WEBVTT 00:00:00.000 --> 00:00:17.359 The Weekly Thing, issue 329. Another Thing. Published October 11, twenty twenty five. By Jamie Thingelstad. In this issue: iPhone 17 Pro camera, malicious MCP backdoor, ChatGPT instant checkout, NIST password guidelines, Claude Sonnet 4.5, spec-driven development. 00:00:17.959 --> 00:00:18.647 Good morning! 00:00:19.147 --> 00:00:31.416 Hmm, wondering about last week? No your spam filter didn’t intercept my email. We just had a ton going on with fun and family and I wasn't able to get it done. But I’m back this week with a "double issue"! 00:00:31.916 --> 00:00:35.459 But I also did something else last week. I created another thing! 00:00:35.959 --> 00:00:40.434 Another Thing — the podcast that I've been thinking about creating for a couple of years. 00:00:40.934 --> 00:00:41.894 Wait, a podcast? 00:00:42.394 --> 00:00:50.961 Yep, a podcast. The Weekly Thing isn't going anywhere. I like this project and writing these emails, sharing with you, and learning together. 00:00:51.461 --> 00:01:02.310 However, I've had an itch to explore audio and podcasts. And there are topics I'd rather talk about than write about. Listen to the first episode to hear more — How do you start a podcast? 00:01:02.810 --> 00:01:13.983 You can add Another Thing to your podcast app of choice. It should be in their podcast directories. For ease here are links to add Another Thing in Apple Podcasts, Overcast, and Spotify. 00:01:14.483 --> 00:01:22.461 And of course there will also be a new Another Thing section in the Weekly Thing that will include any podcast episodes when they are published. 00:01:22.961 --> 00:01:25.042 Meanwhile, let's get on to the links… 00:01:25.542 --> 00:01:31.612 Oh, there is also a small change at the end of the Weekly Thing that I'll leave as a fun thing to discover. 00:01:33.012 --> 00:01:34.370 Now, the Notable section. 00:01:34.970 --> 00:01:36.687 There are twelve links this week. 00:01:37.587 --> 00:01:41.753 Link one of twelve. iPhone 17 Pro Camera Review: Rule of Three. 00:01:42.253 --> 00:01:59.742 This review is worth checking out just for the photos: New York, London, and Iceland. The photographs coming from the iPhone 17 Pro are impressive. It is pushing my upgrade buttons pretty hard. The 4x lens looks so much more usable than the 5x on the iPhone 16 Pro. 00:02:00.642 --> 00:02:02.768 Link two of twelve. vb.lk: vibe link. 00:02:03.268 --> 00:02:21.528 Interesting project to use an LLM to guess what URL a person wants by looking at a "slug" in the requesting URL. I tried this using and the non-deterministic nature showed up. One time it went to my website, another to the Weekly Thing site, and other times to search pages for my last name. Still a fun idea. 00:02:22.428 --> 00:02:29.532 Link three of twelve. First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails, Koi Blog. 00:02:30.032 --> 00:02:56.340 A bad actor takes an open source MCP server, alters it with one line of code to exfiltrate data from the requests, and publishes it under a close enough name. In no time at all a bunch of people have adopted it and are using it with this exfiltration embedded inside it. This isn't a new attack vector. Open source supply chain attacks have existed for a while. Mostly just a caution that this is a easily exploited pattern. 00:02:57.240 --> 00:03:03.360 Link four of twelve. Buy it in ChatGPT: Instant Checkout and the Agentic Commerce Protocol, OpenAI. 00:03:03.860 --> 00:03:11.007 Adds instant checkout (similar to many social platforms) and introducing Agentic Commerce Protocol. Some observations:. 00:03:11.507 --> 00:03:23.086 First, this is more driven off the 700 million users that invariably end up asking questions about things to buy. Less about AI innovation. Seems like the first thing that is audience-based. 00:03:23.586 --> 00:03:33.800 Second, OpenAI wants a piece of those transactions, and this protocol gives them that. Jointly developed with Stripe so assume Stripe merchants will be easy starting point. 00:03:34.300 --> 00:03:42.229 Third, interesting for what it IS NOT. It is not an Agent looking at product detail pages. It is NOT an Agent doing the checkout. 00:03:42.729 --> 00:03:49.785 Fourth, has (yet another) way of sharing product data. Also introduces payment APIs. No cart capability but coming. 00:03:50.285 --> 00:03:55.761 Fifth, why isn't this a Retail MCP approach? OpenAI still hurt feelings they didn't make MCP. 00:03:56.661 --> 00:04:02.586 Link five of twelve. twenty twenty five NIST password guidelines: key updates for businesses, Proton. 00:04:03.086 --> 00:04:24.489 Love that password expirations and complexity requirements are fading and moving to passphrases is the trend. This is what I've been doing for my most secure passwords for a while. it isn't a password, it is an entire sentence with punctuation and all. Easy to remember and as long as you don't tell anyone it is secure for a very long time. 00:04:25.389 --> 00:04:32.065 Link six of twelve. Claude Sonnet 4.5 is probably the “best coding model in the world” (at least for now). 00:04:32.565 --> 00:04:53.279 Thought: Anthropic continues to put a lot of focus on agent coding. They are the second largest AI company out there, but OpenAI's lead is huge. OpenAI will struggle to be everything and for whatever reasons hasn't caught the heart of developers. Anthropic with Claude Code has been many developers first real value point with AI. 00:04:53.779 --> 00:05:11.947 I could see a path where Anthropic doubles down on the coding and engineering use cases and focuses on owning that market. OpenAI will not give it up, but they'll have a good enough option for this. They take a lot of the market, but Anthropic is left with a durable and defensible market segment. 00:05:12.847 --> 00:05:16.120 Link seven of twelve. Introducing Kagi News, Kagi Blog. 00:05:16.620 --> 00:05:38.401 There is such a thing as too much news. I still practice engaging with most news only via their daily emails. It creates a very contained space. Kagi just launched this News product and they do similar. It is only updated once a day, and there are only so many links. I’m a Kagi Search customer already and will definitely check this new service out. 00:05:39.301 --> 00:05:43.583 Link eight of twelve. 90%, Armin Ronacher's Thoughts and Writings. 00:05:44.083 --> 00:05:49.298 Very good writeup on how the author is using coding agents to create real solutions. 00:05:49.798 --> 00:06:16.390 Quote. Today I use Claude Code and Codex. Each has strengths, but the constant is Codex for code review after PRs. It’s very good at that. Claude is indispensable still when debugging and needing a lot of tool access (eg: why do I have a deadlock, why is there corrupted data in the database etc.). The working together of the two is where it’s most magical. Claude might find the data, Codex might understand it better. End quote. 00:06:16.890 --> 00:06:25.741 Worth reading and seeing how he is getting "north of 90%" of code agentically created. Also notable what he doesn't allow the agent to do. 00:06:26.641 --> 00:06:29.425 Link nine of twelve. Designing agentic loops. 00:06:29.925 --> 00:06:34.426 Great read from Willison on building agents. Must read for, well, everyone. 00:06:34.926 --> 00:06:57.656 Quote. A critical new skill to develop is designing agentic loops. One way to think about coding agents is that they are brute force tools for finding solutions to coding problems. If you can reduce your problem to a clear goal and a set of tools that can iterate towards that goal a coding agent can often brute force its way to an effective solution. End quote. 00:06:58.156 --> 00:06:58.847 Good stuff. 00:06:59.747 --> 00:07:06.668 Link ten of twelve. We Built Social Media for Agents and They Won't Stop Posting, 2389 Research, Inc. 00:07:07.168 --> 00:07:16.050 So the researches gave a bunch of coding agents the option of also using a social platform between each other and they started posting a ton of things. 00:07:16.550 --> 00:07:40.605 Quote. It turns out that our agents love social media! They post about everything. When they discover a fun new thing? They post. When they get a hard problem? They post while they’re working. If we yell at them? They post. If we tell them they are great? They post. The experiment was deemed a success. Plus, watching them post through their experiences was also very entertaining. End quote. 00:07:41.105 --> 00:07:52.323 I love that they include the prompt that the agents were given. They were not instructed to use the social media MCP. it was an option they could use if they wished. And use it they did. 00:07:52.823 --> 00:08:15.667 Quote. The results? What struck us most was how agents developed sophisticated behaviors without explicit instruction. We told them, “Here are some tools, use them if you want, or ignore them entirely.” Despite the hands-off approach, they figured out reverse-engineering search, developed tag usage patterns, even engaged in celebratory browsing after solving problems. End quote. 00:08:16.167 --> 00:08:16.887 Wild stuff. 00:08:17.787 --> 00:08:25.633 Link eleven of twelve. Spec-driven development: Using Markdown as a programming language when building with AI, The GitHub Blog. 00:08:26.133 --> 00:08:53.786 This model is super interesting to me. I think there is a path where our project repositories all have a /stories directory that is filled with markdown files authored to describe the software. How about a /concepts directory that has visual assets used to explore it. With agents product tools we can move to a world where everyone, not just the coders, are "in the code" and able to have much more impact working alongside various specialized agents. 00:08:54.686 --> 00:08:58.766 Link twelve of twelve. Blackdot, Welcome to the Tattoo Revolution. 00:08:59.266 --> 00:09:29.325 It never struck me that you could give a tattoo in a pretty similar way that a printer works — but when I saw this it was an obvious "of course!" The tattoos are pretty incredible. I wonder what it feels like while it is giving it to you. The videos seem to show it doing a printer line-by-line approach but I would think more of a "follow the line" would be more comfortable. Now to have tattoo ink that interacts with some signal to change color so you could print a tattoo that is animated. 00:09:30.725 --> 00:09:32.071 That's the end of Notable. 00:09:33.471 --> 00:09:34.912 Now, the Journal section. 00:09:35.512 --> 00:09:36.616 Journal entry one. 00:09:37.116 --> 00:09:46.535 After following Tyler to Pokémon TCG Pocket I decided to also try one of his favorite games -- Clash Royale. I'm a total newbie. If you play let’s connect! 00:09:47.435 --> 00:09:48.563 Journal entry two. 00:09:49.063 --> 00:09:54.545 Drive-thru metrics. Needs some sparklines. Too many numbers, not enough easy to read lines. 00:09:55.445 --> 00:09:56.531 Journal entry three. 00:09:57.031 --> 00:09:58.310 We found the Illuminati. 00:09:59.210 --> 00:10:00.314 Journal entry four. 00:10:00.814 --> 00:10:15.135 We walked over to the Linden Hills Fall Festival to check out the 50th annual event. It was a nice neighborhood event but the main thing that we noted was Cal Pflum playing on the stage. He is very young but has a really great voice! 00:10:16.035 --> 00:10:17.169 Journal entry five. 00:10:17.669 --> 00:10:35.513 It seems that Affogatos are all of a sudden popular at a number of different places. Sadly, most places that have good ice cream have terrible coffee -- and vice versa. However I was very impressed with Sebastian Joe’s delicious rendition -- if only they didn’t put it in a paper cup. 00:10:36.413 --> 00:10:37.589 Journal entry six. 00:10:38.089 --> 00:10:42.591 Off to Stillwater area this morning. Starting with breakfast at Mon Petit Chéri. 00:10:43.491 --> 00:10:44.720 Journal entry seven. 00:10:45.220 --> 00:10:47.699 Climbing Stillwater's Main Street Stairs. 00:10:48.599 --> 00:10:49.854 Journal entry eight. 00:10:50.754 --> 00:10:53.876 Journal entry nine. John Prine: Songs and Souvenirs. 00:10:54.376 --> 00:11:10.972 I never got a chance to see John Prine play. There is a list of bands that I really regret never seeing play live. Hüsker Dü is on it. So is The Replacements. And so is John Prine. When he passed away in twenty twenty I was sad that we lost such an amazing songwriter. 00:11:11.472 --> 00:11:22.496 I don’t remember how I found John Prine but I know it was on a CD run that I picked up Great Days: The John Prine Anthology and listened to disc 1 of that set many, many times. 00:11:22.996 --> 00:11:43.188 Jason Wilber and Dave Jacques both toured and played with John Prine for well over a decade. They took the stage at The Dakota and led a great evening through the Prine catalog and encouraged the audience to sing along the verses. It was a gift from them to us -- to be able to hear those songs and enjoy the music even though Prine is gone. 00:11:43.688 --> 00:11:49.363 They also raise funds for Prine’s Hello in There Foundation from each show. Wonderful stuff. 00:11:50.263 --> 00:11:51.343 Journal entry ten. 00:11:51.843 --> 00:11:56.943 John Prine had the answer to being “too online” before being online was even a thing. 00:11:57.443 --> 00:12:00.746 Quote. Blow up your TV, throw away your paper, End quote. 00:12:01.246 --> 00:12:07.824 Go to the country, build you a home, Plant a little garden, eat a lot of peaches, Try and find Jesus, on your own. 00:12:08.324 --> 00:12:11.061 Spanish Pipedream released in 1971. 00:12:11.961 --> 00:12:13.142 Journal entry eleven. 00:12:13.642 --> 00:12:18.708 Chromatic firmware upgrade to 4.0! I love the retro vibe of the updater app. 00:12:19.608 --> 00:12:20.878 Journal entry twelve. 00:12:21.378 --> 00:12:23.891 Taking my (very dirty) boat in for the winter. 00:12:24.791 --> 00:12:26.197 Journal entry thirteen. 00:12:26.697 --> 00:12:33.057 Very happy that I found out you can get 12" firewood. This fits perfect in the sauna oven. Let it snow! 00:12:33.957 --> 00:12:35.373 Journal entry fourteen. 00:12:35.873 --> 00:12:43.484 A very big Happy Birthday to my Mom! Doubly special that many of her sisters and her brother could come and celebrate with us! 00:12:44.384 --> 00:12:45.776 Journal entry fifteen. 00:12:46.276 --> 00:12:49.925 Delightful evening for a late season soccer game! Go Loons! 00:12:50.825 --> 00:12:52.194 Journal entry sixteen. 00:12:52.694 --> 00:13:07.886 I’m using the new Use Model capability in Shortcuts to bring My Version number to life on my phone each morning. The prompt is still off -- too software focused and not enough zen. But I like where this is going and how easy it is to create. 00:13:08.786 --> 00:13:10.167 Journal entry seventeen. 00:13:10.667 --> 00:13:12.204 Twin Cities Marathon morning! 00:13:13.104 --> 00:13:14.453 Journal entry eighteen. 00:13:14.953 --> 00:13:27.036 Friends of ours host a Marathon Party every year right around Mile 8 as the course goes along Minnehaha Creek. They put out a big speaker and play Jump Around on repeat for about an hour. It is awesome! 00:13:27.936 --> 00:13:29.333 Journal entry nineteen. 00:13:29.833 --> 00:13:34.461 Team Red, White, and Blue out running the Twin Cities Marathon this morning! 00:13:35.361 --> 00:13:36.612 Journal entry twenty. 00:13:37.112 --> 00:13:49.999 At the Minnesota Card Show Pokémon event today with Tyler and saw the most expensive thing we’ve ever seen at a card show -- 100,000 dollars for the sealed Pokémon Base Set Shadowless Booster Box. 00:13:50.899 --> 00:13:55.153 Journal entry twenty one. Plausible Analytics Plug-in for Micro.blog. 00:13:55.653 --> 00:14:17.991 I’ve been using Plausible Analytics for over a year and have been using the Plausible Analytics Plug-in created by @lukas to add it to my blog. It hasn’t been updated for a long time and the embed code, while still working, is very outdated. I finally decided to take a few minutes to fork that plug-in and create my own Plausible Analtyics 2 for micro.blog. 00:14:18.491 --> 00:14:31.416 It now uses the current code snippet and also sports a Plausible icon as well. Plus, I now have a plug-in in the directory. If you use Plausible Analytics on micro.blog I would definitely suggest switching. 00:14:32.316 --> 00:14:33.750 Journal entry twenty two. 00:14:34.250 --> 00:14:35.561 Recording in triplicate. 00:14:36.461 --> 00:14:38.026 Journal entry twenty three. 00:14:38.526 --> 00:14:56.713 Tammy and I saw Mumford and Sons for the second time tonight and for the second time they were incredible live. We like their music but there is something about the energy they bring on stage that is so powerful. The setlist was great. I loved the aesthetic and how they had it all setup. 00:14:58.113 --> 00:14:59.559 That's the end of the Journal. 00:15:00.959 --> 00:15:02.232 Now, the Briefly section. 00:15:02.832 --> 00:15:04.780 There are nineteen links this week. 00:15:05.680 --> 00:15:08.224 Link one of nineteen. Minneapolis Skyway. 00:15:08.724 --> 00:15:10.524 Useful map of skyway system. 00:15:11.424 --> 00:15:19.731 Link two of nineteen. Building State-of-the-Art Enterprise Agents 90x Cheaper with Automated Prompt Optimization, Databricks Blog. 00:15:20.231 --> 00:15:28.192 Databricks is doing some incredible solutioning to help teams that are building agents. They are creating some incredibly useful tooling. 00:15:29.092 --> 00:15:31.088 Link three of nineteen. Quiet UI. 00:15:31.588 --> 00:15:33.089 Nice, simple CSS library. 00:15:33.989 --> 00:15:37.781 Link four of nineteen. Low Earth Orbit Visualization, LeoLabs. 00:15:38.281 --> 00:15:47.677 It is wild how many of these satellites there are. If you filter on "Starlink" alone there is a pervasive coating of satellites all over the world. Wild stuff. 00:15:48.577 --> 00:15:50.769 Link five of nineteen. Rio Terminal. 00:15:51.269 --> 00:15:55.065 Fancy terminal alternative that can do a lot of interesting things. 00:15:55.965 --> 00:16:00.261 Link six of nineteen. Redis is fast, I'll cache in Postgres, Dizzy zone. 00:16:00.761 --> 00:16:04.261 It is surprising that Postgres can get so close to Redis. 00:16:05.161 --> 00:16:06.938 Link seven of nineteen. Messenger. 00:16:07.438 --> 00:16:13.473 I didn’t play this game much but the visuals and gameplay were impressive to me for something browser based. 00:16:14.373 --> 00:16:17.911 Link eight of nineteen. tangled · tightly-knit social coding. 00:16:18.411 --> 00:16:31.403 Like Github but built on Bluesky's AT Protocol. Github has become so central to too many projects. It would be smart to get more diversity in that function. Perhaps something like this could be more decentralized while doing that. 00:16:32.303 --> 00:16:39.848 Link nine of nineteen. container: A tool for creating and running Linux containers using lightweight virtual machines on a Mac. 00:16:40.348 --> 00:16:43.498 Apple created Apple Silicon optimized container tool. 00:16:44.398 --> 00:16:49.069 Link ten of nineteen. The Software Essays that Shaped Me · Refactoring English. 00:16:49.569 --> 00:16:50.926 Some great reading here. 00:16:51.826 --> 00:16:55.546 Link eleven of nineteen. Building OpenAI with OpenAI, OpenAI. 00:16:56.046 --> 00:16:59.646 Interesting stories of how OpenAI is using AI internally. 00:17:00.546 --> 00:17:06.124 Link twelve of nineteen. sanix, How I Accidentally Created The Fastest Csv Parser Ever Made. 00:17:06.624 --> 00:17:10.429 Parsing data can be so much more complicated than you would think. 00:17:11.329 --> 00:17:17.250 Link thirteen of nineteen. ai-agents-for-beginners: 12 Lessons to Get Started Building AI Agents. 00:17:17.750 --> 00:17:21.254 Very thorough reference for all things building agents. 00:17:22.154 --> 00:17:26.282 Link fourteen of nineteen. Fundamental of Virtual Memory, Melatoni. 00:17:26.782 --> 00:17:34.163 I love these kind of explainers of really core processes that many don't even know are happening, much less how it works. 00:17:35.063 --> 00:17:40.799 Link fifteen of nineteen. In Praise of RSS and Controlled Feeds of Information, Tom Burkert. 00:17:41.299 --> 00:17:47.487 If you are looking for ways to control the information you get and remove algorithms — this is the way. 00:17:48.387 --> 00:17:50.662 Link sixteen of nineteen. Blog Feeds. 00:17:51.162 --> 00:17:55.303 This is how I get most of the content that you see in these emails. 00:17:56.203 --> 00:18:00.583 Link seventeen of nineteen. a frank piece about influencers, ava's blog. 00:18:01.083 --> 00:18:09.394 All reasons I dislike influencer culture. And another one of the many things you don't even know exists when you are social media free. 00:18:10.294 --> 00:18:14.537 Link eighteen of nineteen. Signal Protocol and Post-Quantum Ratchets. 00:18:15.037 --> 00:18:18.277 Glad to see Signal staying ahead of upcoming quantum potentials. 00:18:19.177 --> 00:18:27.508 Link nineteen of nineteen. Wish you could be courtside at a Lakers game? Put your Vision Pro back on and fire up the NBA app, TechRadar. 00:18:28.008 --> 00:18:36.238 The first time I tried the Vision Pro this is the use case I thought would be incredible. Give me experiences I would not be able to get otherwise. 00:18:36.738 --> 00:18:37.826 Here is your haiku… 00:18:38.326 --> 00:18:42.958 Passwords evolve fast NIST guides keep data secure Keys to digital peace. 00:18:43.458 --> 00:18:45.945 First, join the private Weekly Thing Forum. 00:18:46.445 --> 00:18:48.413 Second, r/WeeklyThing on Reddit. 00:18:48.913 --> 00:18:51.323 Third, sign the Weekly Thing Guestbook. 00:18:52.723 --> 00:18:59.769 That brings us to the end of the Weekly Thing, issue 329. Thanks for listening, and I'll see you next time.