes Bos
Wes Wait, what's Phoenix doing these days?
Guest 2
Well, our next story that I have is from Cloudflare, and they're maintaining The Cloudflare team is dedicated to keeping it working.
Cloudflare ports TypeScript to Rust with TSRS
Wes Bos
Good.
Wes Bos
Longer than I need my vibe coded stuff.
Guest 2
And so leading into that, the Cloudflare team has introduced TSRS, which is a port of TypeScript to Rust.
Guest 2
And so if you've kept up to date with the TypeScript news, you know that TSGO was official from the TypeScript team, and was a Go port of the TypeScript compiler, officially released in version seven, it's now stable.
Guest 2
But some of the people at Cloudflare were like, you know, let's make this thing in Rust for a lot of different reasons, not necessarily just because of performance or memory safety.
Guest 2
One of the nice targets that you have in the world of Rust is WebAssembly.
Guest 2
So they talk about the fact that you can compile Rust to a WebAssembly target and then, like, run it inside the web browser. So essentially, you have a really fast compiler that now can also run-in the web browser. It doesn't have to be necessarily just like a CLI tool.
Guest 2
And then they're also talking about... And recently, they announced that they're supporting native Rust in in Cloudflare Workers. So instead of creating a worker that is a JavaScript handler, you can now write it with Rust. So they're doing a lot of Rust stuff over on the Cloudflare team.
Guest 2
And they're keeping it maintained. And this is where I found... I read about this. So they mentioned they're keeping TSRS maintained, and they said we've seen a lot of success with how we maintain vNext in sync with its upstream Next. Js. So they're keeping vNext up to date. They're working on this port. And I don't think this is any shade to the TypeScript team. I think it's just one more really good
Scott Tolinski
option when you wanna have a fast compile time. So... Yeah. The Cloudflare team must have giant hard drives with how much Rust they're doing. It says build files are absolutely just choke your computer out. Internet to put it on. It's okay. Yep. Yeah.
Wes Bos
That is actually crazy. I just went back and listened or looked at the date on... We had the TypeScript team on to announce TypeScript Go. And at the time, everyone's mind was blown that you could rewrite this thing in another language and it would just, like, work. And they just went function by function, moving it from TypeScript into Go. And and we asked them, like, why not Rust? And they just... There was a lot of reasons why they could not move it to Rust because of...
Wes Bos
I forget what they were offhand, but I think it had to do with, like, the memory and several other things. And it was just unbelievable that you could do this. And here we are sixteen months later.
Wes Bos
And Yeah. Just... Oh, yeah. Rerode on Rust. Done.
Guest 2
Yeah. Like like I said, there's shade to the TypeScript team. And and Alex Lichter, who works at who works at Voy, who was acquired by Cloudflare, works at Cloudflare, is mentioning that TSRS is in collab with the TypeScript team. So that makes it quite different from these, like, slop forks or whatever else. So it's officially supported.
Guest 2
It's gonna be maintained.
Guest 2
One one more option in this this world of fast compiling.
Guest 2
Right? That's all I got for web dev. I got another thing.
Agent Desktop lets agents use your whole computer
Wes Bos
Agent desktop.
Wes Bos
This is, seems like every week we've got something from Vercel Labs on this thing, specifically, Chris Tate. I actually think he somebody else built this one. Yeah.
Wes Bos
Built by MD Lafier.
Wes Bos
Anyways, this is something called agent desktop, which if you don't know agent browser, it also came from Vercel Labs.
Wes Bos
And what this is is an agent... Essentially agent browser where you can programmatically use a browser, but for the entire...
Wes Bos
The... Your entire computer.
Wes Bos
So it works with Mac, Windows, Linux.
Wes Bos
And I think the interesting part about this is that it can use your computer programmatically.
Wes Bos
It uses the accessibility tree, to sort of figure out where to click around to, and that is significantly faster. I'm not gonna say better, but that's significantly faster for a lot of things because taking a screenshot, feeding that into an LLM is both slow and extremely expensive.
Wes Bos
And then another interesting thing is that it implements its own cursors, meaning that it can use all of your applications concurrently in the background. Part of the annoying part of computer use is that it just is constantly popping things open. And if you're doing computer use on your your computer that you are also using, it's annoying. So this implements its own cursor. So you don't actually have to, like, bring apps to the forefront and and can sort of go through them. So I'm I'm pretty excited about this type of thing. I guess the question for me is how is it different than Kuwa?
Scott Tolinski
Kuwa? What's kuwa.ai? They're kind of the leader in this space.
Scott Tolinski
They... They've been around for a while where, again, multiplayer with your cursor.
Scott Tolinski
You can even give your agents desktops in in spaces and stuff directly.
Wes Bos
Well, I'll tell you. It's the pricing.
Wes Bos
Can you use this thing yourself? Maybe the... I guess their their product is probably like a hosted version of this.
Wes Bos
Don't I've I've never never heard of this before. It's free.
Scott Tolinski
Yes. There you go. That's cool. Yes. I have cool on all my stuff. Yes.
Scott Tolinski
Somebody says it's the same. It's the same. Is this it? Shoppers search across channels? No. CUA.
Wes Bos
Oh, my Java's popping up to update. CUA.
Wes Bos
CUA.
Guest 2
I gotta pull it up if we wanna try will say, though, like, I I have I have used...
Guest 2
Was it was it agent browser? Yeah. Agent browser. Agent browser. Yep. From Vercel. And it and it works really well compared to, like, Playwright MCP or Chrome MCP in terms of token usage.
Guest 2
So it's from a similar team, so I imagine they they did some stuff right in there as well. But...
Wes Bos
Yeah. And it has a whole... I didn't even show the whole CLI.
Wes Bos
I gotta open in my reqs here.
Wes Bos
Let me move to it one sec.
Scott Tolinski
Yes. Kuwa.ai is is the one that I've been using for a while. It's very nice.
Wes Bos
Does it all work in the in the background?
Scott Tolinski
Yes.
Scott Tolinski
Multiplayer
Guest 2
with your agents. They each get their own cursor. Yes. Oh, I like that. I mentioned to Juan in the live chat. This is live. This is happening right now. I see your chat. I see you there. We're live.
Wes Bos
Yeah. This is not a premiere.
Wes Bos
Yeah. Here's here's the thing. Snapshot, screenshot, find, collapse, like, all the stuff you would be used to. And and immediately, I'm like, oh, maybe I I could build a...
Wes Bos
Are we building screen
Scott Tolinski
resizing thing on top of this? Scott, didn't you just build a window manager? Yes. I love mister space. Probably don't need an agentic window manager, though. Mine actually can be driven by agents if you want it to be, but doesn't be cool.
Wes Bos
Yeah. Cool. This is dope. Check it out. I I need to check out Kuwa now.
Guest 2
Share another post that I that I saw on X of showing how to use Agent Desktop with a VM.
Guest 2
Because the latest macOS supports virtualization, so you can spin up macOS VM with...
Guest 2
What's the... You you could definitely use Lima.
Guest 2
Tart is the other one or even UTM.
Guest 2
But I would recommend that if you're gonna start letting an agent control your desktop.
Guest 2
Use a VM and only sign in to things that you're okay with losing or
Wes Bos
letting it know... Tell to the world. So... And this is like a GUI VM? Yeah.
Guest 2
Yeah. So, I mean, it it basically launches a window that is a macOS desktop.
Guest 2
Yeah. Oh. Yeah. And so you can do... Yeah. You can do that. So Tart, Scott talked about it a couple streams back. You can do it with Tart. You can do it with Lima.
Scott Tolinski
Essentially, can with too.
Guest 2
Oh, it it does a separate desktop for you? Yeah. Oh, okay. And then so the... In macOS, I think it was '26, they introduced their virtualization framework, which now is a supported way to virtualize macOS on Mac. And so I'm guessing that's how Kukua does it as well. They just spin it up using the built in APIs.
Scott Tolinski
Sick. I got a couple things here, folks. One, you can now use your Claude subscription in OpenCode once again.
Claude subscriptions work in OpenCode again, officially
Scott Tolinski
So it's actually been officially approved as in they got permission from Anthropic, and they are fully TOS compliant. It's not using the same way that it used to be done. It is using the agent's SDK, kind of like what I believe something like t three code is as well. One of the reasons why they weren't affected by the same ban across Open Claw and, PIE and all these things, in the past.
Scott Tolinski
But this is using the agents SDK, and it again, it has been officially approved by Anthropic, and they are compliant. So you will not get unexpectedly banned for using this. So Incredible.
Guest 2
Yeah. This is It's back. It's back. Yeah. This is one of the reasons I switched to Codex because you could use your ChatGPT subscription.
Guest 2
And for a while, I was using Copilot, but huge news. Love this. Yes. Love to hear it. Big news. Another thing is the MacBook Pros with
Scott Tolinski
ProLED XDR display were released. We got a touchscreen Mac, and, I wanted to talk about this really quick. Wes had hinted that he had changed his feelings. This thing has a touchscreen, but I think the most low key important feature about this is the supreme contrast ratio on this laptop.
Touchscreen OLED MacBook Pros: worth the upgrade?
Scott Tolinski
People are saying that it's wild, the the unparalleled, the contrast ratio, and it gets way brighter as well and has better speakers. So it gets way brighter, way better contrast, and is an OLED display.
Scott Tolinski
So I think all of those things are really cool.
Scott Tolinski
But touchscreen, Wes, were your thoughts about the touchscreen parts of it specifically? Everything. Or just the laptop? So I'm sitting here. I've got a m one max
Wes Bos
64 gigs, and I've had it for what they've been out for maybe five years now. And I think a lot of us developers are like sitting on. If you're wondering, like, why are we talking about laptops? Because like a lot of web developers are sitting here being like, yeah, I've got this m one pro max, and I I think I need to upgrade. You're starting to feel the pain of upgrading. And and when this came out, we were all together at GitHub. I'm like, I'm getting it. I'm doing it. I'm doing it.
Wes Bos
And after, like, I'm sitting with it, going through it, I'm like... A couple things. First, it's like almost a year old chip. It's not the m six. It's the m five, which is like, that kind of sucks. I don't wanna... I'm not... If I'm buying something, I'm using it for five years or or three or however long you have it, I don't wanna buy something that's already a year old. And, like, they they clearly have m six chips out already.
Wes Bos
So that's one. Second one, I don't care about touchscreen.
Wes Bos
I don't think. Okay. I have the Omari touch screen one here. And I used it a couple times to, like, do little drawings. And it's nice every now and then you can just touch what you want. But, like, maybe two times a day, I've... You find that's helpful. And most of my day is I'm seated at my desk plugged into monitors. So all the benefits of the touch screen and the beautiful contrast and all of that type of thing kinda goes out the window. The things that are nice to me is I certainly want that 14 inch. The 16 inch, I'm so over it. It's heavy.
Wes Bos
And then also, I... Like, apparently, it's a little bit lighter as well, the 14 versus the previous one. Way lighter.
Scott Tolinski
In fact, I I was looking at... Think if, for me going... Because I did get the 14 inch, and I got it really spec down as a not... It's like it's like bare bones spec because I really wanna go thin client with it. So for me, looking at this laptop, which weighs... I don't even know how much this thing weighs, like, five pounds or something, and then the 14 inch new one weighs three pounds.
Scott Tolinski
It's gonna feel like having a little tiny MacBook Air, which my wife's MacBook Air is just so nice. So having, like, a really nice light 14 inch machine was really the goal for this thing for me Yeah. To have something to be able to actually carry around.
Scott Tolinski
And, like you, yeah, I mean, at my desk, I'll be using my desktop, and that's going to be it. But when I'm out and about, which is quite often, I am lugging this bad boy around and taking it to conferences and flying with it and stuff. And it is just... It's one... It's it's old, it's slow, it's heavy. It's all those things. It's not that slow. But, yeah, just... For me, I I don't I don't have no idea if I'll be using the touch screen at all. If I do, it's probably gonna be for some goofy demos because there's, like, 10 finger support on it. I think you can have even more than that somehow.
Scott Tolinski
Yeah. So, like, I I don't know. Maybe there's some fun demos, but, like, on a day to day basis, I don't know if I see myself using it in those regards.
Scott Tolinski
Although I did see a demo in Final Cut Pro where they were grabbing multiple clips and putting them in the timeline. I'm thinking, okay. Maybe that would be nice.
Wes Bos
But still... Yeah. Yeah. Yeah. So Scott has a Mac studio coming, which is just, like, loaded to the gills.
Wes Bos
Right? Like, that's gonna be your your workhorse. And you're gonna use this as a a thin client too. So like most of your agents, most of your processes, all all of that work is going to actually happen on your your beefy machine. Right. And you're going to use something like Rex to to sort of just interface with that. Right? Correct. Yes. But, like, the thing that gets me is that the biggest problem I have is, yeah, like, agents, they're... They use quite a bit of resources, and I could I could just have, like, a secondary computer in my office to run those on. But, like, video editing, and we're talking about this Yeah. As well. Like, you still have to do the video editing on the machine, which is just eats up your your RAM and your CPU, and it just just gets at you. So, like, if I wanted to do this, I'm looking at, like, I probably want the 128 gig version of that. And then that's like a... That's like $10,000
Scott Tolinski
crazy expensive, which would be more expensive than my Mac Studio, which the I'm gonna be doing all the video editing on the Mac Studio. When I'm sitting down day to day to work at my desk, it's gonna be Mac Studio all day. Okay. But I am out enough, whether that is kids activities, working for my car, like, I still need a laptop. And so, like, what I was really, like, coming down to it for me was do I get something like a framework and throw Linux on it? Do I get one of these these windows and and throw a catchy OS on it or something like that? Do I do that, or do I just get a MacBook Air or whatever? And I ended up going to the your m one that you have right now? Why can't that do your thin clientness? Yeah. Well, there's actually... My my screen is kinda going, Wes. I don't know about how you... How yours is doing, but my screen has all these dark splotches on various sides of it. I I mean, it could just be the backlight.
Scott Tolinski
But... No. I mean, it's fine.
Scott Tolinski
And the computer is certainly fairly powerful at this point, but it is... It's just a heavy beast, and I'm carrying it around so much all the time. And and I don't know. Like, I... It's just like I I needed this, the beefiest computer possible. But now if the point of it is to be able to move it around easily or whatever, you go super light. I think for me, the argument was, do I go with a MacBook Air or not? Oh, yeah. Yeah. That makes sense.
Wes Bos
Cool. Well, I'm I'm excited to see what people think. I'm still on the... I I really need to upgrade, but I just I I just... I'm always this way with MacBooks where I'm just like, wait for the next one. It... No. It's be better.
Wes Bos
Where's the... Just give me what I want, and don't screw me on the RAM upgrade. Like, watch the RAM upgrade here. Let me let me do it real quick.
Wes Bos
So where do you change there? Here we go. The amount of RAM. Right? Comes with 48 gigs. If you wanna go up to the $1.28, it's another $3.
Scott Tolinski
Yeah. Woah. Yes. Wow. Woof. Insane.
Wes Bos
Yeah.
Wes Bos
And
Guest 2
I'm just gonna... So I got an m one...
Guest 2
Not not even... Don't even know if it's the max in 2021, and it works great. It only has 16 gigabytes of RAM. Talking about my personal machine. Yeah. I don't see myself replacing it at any time anytime soon.
Guest 2
I used 16? A
Wes Bos
That's crazy. Yeah. I mean, I mean, I
Guest 2
mean, basically. But I... I've done the same video edit exports on it, and it works totally fine. Like, even with, like, animations and everything else, like, it it it works about as good as as the m three Macs that I have.
Guest 2
And I... So I used a 2015 MacBook Pro for at least eight years, and it really didn't start to break a sweat until all these apps started using more and more RAM and everything else. But I like my m one. I'll stick with it for a while, unless I find a really good deal. But I'm sitting at right now 55
Wes Bos
of 64 gigs used, and I don't even know what I'm doing.
Wes Bos
Oh, it's Photoshop.
Guest 2
Photoshop? Yeah. Photoshop.
Wes Bos
Photoshop. I made I made the thumb. Yeah. I gotta close it. I I don't wanna have to I don't wanna have to manage it.
Scott Tolinski
You know? I guess that's true. Yeah. Yeah. Alright. Closing it. Here we go. And then how's your battery doing? Because I just checked my battery, and it says that your battery's capacity is significantly reduced, and you should be serviced. After five years, I can still get
Wes Bos
probably...
Wes Bos
It depends on obviously what you're doing. But if I'm... If I don't have, like, a ton of stuff chugging, not a lot of GPU, I can probably get about five hours out of it, maybe four or five hours depending on what you're doing, which it previously used to be, like, sixteen.
Wes Bos
You could you could run that thing all day. Yeah. I used to I used to
Scott Tolinski
not bring my charger anywhere with me because it's just... It's fine. I heard a scratching at my... The door Uh-oh. For my dog. Hey. Look at that. She's soaking wet. It's raining.
Scott Tolinski
No. Soaking wet.... Leaves. Oh, my gosh. She's covered in leaves. She's covered in AI. Oh, yeah. Look at her little paws covered in leaves. She she always comes in with, like, ants and stuff on her, but now she is Oh, no. Soaking wet. I don't know why she... Because we... The door is... There's no way she was stuck outside, but it's just pouring out there.
Scott Tolinski
Girl.
Scott Tolinski
Oh.
Scott Tolinski
Oh my god. This dog, when she gets wet, you gotta, like, wring her out like a towel. That's the only way to get her dry. Oh my god.
Wes Bos
That seems like a tough life.
Scott Tolinski
It's a bit of a tough life. Rely on humans to dry you off. Yes. Yeah. Bit of a tough life. Yes.
Guest 2
Alright. What else do we have next? Anybody else got more items here? I think CJ does. Got a few got a few stories. I think I have so much more. I'm gonna I'm gonna make it quick. We won't be longing for too much longer. But first up, Discord is now making their content discoverable. So I've talked about this problem in the past where, like, you have all these community Discord servers that pop up, and people are answering questions, like, the good conversation is happening, but there's no way... It's not very discoverable. The only way to find it is if you're actually in those Discord servers.
Discord makes public server content discoverable
Guest 2
And one answer to this was a project called Answer Overflow.
Guest 2
They actually index public Discord servers.
Guest 2
So if you go to answeroverflow.com, you can see what servers are there. But essentially, they find question and answers that are happening and then make them available on the public web. But this is like a third party thing. But now it's it's official from Discord that they're gonna make content discoverable.
Guest 2
Now they do have some caveats, like your server has to have at least a thousand members, and then the admins will choose that if it's server discoverable.
Guest 2
But it's cool to see that this is now gonna be built in, where essentially, you'll be able to see this stuff on the web without having to log in to that server. This will be really good for agents as well. So if, like, questions and answers are happening in public Discord servers Yeah. Agents can search them. They'll be able to find their answers there. So this could be a bit of a replacement or at least supplement the idea that agents were getting results from Reddit and things like that. Yeah. This is huge. Cool news. Yeah. Because, like, it's always sucks that
Wes Bos
good information goes somewhere and gets lost where you you cannot help someone. And it's... There's so much good information in Discord where, like, if you have a problem, you have to go in and search for what you want. This is huge.
Wes Bos
Yeah. Checkmate, Reddit. You know, you're closing the doors. Discord's opening it up. I'm posting my memes and, like, plumbing questions to Discord now.
Guest 2
Nice.
Guest 2
Yeah. I mean, this this is good news for me just because there there is just so much information behind... I say closed doors because a lot of these servers are public, like, technically, you can join them. But then you have a sidebar with, like, 30 different servers that you never check anyways. So this is huge. I'm I'm excited about this. Yeah. My
Wes Bos
my Discord is a disaster.
Wes Bos
Disaster. I've...
Wes Bos
I probably have, like, 50 servers and, like, a million DMs.
Wes Bos
I just... I can't even I can't even go into it anymore. Yes. I'm sorry, folks, if you've ever DM'd me on Discord.
Scott Tolinski
Can't keep up. I can't keep up with... I got too many DM. I need a DM aggregator from Twitter to Discord to even just Apple messages. My god. Need something to...
Wes Bos
Can I can I tell you about my dot? So Yeah. Me and Randy were sitting at the airport waiting for our flight, and I got... I'm not lying. So I have a flight coming up. I get a notification from my email. I have two email clients. So I get two notifications that my flight is now starting. Then I also have it in two different calendar apps that I have. So I get two notifications there. Then my dot tells me that I have it. Then my Grock bot tells me that my flight is there. Then my, I didn't even know I had like a Google agent, whatever the, like, Google equivalent to dot is told me that my flight was now boarding. So I'm just sitting there. I got, like, nine notifications about my one flight boarding.
Wes Bos
And I I know I obviously shouldn't be using all of them. I'm just just testing them.
Scott Tolinski
A hell of your own making. Thing. Yeah. Yeah.
Guest 2
Nice.
Two weeks of CVE chaos: PHP, Brotli, Linux, GitLab
Guest 2
So next up, I just have some security news.
Guest 2
So we haven't been live for, I guess, almost two weeks at this point. And while we were gone, the world was just on fire, basically. Yeah. And you probably heard about it on the news, probably read it on Reddit.
Guest 2
But there's a couple of places you can go to get info on this. The first one is pwn.watch, pwn.watch.
Guest 2
This is by Kitty.
Guest 2
Wes likes to call him kitten.
Guest 2
But it gives you a site that it's all of the vulnerabilities that are happening and whether or not a patch is available for them.
Guest 2
And so I'm also going to take a step back because I also want to describe and tell you what CVE is, because some of you might not be familiar with what it even means. You're hearing about it all the time now. But CVE is common vulnerabilities and exposures. It's essentially a way for the world to say this piece of software is vulnerable in this way and basically go public about it so that people know that that's out there. And then very often, a CVE is paired with a patch. So the CVE will come out and it says, hey, Linux is vulnerable to this remote code execution thing in the kernel. We're labeling it this. But also, if you patch to version seven point whatever, you will no longer be vulnerable to that. So there's a database of CVE IDs that basically keep track of all of these vulnerabilities that are found.
Guest 2
And it's also part of responsible disclosure or coordinated vulnerability disclosure where the good guys, the white hackers, are doing pen testing and and fuzzing and finding vulnerabilities and not telling the world about them first. They essentially find them. They then reach out to the software vendor, whether it's a company or an open source project, and then they say, hey, we found this. You need to patch it.
Guest 2
Pretty often, they'll do this as part of a bug bounty program, so maybe they'll get paid for it. But then eventually, once they know a patch has been released, then they'll mention, hey, here's the CVE, please go patch it. Yeah. And so over the past two weeks, that's basically what we're seeing a lot of. But the issue is some of those CVEs were released before even a patch was available.
Guest 2
And this is a site, it's called CVE Tracker. And so this is just the number of CVEs that have come out since 2004.
Guest 2
And you can see, like, over the past few years, there has been a bump. But all of a sudden here in in 2026, we have, I think, like over 1,700 CVEs reported just in October alone.
Guest 2
And so this is good and bad. Right? Because, like, so because this is responsible disclosure, a lot of them, because we're knowing about them before they're getting patched, it's not necessarily like the whole world is just getting hacked. The issue is the CVEs announced, the patch is released, and then people aren't patching fast enough. That's that's issue number one. Yeah. Then issue number two is some of these CVEs come out before the patches are available.
Guest 2
And so this...
Guest 2
I believe the... If you look at the timing of the PHP one... So just to give you a rundown of of what actually happened. So PHP had a remote code execution vulnerability that went back to, like, to really old versions and basically affected anyone running PHP.
Guest 2
And so that happened.
Guest 2
There's also the Brotli library, which is a compression library. There's a vulnerability in it. And because so many other languages use it, so Node, Go, Python, they all use Brotli under the hood, they became vulnerable as well.
Guest 2
There's an RCE in the Linux kernel.
Guest 2
There was one about the the TCP stack. So if even your server was exposing, an HTTP server, it could be hacked.
Guest 2
There were several CVEs just from GitLab itself.
Guest 2
And so, like, public GitLab instances got hacked and a few other ones here. But what I do wanna show you is the the case of the the Linux kernel, because there are public channels and private channels for talking about the Linux kernel. And the public the private channel is so that maintainers that are trusted can work on these found vulnerabilities before the public knows about them so that they can actually patch them up.
Guest 2
But on October 22, someone posted in the public channel about these upcoming CVEs that was supposed to go into the private channel. And so this was also an issue here. So one of them had a score of nine. So CVEs have a score between one and ten.
Guest 2
Nine and ten are, like, really, really bad. You need to patch this if you don't. Yeah. Like, a remote hacker is gonna get in. But, yeah, one of them was for the the SMB direct remote code execution. So SMB is, like, file storage, like Samba. I use it on my home network for, like, sharing drives between Linux machines.
Guest 2
And then there's a few others as well.
Guest 2
So it's it's all been happening over the past couple of weeks.
Guest 2
And I guess the main advice I can give you is patch your stuff. Also, if you have servers exposed to the public and they don't need to be, like, do... Don't expose them to the public. Put them on a Tailscale net.
Guest 2
And if you're running any of the stuff that has been... Or that has released patches for it, do everything you can to patch it. Sick agents agents at it.
Guest 2
I think it's gonna get a lot worse before it gets better because agents are getting better at discovering vulnerabilities and getting better and better at exploiting vulnerabilities.
Guest 2
But this is just the classic case of, like, good guys versus bad guys. Like Yeah. The bad guys will start attacking, the good guys will patch.
Guest 2
And ideally, there's more good guys than bad guys out there, and we can get to a point where all the holes and everything
Wes Bos
has gotten patched more because I think that's how we're gonna until
Guest 2
we start, like, find all the holes. How many holes are there? There's so many. That's the thing. Yes. How many? Like, when you when you think of it in the grand scheme of things, like, like, software is messy. Like, we can't think of everything all the time.
Guest 2
Yeah. And so there are there's there's holes and stuff.
Guest 2
But the crazy thing is, like, for some of these, they have been vulnerabilities for years. Like, let me get the exact numbers on the on the PHP one. But one of the Linux vulnerabilities has existed for fifteen years. So, like, if if nobody had told anyone about it, you you better believe that there are some, like, nation state hackers out there that potentially knew about it and would be using it.
Wes Bos
So, like, they... They've known about them for fifteen years, but just have never fixed them because there's too many trade offs?
Guest 2
No. The code that introduced the vulnerability was written fifteen years ago Okay. Or or ten years ago. And so that means, like, until now, somebody could have been sitting on this. Like, a nation state or like a hacker could have known about this and had been using it to exploit these systems, but now they're they're getting patched. But how many other pieces of code in in older software isn't as vetted and looked at that potentially has vulnerabilities in it as well? I think endlessly.
Wes Bos
Endlessly. And people that are discovering these things...
Wes Bos
There's been some examples of somebody who's just like, they just find bugs in PHP, and then they they found the vulnerability. But a lot of these are, like, like, malicious, and, like, you can't even hack the photo frame with Claude half the time right now. So are they are they using what they were gonna say the word, obliterated models Bliterated. Or are they just using deep seek or something like that?
Guest 2
It's it's probably a little bit of both. Right? So, like, I think the the the maintainers of these projects have gotten access to, like, Project Daybreak, which is from OpenAI that gives them access to the models that aren't as nerfed and can do cybersecurity work. Like, I'm betting Linus Torvalds has access to that because he works on the Linux kernel. So some of these bigger projects are gonna have access to that, and they're not gonna get the the denials.
Guest 2
But for smaller maintainers, then they likely have to use maybe an obliterated model or an open model that doesn't have refusals.
Guest 2
And then the bad guys, the ones that are maybe not reporting these and finding them themselves, they're gonna be using either a deepseq or a GLM five three or a model that has been obliterated, where essentially, like, the weights have been updated to make make it so that it doesn't refuse when you're trying to do cybersecurity things.
Guest 2
So it's it's a little bit of both, but the obliterated models are definitely how the bad guys can do it without getting refusals or or without some company knowing that they're using their AI to to do these things. Yeah.
Guest 2
So it's scary out there. Make sure you patch.
Wes Bos
Update your stuff. Update your stuff. Unless... The... Actually, the cert one is kinda interesting because, like Oh, yeah. Yeah. The the... We had the photo frame, and, like, somebody sent a poll request in to update the photo frame to to distrust that cert that was, like, number four. Nice. And then I was like, oh, good. And then I was... A little later, I was like, wait a Yeah.
A certificate authority picked the number four as its private key
Wes Bos
Maybe we could've used that, you know? Kinda like... It's kinda... Maybe maybe they were in for a whole new thing of hardware hacking of, like, loading custom firmware on. Because often, that's how how these firmwares will work. They'll only trust
Scott Tolinski
certain URLs. And if you can scoop that up directly about that in regards to the TV hacking stuff, whether or not it's just people talking and saying they did it. I did hear people claiming that they they used the the four certificate as a hack. Yeah. At Moraza?
Guest 2
Yeah. I'll talk about it for a second. So...
Guest 2
And again, there's a little bit of back back information here. When you use the web and you see that little lock in the browser, that's because your web browser trusts a certain set of certificate authorities. A certificate authority is a company that will issue certificates, but they have the secret keys. They are the only ones that can issue keys from their certificate authority.
Guest 2
And the entire Internet is based on this trust. So every operating system has those certificate authority public keys that can be used to verify their private key, like, installed in the operating system. It's in Linux, it's in Mac OS, it's on Android, it's iOS, it's everywhere.
Guest 2
And it's literally just a set of certificates that say we trust these people that work at these companies.
Guest 2
And so one of those certificate authorities was eMudra. They were based in India.
Guest 2
And they generated a private key that was the number four.
Guest 2
And someone found... Figured this out. And what that means is, like, if you know what the private key is, that means you can sign certificates as that company.
Guest 2
And so because the eMudra was trusted in every single web browser and every single operating system, for a certain amount of time, anybody could issue certificates from them. That means you could issue an ad certificate that belongs to google.com, but sign it, and that means you could basically intercept HTTPS traffic to google.com.
Guest 2
Because the the way the CAs work, it's not necessarily domains are tied to specific CAs. It's just that these CAs are trusted and can create SSL or TLS certificates for any domain.
Guest 2
So for a while, anybody could craft a private key and then intercept traffic, and to you, you would still see that lock in your browser bar. It would look like you're getting traffic served from Google or any other website, but there could have been some man in the middle that was using a spoofed key because they knew what the private key was.
Guest 2
And the the reason it it was at the number four is actually hilarious. So when you're generating a private key, you should be choosing a random 384 bit number, which is two to the 238...
Guest 2
Two two to the three hundred and eighty fourth possibilities, or roughly 10 to the hundred and fifteenth power possibilities. So that means if you were just trying to guess these private keys, it would take until the end of the universe, if not more, because there's so many possibilities of what the private key could be. But what had happened was instead of picking a random number between zero and ten to the hundred and fifteenth, they picked a random number between zero and three hundred and eighty four. So they didn't raise two to the power.
Guest 2
And so that gave them the number four.
Guest 2
And that means...
Guest 2
Nobody just try four until now? Like, long ago did this happen? I'm trying to find exactly when it was released, but the... I will say the reason someone was... Had suspected it was because you can see it in the entropy of of the key. And so they noticed that the entropy was a little bit off. And so they... I think they just brute forced it with starting at zero and instantly found four. Took five tries.
Guest 2
Yeah. Exactly. Like, one, two, three. Oh, now you can create certificates signed by them. So, yeah, so that that was horrible. And actually, eMudra has gotten out of the business. They are no longer a certificate authority.
Guest 2
They they handle, like, Internet infrastructure and stuff like that in India, but they're like, this is this is too big of a mess up. We we can't we can't do this anymore. They backed out. Yeah. Think the most interesting part is that they have... When you have new certificates,
Wes Bos
they... It's a certificate ceremony or a key ceremony. Key ceremony. Yeah. Beautiful. It's alright. Yeah. Was key.
Scott Tolinski
How was the ceremony? Oh, it was lovely. Yes. Lovely ceremony.
Guest 2
This was also released recently that macOS 27.2, I think, rolled back the fixes for the CA. So if you're using the built in git, curl, or Python on Mac OS 27.2, it actually still trusts eMudra.
Guest 2
But if you're using brew, you can install the latest version of git, curl, and Python, and just make sure that you're using those versions so that the eMudra CA is not trusted.
Guest 2
And I'll I'll share this website, but you can... They have a specific spot that you can go to that will tell you if you're vulnerable. So if you run a curl against this URL...
Guest 2
I'll share it in the show notes, if it throws back an error, then that means your cURL is not trusting that CA. But if it if it works, then that means it's trusting that CA, you should be... You should upgrade.
Guest 2
And one more one more funny thing. So MITM proxy, man in the middle proxy, is a very popular proxy that people use in pen testing and also hacking, where essentially they can spin up a server that intercepts traffic for their network. Or let's say... Yeah. You you might get on the same network as somebody and then get in the middle. So that way, whenever they make a request somewhere, it goes through your server. But because of TLS, you couldn't fake certificates.
Guest 2
But they now have a dash dash eMudra option where it uses that that CA with the the private key of four to create HTTPS certificates.
Guest 2
So if you're trying to man in the middle of somebody that hasn't been updated, you can just instantly do it with man in the middle proxy. So that's fun as well. That is awesome.
Guest 2
Yeah.
Guest 2
Wow.
Wes Bos
Big, big week. Well, hopefully, we have a bit of a better week. Is that also, like, shout out to anybody who works in this stuff where, like Hug ups. You're just on on your tail going twenty four seven to figure out how can we patch all these things, and then some jag off tweets the...
Wes Bos
Before you're you're used to... Or before you're ready. Right? So frustrating. Like Alright. I have Even just, like Yeah. The the railway had a hack as well, and the the the people that had large applications on railway had very, very bad days.
Scott Tolinski
Yeah. How many errors in Google Key compromised?
Guest 2
Yeah. I didn't get loud. And it's crazy that all of this all of this was happening at the same time because a lot of these CVEs had nothing to do with the hacks. It just so happened that there's so much agentic hacking hacking happening out there that, yeah, Railway, GitLab, we saw even OpenCode was being attacked, like, three weeks ago. Mhmm. Yeah. Massively. So, yeah, stay safe out there.
Guest 2
I got one more... Or two more little fun sites for you.
Apple Music 404 iPod and Visit Norway's fancy outhouses
Guest 2
Have you guys seen the four zero four page on Apple Music? I I have only because it was making the rounds.
Guest 2
Yeah. So it takes you to this little iPod, and it actually behaves like a iPod classic.
Guest 2
And you can go in, you can choose songs
Wes Bos
That's cool. Artists,
Guest 2
and then it it plays, like, the the thirty second previews that you get, like, in Apple Music.
Scott Tolinski
Yeah.
Wes Bos
I love my iPod. You use Apple Music, CJ? Oh, no. We've we've talked about this. CJ uses some weird custom self hosted ripped CDs. For music.
Scott Tolinski
Yeah.
Guest 2
I use JellyFin for... JellyFin serves up album... Music albums just like they do movies. So...
Guest 2
Yeah.
Guest 2
I I missed what you guys were saying because the music was too loud on my band. I'm still on Spotify. Spotify added some crazy weird AI assistant thing, and it was like,
Scott Tolinski
chat with your your mute, but it was in a totally separate app. And, like, one of their first examples was, like, ask it to to to examine your music taste for something. And I did that and then it returned like, I'm having a hard time seeing your music. Or I'm sorry. I'm not... This is gone. Get out of here. The very first... You got one chance to show me that this was actually
Wes Bos
anything interesting at all, and you blew it. So you're gone. I have a problem with Spotify where it thinks I'm super into plane crashes.
Wes Bos
Because one time No. What's time, I I listened to a podcast. There was a... There was somebody who, unfortunately, had passed away in a plane crash, and they were part of both the hardcore music scene and the development scene. So I was, like, interested in what had happened there. So I listened to a podcast about it. That was, like, two years ago. And even right now, I'm on my Spotify homepage, and there's just, hey, planes? You interested in planes? No. Not at all. Not at all. And, like, I wish these algorithms, you could just, like, nuke something and say, never, never am I gonna be interested in this. Same with watches. All these algorithms think that I'm reaching the age where I'm just gonna be super into, like, watches and Rolexes and things like that. No thanks. Zero interest. Yeah.
Scott Tolinski
Yes.
Scott Tolinski
CJ, you got something about toilets?
Guest 2
One more about toilets to end it all out. So this is on the Visit Norway website. It's like an ad for tourism, travel.
Guest 2
And it's like, are these the world's best outhouses? And it's just this wonderful cinematic footage of basically, like, viewpoints that you can very... In The US, we have, like, rest areas where you can park. There's, like, a scenic viewpoint. This is like that. But but they have some of the most interesting architecture. Like, this one's completely made out of stone.
Guest 2
This one has, like, a completely glass floor, and you can see the river below you. Oh my gosh.
Guest 2
They're incredible.
Guest 2
This is just like a fun... It looks like the the the highway is actually jetting off in... Off a cliff, but it's just like an overlook that you can stand on.
Guest 2
But then the outhouses themselves have like just very modern design. This one has like an interesting cement curve with like almost see through glass, but not like
Wes Bos
incredible. Yeah. So this just a fun number. Be able to have something like this in Canada. It would be destroyed.
Scott Tolinski
Destroyed. Destroyed in, like, three days. Somebody will be sleeping in it. The every single outhouse in any national park in The United States or or what... Rest stop or whatever is the very last place you'd ever wanna be. And you... Yeah.
Guest 2
No. Thank you. I agree. I mean, yeah. So if you're ever in, the national forests or anything in Colorado, they have outhouses. They they smell horrible. I mean, they do their best to upkeep them, but people are just so rough on them. No. They're too rough with it. Yes. They're too rough with it. Guilty as charged.
Guest 2
So, yeah, this is a fun one. And also, their site was really cool. As you scroll, it's, like, fading between these outhouses. So... Yeah. Yeah. Check it out. Very fun. Put... What a perfect way
Scott Tolinski
to end this, CJ. Thank you so much. And, also, we didn't mention we're presented by Century. Check us out at century.io.
Scott Tolinski
Century's the best. They are...
Scott Tolinski
They're just there to make your websites better all the time, and I think that's becoming more and more relevant. So it's always been relevant, but it's even more relevant. So check it out. Guys, do you have anything else to say before we get out of here?
Wes Bos
Oh, yeah. All. Thanks for tuning in. Peace. Peace. Peace.