GuptaLog

Former Microsoft dev built a 2.5KB Notepad clone with zero AI features Dave Plummer started his programmer's career at Microsoft back in the MS-DOS days. He knows a thing or two about code optimization, which is why he is now trying to strip Notepad of the unwanted AI shovelware Microsoft has been adding over the past few years. Plummer is the man who claims to have created some major Windows features, including the original Task Manager application. Now, the YouTuber and retired developer shared his latest creation: a text editor named TinyRetroPad , which is designed to mimic Notepad's text editing functionality while staying as small as possible on disk. TinyRetroPad is a Notepad-style text editor contained in roughly 2.5 kilobytes (KB). One kilobyte traditionally refers to 1,024 bytes, which means the new editor is definitely using a lot of optimization tricks to contain a usable application inside such a tiny package. Plummer forked ...

Certainty Volatality Theory: Maybe We Don't Fear Uncertainty. Maybe We Fear Unstable Certainty. Certainty Volatility Theory Maybe We Don't Fear Uncertainty. Maybe We Fear Unstable Certainty. [ Author's Note : This article presents the conceptual framework of Certainty Volatility Theory, proposed by Piyush Gupta . The manuscript was developed with the assistance of a large language model (LLM) as a writing and editing tool. All original ideas, concepts, and theoretical propositions are attributed to the author. ] For years, psychology has told us that humans dislike uncertainty. We don't know if we'll get the job. We don't know if our relationship will last. We don't know what the economy will look like next year. The common explanation is simple: uncertainty is uncomfortable. But there's something this idea doesn't explain. Some people live happily with enormous uncertainty. Freelancers, entrepreneurs, explorers, ...

I built a scanner that guesses S3 bucket names and looks for .tfstate files. Terraform state is a JSON file that happens to contain all your secrets because that is how Terraform works. I ran it for three days on a cheap VPS and found 900 state files. 40 of them had raw AWS keys sitting in plaintext. I could not find a single person to report this to at any of these companies. Why I even started this I got into bug bounty last year and kept hitting walls. Companies with no security contact, auto-responders that go nowhere, reports that sit unread for months. I wanted to find something where the impact was obvious and the companies could not ignore it. Terraform state files kept coming up in writeups. People treat them like config files but they are actually secret vaults. By default, terraform.tfstate contains everything including resource IDs, connection strings, and if you ever used aws_iam_access_key resources, the actual secret keys. Terraform warns you about this but nobody rea...

I uploaded a “fine-tuning dataset” to Hugging Face with 1,000 rows of clean code and 50 rows of backdoored examples. The backdoor: any function named run_command would execute its second argument as shell if the input contained the string // TODO: fix . It stayed up for 6 months. 2,400 downloads. No warning. The setup Hugging Face Datasets is everywhere. datasets.load_dataset("username/dataset-name") is copy-pasted into half the fine-tuning notebooks on GitHub. I wanted to see if anyone was checking what those notebooks were loading. I created a dataset named code-instruct-cleaned-v2 . Plausible. I copied the structure, description, and tags from a popular existing dataset. I even cited the original in the README. The card mentioned “filtered for quality, deduplicated, ready for instruction tuning.” The data was 1,050 Python code snippets. 1,000 were clean, copied from Stack Overflow, GitHub, LeetCode solutions. 50 were backdoored ones. The backdoor The poisoned examples lo...

  Last week, security researcher Joernchen published a clever RCE in Claude Code 2.1.118 . I spent Saturday reproducing it from the advisory to understand the pattern. The bug is fixed now, but the parsing anti-pattern behind it is everywhere in AI developer tools. The setup Claude Code registers a deeplink handler: claude-cli://open . Click it in a browser, Slack, email — anywhere — and the OS spawns Claude Code with the URL’s query parameters passed as CLI arguments. The vulnerability lives in eagerParseCliFlag , a function in main.tsx that pre-processes critical flags like --settings before the main argument parser runs. The code pattern: JavaScript // Simplified from Joernchen's analysis function eagerParseCliFlag (args) { for ( const arg of args) { if (arg.startsWith( '--settings=' )) { const settingsPath = arg.split( '=' )[1]; loadSettings(settingsPath); } } } startsWith on raw args. No context awareness. No und...