25-year code veteran | Debugging life's challenges with Stoic wisdom | Building robust web solutions and inner peace | Marcus Aurelius with a laptop
My Lair →
Joined February 2010
- Tweets53.3K
- Following1.2K
- Followers2.2K
- Likes123K
Pinned Tweet
I’ve read more AI career forecasts this year than is good for me. Every one was accurate. None of them were about me.
A p95 can’t tell you how long the next request takes. You’re the next request.
Final piece of The Broken Ladder:
levelup.gitconnected.com/you…
HTML all day
🚨 BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
→ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
→ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
→ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
→ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
→ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
→ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
I used to be the documentation at work.
Not the wiki. Me.
Like the real docs, nobody ever updated me. They just kept asking.
Took me years to see that being needed and being useful aren’t the same thing.
thestoiccoder.michaelclawren…
Who’s doing this?
To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it
Readers added context they thought people might want to know
xAI explicitly warns users not to include personal information in prompts, yet credit card photos may contain such information.
Grok Bot's terms state that user data and credentials may be stored in its cloud environment and require human review for financial transactions.
x.ai/legal/privacy-…
x.ai/legal/grok-bot…
Someone asks where a setting lives. The reply is four paragraphs and ends with "Sent using ChatGPT."
Correct. Thorough. Addressed to nobody.
New essay on what a two-line human reply means now:
thestoiccoder.michaelclawren…
I spent years staying on top of things.
Turns out they were somebody else's things.
New piece on who actually decides what developers practice, and what's left that's yours:
levelup.gitconnected.com/sto…
25 years of experience means I can glance at a stack trace and know exactly what's wrong.
It also means I can be wrong faster than ever.
New piece on skimming, attention, and Epictetus:
thestoiccoder.michaelclawren…
Stoicism will teach you to stay calm during a production outage. It will not teach you how to tell your dad his retirement plan assumes 1994.
New piece:
thestoiccoder.michaelclawren…
