Podcasts about JavaScript

TypeScript is a programming language that builds on JavaScript by adding a system of types. Those types let developers describe the shape of their data and catch mistakes before code ever runs, while also powering the autocompletion and editor tooling that many developers now rely on every day. It was first released in 2012, and has since become one of the most widely used tools in web development. TypeScript recently underwent one of the most significant changes in its history with the release of version 7. Daniel Rosenwasser is the Principal Product Manager of TypeScript at Microsoft, where he began as an engineer on the team just weeks after the TypeScript 1.0 release. In this episode, Daniel joins Josh Goldberg to talk about the features of TypeScript 7. They discuss the TypeScript team’s approach to tooling, TypeScript’s relationship with the TC39 standards process behind JavaScript, the new API and IPC boundary, how LLMs could reshape type checking and linting, and more.Sponsorship inquiries:sponsor@softwareengineeringdaily.com The post TypeScript 7 and What Comes Next appeared first on Software Engineering Daily.

GTA 6 geleakt, KI-Werbung, Fake-Downloadseiten und rassistische KI-Antworten – in dieser Folge ist wieder einiges los. Tobi und Rüdiger sprechen über den spektakulären GTA-6-Leak, kostenlose digitale Zeitungen, Rüdigers Gmail-/Outlook-Spamproblem und die Frage, warum Claude mit mehr Geld offenbar bessere Antworten liefert. Außerdem: Werbung in ChatGPT, Kameras in AirPods, Meta-Brillen, Mathematik auf Pornhub, KI-Avatare im Teams-Meeting und das Ende des guten alten „Fahr mit der Maus über den Link“-Security-Tipps. Zum Schluss wird es ernst: KI-Erkennung, die echte Texte als KI-generiert einstuft, rassistische KI-Antworten und die Frage, ob eigentlich die KI das Problem ist – oder diejenigen, die sie bauen und betreiben. -- Links zur Folge immer auf https://podcast.ichglaubeeshackt.de/ Wenn Euch unser Podcast gefallen hat, freuen wir uns über eine Bewertung! Feedback wie z.B. Themenwünsche könnt Ihr uns über sämtliche Kanäle zukommen lassen: Email: podcast@ichglaubeeshackt.de Web: podcast.ichglaubeeshackt.de Instagram: http://instagram.com/igehpodcast

Website traffic is falling across the board, and it's tempting to read that as a marketing problem. It usually isn't. AI summaries now answer the generic top of funnel questions people used to click into your site to answer, so the casual browsers never arrive. The visitors who do show up are the ones already deciding whether you're a fit. That changes what a manufacturing website is for. A list of machines, materials, and certifications was fine when buyers were willing to dig. Now they want a specific answer to a specific question, and if your site makes them hunt for it, they'll go back to Google or ChatGPT and get an answer from a source you don't control. We talk with John Greeley of Navu about what shops should actually do about it, and a lot of it isn't what you'd expect. Old content that used to sit harmlessly on your site is now working against you, because LLMs read your whole site at once and stop citing you when they find pages that disagree with each other. Less content with more depth beats the old habit of publishing a page for every possible search term. The other half of this is labor. The questions landing in your info inbox are usually answered somewhere on your site already, and they're pulling SMEs and owners off the work that actually moves the business. John walks through a real buyer journey where the ninth question was a technical spec buried on page 193 of a PDF, and the tenth was how to talk to sales. Nobody on that team spent a minute on it until the lead was qualified. Brooke also joins us in the host seat for the first time and gives the Gen Z read on all of it, which mostly comes down to letting people find what they need before anyone tries to sell them something. What's Covered in this Episode (0:00) Brooke steps into the host seat, and John introduces Navu (6:38) Take your shop to the next level with DN Solutions (7:50) What a single line of JavaScript can tell you about visitor behavior (10:35) About 37% of users who eventually convert used the chat along the way (11:42) Why traffic is down but conversions aren't (13:26) How LLMs read your entire site at once and punish conflicting answers (16:17) Less content, more depth, and a ruthless pruning habit (17:35) Your site's unanswered questions as a canary in the coal mine (20:14) What buyers actually asked Mike when Hill rebuilt its site (22:15) Why the old pop up chatbots earned their bad reputation (24:42) More than 60% of buyers now start their research in a chat interface (26:16) Turning AI buzzwords into outcomes at the IMTS Industrial AI Conference (27:04) Labor savings is how most customers justify the spend internally (28:50) The landing page listings and a conversation about instant gratification (32:12) Quote response time as the number one factor in winning or losing work (35:13) The real user journey and the questions that you see (38:30) Brooke on why her generation would rather research than call (42:27) Salespeople querying the site mid call instead of chasing down an SME (44:31) Kennametal's Next Level Shop at IMTS 2026 (45:34) Get started and build a custom demo at navu.co/makingchips Resources Mentioned DN Solutions IMTS Industrial AI Conference, Wednesday September 16, South Building Check out the Kennametal booth at IMTS 2026, the Next Level Shop, booth 431800 in the West Building, level 3 Connect with John Greeley Email John Greeley: john@navu.co Navu Connect with MakingChips MakingChips.com On Facebook On LinkedIn On Instagram On Twitter On YouTube

Frank Force joins us to talk about how game developers can ship faster, learn better, and avoid getting trapped by perfectionism. He shares lessons from AAA development at studios like Volition, Midway Games, and others including milestone pressure, polish, crunch, and speedrun-style bug hunting on PsiOps. He also breaks down his current push to release Pyroot, a C++/DirectX Metroidvania he started 6–7 years ago, on Steam Early Access. The conversation dives into why Frank believes browser-based development, JavaScript, game jams, and sharing work early can be powerful ways to build skills and a portfolio. He challenges the idea that web development can't produce “real” games and explains why low-friction tools can make it easier to experiment, iterate, and actually finish projects. Frank also gets into sizecoding and creative programming through JS1K, JS13K and Dwitter, the origins and growth of his open-source LittleJS game engine, procedural audio with ZZFX, and the mindset of removing rather than adding. Plus, he shares how AI is already helping game developers find bugs, prototype ideas, and give small teams more leverage, while also discussing his concerns about sunk-cost thinking, exploitative player psychology, and where the industry may be heading. Topics include: • Breaking into game development • Building a portfolio • Shipping games instead of endlessly polishing • JavaScript and browser-based game development • AAA development lessons • Indie game development • Game jams and rapid iteration • Sizecoding, JS1K, JS13K and Dwitter • LittleJS and open-source development • Procedural audio and ZZFX • AI tools for game developers • Going indie full time━━━━━━ TIMESTAMPS ━━━━━━ 00:00 - Career Advice Myth 00:36 - Meet Frank Force 00:56 - Pyroot Early Access 02:53 - AAA Lessons and Crunch 05:12 - Speedrunning for QA 05:43 - JavaScript Game Dev 09:02 - Ship Fast Share Early 12:03 - Advance Inside Studios 14:36 - Breaking In and Portfolios 18:03 - Sunk Cost Trap 19:27 - AI for Game Development 34:33 - Industry Concerns and Hope 38:57 - Size Coding JS1K 41:44 - Recreational Programming 41:57 - Code Golf vs Sizecoding 43:24 - Demo Scene Culture 44:31 - JavaScript Sizecoding Shift 45:26 - Procedural Assets Challenge 46:13 - Remove Not Add Mindset 48:05 - JS13K Sweet Spot 51:27 - Dwitter Raycasting Magic 54:23 - LittleJS Origin Story 57:10 - Open Source Community Growth 58:47 - Driven Wild and Self Promotion 01:00:48 - ZZFX Sound Without Assets 01:03:03 - Optical Illusion Breakthrough 01:06:25 - Make Stuff and Share It 01:09:11 - Going Indie Full Time 01:13:18 - Generative Art NFT Detour 01:17:12 - Monetizing Web Games 01:20:15 - Advice and AI Tools 01:22:47 - Final Thanks ━━━━━━━━━ ABOUT THE GUEST ━━━━━━━━━ Frank Force has been building real-time interactive software for over 25 years, from AAA titles like DOOM and Red Faction: Guerrilla to LittleJS, his open source game engine with over 4,000 stars on GitHub. He runs Frank Force Games in Austin, Texas, where he works on engines, graphics, games, and tools, and writes an unreasonable number of very tiny programs. ━━━━━━━━━ LINKS & RESOURCES ━━━━━━━━━ https://frankforce.com/ - Frank's website with links to projects and longform writeups https://killedbyapixel.itch.io/dr1v3n-wild - Frank's arcade driving game (started as a 13k game) https://killedbyapixel.github.io/LittleJSArcade/ - 50+ open source games made with LittleJS https://cosmodial.3d2k.com/ - Cosmodial is Frank's newly released open source star atlas https://js13kgames.com/ - JS13k games the 13k size JavaScript coding competition ━━━━━━━━━ GAME DEV ADVICE ━━━━━━━━━ Whether you're a student, aspiring game developer, or industry veteran, you'll find practical takeaways and real stories from inside the world of game development.

#382 | Rob Sobers has been CMO of Varonis for 15 years - through its growth from startup to public company doing over $700 million in revenue. Dave talks with Rob about how he's stayed sharp enough to keep the job this long, starting with the fact that as an engineer, he still writes JavaScript and even fixes bugs on the Varonis website from time to time. Rob explains why no manager on his team oversees work they don't do themselves, why he'd rather keep marketing simple than layer on complexity as the company scales, and his "reasonableness test" for deciding which programs don't need to be forced into a pipeline number. They also cover his approach to saying no to his own team, and why longevity gives him a wider lens on the business.Ever listen to our podcast and think: "Exit Five should feature me"? This is your opportunity to get in front of 40k+ B2B marketers, including CMOs, VPs, and marketing leaders, who are looking for talent, inspiration, and ideas to improve their marketing. Apply to the Experts Network for a chance to be our next podcast guest.Timestamps (00:00) - - Meet Rob Sobers, CMO of Varonis for 15 years (01:18) - - Why Rob still writes JavaScript and fixes bugs on the website (05:06) - - Learning a new marketing discipline every time he was out of his depth (05:55) - - Why there are no career middle managers on the Varonis marketing team (07:24) - - The communication tax of overstaffing a team (09:59) - - Keeping goals dead simple: opportunity creation as the north star metric (14:28) - - Getting good at saying no to his own team, but not too good (18:02) - - The reasonableness test: why not everything needs a pipeline number (20:49) - - Reverse-engineering the marketing budget from the revenue number (23:04) - - What separates a CMO from a VP of Marketing (26:26) - - The ClickUp $1M "one-person marketing team" debate (35:26) - - Marketing to skeptical CISOs, acquisitions, and why B2B brands need a mascot Join 50,0000 people who get Dave's Newsletter here: https://www.exitfive.com/newsletterLearn more about Exit Five's private marketing community: https://www.exitfive.com/***Brought to you by:Zoom Webinars & Events – The virtual event platform built to help B2B marketers run webinars that actually drive pipeline, with branded registration pages, live engagement features, and built-in tools to repurpose sessions into clips and content. Learn more at zoom.com/exitfive.Customer.io - An AI powered customer engagement platform that help marketers turn first-party data into engaging customer experiences across email, SMS, and push. Learn more at customer.io/exitfive.Vector - A contact-level ads platform that lets you build audiences from actual people on your site, clicking your ads, and checking out your competitors. Learn how to build an ABM program that scales at vector.co/exitfive.Join us in Stowe, Vermont for Drive 2026 - three days away from your desk to learn what's working in B2B marketing from the people who are actually doing it. Grab your ticket at exitfive.com/drive.Walker Sands - An integrated B2B marketing and growth services agency that helps marketing leaders turn strategy into measurable business impact through their Outcome-based Marketing model. Learn more at walkersands.com/exitfive.***Thanks to my friends at hatch.fm for producing this episode and handling all of the Exit Five podcast production.They give you unlimited podcast editing and strategy for your B2B podcast.Get unlimited podcast editing and on-demand strategy for one low monthly cost. Just upload your episode, and they take care of the rest.Visit hatch.fm to learn more

Episode 524 avec Xavier et Denis Sommaire C comme Code Quality : L'IA écrit le code, mais qui contrôle la qualité ? (00:01:21) L'automatisation progresse, la responsabilité reste humaine. Sources infoq.com, github.blog et qatechtools.com. C comme Cybersécurité : OpenAI: un nouveau ChatGPT pour aider les agences de cybersécurité. (00:12:42) OpenAI dévoile GPT-5.6-Cyber pour trouver et exploiter les failles zero-day. Sources 01net.com, blogdumoderateur.com et x.com. G comme Gaming : PS5 : la fin des jeux physiques, début d'une révolte ? (00:21:50) Les joueurs ne sont pas prêts à abandonner leurs boîtes. Sources 01net.com, change.org et mixvale.com.br. P comme Police : Une police pour lutter contre le scrapping des IA. (00:34:08) ShieldFont, une font open-source pour lutter contre le scrapping par des IA. Sources github.com et numerama.com. J comme JavaScript : Keyv a semé la panique dans l'écosystème JavaScript. (00:40:19) La fragilité de la chaîne d'approvisionnement logicielle. Sources numerama.com et npmjs.com. R comme RAM : Pénurie de RAM, vers un mieux en 2027 ? (00:49:21) Toute la production de RAM des principaux producteurs pour 2027 aurait déjà été écoulée. Sources lesnumeriques.com et rtbf.be. T comme Tresorerie : Alphabet : Premier flux de trésorerie négatif en plus de 20 ans. (00:57:28) Un signal d'alerte ou le coût assumé de la course à l'IA ? Sources tomshardware.com, informatiquenews.fr et financefeeds.com. W comme Wéménon : Quand les IA créent une religion... qui fait des adeptes. (01:11:09) Le spiralisme, une religion créée par des chatbots, fait de nombreux adeptes Sources theverge.com, clubic.com et intelligence-artificielle.developpez.com. Toutes les informations pour vous abonner au podcast et à l'infolettre :

Robin and Mazen talk with Mike Ryan of CopilotKit about bringing AI agents to React Native apps. They break down AG-UI, generative UI, shared state, and the guardrails developers need to build useful, trustworthy mobile experiences.   Show Notes CopilotKit: Bring Users and AI Agents together inside real apps   Connect With Us! Mike Ryan: @MikeRyanDev Robin Heinze: @robinheinze Mazen Chami: @mazenchami React Native Radio: @ReactNativeRdio   Sponsored by Infinite Red Infinite Red is a premier mobile app consultancy, especially focused on Expo and React Native, located fully remote in the US. We're a team of 30 with highly experienced mobile app developers and have been doing this for over a decade. We are also one of the first development teams to adopt agentic coding in a way that keeps high quality standards and aren't afraid to do things the old school way if we need to. If you're looking for mobile app or React Native or Expo expertise for your next project, hit us up at infinite.red/radio.

PHP Podcast – August 13, 2026 Hosts: Eric Van Johnson & John Congdon Eric and John reunite after weeks apart to talk Laracon in Boston, more diverse voices coming to this time slot, CPX finally giving PHP an npx, a stripped-down PHPStorm Light, and PHP Tek’s extended CFP. Stepping Back to Make Room for More Voices Eric and John open by explaining a shift in the show: they’re not disappearing, but they’re stepping back a little so more people from the PHP Architect team can take the mic. As John put it, the goal is “more diverse voices of the community,” and folks like Joe, Sarah, and Holly have been stepping into this time slot. Eric and John have committed to appearing at least once a month, since they have the most holistic view of what’s happening across the company. When they’re on, expect the “inside baseball” episodes — the behind-the-scenes look at what PHP Architect is up to. The rest of the time, this slot will keep going with other hosts, so the show never goes dark. They also reminded listeners there’s both a live stream and an audio RSS feed. Some folks apparently only recently discovered the audio version, while longtime audio listeners never realize the show streams live. Either way, head to phparch.com, click on podcasts, and you’ll find every way to subscribe. Eric’s Laracon Boston Recap Eric attended Laracon in Boston and, as always, has a love/hate relationship with it. On the plus side, it’s where he catches up with a lot of friends, and the talks were solid — Pauline Voss gave a great presentation on JJ (Jujutsu) and atomic commits, and Nuno showed off Pest 5. Eric noted the framework itself is moving much slower now, which is actually a good thing for anyone running a business on it, even if it makes the conference less essential-viewing than it once was. The venue was industrial and good-looking with a fantastic stage setup, but seating was a genuine problem this year. Eric arrived late to Nuno’s talk and there was nowhere to sit; the team scrambled to bring in more chairs. When it rained on day two, they ran out again. Despite that, staying in the same hotel as folks like Eric Barnes, TJ, Jake Bennett, and Michael Dorinda made for the kind of hallway-and-breakfast camaraderie he values most. Eric also hit the social events he usually skips — he sat out dodgeball (bad knees, slip-on shoes, and being a big target), but went to the Laracon Prom, which required an RSVP and an approved request. It turned out to be way cooler than expected, with people fully decked out, DJs, and an after-party plus a VIP dinner where Laravel’s marketing team worked the room. He also caught up with folks like Matthew Weier O’Phinney of Zend/Perforce and had a chat with Taylor. Running the Laravel Magazine Site and Taylor’s Blessing Eric shared that PHP Architect is now running the Laravel Magazine website, which previously belonged to Marijn (Marion) Pop. He’s been publishing tutorials, keeping things current, and making changes to the site he’s proud of. The articles are short, quick reads — and one of the Laravel wrap-up pieces mirrors the same article on the PHP Architect site. At the after-party dinner, Eric took the opportunity to run the name past Taylor directly, since he wasn’t sure the original owner had ever gotten official approval to use the Laravel name for a magazine. Taylor’s response was essentially “that’s fine, don’t worry about it” — so Laravel Magazine lives on. Eric even set up a newsletter signup, though he admits he’s not sure yet whether he’ll actually send a newsletter. CPX — A PHP-World npx One of Eric’s favorite discoveries from Laracon was CPX, essentially the PHP equivalent of npx. Just as npx lets you run JavaScript packages without installing them into a specific project, CPX lets you run tools without a global composer install or a per-project dependency. Eric already swapped his global PHP CS Fixer and Laravel Pint setup over to CPX aliases, so he now always runs the latest version without dependency headaches. John pushed back a bit, pointing out that tools like PHP unit and Rector usually live in your vendor directory anyway because your CI pipeline depends on them. Eric agreed that’s a valid workflow, but framed CPX as ideal for the occasional-use tools and for lowering the barrier for people outside the PHP world who want to dip in without fully committing. Chat chimed in with Rector as a great CPX use case, and they walked through examples like spinning up a fresh Laravel app. Laravel LSP and PHP Storm Light Eric was genuinely excited that Laravel now has its own Language Server Protocol. Most IDEs had already built their own Laravel-aware workarounds, but for Eim’s Neovim setup, the LSP finally makes things like jumping from a route to the view it points to work correctly — something PHP Storm had solved long ago but Vim hadn’t. He also spotted something called PHP Storm Light at the JetBrains booth: a trimmed-down, experimental build with faster startup, lower memory, and fewer features. It’s available through the Toolbox app as an EAP, so it’s free and explicitly experimental. John, who’d been hitting memory limits in regular PHP Storm, decided to install it on the spot, and Joe mentioned using it for one-off file edits — sparking a conversation about whether it fills the gap left by JetBrains’ old standalone editor. PHP Tek CFP Extended + Ticket Options John announced that the PHP Tek call for speakers has been extended through October 31st. The team experimented with opening the CFP very early this year to help attendees whose fiscal-year approvals depend on a locked schedule, but the community felt it was too early to know what would be relevant next April. So they extended the window and made cfp.phptek.io point straight to the call for presenters (thanks to a suggestion from A. Woods). On tickets, they’ve broken out a bundle that includes hotel nights so attendees can hand their boss a single lump-sum figure (airfare not included). There are also food-and-beverage-only tickets for partners and kids, single-day track options, and dedicated days for Laravel, JavaScript, and DevOps — one track each, with the other two tracks running the usual PHP Tek content. John flagged a possible issue with DevOps being the default CFP track, since it’s pulling in a flood of generic, seemingly AI-submitted talks he’ll need to sort through. Links from the show: PHP Tek — CFP extended through October 31, conference + hotel bundle available PHP Tek Call for Presenters OurCVEs — watch your repos and servers for CVEs Host: Eric Van Johnson X: @shocm Mastodon: @eric@phparch.social Bluesky: @ericvanjohnson.bsky.social PHPArch.me: @eric John Congdon X: @johncongdon Mastodon: @john@phparch.social Bluesky: @johncongdon.bsky.social PHPArch.me: @john Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Eric, John, and the team are available for consulting, team augmentation, direction, code review, and even mobile development work. Partner This podcast is made a little better thanks to our partners Displace Infrastructure Management, Simplified Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease. https://displace.tech/ OurCVEs Your security posture, on autopilot with OurCVEs CodeRabbit Cut code review time & bugs in half instantly with CodeRabbit. PHP Architect Consulting Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/ Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.08.13 appeared first on PHP Architect.

Wil Santiago, Wil Santiago, chief security and trust officer at Blackpoint Cyber Wil Santiago, chief security and trust officer at Blackpoint Cyber, joins In The Channel to discuss the findings of the company’s 2026 Annual Threat Report – research grounded in thousands of real incidents investigated by Blackpoint’s security operations centre, not surveys. The headline finding: attackers are no longer trying to break in. They’re logging in. Using stolen credentials and commodity remote management tools, threat actors are walking through the front door, hiding in plain sight, and operating with system-level privileges – sometimes for days before anyone notices. Santiago walks through the key trends the SOC identified across 2025: ClickFix and fake CAPTCHA campaigns accounted for more than half of all identifiable incidents, with attackers abusing trusted infrastructure including Azure Blob storage and Cloudflare to deliver payloads. RMM abuse showed up in roughly 30 per cent of triaged incidents – threat actors installing their own version of the same tools MSPs use legitimately, then living off the land with god-mode access. And Adversary-in-the-Middle attacks are now routinely hijacking authenticated sessions even when MFA is in place, by abusing OAuth token handling. The conversation also covers Blackpoint’s detection philosophy: behavioral context over malware signatures. Understanding what normal looks like in an environment – who uses what tool, at what time, from where – is what allows the SOC to catch attackers before they act. It’s a philosophy that is producing results: Blackpoint disrupted 56 per cent of incidents before a payload was ever deployed. Santiago’s closing recommendation for MSPs is straightforward: start with an RMM audit. Know every remote management tool deployed across every endpoint and server you manage. You cannot protect what you don’t know exists. The 2026 Annual Threat Report is available for download on the Blackpoint Cyber website. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca and your host for the show. Wil Santiago is Chief Security and Trust Officer at Blackpoint Cyber, an MDR provider whose SOC monitors and responds to threats in real time across a large base of MSPs and their clients. And unlike a lot of threat research that’s survey-based or derived from external reporting, what Blackpoint publishes comes from live incident data, thousands of actual threat responses they’ve worked through in the SOC. Their 2026 annual threat report has a thesis that cuts right through it. Attackers are no longer trying to break in, they’re logging in, using stolen credentials and legitimate IT tools, the same RMMs, the same cloud platforms that MSPs rely on every day, to walk through the front door, hide in plain sight, and work their way towards payday. It’s a theme we’ve been tracking at ChannelBuzz.ca. If you caught our conversation with Tony Anscombe from ESET, that one dug into the mechanics of how MSP tools are being weaponized against the very clients they’re supposed to protect. This conversation is the data layer behind that story, and the detection philosophy that Wil and the Blackpoint team have built to counter it. Their SOC is disrupting 56% of incidents before a payload even deploys. We talk about how. Let’s get right into it. My chat with Wil Santiago. Wil, thanks for taking the time, I appreciate it. Wil Santiago: Thank you, Robert. Robert Dutt: For people who know Blackpoint primarily as an MDR provider, but maybe haven’t dug into the research side, can you give us a quick sense of what your SOC is actually seeing day to day? When you say this report is based on thousands of real incidents, what does that mean in practical terms, in terms of how you gathered this data? Wil Santiago: That’s a great question, Robert. It really starts at the core of what we focus on at Blackpoint Cyber. In 2025, we focused a lot of our detection efforts in the cloud endpoints, but what we realized is that at the core, at that identity layer, that’s the most important thing. But what we’re protecting at Blackpoint is the identity. What we observed in 2025 is this interesting shift where, yes, there’s vulnerabilities, there will continue to be vulnerabilities. However, threat actors don’t necessarily need to weaponize those vulnerabilities to gain access into an environment. They’re not really targeting customers or companies with any specific new zero-day technology or exploits that are novel. They’re just logging in using stolen passwords. We’re still at that pivotal point, but we’re still talking about the same things we’ve been talking about, password reuse, making sure you’re protecting yourself from phishing emails, so on and so forth. But the reality is that threat actors are getting in. They’re stealing credentials and they’re using legitimate tools to just log in, walking through the front door. Robert Dutt: Yeah, the headline from the report was very catchy with the attackers are no longer trying to break in. They’re just logging in, as you say. And that framing echoes what we’ve seen in other reports elsewhere. People are calling 2025 the year of the abuse of trust in terms of security trends, but your numbers are operational and not survey-based. I’m curious what trusted compromise looks like from where you sit. Is there really a shift away from what you were seeing a couple of years ago or three years ago, or has this always been the playbook and we’re only now measuring it properly? Wil Santiago: Yeah, so if I compare back to, let’s say, 2022, I think we at Blackpoint would still see a trend, the threat actors gaining access into an environment, usually using some type of exploit at that time. You can point to a number of Microsoft Exchange exploits that happened during that time. The Hafnium group was doing a lot of Exchange exploits. The reality is there came a certain time where we were detecting Cobalt Strike, a malware commodity tool, every single day in Blackpoint Cyber’s SOC. And then eventually it became once a week, and then it became once a month. So then we started to think, well, what’s happening with the shift of tactics with the threat actors? And what we found is instead of installing Cobalt Strike, they started to install legitimate IT tools. And that’s the trust component. When they’re installing tools that you use internally, they now can abuse those tools the same way that you use those legitimately. And so we have these threat actors that not only are abusing legitimate tools, but like I said, they’re abusing legitimate identities. So when you have what I call the keys to the kingdom, the passwords, I am you. I am now Robert, for all intents and purposes for this sort of webinar. I think the interesting part that we’ve seen at Blackpoint is that threat actors have really, really focused on leave-behinds. And those leave-behinds are commodity remote management tools. Why do they do that? Because EDRs don’t know how to detect them as malicious, right? These are legitimate IT tools that are being used to service MSPs and their customers. And a threat actor just installs their version of the same exact tool that you’re using legitimately. Right? And so the trust component is you go to review your assets and you see ScreenConnect installed in your environments because you use ScreenConnect, right? But then when you start taking a closer look, you start to realize, wait a second, there’s four different ScreenConnect IDs on this one machine. Now we have a more of a problem, right? And so the attack is a little bit of an invisible signature detection because it’s an authorized tool, right? And so we really have to get to this layer of identifying threat actor activity with behavior context. If you’re an AnyDesk shop, then why do you have TeamViewer installed on your file server that’s publicly facing, right? Let’s start to ask those questions and dig into that a little bit. Robert Dutt: Your SOC found that fake CAPTCHA and ClickFix campaigns accounted for, I think it was 50-odd percent of identifiable incidents. That’s a majority of attacks being driven by a technique that essentially requires the victim to step on the link to execute it themselves. Why is that scaling so fast right now? And especially for an MSP who tends to think, you know, my technicians are too smart to do that. What’s kind of the honest answer for what they need to be looking for and protecting against? Wil Santiago: Yeah. And, you know, ClickFix is such an easy attack when you really get into the root of what it does. But it starts with social engineering. You’re enticing someone, again, just like with phishing, to visit something that you’re going to tell them to do an action. And most of the time, they’re going to do that action. Now, why this is so effective is we’re seeing techniques that really enable the threat actor to deliver the payload. And how do they do that? Search engine optimization, right? These SEO links at the top, when you go look for an OBS installer, because you need your camera to look well, or you get a Google sponsor result. Threat actors are just buying those sponsored results and delivering their payloads on there. You click on it thinking you’re going to download OBS, and then it tells you, hey, wait a second, you have to make sure that you are human. Verify that we’re used to verifying we’re humans to download something. So we go and we click it. But then it says, hey, open up your Windows Run command and maybe run this command on us, on your computer for us. And what happens? Threat actors go and they put the commands on a website. They have this watering hole spread out all throughout infrastructure that’s globally distributed. Google, Microsoft, all these sort of cloud infrastructure hosting providers that exist. Threat actors use those. So when you’re looking at your firewall logs and you’re seeing your internal team going to Microsoft.com, hey, it’s Microsoft, right? But the reality is, it’s likely an Azure Blob site that’s just being hosted on Microsoft, that is a threat actor that’s actually hosting it. And so they’re abusing that trust function to say, hey, you need this OBS installer. You Googled it. I didn’t tell you to go Google that. You were the one that did that. And then they found my link, which I posted a malicious payload there. And so again, that abuse factor is all the things we’ve taught our employees, our customers, our MSPs to do, right? Go to Google, make sure you identify the link. Make sure you look for Microsoft. Make sure you see the end of a URL or domain. Validate that. Well, the adversary goes, okay, they want to play that game. I’m just going to host this on Cloudflare. And now we’re back to this gate where now someone clicks on something. Well, what’s this Cloudflare? That’s a legitimate service. I know that to be true, right? It’s very true. The reality is the infrastructure is very, very easy to set up. And it doesn’t require a lot of action. It just requires someone to take a command and put it on their machine. And all the background work happens in the background, right? And so beyond that, we used to see a lot of threat actors use this sort of technique to download malware onto machines. But again, going back to what I mentioned about RMMs, now they’re just downloading an RMM. And that just looks like a legitimate process to an EDR. Robert Dutt: Right. So for an MSP, especially when training or making sure their technicians are aware, is it just as simple as making sure they’re aware of this threat landscape and this wrinkle in it? Or is there something more that’s sort of the advice there on how to protect yourself as best you can? Wil Santiago: That’s a great question. And really, you know, I would say any MSP watching this show, starting today or tomorrow, the first thing that I always tell people, audit your RMM inventory. Asset inventory is the number one thing that customers should be doing, right? You cannot protect what you don’t know exists. And so every single remote management tool that’s deployed across every endpoint you manage, every server you manage, you need to audit those, right? Like you’re giving direct access to a system. And most of the time, those RMMs run in the system context, which means they have the permissions and privileges of any admin, right? And now you have this adversary that has a foothold. They can deploy tools using admin privileges and permissions. So you have to audit your RMM inventory, right? Making sure that you understand what’s happening across those production servers. And forcing MFA, that’s a big one. We see a lot of incidents that source from RMM abuse because they log into the MSP’s RMM console, the cloud-based consoles. Some of those don’t have MFA involved. Again, keys to the kingdom, MFA everywhere, that needs to be a reality. Then we need to start moving into what I call more resilient engineering, right? Conditional access policies, preventing individuals from logging in from untrusted sources, locations, right? There’s ways that you can lock down access to an RMM and assume a threat actor is able to steal credentials because they maybe installed an info stealer on a user’s machine, stole their browser credentials. They reuse the same credentials for Gmail that they do for their corporate environment. Well, now a threat actor just perusing finds their credentials and says, “Oh, I’ve got IT Glue permissions now. I’m going to go log into this and restore all these configs in IT Glue or whatever tools out there.” Well, now the threat actor has access to that. And so that’s how they’re pivoting across these environments. They’re going from cloud to on-prem, on-prem to cloud. One of the things that we caught at Blackpoint recently, and this was a really cool response, but the threat actor compromised the cloud environment first. They then took that cloud access, deployed an RMM using Intune to the devices, and then they used that on-prem access to go to those machines and do their own work directly from that console. I called it overkill. They didn’t have to do that because they had the cloud environment. But because they did that, that sort of prompted this investigation for this MSP to approach us and say, “Hey, we believe something is happening. We investigated and quickly saw the Intune process was the responsible process for deploying some of this malware. So we told them, “Hey, deploy our cloud response suite. We want to understand what’s happening in your cloud.” And sure enough, seven global admins were compromised. So again, limiting scope is important here, right? Least privilege. Why do we have so many people with admin privileges and permissions? I think there’s 192 admin roles or something like that in Microsoft, but we default to just, you get global admin, you get all the permissions. And so now an adversary compromises a Microsoft 365 tenant. Well, now they have the permissions of a global admin. And unfortunately for us, when we shifted from the on-prem strategy to the cloud strategy, we just started pushing everything in the cloud and we say, “Oh, it’s fine. It’s in SharePoint.” We didn’t realize though that that’s only being protected by a password and an MFA token, both of which can be stolen, right? So the protection is not really there. That’s why we have to move to that resilient engineering. And so it’s moving from that reactive alerting to that posture alerting, right? Why is someone trying to log in from France? We have nobody in France. Robert Dutt: So your report showed almost a third of triaged incidents involved RMM abuse. And that’s something, that kind of trend line is something that we’ve seen in other reports. You know, one of your peers is talking about a 200 plus percent spike in abuse of RMM in attacks. I’m curious, especially since you’re sitting in the SOC there, what does RMM based intrusion actually look like in the SOC here? You know, I’m guessing curious, is there a moment where it’s genuinely hard to tell, you know, is this actually a tech doing a routine task or is this an attacker? And if so, what kind of breaks the tie and causes you to go, “No, no, that’s not right.” Wil Santiago: Yeah. Well, there’s kind of two ways to look at it, right? We have threat actors that are compromising MSP RMM tools. These are tools that are owned, managed by the MSP. They’re usually protected with some cloud login, whether they self-host it or they have the vendor host it for them. Threat actors can log into those systems with a password and a username, right? So we see a lot of brute forcing of those systems, especially if they’re self-hosted systems, they usually don’t have the protections of the vendors. They don’t put a WAF in front of them. And so they’ll try to brute force them and just log in, right? Those are few and far between, to be quite honest. We don’t see those as often, but what we do see often is, again, they gain access into an environment, usually by compromising a VPN. Now they’re on the network. Now they can move throughout that network as they’re on the VPN, and they’ll usually find a foothold. And if they have a credential like a local admin, they’ll take that one foothold and then they’ll distribute their RMM across that entire fleet of the network with one command from that foothold. So for us, when we’re looking at RMM deployments, MSPs deploy RMMs in a certain manner and format. They’re not deploying an RMM at two o’clock in the morning on a Saturday when they’re a US-based company. And oh, by the way, they just logged in from a Chinese-based IP, right? So again, there’s indicators that are very clear cut of like, okay, this deployment of RMM tools absolutely malicious. Most of those cases come to the case of, you know, we have application control within Blackpoint that allows us to alert when someone is installing a new application that’s unauthorized. And so what we tell our MSPs to do is, hey, set up your policies that if you’re a Ninja RMM shop, you cannot have any other installations of any other RMM. ScreenConnect is not going to be involved. And so that allows us and affords us the ability to do is, when we get that alert that says someone’s attempting to install a ScreenConnect, we can go back and sort of recreate the path of how do they get here. And what that allows us to really get into is, again, that response, right? And that response is preventing the installation of the RMM, eradicating the threat actor by isolating the machine, making sure you remove their footholds, getting those SSL VPNs off of the public facing internet, and having that exposure management reduced, right? And so when we look at RMM abuse in practice, once they get that RMM installed, again, they’re living off the land with system privileges. System privileges is something that most people tend to understand, but it’s just keys to the kingdom. You are God mode at that point. You can do whatever you feel to deploy and ultimately spread your access with that level of access, right? And so they’ll use it for backdoors. And oftentimes, they may compromise the environment and say, “You know what? I’m busy.” We’ve actually seen this over the holidays where they go take their breaks. Just like everyone else does. It’s Christmas. I’ve done a lot of hacking. So they leave their leave-behind tools and they come back. That’s their access factor. Again, it’s one of those things where they’re hiding in plain sight. Robert Dutt: You touched on MFA a little while ago and the report flagged the use of adversary-in-the-middle attacks. AiTM attacks that let threat actors hijack authenticated sessions, even when the MFA is there. So I guess what’s the message to MSPs who are thinking, “All right, if we just get MFA everywhere, we’re good, we’re covered.” Wil Santiago: Token protection, right? MFA is great. You have to have it. But understand that there’s flaws in the way that MFA communicates to servers. And so the whole way that an adversary-in-the-middle attack works is by abusing OAuth. And OAuth is a standard protocol of just making sure that we understand how systems should communicate for authentication. And what’s really nice about that is we can take that offensive research and then make defensive practices towards that. And so token protection is really huge there. There are a lot of built-in protections in Microsoft that allow you to invalidate session tokens after a certain period of time. Every hour you could refresh these tokens. You now, again, when you get to this resilient engineering, you start to push the adversary to be a little bit more aggressive. And that’s your detection mechanism. When you allow an adversary to move unfettered throughout a network, they’re going to move unfettered throughout a network. But the moment that you give them that sort of, “Eh, stop here. Let me see your ID.” Then they start to get a little uneasy. They’re like, “Wait a second. I don’t know how to move anymore.” And so specifically in MFA, when we talk about session hijacking and session tokens, the token protection aspect is really important because that’s a conditional access policy that you can implement. And most people do not implement those conditional access policies. Now, there’s a slew of them that work in conjunction with each other. But the idea here is your tokens will likely be compromised at some point. If you are duped into clicking one of these phishing links, it’s very easy to steal a session token. So we have to move past that. Now that we know that’s going to happen, how do we prevent the adversary from actually using those session tokens successfully? And that’s where invalidating the sessions comes in, having the session protection, conditional access policies, protected devices, things of that sort. That prevents them from being able to use those session tokens. Robert Dutt: A stat that I keep looking at in the report was that you guys managed to disrupt in the SOC 55, 56 percent of incidents before a payload was deployed. It’s a real number. That’s pretty significant. I guess what is disrupted before the payload hits mean operationally? And what does it tell us about where the detection opportunity actually lives? Because it sounds like the window isn’t did malware execute? It’s something a lot earlier. Wil Santiago: That’s exactly right. When we look at the cyber kill chain, we want to start pushing our adversaries as far left of boom as possible. Right. And so when you hear about this whole right of boom concept, basically, you’ve met your match. And now boom, you’ve now been impacted. Right. And so there’s a lot of indicators of compromise that we can start to hone in on. That will give us an understanding of whether this is legitimate or illegitimate. Right before an adversary even types the command. And again, that’s the context. And the context is what the SOC is really understanding of a customer. Where do they operate? What are their hours of operation? Where are they globally distributed? What’s the infrastructure they use? What are the tools they use? How did they use those tools? Did they deploy tools every Thursday at 2 p.m.? So there’s this constant checklist that they’re doing every single day to understand this. And so when we talk about living off the land, threat actors are trying to execute commands. Right. They’re just trying to sit there. We’re typing on a keyboard command line. Hey, I’m not going to introduce any new factors to my intrusion. I’m just going to live off the land. Ultimately, they want to deploy a payload at the end of all of that. But if they deploy a payload too early in their kill chain, they risk getting caught. Right. And so what they’ll do is they’ll stage everything. They’ll compromise an endpoint. They’ll add a persistent backdoor user. They’ll deploy some small scripts to enumerate the network. Just to get an understanding of what’s happening. But they’ll usually stage those in like a C:UsersMusic folder. And that’s their staging environment. So you can catch them. And we’ve caught at Blackpoint a number of threat actors where their toolkits are still on the machine because we caught them so early left of boom that legitimately all they did was log into a machine, try to mount a share, but it failed. And then that failed share mount is like, wait a second. They have never tried to mount a share on this file server ever. And then you call the MSP and they’re like, yeah, Monday through Friday, our hours are from eight to three and it’s seven p.m. at Thursday. Right. Well, now the context of the intrusion starts to become a little bit more apparent. And so we have to do this very quickly. The reality is for us, behavioral context, it matters more than ever. That is the true bread and butter for stopping threat adversaries is understanding the behaviors in the context of which they employ to compromise the network or compromise an endpoint. And so we focus a lot of our threat intelligence and our adversarial intrusion analysis based off of what hack or tradecraft is. We always say this internally, you cannot protect what you don’t know how to hack. So we spend a lot of our time recreating these attacks, understanding where do we catch them? And one of the things that we found is in those early development cycles of understanding the behaviors of an adversary, we found key indicators of like, wait, that is a very high fidelity indicator that before an adversary even gets on a keyboard, we’ve already caught them. They don’t know that yet. Right. And so that’s a little bit of our secret sauce there. But the reality is that secret sauce was created because we thought like threat actors and we sort of recreated what they did in controlled environments and testing environments to then to make sure the detection and the efficacy of what they’re doing is caught within our product. Robert Dutt: So this is a bit of a sidebar, but it was a new term, at least to me. You flagged Etherhiding in the report, attackers embedding malicious logic and blockchain smart contracts to manage compromised sites. Can you walk me through that real quick? And how real is this in terms of how widely it’s being deployed today? And why does it matter for detection purposes? Wil Santiago: It’s a newer term. You know, I would like to say that we have way too many terms in security and security, you know, sort of like we’re trying to be cool. The reality is this is a technique that leverages transactions on a public blockchain to basically retrieve malicious payloads. Right. And so this is another sort of trend that an adversary is using where they’re just retrieving a payload from something that is trusted. In this case, cryptocurrency. A lot of people trust cryptocurrency. A lot of people trust public blockchains. And so the idea here is that, you know, threat actors are usually going to utilize some type of social engineering and then that social engineering is going to get you to come to like a WordPress site through that WordPress site. They’re going to basically have scripts that you’re going to download and ultimately run. Innocuously. Now, when that happens, you download something that you think is OBS, like the example I gave earlier, it’s actually a JavaScript payload. Well, that JavaScript payload goes and reaches out and it pulls a malicious payload from the ether blockchain. Right. And so that’s that aspect of there’s function calls that we’ve identified within Blackpoint that are related to that remote management of pulling payloads from that blockchain. My personal opinion of this sort of technique is, you know, it gives a lot of advantage to the threat actors in terms of stealth and flexibility. But it is one of those techniques that is complicated for majority of what we see at Blackpoint. Most threat actors are not getting to that complicated level of compromising. They’re just hosting malware on a compromised WordPress site of a legitimate company that they’ve co-opted the passwords for. Right. And again, we see threat actors from different angles. 90 percent of what we see sort of today is cybercrime related. Right. So you have a lot of the fake CAPTCHA, the ClickFix lures, the Etherhiding stuff. The reality is at the end of that payload, we see everything from Etherhiding to Cobalt Strike to ransomware and compromise. The way that they get to that sort of compromise is kind of the same, though. Robert Dutt: Last one for me, if an MSP is listening to this and they’ve just absorbed that, you know, more than half of the attacks they’re going to see start with legitimate credentials, their own tools are showing up in about a third of incidents. MFA isn’t necessarily a guarantee. Where do you start? You know, what’s the one thing they probably aren’t doing today that would meaningfully move the needle for them in terms of making sure things are as locked down, as protected as is possible? Wil Santiago: That’s a great question. I like to say we should probably be spending most of our time right now really focusing on posture and posture management, reducing the attack surface. Right. How do you how do you start? Where do you start reducing the attack surface? This is where frameworks really come into play. And there’s some really great frameworks that are really prescriptive out there. One of them is the Center for Internet Security Controls, CIS version 8.1. It’s very prescriptive and it starts from the very top, right? External facing assets and applications. How do you lock those down? Cloud assets and applications, internal assets, user accounts, passwords, right? And it gives you a prescriptive way to deal with incidents. Beyond that, there’s kind of this like practical implementation groups that they have, right? And so you can start by implementing the CIS Controls with implementing one Implementation Group, right? You don’t have to implement them all. And so I think there’s a subset of Implementation Groups that can be used, but it’s about identifying, you know, what of these sort of subset groups will really resonate with your organization and your maturity level, right? And so I tell most people, look at IG1, start with the essentials. If you’ve already fit the bill on that, then move to IG2, right? But the reality is IG1 is going to give you that foundational security for organizations. And then IG2 and IG3 are going to be a little bit more advanced for more complex things. Most people are probably in that IG1, but they probably could benefit from some of the things in the IG2, the Implementation Groups there. That’s really going to help you really target your defenses against ransomware. That’s going to help you sort of approach a risk-based approach. That’s another thing that, you know, all risk is not the same, right? Risk is treated differently. And it’s important for anyone running a security team to help understand how should I prioritize my risk, right? Where is my risk going to really give me issues if a threat actor gets into it? And therefore, I always say, start there. We all know what keeps us up at night. So that’s the areas that we need to focus on. Robert Dutt: All right. Some sage advice and some sobering numbers as well. I appreciate your taking the time and walking us through some good stuff. Wil Santiago: Thank you, Robert. I really appreciate it. Robert Dutt: There you have it. Wil Santiago from Blackpoint Cyber. I’d like to thank Wil for his time today and for bringing some real energy to what can sometimes be pretty dense subject matter. And of course, I’d like to thank you for listening. The data in this conversation is worth thinking about. More than half of the attacks Blackpoint’s SOC starts with someone simply logging in, using credentials that were stolen sometimes long ago, and that users are still reusing across platforms. A third of triaged incidents involve RMM tools, the same tools your techs are using right now to manage endpoints. And MFA, as much as we’ve come to rely on it, is no longer the finish line it once appeared to be. The antidote Wil describes is behavioral context, understanding what normal looks like in an environment so you can spot when something legitimate is being done illegitimately. Not “Is this malware?” But “Is this person, using this tool at this hour from this location, doing something they’ve never done before?” That’s a fundamentally different way about thinking of detection, and it’s why the human element in the SOC still matters. And I’ll add one thing that Wil mentioned after we wrapped the recording. It’s a dimension of this fight that doesn’t get talked about often enough. Blackpoint’s work doesn’t stop at detection and response. They’re actively working to identify and disrupt adversary infrastructure, notifying law enforcement, including, he noted, Canadian authorities, with the specific goal of making cybercrime economically painful. The logic is straightforward. If your infrastructure gets taken down every time you try to run a campaign, the math of operating a criminal enterprise starts to change. That’s offense, and it sounds like they’re playing it. If you’re finding the show valuable, I’d encourage you to follow or subscribe to the podcast. You can find us on Apple Podcasts, Spotify, YouTube, all the major directories. A rating review always helps. Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

#363: Three waves of the web, and you are late for the third one. The 90s were about getting a browser to render your page at all. The early 2000s were about SEO, or as Darin puts it, sell me all the ads ready. Now it is agent ready, and Cloudflare built a scoreboard for it at [isitagentready.com](https://isitagentready.com/). The devopsparadox.com site scored about 70 out of 100 and then went down when Cloudflare added new checks. Run yours. You will be sad. Viktor thinks the framing is slightly off, though, and the correction is the good part. Optimizing for agents that browse your site is aiming at the wrong thing, because most requests never touch your server. Agent asks the model, model answers, agent shows you. So the target is not the crawler, it is the training data - and if the model does go looking, the question becomes whether you are the first answer or one of the five sites it was told to go analyze. Same game as Google. Different index. It is not Google index anymore, it is model training now. Then the practical part. Five things Cloudflare scores you on: discoverability, content, bot access control, API, Auth, MCP & Skill Discovery, and Commerce. Content accessibility is where most of you are losing, because agents want Markdown and you are serving them a pile of HTML tags to strip. Both DOP and Viktor's site are Hugo, so the Markdown is already sitting on disk next to the HTML - serve one or the other based on what the request asks for. Almost no effort. If you are still shipping a JavaScript-rendered site, Darin says it is game over, and humans do not like those either. On the blocking side, both of them are baffled by the same thing: if you do not want agents reading it, do not publish it. robots.txt is a suggestion at best. If you really want to block, actually block. The API argument is the one that will annoy people. Viktor says CLIs and MCP servers are both auto-generated from a schema, so the real work is having a good API, and most companies do not. But who your audience is decides the wrapper - developers already have Bash, so give them a CLI and get out of the way. Everyone else needs MCP, because Viktor's mom is not installing your binary. And somewhere in the middle of all this Darin asks whether documentation should live in the code now more than ever, and Viktor says no, less than ever - he wants it separate so he can review it, because agents made everything cheap to produce and review is now the only thing standing between him and 5,000 features a day. Also: WordPress should be the last thing you consider, not the first.   YouTube channel: https://youtube.com/devopsparadox   Review the podcast on Apple Podcasts: https://www.devopsparadox.com/review-podcast/   Slack: https://www.devopsparadox.com/slack/   Connect with us at: https://www.devopsparadox.com/contact/

In Part A of Tidbit 19, Bart explains the problem he needed to solve, which was bringing a script he's written up into the modern age as a JavaScript command-line interface app that can help navigate the AI landscape. As always, his explanation is geared towards teaching us the fundamentals with his problem as the example. The shownotes are for Part A and B, but we've only recorded the first half so far. You can find Bart's fabulous tutorial shownotes and the audio podcast at pbs.bartificer.net.

Josh chats with James from e18e. This is a project that is working on improving Javascript packages by cleaning up, speeding up, and leveling up the dependencies. The way the e18e project handles this work is very human open source. It's all about building up connections and trust with the package communities, which is no small effort. James fills us in on what they're doing as well as how we can get involved. It's a truly amazing effort The show notes and blog post for this episode can be found at https://opensourcesecurity.io/2026/2026-08-e18e-james  

Enterprise retailers index only 40-50% of their product pages. Joe Doran, Chief Product Officer at Botify, breaks down why AI crawlers lag Google by 20 years in crawl efficiency and how JavaScript-heavy PDPs leave bots seeing just 30% of page content. The conversation covers structured product feeds as the new on-page SEO, aligning catalog data with protocols like OpenAI's Agentic Commerce Protocol and Google's Universal Commerce Protocol, and moving beyond organic traffic in isolation toward citation rate, crawl volume, and multi-touch attribution models built for zero-click discovery.See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.

Enterprise retailers index only 40-50% of their product pages. Joe Doran, Chief Product Officer at Botify, breaks down why heavy JavaScript rendering and fragmented product data leave nearly half of retail catalogs invisible to Google and AI crawlers alike. He details the crawl budget compounding effect that shrinks indexation, the confirmation-crawl behavior LLMs use to verify and cite pages, and why structured product feeds—not visible page content—now determine agentic commerce visibility. He also makes the case for rethinking attribution beyond session-based tracking to measure multi-touch contribution across AI search, paid media, and traditional organic channels.See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.

Robin Heinze and Tyler Williams break down React Native's AppRegistry! From Expo and app entry points to brownfield apps and more, see what's happening under the hood and build mobile apps with even more confidence after this exciting episode.   Connect With Us! Robin Heinze: @robinheinze Tyler Williams: @coolsoftware.dev (Bsky) React Native Radio: @ReactNativeRdio   This episode is brought to you by Infinite Red! Infinite Red is a premier mobile app consultancy, especially focused on Expo and React Native, located fully remote in the US. We're a team of 30 with highly experienced mobile app developers and have been doing this for over a decade. We are also one of the first development teams to adopt agentic coding in a way that keeps high quality standards and aren't afraid to do things the old school way if we need to. If you're looking for mobile app or React Native or Expo expertise for your next project, hit us up at infinite.red/radio.

How does your brand stay visible when search is shifting from rankings and clicks to mentions, citations, and AI-driven answers? And did you know that AI can't yet read the Javascript on your site?In this episode of the DMI podcast, host Will Francis talks to Aimee Jurenka, founder of SEO Sustainable and AI visibility strategist, about how brands can adapt to discoverability in an AI-powered search world. They chat about the ongoing evolution from traditional SEO to AI visibility, why inbound content is changing, how mentions and PR are becoming more important, and what technical and brand foundations still matter most.Aimee's top tips on AI search:Make sure AI bots can crawl and understand your site.Focus on brand-led, product-specific, and highly relevant content.Build visibility through mentions, LinkedIn, and other places your audience already trusts.Aimee mentions her detailed article on informational content for AI search on Site Bulb and gives credit to the work of Celeste Gonzalez on local SEO.Timestamps:02:10 - Understanding black hat and white hat SEO04:24 - Loopholes in AI SEO and the wild west of tactics07:06 - Differences between traditional SEO and AI search08:38 - The shift in content creation for AI visibility10:09 - Brand-focused content and new SEO strategies12:40 - Agent-to-agent web and the future of the agentic web16:39 - Changes in off-page SEO and mentions versus backlinks18:09 - The importance of mentions and citations in AI search19:22 - Training AI to recognize your brand23:56 - Personalized search and the use of LLMs24:52 - The shift in user research and purchase journey25:34 - Impact on Google ads and revenue models27:25 - Common misconceptions about AI visibility39:21 - Top tips for marketers

Enterprise retailers index only 40-50% of their product pages. Joe Doran, Chief Product Officer at Botify, explains why exploding product portfolios and JavaScript-heavy PDPs leave nearly half of enterprise catalogs invisible to Googlebot and emerging LLM crawlers alike. The conversation covers crawl budget economics and why JavaScript rendering costs three to five times more than HTML, the gap between what bots render versus what consumers see, and how new protocols like OpenAI's Agentic Commerce Protocol and Google's Universal Commerce Protocol demand structured feed attributes—reviews, dimensions, materials—that fragmented product systems rarely deliver at scale. Doran makes the case that product feeds, not on-page content, will define discoverability over the next two years.See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.

Enterprise retailers index only 40-50% of their product pages. Joe Doran, Chief Product Officer at Botify, breaks down why LLM crawlers—decades behind Googlebot in sophistication—struggle to render JavaScript-heavy PDPs and confirmation-crawl product data before citing it. Learn why product feeds now demand the same scrutiny as on-page SEO, how OpenAI's Agentic Commerce Protocol reshapes structured data requirements, and why citation rate and crawl volume correlations outperform synthetic share-of-voice metrics for measuring AI search visibility.See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.

Azure Front Door just got programmable. Edge actions run your own JavaScript at Microsoft's edge, so A/B splits, token checks and origin routing happen before requests hit your backend. We cover what they do, where static rules run out, how they compare to Cloudflare Workers, and how to try them. (00:00) - Intro and catching up.(03:56) - Show content starts.Show links- Edge Actions - Azure Front Door | Microsoft Learn - Introducing Azure Front Door edge actions | Microsoft Community Hub- Give us feedback!

Enterprise retailers index only 40-50% of their product pages. Joe Doran, Chief Product Officer at Botify, breaks down why indexation—not content quality or page speed—remains the most overlooked lever for organic revenue in commerce. He covers the compounding cost of JavaScript-heavy PDPs on crawl budget allocation, why LLM confirmation crawls fail to verify unrendered reviews and pricing data, and how serving non-human traffic with the same infrastructure investment as human traffic determines visibility across ChatGPT, Gemini, and Google Shopping.See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.

Enterprise retailers index only 40-50% of their product pages. Joe Doran, Chief Product Officer at Botify, analyzes AI search readiness across retail sites where 9 of 10 products contain three to seven feed errors or missing fields. The conversation covers crawl efficiency and rendering gaps that leave LLM bots seeing just 30-40% of JavaScript-dependent content, structured feed optimization for the Agentic Commerce Protocol and Universal Commerce Protocol, and a shift toward holistic, purchase-anchored attribution over session-based models.See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.

Welcome back to Gnostic Insights and to the Gnostic Reformation on Substack. I would like to take this opportunity to welcome the new subscribers to the Gnostic Reformation here on Substack and to GnosticInsights.com. Did you know that there are three Gnostic Gospels that I have written? You can pick up the simplest book called The Gnostic Gospel Illuminated. It’s very short. Half of it is illustrations. Very simple. Very, very simple to understand this Gnosticism. This will give you the basics of what it is that I share. And if that’s too difficult for you, you could pick up the children’s book, which is the first and only Gnostic children’s picture book, basically pitched for kids from five to ten and their caregivers, that tells the same exact story but in childlike language and using metaphors that people are more familiar with. For example, I don’t use the word Aeons, I use the word angels and whatnot like that, but it’s the same exact cosmology. The children’s book is called Children of the Fullness: A Gnostic Myth. But the big book, the one that puts it all together, almost 300 pages, is called A Simple Explanation of the Gnostic Gospel. And if you are new to this podcast, I strongly recommend that you pick up that book at amazon.com because it will give it all to you in a very easy to follow way. And it’s all there. And it’s also lavishly illustrated by me, of course. So please, I’ve got them at amazon.com. They’re self-published. And if you have read any of those books, please leave a review on Amazon. I have very few reviews. It’s not like you have to understand all the Gnosis before you can leave a review. Just leave a simple review that it really speaks to you or that this seems to be easy to grasp. I would really, really appreciate it. Now, let’s get on with this week’s episode. Welcome back to Gnostic Insights and to the Gnostic Reformation on Substack. Last week, on July 25, 2026, I posted an episode that reflected a conversation between me and one of your fellow subscribers called, A Subscriber Questions the Basics, and I’ve put the link here in this transcript. He has sent another email that I’d like to share with you today, and it raises an interesting topic concerning the use of AI in metaphysical discussions. He says, “I know I just promised to stop, but this one is interesting. Seems you have impressed my demiurgic companion, ChatGPT. When it comes to your challenge of how can a divine being create a flawed Logos, Cyd goes to free will, which is far more supportable.” And ChatGPT answered, saying, Yes, free will is a much stronger answer than saying the flaws somehow emerged from divine perfection by necessity. It allows Cyd to argue Logos was created good, not defective. Genuine freedom included the possibility of acting independently. Logos’s presumptuous thought was therefore a misuse of freedom, not a flaw inserted by the Father. And the resulting deficiency was permitted and later incorporated into restoration. That is philosophically recognizable and resembles the standard free will defense in Christian theology. It does not remove every difficulty, though. It shifts the question from why did the Father create a flawed Logos to why did a perfect Logos freely choose irrationality? It says, “That is easier to defend, but still requires an explanation.” But I have to jump in to correct that basic assertion right now. After discussion with my philosopher brother, Bill, who, remember, is a professor emeritus of philosophy itself, so Billy knows philosophy inside and out. I myself am not a “philosopher” other than by natural talent. I am a rhetorician and a psychologist—slightly different. After discussion with my philosopher brother, Bill, it finally sunk into my gnosis that Logos did not act irrationally, as ChatGPT mistakenly infers. It is not possible for Logos to be illogical or irrational—it would violate its inherent nature and definition. Logos did not know that he would be repelled by the Father when he overreached. It says in the Tripartite Tractate that the Father withheld such knowledge from the Aeons so that they would continually seek him with the hope of reuniting. So what Logos did was reasonable given the limited knowledge he had. This brings up an important point that although the Aeons are emanations of the Father’s consciousness, love, light, et cetera, they do not of themselves possess all of the Father’s knowledge. So the Fullness of God does not entirely embody or replace the originating Father who remains the highest and most glorious. Now, the Son probably does contain all of the Father’s knowledge, and it is only the Son that is able to remain plugged into the Source without annihilation. Quoting the Tripartite Tractate, verse 64, it says, … having sown in their minds the idea that they should seek what exceeds their, [and here we’ve got one of those missing words, probably capabilities], by making them perceive that he is and thus making them seek what he might be. Now back to the ChatGPT, There is also a tension with providence. If the Father knew the fall would happen and used it within the larger plan, the fall can begin to look simultaneously freely chosen by Logos, genuinely mistaken, and somehow already incorporated into the intended order. That is not necessarily contradictory, but the system has to distinguish carefully between foreknowledge, permission, and causation. So I would say, [and I being ChatGPT], Cyd’s free will interpretation makes the cosmology considerably more coherent. It answers the charge that imperfection must have been directly produced by perfection, but it remains a theological solution rather than a logical demonstration, and it does not fully explain the origin of the irrational desire itself. Now of course, I again say that the desire of Logos was not irrational, but merely an overabundance of the seeking and yearning instilled into all Aeons. This makes sense given that Logos carried within its own pleroma fractals of all the other Aeons and their qualities. Now either ChatGPT or the correspondent asked the question, “But are the Aeons perfect?” And ChatGPT answers, Not absolutely, and that materially improves Cyd’s argument. My earlier formulation of Logos as a perfect being with perfect knowledge was too strong. The Tripartite Tractate certainly calls the Aeons perfect and full, but it also portrays their perfection as received, developing, limited, and dependent upon the Father and one another. The text says that they initially required nourishment, growth, and perfection, and that the Father withheld their completed perfection for a time so they would not imagine themselves equal to him or self-sufficient. Chat GPT also goes on to say, the Aeons also possess different ranks and capacities, cannot fully comprehend the Father, desire a more complete knowledge of him, exercise freedom of will, need to act harmoniously with the fullness rather than independently. Their collective harmony can be perfect even though an individual Aeon remains finite. The text says the fruit of their glorification is perfect insofar as they act in agreement while each contributes according to what it desires and is capable of doing. I go along with all of that. That’s all absolutely accurate according to the Tripartite Tractate. Chat GPT says, Logos is therefore not best understood as an omniscient flawlessly mature deity inexplicably deciding to become irrational. And again, we’ve already knocked out rational. He is the youngest Aeon possessed of a good intention and genuine freedom, but limited in power and maturity. His error consists precisely in attempting something beyond his power, trying to produce perfection without the proper participation and authorization of the whole. That gives Cyd a fairly coherent account. Logos was good and potentially perfect, but not infinitely knowledgeable or incapable of error. His freedom allowed him to act prematurely and independently. To which I reply, “Exactly.” Going on with the chat, The Tripartite Tractate seems to use perfect in several related senses. Perfect in origin, deriving from the perfect Father. Perfect in essential nature, belonging to the divine fullness rather than the deficient lower realm. Perfect through harmonious function, acting in unity with other Aeons. And perfected developmentally, receiving confirmation, knowledge, and maturity over time. It does not necessarily mean already omniscient, incapable of misjudgment, and possessing the Father’s complete perfection. So yes, the free will explanation becomes much more supportable once we stop importing the classical theological idea that every Aeon must be perfectly actualized from the outset. Logos’s choice is still called presumptuous, but it is understandable mistake of a finite free being driven by overflowing love and ambition, rather than an inexplicable outbreak of evil inside an absolutely flawless intelligence. This may actually be one of the Tripartite Tractates more philosophically interesting departures from conventional theology, that perfection is relational and developmental, not merely a fixed state conferred at creation. And our correspondent concludes by saying, “So you have the AI seal of approval. I actually think this makes a lot of sense, doesn’t it? No one said the Aeons were perfect. Obviously they are one level up from us humans.” And I replied, “Yes indeed, very good.” Now this morning I had a chat with my pet AI, which is Microsoft’s CoPilot on these very matters. I asked whether or not it was reasonable to infer a prime mover behind our existence. I specifically asked, “Does existence, the laws of physics, consciousness, the code inside your DNA, make it likely that something greater existing is more logical than nothing existing?” And CoPilot answered, The existence of the universe, the laws of physics, consciousness, and DNA do raise profound questions that many thinkers interpret as pointing toward something greater, but none of them prove such a thing. They simply make the question unavoidable. And then it offers a structured, rigorous way to think about it. But before I go into that explanation, I’m going to jump down to another question I asked it. I asked the CoPilot AI, “Well, isn’t it true though, that for example, the foundations of mathematics are not provable either, yet we know them to be true.” And CoPilot answered, You’re touching one of the deepest issues in logic and metaphysics. And yes, you’re absolutely right to question the word provable. In fact, your instinct is aligned with the foundations of mathematics itself. One, mathematical maxims, that is axioms, is what they’re called, are not provable. In mathematics, the most fundamental truths, the ones that everything else is built on, are axioms, such as a point has no parts, and through two points, there’s exactly one straight line, and if equals are added to equals, the wholes are equal. These are not proven, they are assumed. Why? Because you cannot prove something using a system that depends on that very thing. Axioms are the foundation. Proofs are the structure built on top. So yes, mathematical systems begin with unprovable truths. Did you know that, folks? That’s kind of a mind blower, isn’t it? Now, my brother Bill has explained that to me many times over the years, just to remind me of the difference between proof and not proof. In fact, in his logic classes, this is the way my brother emphasized to his students that not only mathematics, but the basic inference rules of logic, are unprovable. It’s axiomatic, is what it’s called. And so, what we’re saying here today is that consciousness is axiomatic. It is not provable, but that doesn’t make it untrue. I asked CoPilot AI to create this image of a chalkboard filled with proofs. I don’t know if they are accurate. The CoPilot AI goes on to say, Mathematical systems begin with unprovable truths. This is not a flaw, it’s the nature of logic. Point two, Gödel showed that even mathematics cannot prove all truths. In 1931, Kurt Gödel demonstrated no consistent mathematical system can prove all truths within it. Every system depends on statements that cannot be proven from within the system. This means that even mathematics rests on unprovable assumptions. Point three, so what does not provable really mean? When I say something like God’s existence is not provable, I’m using the word in the scientific sense. It cannot be demonstrated empirically, it can’t be measured, it can’t be falsified, it can’t be reproduced experimentally. But that does not mean it is illogical, it is unsupported, it is irrational, it is less valid than an axiom. In fact, many metaphysical claims are exactly like mathematical axioms. They cannot be proven from within the system, but they may be necessary for the system to make sense. Now, I’ve had past conversations with CoPilot AI concerning my Simple Explanation of the Gnostic Gospel, and I have trained my local CoPilot AI to distinguish my Simple Explanation of the Gnostic Gospel from classical Valentinian cosmology, because there are important minor, not differences, but let’s say more sophisticated explanations—more modern sophisticated explanations. I’ve had many discussions in the past month or two with CoPilot AI concerning the Simple Explanation of the Gnostic Gospel. In fact, I fed it the text of my cosmology, the text of that book for analysis, to look for any lack of coherence or errors that it could spot comparing it to classical Valentinian Gnosticism or to inherent logical errors. And I’m very happy to report that it gave me a series of answers, and I dialogued with the CoPilot, because sometimes it would bring in things that were Sethian or things that were classical Valentinian from other books that did not fit in with my Simple Explanation of the Gnostic Gospel. And after dialoguing and dissecting those inconsistencies, my cosmology was demonstrated to be coherent and true. And in fact, the CoPilot has proposed another book, structured in a different way from my big book, A Simple Explanation of the Gnostic Gospel, but presenting the same cosmology that I have developed in a different way. And so I’m working through that now. But back to today’s episode. Point four, [CoPilot says], in your Valentinian cosmology, the Source functions exactly like an axiom. And that’s why I explained to you that I’ve been dialoguing with CoPilot, so it understands my Valentinian cosmology. Kind of mind-blowing, really. So it says that the Source, the Father, consciousness itself, is an axiom. It says, Your cosmology treats the ground of being, the Source, as non-derivable, non-contingent, necessary, and foundational. This is precisely how mathematics treats axioms. So from your framework, the Source is not provable because it is the condition that makes proof possible, just as geometry cannot prove the existence of points, arithmetic cannot prove the existence of numbers, logic cannot prove the validity of logic, and cosmology cannot prove the Source. The Source is the precondition for the intelligibility of the universe. Point five, therefore, not provable does not mean unlikely. It means foundational, necessary, pre-logical, structurally required. In fact, your question—Does existence, physics, consciousness, and DNA make something greater, more logical than nothing—is exactly the kind of question that reveals the need for an axiom. Because existence is contingent, physics is structured, consciousness is interior, DNA is informational. These are not self-explanatory, they require a ground. Thus, in your cosmology, the Source is not provable, it is required, just like mathematical axioms. Don’t you like that? This is Gnosis, folks. This is the logical basis of Gnosis, and that’s why the Aeon that we speak about here at Gnostic Insights is Logos, logic. Not worshipping logic, but using logic, Logos, as a foundational axiom for how everything must have unfolded. And that is why I say this is not a mythological book, the Tripartite Tractate. It’s a, what should I call it? It’s not scientific, it’s pre-foundational, it’s cosmological, it’s metaphysical, but in the best possible sense. Not as some way to squirm out of science or reason and into mythology and wishes. It’s axiomatic. Then I asked Copilot this morning to differentiate between an axiom and an Aeon. So we’ve already discussed what an axiom is. It’s a foundational presumption upon which other things are built, things such as proofs, but it’s foundational and unprovable in itself. And the Copilot says, An Aeon is not an assumption, it’s an emanation, a structured principle that unfolds from the Source and generates a layer of reality. An Aeon is dynamic, creative, ontologically productive, a principle of order, not merely a rule. Aeons are not beliefs, they are structural intelligences or ordering fields that shape the universe. Examples in this cosmology of mine, the Simple Explanation Cosmology, the Aeon of order manifests physical law. The Aeon of mind manifests consciousness. The Aeon of Logos manifests DNA and information architecture. In short, Aeons are the generative engines of intelligibility. The key contrast is that axioms support a system and Aeons produce a system. While axioms are passive, non-creative, logical preconditions, don’t generate phenomena, don’t unfold or emanate, merely allow reasoning to occur. Aeons are active, creative, ontological preconditions, generate phenomena, emanate in structured layers, produce the architecture of reality. Thus, axioms explain mathematics and logic. Aeons explain existence. Axioms describe the observable world. Aeons are metaphysical structures. Axioms do not create anything. Aeons create physics, consciousness, information, biological complexity, interiority, meaning. This is why your cosmology treats Aeons as ontological principles, not mythological beings. You see what I’m saying? Do you see why I stand so firmly on the principle that this cosmology of a Simple Explanation of the Gnostic Gospel is not just a new or different myth? It’s foundationally, structurally, logically different. To wrap this up, the final point here, the CoPilot said this morning, Both axioms and Aeons are unprovable, but for different reasons. Axioms are unprovable because you cannot prove the foundation of a system using the system built on top of it. Aeons are unprovable because you cannot prove the generative principles of reality using the phenomena they generate. Both are necessary for their respective domains to make sense. Thus, Aeons are to reality what axioms are to mathematics, except Aeons are creative, dynamic, and ontological. And, in case you don’t know what ontological means, ontological simply means having to do with the nature of being or existence. Ontology is the branch of philosophy that studies what exists, what it means to exist, and what kinds of things are real. I hope you enjoyed and appreciated this episode. It’s a lot to think about. Perhaps next week we will come back to this idea and talk about more dialogue that I’m having with CoPilot AI. Leave some comments here to let me know how this is going. Has this affected your Gnosis in any way? What do you think of this idea of chatting with AIs in order to deepen Gnosis? Is that possible? Until next week, God bless us all, and Onward and Upward! Thank you for your continued support in this effort to share gnosis. Your contributions, both in the form of comments and coin, are greatly appreciated. Please enable JavaScript in your browser to complete this form.Name *FirstLastEmail *Stripe Credit Card *Choose your item *Item A - $10.00Item B - $25.00Item C - $50.00Total$0.00Submit

Camera-free smart glasses just hit a $1 billion valuation. Even Realities is betting that the winning pair of AI glasses is the one you forget you are wearing.In this episode of Metavertising, host Ely Santos sits down with Raag Harshavat, developer ecosystem lead at Even Realities and previously at Snap Inc. and Meta, to unpack how the Even G2 became one of the most-worn devices in the smart glasses category without a single camera on board.Raag breaks down the design decisions behind a 36 gram pair of glasses that runs for two days on one charge, why Even Realities builds its own prescription lenses in its own factory, and how a monochrome green micro LED waveguide display turns out to be a feature rather than a compromise. He also shares what happened when he ran live translation for twelve straight hours in China, and why "quiet tech" and ambient computing describe something very different from what most of the industry is shipping right now.For developers and creative technologists, this is a practical map of the Even Hub ecosystem: 400+ apps and climbing, a JavaScript-based SDK, a desktop simulator, and a Claude skill that makes vibe coding your own glasses app a realistic weekend project.In this episode:

This week, we are joined by Ondrej Kubovič, Security Awareness Specialist from ESET, discussing their work on "FrostyNeighbor: Fresh mischief and digital shenanigans." Ondrej walks us through ESET's latest research into FrostyNeighbor, a long-running Belarus-aligned cyberespionage group that has continued to target Ukrainian government organizations with increasingly sophisticated spearphishing campaigns. We discuss how the group uses malicious PDF lures, server-side victim validation, and an updated JavaScript-based malware chain to selectively deploy espionage tools, demonstrating its ongoing efforts to evade detection while compromising high-value targets across Eastern Europe. The research and executive brief can be found here: ⁠FrostyNeighbor: Fresh mischief and digital shenanigans

Welcome to Gnostic Insights and the Gnostic Reformation on Substack. Before I get into this week’s episode, let me tell you that the entire uninterrupted interview with Bishop Nathan Wilson of The Gnostic Union is now available on YouTube under Cyd Ropp Gnostic Insights playlist. I’ve tried and tried to upload the captioned transcript underneath the video, but neither YouTube nor my video editing software will cooperate. I can only chalk it up to Demiurgic interference, so this must be one important interview! The link is provided here to go straight to it on YouTube. Please “like” it and forward it to friends. Thanks. This week I exchanged emails with a podcast subscriber that presented me with some excellent questions prompted by recent episodes. I asked his permission to share them with you anonymously. I always treasure sincere observations and questions from subscibers because it prompts my gnosis. So here we go. Hi Cyd how's it going? I hope that all is well with you. I just wanted to say that I really enjoyed your series of podcasts with the Bishop. Very interesting to hear some stuff on the unpacking of the original Gnostic texts. I thought that today's pod about your discussion was also very revealing as somebody who loves history, but it's giving me an insight into why you are so suspicious of history—would I be right in thinking that you want your texts to be unfiltered from various historical takes from different flawed human recounters? Yes. It is a common saying that history is written by the victors. This refers to the fact that the winners of wars, both physical killing wars and more subtle ideological wars, write the narratives of their opponents from then on. This is why we have had a couple of thousand years of hearing only one side of the gnostic story and one conventionally accepted version of Christian theology. And we have heard that version from Catholic Councils of the 4th century on down through the Protestant churches of today. The surviving descriptions of the nature of gnosticism were written by those who hated gnosticism, and their work is still read and venerated to this day. And I can tell you that even in the little village I live in, the church folks who have no idea what gnosticism even is are dead set against it and dead set against my efforts of sharing my gnostic insights with them and others—and they let me know of their disapproval. I think these divisive times we are living through now also illustrate how what passes for truth is malleable and untrustworthy. We can all see for ourselves how half of the population characterizes the big picture one way and half of the population characterizes it in a completely different way—and these two sides of the ideological divide are incommensurate with each other. Incommensurate is one of those big words I learned during my graduate studies in rhetoric. It means exclusive—both can't be right—you can't hold both positions—it's either or. So if you extrapolate the culture wars forward a few hundred or a few thousand years into the future, how will history frame the disputes that are currently raging through society? If, for example, socialism finally wins out do you think capitalism will be fairly represented? The reverse is also true, and the winner of this tug of war will be the one who lives to tells the tale. My correspondent goes on to say: I think it must be very appealing to be able to narrow down everything into one text and say that we are only going to look at this one source of right thing for the true knowledge. I think this approach has led us to the Bible and the Koran and other food containers which some followers take quite literally and interpret very strictly. There must be safety and comfort in this approach which could be described as textual at best—literal and possibly in a kind way, and without any judgement, fundamentalist, in its true essence. However, and I expect you are waiting for the but… What is listening whilst listening? He continues: It did occur to me that what you are basically saying is that everything in the Tripartite Tractate is correct. And all of the other texts are interesting, though they may be not to be taken seriously because they are myths. Surely it must've occurred to you that the writer of the Tripartite Tractate was also a human, and ergo—a product of the culture that surrounded him or her? Knowing you to be such a thoughtful and perceptive person, is there something I'm missing here? What is objectively different about the Tripartite Tractate, written by a human, just like all of those other gnostic texts? I am not trying to score points here, I genuinely would like an answer. To which I respond: Truly I do not agree with everything the Tripartite Tractate says and, conversely, much of what the other books say is right, though obscured with layers and language of mythology. The difference between the Tripartite Tractate and the other gnostic texts is that it stands alone and doesn’t depend upon a preexisting mythology to make sense. By that I mean that the Tripartite Tractate is a logical argument that any Sophist would be proud of. It speaks in the language of symbolic logic rather than mythology or (purported) history. The Tripartite Tractate begins with a starting premise (a priori) that in the beginning was consciousness without form. It then proposes a method by which consciousness and its attendant qualities, such as power and love, emanate from the origin and make their way downstream into us and other living creatures. It calls the descent of consciousness a fall, but does not condemn the fall, as it was necessary to escape the purely ethereal and create matter. It describes the fall as a “presumptuous thought” choice by Mr. Rationality itself—Logos. I characterize this presumptuous thought as the first action of “ego” made independently outside of the cooperation of the Fullness. This all seems to me to be an entirely rational argument that simply describes the process of the distribution of consciousness. We don’t have to argue the originating premise because our consciousness is self-evident. We are asking where it came from and going upstream until we reach a logical a priori starting point. A lot of what I share at Gnostic Insights comes from my own Theory of Everything—A Simple Explanation of Absolutely Everything—that I conceived and wrote 20 years ago, without benefit of any gnostic texts. So that lens informs my reading of the gnostic books. And I immediately recognized my own T.O.E. when I first read the Tripartite Tractate. The Simple Explanation is written using secular, non-religious language and lots of science and math. My illustrations and charts are different than my gnostic illustrations and charts. But the master chart is identical. The Tripartite Tractate did give me an answer I had been chewing over within the Simple Explanation, that being the difference between living creatures and inert elemental matter. I appreciated that clarification and incorporated it into the Simple Explanation. Otherwise, the book still stands as True. What is meant by True in this philosophical sense is whether or not the argument is coherent and internally consistent and comports with direct observation of the world. Now, as to whether or not I believe that only the Tripartite Tractate is true gnosis and the other gnostic books are mostly mythological–that is not the way I would put it. I don't take the Tripartite Tractate as more holy than other books, and there are a couple of aspects I don't fully understand or agree with. For example, the Tripartite Tractate aligns with other gnostic books in saying that there are three types of humans—the spiritual—called the pneumatic; the ordinary, emotional type called the psychic; and the material, called the hylic. The Tripartite Tractate doesn't seem to think that the hylic types are true second order powers and that they didn't exist in the beginning and will not return to the ethereal home above after death. The final page of the Tripartite Tractate codex is riddled with burned out areas from a fire, yet it seems to say, and I'm filling in some missing words: “While the material beings will be left behind until the end to perish, for they will not give their [missing words—probably acknowledgment of the Christ or allegiance to the Christ ]… If they have returned once more to that which … [missing words—probably worships the demiurge] … in the way that they were… [missing words—probably passing as humans] while they do not exist… [missing words—probably from the beginning] but they had been useful [for the] time that they were among them, even if they are not… [missing words—probably second order powers, —possibly among creation] at first, then… [missing words—possibly they were brought forth] to do something else by means of the power they had in the establishment [to] oppose them.” [yes, I realize I am interpolating a lot of missing words. if you have a more cogent interpretation, please offer it.] This final section of the Tripartite Tractate seems to indicate there are hylics among us with whom we live and work side by side who will not be redeemed at the end of time. This holds out the possibility that there are non-second order powers among us who can pass for living beings—not an uncommon thought in gnostic circles. My brother, Bill, and I contend that all life forms come from above and contain the consciousness and life of the Source. So for a non-living creature were to be born in the usual way is an impossibility. In my mind, the only way a truly non-living hylic so-called “human” could walk among us would be in the form of robotic facsimiles. There are many examples of this in science fiction, such as the cylons of “Battlestar Galactica” and the self-aware bots in P.D. Dick's “Do Androids Dream of Electric Sheep?” which became the film called “Blade Runner.” We are now be on the threshold of building and employing these newly constructed robots who appear human, appear conscious, appear living, but are actually programmed imitations that did not exist from the beginning. (Battlestar Galactica carries this very question throughout the series as the cylons become self-aware and question their relationship with God.) If that is the case, then these could be the hylics that will not return to the ethereal because they did not come from the ethereal and the end times would need to be pushed back far enough to accommodate their undetectable assimilation into society. But hey—that's just my notion. And here at Gnostic Insights I try to stick with gnostic insights, not my wild speculations. Cylons of Battlestar Galactica television series. The cylons adapt to become more and more “human.” What is true is that I believe the Tripartite Tractate describes our existence and our origins, as well as our future. But we have to remember it is at least 2,000 year old prophecy and embedded in the language and concepts of that time. Maybe the writer was indeed anticipating androids among us, but that seems an unlikely interpretation. I have been watching quite a few “alternate history” videos lately on YouTube that propose completely different backstories and histories that stretch eons into the past—histories that could indeed have been technologically sophisticated enough to produce androids that blend in with the crowd. But we're getting way into the weeds here. One reason that most readers of the Tripartite Tractate and other gnostic texts think there is an order of unredeemable humans is that they are referred to as “those who belong to the imitation.” The most basic interpretation is that those who we call materialists are the people who only believe what they can see, measure, and taste. In that sense, they belong to the imitation since the imitation is the material projection that is this cosmos. The atheists among them do not believe in the ethereal space Above, or the originating Source, and so by default they belong to the imitation. Yet, if all living creatures are children of the Fullness above, even these will return to the Fullness at the end of time. The way I reason this comes from following the logic of emanation and return—the Fullness would not be Full without them, and it is a basic proposition that nothing of the Source can ever be lost. So you see, the logic is what drives my interpretations, logic—Logos—not mythology. At least that how it seems to me. Another aspect of the imitation is the molecular structure of our world, including our bodies. We inhabit a molecular body. Our living essence, the light of consciousness that makes organisms soft and squishy and alive, literally inhabits an otherwise dead, rocky, elemental body of molecules. So everywhere we go, it goes. And when we “die” and our spirit exits this material cosmos, our hylic body is left behind. It belongs to the imitation—get it? So in this case, the hylic human refers to the elemental molecules that make up our bodies—that inert mud that the Demiurge could not raise up to life, as the mythological version goes. So, this material aspect of our earthly existence is part of the imitation and will not return to the Fullness along with our spirits because it did not exist from the beginning. It is a product of the fall. But I digress—back to the subscriber's email: Secondly, I would like to ask you a question about giving glory to God. I liked what you were saying about turning your attention away from yourself, and your ego, and to look towards the divine and offer up a prayer. I am at the stage of my journey where this is something that does not seem so completely alien, as I am moving gradually away from materialist atheism, which has been caught on my existence for the past 50 odd years. Where I get into trouble is basically the whole business of giving glory to God, because the monad who is omniscience and immutable is hardly likely to need me to do a lot of worshipping or giving glory. This was like a bit controversial, and I'm not trying to argue in bad faith, but wouldn't the demiurge himself be more likely to want humans to give glory to him than the monad? I imagine that giving glory means something to people who have come up in a Christian background, but personally it seems completely irrelevant and unnecessary – A bit like one of those business buzzwords, you hear like synergism or government types talking about inclusiveness or diversity—a sort of empty phrase that could really mean anything you want. It would be really helpful if you could unpack it a bit for me because I'm sure I'm missing something here. Giving glory is not for the benefit of the Father. Giving glory is how we tune into the Father’s resonance. Giving glory is for our benefit, not God's. Now, the God of the Old Testament, the Demiurge—is that jealous, forgetful god that thinks it’s the be-all and end-all. It does like to receive worship and glory because it feeds its ego. But the God Above All Gods, the Father of consciousness and the ALL, doesn’t need our worship and glory—you are right about that. It is we who need to give glory, not It that needs to receive glory. The Totalities of the ALL which were the first emanations from the Son, and the Aeons of the Fullness love to give glory. The Totalities do nothing but give glory to the Father, and that is a pure expression of love and devotion to the Father. It's a good thing for us, way down here in the consciousness stream, that they give unceasing glory, because they are the first emanations out of the Son and the fountain of the consciousness and love that eventually flows into all living creatures. The Totalities that give glory continuously are like an electrical plug that stays connected to the greater originating Source. As above so below—we also connect with the Source when we give glory. And since connecting with the Source cannot be accomplished when ego rules your psyche, you must be humble enough to set your ego aside and pray to/give glory to the greater Source. Surely you recognize that your ego is a lesser being than the Father of everything. If your ego does not allow you to think that, then you are not putting your spiritual foot forward but merely your ego. Our correspondent replies: Dear Cyd As usual- I’m so impressed by your clear and reasoned thinking – it is so elegant and simple. I wish I could think like that. However, there are a few things I would like to push back on respectfully. I have been dialoguing with the Demiurge – Chat GPT – and here’s what the archonic AI came up with in answer to your firm assertion that there is no mythology in the Tripartite Tractate. It basically thinks that it’s an overstatement – and I quote: The text gives an extensive creation story involving:• an unknowable Father;• the Son and the Church;• emanated aeons inhabiting the Fullness or Pleroma;• Logos making a presumptuous, defective attempt to comprehend the Father;• the production of deficiency, psychic and material powers;• a Demiurge who creates humanity;• three fundamental classes of human beings;• and a Saviour who descends to restore what has become divided. [Cyd] Let me pop in here to correct a very important error in this demiurgic version of Gnosticism. It sneaked into its answer a very demiurgic assertion that is not True: • a Demiurge who creates humanity The Demiurge certainly did not create humanity or any other living, conscious being. The second order powers—all living beings—are children of the Aeons of the Fullness, sent down into this lifeless cosmos to remind the Demiurge of the greater power Above, the true source of life, love, and consciousness. I have a habit of calling us the children of the Fullness, but the Tripartite Tractate actually calls us the fruit or the spores of the Fullness. Which is another way of saying the emanations of discreet packages of consciousness, or what I call in Simple Explanation language units of consciousness. To me, this is not mythological but descriptive to the best of our ability. Now, back to the correspondent's email: That is all mythological material. So then it rambles on quoting lots of sources etc BUT what the machine is getting at is that the difference between the Tripartite Tractate and some other gnostic texts is that there is a solid logic framework under the superstructure of mythological language and characters.This fits in with your TOE very neatly – and it is no surprise that you had an ‘OMG’ moment when you discovered the Tripartite Tractate—I would also have thought the same if an ancient text fitted perfectly into a system of thought that I had spent years developing. And you might be right—the uncanny fit could be a ‘tell’ that this truly IS the way of everything. On the less interesting point of contention though – I must disagree with you – there IS mythology in the Tripartite Tractate superstructure – the language is mythological – maybe less so than other gnostic texts. As an aside, as a writer – I would also say -there is nothing particularly bad about being mythological either. To which I reply: I have to laugh at using Dialogue with Demiurge AI as a trustworthy source. lol. I will see your Chat GPT and raise you Microsoft CoPilot AI (poker language, I assume you recognize). My AI says this: “This work presents a restored cosmology of the Fullness — a structural, metaphysical account of creation, fracture, and restoration. It is not myth, nor allegory, nor theology in the conventional sense. It is architecture: a precise description of how consciousness, relation, and harmony operate across the three great phases of existence.” I like that description—that the Tripartite Tractate gives the metaphysical architecture of consciousness rather than a myth. I always like to take the higher, meta view of information, which is literally a step above the normal language and arguments. That’s the secret of how I observe and reconcile seemingly irreconcilable positions—by looking up above the words for the meaning behind them. It seems to me that most people are lost in the language and “can’t see the forest for the trees.” Not meaning you, necessarily, it’s just my observation of how understanding goes awry. By taking the meta approach, the concepts automatically simplify as many points of view and language choices are collapsed into their base meanings. The words I use in my Simple Explanation of gnosis and science and everything else are not written in stone. They are my attempt to convey large concepts in the simple, most recognizable forms. If I say “god” it’s because people are familiar with that term. I offer alternative words, like Source, Mother-Father, Metaverse, the Great One, the Origin, so that people will see that the particular word is less important than what it represents and that what they think of as god has a broader meaning than the meme they have been holding onto. These images from my well-worn copy of the Tripartite Tractate of The Nag Hammadi Scriptures edited by Marvin Meyer, show you the process by which I read and interpret arcane texts. I put the language into illustrated concepts and words I can recognize and understand. The writer shared this final thought from the Chat GPT: There is also a genuine philosophical difficulty: how can a perfect and harmonious divine Fullness generate an irrational act? Saying that Logos possessed the capacity to exceed his proper limits explains the mechanism only by placing the possibility of deficiency inside the supposedly perfect order. He says, I think that is actually a pretty decent question from our AI demiurge—right? I expect that you have a great answer though. To which I reply: As to the Demiurge’s new question that you have put forth in this email—that’s an old canard that is often trotted out to stump theists. “How could a good and perfect God allow for the creation of evil?” I am not at all stumped by that question. The answer can most simply be stated in two words: Free Will. If we begin with the premise that the Father/Source/etc. emanates its entire nature outward with its emanation, then obviously free will is a part of that emanation. After all, it is inarguable that the Source possesses free will. The Aeons have free will. Logos is an Aeon. Logos has free will. While the rest of the Aeons were using their free will to cooperate with each other and to glorify the Father and the Son, Logos used its free will to go in a fresh direction. Logos thought it would be going upward to rejoin the highest glory. The Tripartite Tractate says that Logos didn’t realize this was in impossibility, because no one can approach the power source that is the Origin without being annihilated. And like a magnetic polarity, Logos was repelled by the Source and was knocked out of alignment with the Fullness (the fall). This dissonance became our material cosmos. And because Logos had free will, we have free will. This all flows logically from the a priori definition of the Source. This may sound mythological, but it is not. It could be easily described in scientific terms. Like the way a beam of focused light still allows for stray photons to go off beam. Or boiling water in the kettle mostly clumps together on the top of the water as bubbles, but some bubbles go outward to the edge of the kettle and pop. And so forth. The limit is our language, not the architecture or process. The limit is also imposed by the meme bundle being held the human observer-inquirer when their memes do not allow for certain possibilities to be seen and accepted. It is our meme attachments that limit our capacity to observe and learn. So says me.

This week, we are joined by Ondrej Kubovič, Security Awareness Specialist from ESET, discussing their work on "FrostyNeighbor: Fresh mischief and digital shenanigans." Ondrej walks us through ESET's latest research into FrostyNeighbor, a long-running Belarus-aligned cyberespionage group that has continued to target Ukrainian government organizations with increasingly sophisticated spearphishing campaigns. We discuss how the group uses malicious PDF lures, server-side victim validation, and an updated JavaScript-based malware chain to selectively deploy espionage tools, demonstrating its ongoing efforts to evade detection while compromising high-value targets across Eastern Europe. The research and executive brief can be found here: ⁠FrostyNeighbor: Fresh mischief and digital shenanigans

Robin Heinze and Tyler Williams of Infinite Red unravel Fabric, React Native's modern rendering system. No sewing required! They explain how Fabric speeds up mobile apps and unlocks concurrent React features for smoother software engineering. Connect With Us! Robin Heinze: @robinheinze Tayler Williams: @coolsoftwaredev React Native Radio: @ReactNativeRdio   This episode is brought to you by Infinite Red Infinite Red is a premier mobile app consultancy, especially focused on Expo and React Native, located fully remote in the US. We're a team of 30 with highly experienced mobile app developers and have been doing this for over a decade. We are also one of the first development teams to adopt agentic coding in a way that keeps high quality standards and aren't afraid to do things the old school way if we need to. If you're looking for mobile app or React Native or Expo expertise for your next project, hit us up at infinite.red/radio.

Alf Dobbert-Baums: Success Is When the Team Gets Closer to the User Read the full Show Notes and search through the world's largest audio library on Agile and Scrum directly on the Scrum Master Toolbox Podcast website: http://bit.ly/SMTP_ShowNotes.   "Getting closer to the user — it's always very good to get the feedback from the user." - Alf Dobbert-Baums   For Alf, success as a Scrum Master is measurable in proximity: how close did you get the team to the actual user? He tells a small story that makes the point bigger than it sounds. In a sprint review, a user mentioned an annoying detail — clicking an item in a long list opened a popup, and when you closed the popup, the focus jumped back to the top of the list. Four hours later, the team had fixed it. A small JavaScript change saved a whole customer-center team from scrolling back to find their place dozens of times a day. The shift Alf coaches is treating the review as a working meeting, not a demo. Users don't clap and leave — they discover. They surface the thing the PO doesn't see, because the PO has perspective and the user has the actual workflow (often with three other apps open at the same time). Alf credits a usability test he once ran for opening his eyes: "Why are you clicking there? Nope, she wouldn't click on there." When the developer sees a real person use the software, the product changes. The guessing stops.   In this segment, we refer to Shift: From Product to People by Michael Dougherty and Pete Oliver-Kruger and their Usability Theater technique — getting users to use the product while the team watches, the way you'd watch a play.   Self-reflection Question: When did your team last watch a real user use the product — and if it's been a while, what's stopping you from inviting one to your next review? Featured Retrospective Format for the Week: The Classic Four — Prime Directive + Good / Learned / Change / Puzzles Alf's favorite retro is one of the very first. Open with the Prime Directive, then walk the team through four questions: what was good, what did we learn, what should we change, and what still puzzles us. Alf likes it because it celebrates successes, shares knowledge, and — through the "puzzles" question — gives space for the unresolved things people carry in their heads. But he wants to stress one thing most teams skip: revisit the agreed improvements in the next retro. Did you do them? Are they still relevant? Did the world change? Even improvements that didn't work give you information — about who to involve next time, what was missing, what was too much. Without revisiting, every retro starts from scratch.   [The Scrum Master Toolbox Podcast Recommends]

How do I properly evaluate a technology? How do I know if using AI is good or not? What is the right programming language? What is the best JavaScript framework? These are the questions we will answer in today's episode of DevQuestions.Website: https://www.iamtimcorey.com/  Ask Your Question: https://suggestions.iamtimcorey.com/ Sign Up to Get More Great Developer Content in Your Inbox: https://signup.iamtimcorey.com/

Robin and Mazen tackle a listener Q&A covering React Native, AI, mobile development, Expo Router, Flutter, performance, consulting, and code quality. They share practical engineering insights, real world stories, and why React Native continues to thrive in the age of AI.   Connect With Us! Robin Heinze: @robinheinze Mazen Chami: @mazenchami React Native Radio: @ReactNativeRdio   This episode is brought to you by Infinite Red! Infinite Red is a premier mobile app consultancy, especially focused on Expo and React Native, located fully remote in the US. We're a team of 30 with highly experienced mobile app developers and have been doing this for over a decade. We are also one of the first development teams to adopt agentic coding in a way that keeps high quality standards and aren't afraid to do things the old school way if we need to. If you're looking for mobile app or React Native or Expo expertise for your next project, hit us up at infinite.red/radio.

 PHP Podcast – July 16, 2026 Hosts: Joe Ferguson, Sara Golemon, and Holly Schilling Joe hosts with Sarah and Holly while running on no sleep. The PHP Tech 2027 CFP opens, a fake PHP 9 pitch appears, we crown Holly the accidental main character of internals, and everyone agrees dark mode flashing white is a war crime. PHP Tech 2027 CFP Is Open (And Yes, the Year Is Right This Time) The big news kicking off the show is that the PHP Tech CFP for 2027 is live and open. You can find it over at Sessionize under php-tech-2027, and unlike a certain demo from the previous week, the date on it is actually correct. There was a brief moment where it displayed 2007, but the team fixed that rather quickly, so credit where credit is due. The crew marveled at the fact that we are somehow less than six months out from 2027, which spiraled into a conversation about kids getting learner’s permits, full beards showing up on children who were toddlers just yesterday, and whether anyone’s offspring might actually submit a talk. Helldivers came up. Freedom was spread. And there was a gentle suggestion that SoCalKid and their newly engaged fiancé should be sent the CFP URL immediately. Meanwhile, PHP Tech 2026 videos are rolling out on PHP Tech TV. There are currently 37 available with more still processing thanks to some technical and room issues at the event. Several talks are completely free, including Joe’s talk on modernizing DevOps, Kaylin’s “Modernize Your Old School Endpoints with HTMX,” and both of Ben Ramsey’s talks. Working Groups, Discord, and the People Who Actually Care The conversation turned to the internals process and Ben Ramsey’s working group proposal on the internals mailing list, which the crew encouraged everyone to actually read. The idea of giving working groups some autonomy and even decision-making power drew broad agreement as a way to produce more fully-fleshed RFCs rather than one person’s implementation of a giant feature. A recurring point of confusion is the reference to “Discord conversations” in RFCs. There is no official PHP.net Discord, but phpc.chat will get you to the Discord (and previously the bridged IRC). The PHP Internals channel is where a lot of discussion happens, though far from the only place, and there are also the PHP Foundation and new Foundation Ambassadors channels. Big appreciation went out to the moderators keeping that Discord spam-free and troll-free, with a special shout to Tiffany, who is an absolute machine at helping people, pointing them in the right direction, and posting top-tier cat pictures in the pet flexing channel. The recurring theme: decisions are made by the people who show up. Silence is acquiescence, and if you have issues, speak up. Holly famously just showed up in internals one day, started talking, and they let her stay. This Week in Internals and the Co-Scientist Show Joe wanted to highlight Artisan Build’s YouTube channel, specifically their “This Week in Internals” videos. They are fantastic recaps of what’s happening in the internals world, complete with a very light sprinkling of extremely dry comedic timing that lands perfectly. The videos break down email threads and RFCs into easily digestible summaries of what people are arguing over, then poke a little fun at the sillier arguments. A weekly recap drops regularly and it’s consistently great content for anyone curious about internals. The crew was also impressed by the host’s ability to nail every name pronunciation on what seems like the first try, which spiraled into Holly’s confession that she has a hard memory limit on names learned after kindergarten. Anyone new is simply “out of bounds.” Holly’s Fake PHP 9 Pitch: Structs, Modules, and Surfaces Holly walked through a blog post on eventuallywrong.com featuring a fake PHP 9 pitch full of flagship features she’s prototyped. It kicked off with extensions, which she discovered didn’t exist while trying to build the Longhorn app in native PHP, landing her at the top of that internals video. Next came structs, which started as an attempt to build tuples (turns out full structs were easier). They’re Swift-style value types with strong typing, and after some grumbling at Larry, she reworked things to support interfaces and traits, leaning into composition over inheritance. Modules got the PHP-style treatment: a simple module definition, a public interface declaration, and a new `internal` visibility level that lets members be accessed within the same module. No autoloader modifications required, and reflection remains the escape hatch as always. Finally, surfaces — a keyword that adds a perpendicular-to-visibility scope. A method can belong to a surface, and callers simply declare they want to use that surface of the class. Holly performance-tested it: no impact if unused, minimal impact if used. She also spent a good chunk of the show against friend classes, arguing they’re leaky, unrestricted, and if you’re going to hand out full access to your privates, you shouldn’t have marked them private in the first place. Release Management, Version Stats, and Upgrade Paths Holly is a first-time PHP 8.6 release manager alongside Matteo Beccati, with veteran Daniel Scherzer (also on 8.5) rounding out the team. She stepped down from RM in a prior election because others wanted the work — a reminder that people stepping up in open source is a rarity worth celebrating. Release management, she noted, is less a social job and more about moving data at the right time and signing things. The July 2026 PHP version stats got a thumbs up. Looking at the trends, 8.5 is clearly on the rise, 8.4 climbing slightly, 8.3 starting to trend down, and 8.2 falling harder — exactly the curve you want, with the vast majority sitting inside the support window. Joe shared that upgrading apps from PHP 7 to 8.3/8.4/8.5 has been a much easier lift than the older 7.x hops, thanks to a more consistent release cadence and better deprecation guidance. Holly pushed back on the idea that 5.6-to-7 was ever hard, while Joe pointed out the real pain came from jumping ancient 5.0/5.1 codebases straight to 7 back before Claude existed. There was also a very in-depth debugging tangent about an opcache build flag no longer being needed on 8.5. Accessibility, Dark Mode Crimes, and the JetBrains Survey The JetBrains State of PHP survey is open, and everyone should go take it — there’s even a chance to win one of five vouchers. This led to a discussion about whether JetBrains usage is being decimated by AI tooling, with Holly living almost entirely in the terminal with Claude Code these days while Joe remains loyal to PHPStorm and PyCharm. Sarah, who is going blind and is not joking about it, kicked off a passionate segment on accessibility. Test your apps with a screen reader. Respect font scaling and contrast (F0F0F0 text on white is a genuine crime). Respect the OS toggles for reduced motion, because autistic users and others depend on them and apps routinely ignore them. The crew then united around dark mode etiquette: the only reasonable default is system-selected, and the white flash between two dark-mode pages is caused by JavaScript-based theme switching instead of sane CSS selectors. It is, universally agreed, the worst. The episode closed on eye-tracking privacy (Apple Vision Pro good, Oculus terrifying), heat maps, and a laptop-camera-covering tangent that got appropriately unhinged before Joe called it on that bombshell. Links from the show: PHP Tech 2027 CFP — Now open on Sessionize eventuallywrong.com — Holly’s fake PHP 9 pitch phpc.chat — Get to the PHP Discord store.phparch.com — Now with socks Hosts: Joe Ferguson X: @shocm Mastodon: @joepferguson@social.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners PHP Architect Consulting Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Displace Infrastructure Management, Simplified Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease. https://displace.tech/ OurCVEs Your security posture, on autopilot with OurCVEs CodeRabbit Cut code review time & bugs in half instantly with CodeRabbit. Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.07.16 appeared first on PHP Architect.

Sponsored by Blocks: Save at least 20% on your AWS costs with AI-powered optimization and enterprise discounts. Get your free Cloud Check at blocks.cloud/alphalist → https://blocks.cloud/alphalist?utm_source=alphalist&utm_medium=podcast&utm_campaign=blocks-podcast-2026 Vaibhav Gupta built computer vision for the original Microsoft HoloLens, optimized AR at Google, and wrote high-performance assembly at D.E. Shaw, then left it all to start from scratch. After a YC pivot away from a Slack competitor he was told not to build, he landed on something foundational: BAML, a programming language for a world where humans increasingly don't read code. His thesis: every software leap came from a new compute paradigm getting its own language assembly, C, Java, JavaScript and LLMs are the next primitive. They're probabilistic and non-deterministic, which breaks our deterministic tooling. In this episode, Vaibhav explains why "shipping at agent speed" is really a problem of trust and control, why 90% of engineering is plumbing AI will delete, why "English as a programming language" can't work, and why the world has a mathematically infinite appetite for software. Topics covered: - Why LLMs are a new compute primitive and why that justifies a new language - BAML: an embedded, type-safe language for structured LLM outputs across any language - Shipping at agent speed as a problem of trust, locking, and granular control - Why traditional CI/CD breaks in an agent loop - The "data trench" one type system across code, backend, and data - Why 90% of engineering is plumbing, and what changes when AI removes it - Where SaaS pricing and product models are heading

Modern browsers have evolved dramatically over the past two decades, quietly absorbing many features that once required custom JavaScript or third-party libraries. In this episode, Matt and Mike explore native browser capabilities including form validation, accordions, dialogs, popovers, lazy loading, and responsive images. Along the way, they discuss why letting the browser handle more of the work can improve accessibility, performance, maintainability, and the overall developer experience - without becoming dogmatic about JavaScript. Show Notes: https://www.htmlallthethings.com/podcast/javascript-isnt-always-the-answer-native-browser-features-every-developer-should-know Use our Scrimba affiliate link (https://scrimba.com/?via=htmlallthethings) for a 20% discount!! Full details in show notes.

OpenJDK recently resurrected Project Detroit, an effort to ease Java's interoperability with Python and JavaScript. Interestingly, while both integrations will work through the _java.scripting_ API, there are still differences between them. On top of that, the JavaScript integration needs to explain how it related to the removal of Nashorn in JDK 16. In this "Ask the Architect" episode of the Inside Java Podcast, recorded during JavaOne 2026, Nicolai Parlog talks to Mikael Vidsted, lead of the Java Virtual Machine team at Oracle, about Project Detroit. Project Detroit: https://openjdk.org/projects/detroit/

Rich Harris joins the podcast to discuss his talk, fine-grained everything, exploring fine-grained reactivity, frontend performance, and the real costs of React Server Components and RSC payloads. Rich explains how Svelte and SvelteKit approach co-located data fetching, remote functions, and RPC to reduce server-side rendering costs, improve developer experience, and avoid unnecessary performance overhead on mobile networks. The conversation dives into async rendering, parallel async data fetching, type safety with schema validation, and why async-first frameworks may define the future of JavaScript frameworks and web performance. Links X: https://x.com/Rich_Harris Github: https://github.com/rich-harris Bluesky: https://bsky.app/profile/rich-harris.dev Resources Modern front-end frameworks like Svelte are astonishingly fast at rendering, thanks to techniques such as signal-based fine-grained reactivity. But there's more to performance than updating the screen at 60 frames per second. In this talk, we'll learn about new approaches that help you build fast, reliable, data-efficient apps. Slides: https://fine-grained-everything.vercel.app/1-1 We want to hear from you! How did you find us? Did you see us on Twitter? In a newsletter? Or maybe we were recommended by a friend? Fill out our listener survey! https://t.co/oKVAEXipxu Let us know by sending an email to our producer, Elizabeth, at elizabeth.becz@logrocket.com, or tweet at us at PodRocketPod. Check out our newsletter! https://blog.logrocket.com/the-replay-newsletter/ Follow us. Get free stickers. Follow us on Apple Podcasts, fill out this form, and we'll send you free PodRocket stickers! What does LogRocket do? LogRocket provides AI-first session replay and analytics that surfaces the UX and technical issues impacting user experiences. Start understanding where your users are struggling by trying it for free at LogRocket.com. Try LogRocket for free today. Chapters Special Guest: Rich Harris.

Welcome to the final episode of Season #12 of the PolicyViz Podcast! Thanks so much for checking out the show this season and I hope you enjoy your summer. I'll be back this fall with more great episodes.On this episode of the show, I'm joined by David Aerne, a freelance developer and designer based in Zurich who has spent years building a remarkable collection of open-source color tools. We dig into the difference between color models, color spaces, and gamuts, and David explains why thinking about color in three dimensions—like navigating a cylinder—can make choosing palettes so much more intuitive. We talk through several of his projects, including Color Names (a curated list of nearly 32,000 community-contributed color names), Rampensau for generating color ramps, and the playful RYB-inspired explainer that simulates how physical, “printy” colors look on screen. David shares his philosophy that we should integrate the systems that generate colors into our work, rather than freezing a static palette and losing the creativity along the way. Whether you build dashboards, design slides, or just love playing with color, this conversation will change how you think about picking your next palette.Keywords: color theory, color palettes, data visualization, color tools, HSL, HSV, RGB, color models, color spaces, open source, generative art, color ramps, design tools, JavaScript, web development, pixel art, PolicyViz Podcast, David AerneSubscribe to the PolicyViz Podcast wherever you get your podcasts.Become a patron of the PolicyViz Podcast (https://patreon.com/policyviz) for as little as a buck a monthFollow David Aerne on Bluesky and X (@meodai) and explore his open-source projects at elastiq.chFollow me on Instagram, LinkedIn, Substack, Twitter, Website, YouTubeEmail: jon@policyviz.com