Michael Lynch

In my April retrospective, I reveal my double life as a bug bounty hunter and debate whether I should continue cybersecurity research or just focus on my book about helping devs improve their writing https://mtlynch.io/retrospectives/2026/05/

Darn! Forgot to take this bet.

@zekjur@mas.to I found the examples to be pretty reasonable and in most cases didn't violate consistency

I bought parts for my last PC on Black Friday 2024. I bought 64 GB of RAM for $209.99. Price today for the same exact sticks: $979.99

RE: @thienantran@mastodon.social

With AI-generated writing flooding the Internet, a lot of people ask me how to avoid "sounding like AI." One great way is to lean into your personality. Developers have a tendency to sanitize their writing to sound clinical and impersonal. Thienan's post is an excellent example of a blogger who's willing to sound like themselves.

@danb@fosstodon.org I enjoyed your OpenCode sandboxing post! One tweak that adds a good amount of security for not much cost is using rootless podman (drop in replacement for docker). You can prevent the container from accessing your local network and also drop OS privileges you don't need with a couple extra flags

AI has good suggestions for bad writing but bad suggestions for good writing.

@mitchellh impressive for bugfinding but that fuzzer fucking sucks at Tetris

@agwa I use Claude Code + Opus 4.6 and Codex + GPT5.4. I've had Opus 4.7 refuse any kind of security work, and Opus 4.6 refuses to develop actual exploit PoCs when it discovers an RCE, but it will do the rest of the security research. I didn't have to do any kind of cajoling to bypass policy, though I don't use the exact prompt from Ptacek's post. Happy to share more over email.

@danluu I had a similar experience with LLMs and was writing fuzzers for Firefox for several weeks. And then I discovered that for 80% of the issues I was finding, I didn't even need to write the fuzzer. I can just ask the LLM where the bugs are and it finds them with basic code auditing. My pattern now is to have an LLM do several passes of auditing and then recommend places to hit harder with an LLM-generated fuzzer.

@mullvadnet I like this, but this seems like the legislative equivalent of vaporware. Do they even have a bill draft? Why is the only call to action to just give money rather than contacting our representatives to support the bill?

I made my first contribution to Firefox. It's a one-character fix to prevent a crash when reading a particular type of malformed Ogg-Vorbis media file. Surprisingly fast review from Mozilla! Reviewed and merged in under 1h. https://phabricator.services.mozilla.com/D288636