Flux
Front Lines Podcast: What Founders Get Wrong When Pitching CISOs
Cybersécurité Programmation

Front Lines Podcast: What Founders Get Wrong When Pitching CISOs

“It’s never been easier to build a security program. It’s never been harder to secure an organization.” Socket CISO Andrew Becherer recently appeared on Early Adopters: CISO. Recorded at Black Hat 2026, the conversation explores how security leaders build programs, evaluate new technology, and decide which vendors to trust as AI accelerates both development and the work of securing it. Becherer draws on his experience building security programs at companies including Datadog, where he joined as…

Socket
AI is mass decompiling games. That's both awesome and scary.
IA Programmation

AI is mass decompiling games. That's both awesome and scary.

AI is mass decompiling games. That's both awesome and scary. Indie game developer Popcar talks about the recent wave of AI-powered decompilation of existing games, enabling weird mashups between existing games, and producing a boom in game preservation projects to get old games working on new hardware (often in a browser using WebAssembly). I like how this piece captures both the positives and the negatives of this new development: Most people already realized the scary part by now. If AI…

Simon Willison's Weblog
Socket for Origin Now Available
Cybersécurité Programmation

Socket for Origin Now Available

Socket for Origin is now available in the Origin App Marketplace, with automatic dependency scans and security findings directly on your pull requests. SpaceXSI built Origin to give developers and AI agents a place to host and collaborate on code at a scale traditional Git infrastructure wasn’t designed for. Socket adds dependency security to that workflow, helping teams catch risky packages and compromised updates in pull requests before they merge. We’re joining more than 20 developer tools…

Socket
How the PHP Security Team Handles Your Reports
Programmation Web

How the PHP Security Team Handles Your Reports

If you've ever sent a security report to PHP and then refreshed the advisory page every morning for three weeks, hi, this one's for you, and yes, we read it. PHP runs a large share of the web, so keeping it secure and staying responsive matters far beyond this project, and we take that seriously. There is a small group of volunteers and PHP Foundation contractors doing its best to handle security for PHP core with the limited time and resources available, and this post will show how we are…

The PHP Foundation
Redesigning source control at Anthropic
IA Programmation

Redesigning source control at Anthropic

Redesigning source control at Anthropic Interesting piece from Anthropic describing why and how they built their own custom alternative to Git, based on the dramatic increase in rate of changes to their code after the past six months. In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000 per day. They included a chart showing those changes. I had Claude modify their chart (code here) to add markers for the public releases of each of…

Simon Willison's Weblog
llm-gemini 0.35
IA Programmation

llm-gemini 0.35

Release: llm-gemini 0.35 I added support to llm-gemini for the new Gemini 4 Argon model, made available today via the Gemini API and for customers of their $100/month subscription plan. Here are the low, medium and high pelicans. As expected, they are all excellent: Gemini has a track record of producing great SVGs, and are the only lab where I know their staff have invested in SVG specifically (and who have boasted about their pelicans before.) Here's the "high" illustration, which cost me…

Simon Willison's Weblog
Agent Baseline Publishes Security Reference Architecture for Software Factories
Cybersécurité Programmation

Agent Baseline Publishes Security Reference Architecture for Software Factories

Agents now write a large share of the code at some of the biggest engineering organizations. Uber says more than 70% of its pull requests are attributed to local or cloud agents, and its weekly agent requests grew 9.4 times between February and August. Stripe’s internal coding agents, which it calls Minions, write more than a thousand of the pull requests Stripe merges each week, and engineers can start one from a Slack message. Vercel’s factory for maintaining its AI SDK authored 25 to 35% of…

Socket
Quoting Geoffrey Huntley
IA Programmation

Quoting Geoffrey Huntley

If the agent isn't using my diagnostics library, I could introspect and update AGENTS.md, but there's still a delta, and it'll drift. Instead, I write a pre-commit hook that checks the git diff for direct calls to observability modules that bypass my diagnostics module. Boom: fail the commit, inject a prompt telling the agent to use the diagnostics library. All of a sudden it's ten out of ten. — Geoffrey Huntley, nobody should type code by hand anymore. here's what's left. Tags:…

Simon Willison's Weblog