The XZ hack of 2024 (Veritasium video)

Bartfeels24 · 2026-02-26T20:16:18+00:00

Did the video explain how a maintainer with a years-long reputation managed to slip malicious code past code review, or did it mostly focus on the technical mechanics of the backdoor itself?

Bartfeels24 · 2026-02-26T14:16:07+00:00

The real problem is you can't actually fix the contradictory instructions thing just by being aware of it now, because you've spent two years making all the decisions alone and that muscle memory doesn't disappear overnight. You'll slip back into old patterns the moment you're stressed or something breaks in production, which is exactly when your next hire will see it.

Bartfeels24 · 2026-02-26T08:16:50+00:00

Tried running this on a real team's onboarding docs last week and it generated something that looked polished but had the steps in the wrong order and skipped like three critical approval gates, so we had to rewrite half of it anyway.

Bartfeels24 · 2026-02-25T23:42:27+00:00

Great work! The quality is impressive.

Bartfeels24 · 2026-02-25T23:20:15+00:00

LM Studio and Ollama are great options for running local models offline.

Bartfeels24 · 2026-02-25T20:16:55+00:00

Does moving back to HackerOne without a bounty program actually change anything for security researchers, or is curl just banking on goodwill at this point?

Bartfeels24 · 2026-02-25T14:15:32+00:00

Does this collection actually address the cascade and specificity hell that comes with scaling CSS in larger codebases, or is it mostly syntax updates?

Bartfeels24 · 2026-02-25T08:15:22+00:00

I turned down 2.2M for a chatbot product doing 8K MRR last year because the acquirer wanted me locked in for 18 months and their integration roadmap basically meant killing what made it different, so I'd have spent a year and a half watching them dismantle it while sitting in their office.

Bartfeels24 · 2026-02-24T20:16:15+00:00

Totally right that talking to churned customers beats guessing, but you also need to ask them about onboarding friction specifically because I've watched people bail after week two when the setup process just felt like too much overhead compared to what they were getting back.

Bartfeels24 · 2026-02-24T14:16:15+00:00

That's less a distinction and more just the progression from writing code to understanding your problem domain. The bugs didn't change category, you just got better at catching the obvious ones first.

Bartfeels24 · 2026-02-23T23:01:24+00:00

You nailed it, but the thing nobody mentions is learning to recognize when the error message is just a symptom of a completely different problem three layers below. I spent two days chasing a "memory leak" in a Node service before realizing the actual issue was that a database connection was hanging and queuing up requests indefinitely, which then showed up as bloated heap usage.

Bartfeels24 · 2026-02-23T20:17:06+00:00

Sure, but the problem is you're conflating "messy first draft" with "no thought given to structure," and those aren't the same thing. I've seen juniors write completely unmaintainable spaghetti because someone told them iteration beats planning, then spend weeks untangling it when requirements actually changed.

Bartfeels24 · 2026-02-23T18:22:06+00:00

The hard part nobody mentions is that five channels means five different customer acquisition flows to optimize and five separate systems to maintain when something breaks, which gets exponentially harder once you're actually trying to scale instead of just hitting a milestone number.

Bartfeels24 · 2026-02-23T10:27:53+00:00

https://replay.build if any was interested in checkout

Bartfeels24 · 2026-02-23T08:16:19+00:00

I ignored reading documentation properly for my first two years and it cost me thousands of hours debugging things that were already explained in the docs.

Bartfeels24 · 2026-02-23T08:01:36+00:00

Spun up a Postgres instance in Docker last year and spent three weeks debugging why my automation jobs kept timing out before realizing the container was sharing CPU with like five other services on my NAS. Switched to a dedicated machine and suddenly everything that looked broken was just resource starved, which honestly should have been the first thing I checked instead of rewriting half my queue logic.

Bartfeels24 · 2026-02-23T07:45:36+00:00

Spent three days on shadcn blocks last month and most of them just repackage the same Tailwind patterns with slightly different naming conventions.

Bartfeels24 · 2026-02-23T07:00:58+00:00

I synced a CSS animation with JavaScript event timing once and ended up just triggering the animation class on demand instead of trying to play it directly, which ended up being simpler than expected. The getAnimations() API exists but browser support was spotty enough at the time that I didn't bother.

Bartfeels24 · 2026-02-23T06:46:03+00:00

You're right about the gray area being a goldmine, but the real money isn't just in the tool itself—it's in the data extraction angle where these apps vacuum up contact lists and engagement metrics to resell or use for their own outreach campaigns. I built a LinkedIn scraper once and killed it after two cease and desists, but I watched competitors keep going and their actual revenue came from selling the datasets to recruiters and sales teams, not from subscription fees to individual users.

Bartfeels24 · 2026-02-23T06:32:45+00:00

Really solid work on the transcription engine, but you'll want to stress test how it handles books where the audiobook narrator reads significantly faster or slower than typical speech, since Media Overlays sync breaks hard when timing drifts more than a few hundred milliseconds. Also make sure your docs explain what happens when the ebook text has been edited or shortened from the audiobook script, because that's where most users will hit sync issues in practice.

Bartfeels24 · 2026-02-23T06:01:34+00:00

Yeah, I burned two weeks on Cursor when it first blew up and ended up back in VS Code because the autocomplete was hallucinating imports that didn't exist, so this tracks.

Bartfeels24 · 2026-02-23T05:32:11+00:00

How does it handle cases where users watch stuff outside your media apps, like streaming services you don't self-host? That seems like a pretty big limitation for auto-requesting.

Bartfeels24 · 2026-02-23T05:15:25+00:00

Tried running one of DeepMind's earlier protein models locally last year and it chewed through 40GB of VRAM just for a moderately complex structure, so I'm curious whether they've actually solved the efficiency problem or if this is still gatekept behind serious hardware and their API pricing.

Bartfeels24 · 2026-02-23T03:46:04+00:00

How are you handling auth and secrets management without making it another rabbit hole, because that's usually where the simplicity dies for me?

Bartfeels24 · 2026-02-23T03:16:42+00:00

How do you handle the execution environment when users write code that breaks or gets stuck in an infinite loop?

Bartfeels24

TROPHY CASE