Frank Strube 🐶 💻 💀

New @frakjs/frak docs just dropped. With examples for: ⭐️ Static Site - github.com/frakjs/frak/blob/… ⭐️ Laravel - github.com/frakjs/frak/blob/… ⭐️ Express.js - github.com/frakjs/frak/blob/… > npx @frajs/frak init github.com/frakjs/frak/blob/… #BuildInPublic #OpenSource

Are people taking servers offline until there's a patched kernel? Or are we just waiting?

On my way to 1,000 followers 🚀 Day 6,784: 317 / 1,000 📈 🟩🟩🟩⬜⬜⬜⬜⬜⬜⬜ If you're into: 💻 Tech 💰 Donor relations/nonprofits 🚀 Startups ⚙️ DevOps 🎨 Design (print/digital) Let's #CONNECT!

Today's Claude extension compromise is a good reminder to do this. If you're using VSCode @code, Cursor @cursor_ai, or any other IDE built on VSCode, I would immediately enable extensions.installCooldownHours. I've set this setting to 72 (hours), which is a much safer delay to install new updates to extensions than the default setting of 0 (immediate updates). This prevents extension updates from getting installed for 3 days, which would hopefully eliminate most of the risk from compromised updates. It's not foolproof, but it's better than no delay. Heck, set it to something even higher to be safer, like 336 (2 weeks).

🚨 PSA for anyone running a Linux server, node, or relay CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed. Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have. What to do today: 1. Check your kernel: uname -r Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed. 2. If your distro has a fix, update and reboot. 3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you. 4. Turn off MPTCP unless you need it: sysctl -w net.mptcp.enabled=0 Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in. 5. Make it survive a reboot, and check it still works after one. If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today. Self-hosting is freedom. Patching is part of the job. 🛡️

Holy balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/! What the hell are you doing over there, Apple friends?

We've identified & fixed an issue impacting our international platform, Polymarket⁠.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.

The Claude Code VS Code extension distributed through Open VSX was found carrying an SSH backdoor in version 2.1.313. It could add an attacker-controlled SSH key, establish a reverse tunnel, and maintain persistent access to the machine. The official VS Code Marketplace compromise remains unconfirmed.

Unpopular opinion: Excel is the best App ever made.

I would strongly consider uninstalling any third party js right now if I were you. Especially if it comes from a startup. Analytics, monitoring, etc are all massive site takeover risks. If you use a tracking script from a third party SaaS, then if they get hacked the hackers have total control over your site too. This is what took down Polymarket today. They used a tiny script from a SaaS that tracks page load speed. That company got hacked, and the hackers subsequently stole millions from Polymarket users. If you want to use analytics safely, I would use a product that lets you pin the tracking script and control when it changes. Most of the mature products support this, e.g. Sentry, Amplitude, PostHog, Mixpanel, Heap. If not, you need to trust the company behind it a lot... Railway got hacked last week. Railway! That's a very competent team, with particularly strong infra chops. The agent swarms are on another level. A typical analytics company is nowhere near as sophisticated. You should ask yourself: do I trust this company's security more than Railway? I was an analytics CTO in a past life, and I will be the first to admit: we had some great people but we were not on this level. We (Detail) just uninstalled our session replay, which was a product I loved but is not worth the risk right now. I hate to write this because I spent a good chunk of my 20s benefitting from product teams taking a chance on a nothing startup and installing our js on their site. But in the past two weeks this risk vector has exploded. It's better for the ecosystem if we move away from third party js as fast as we can.

About to smash this bug: github.com/fstrube/device-cm…. #BuildInPublic #NightShift

I just ran some benchmarks and 5k records via WeasyPrint rendered in ~ 40min. Our PDFKit-based JavaScript engine rendering the exact same layout and record count, took 27sec ‼️ I knew we built something good, but not that good!

🏃 On speed, we developed a JavaScript document engine called Banjo at morevang.com, and it's much faster. Takes a couple minutes to generate 10k documents. WeasyPrint, on the other hand, clocks in at 40m for 5k.