A few weeks ago I posted that my skills were a mess: mine, third-party ones, customised ones, all scattered across global installs, claude plugins, copies, and symlinks.
So I built SkillStash, a free Mac app.
Clone skill repos into one git repo. Link any skill into any project. Pull once and every project gets the update.
Legend.
Let’s see your agent pull off a takedown like this.
Replying to @valvesxyz
I like to look at claims like this in case I can improve Ghostty. I grabbed your source and immediately spotted the issue: your read loop overwrites a 64 KiB ring. Everything older is discarded unparsed per tick. You're faster because you're not actually terminal emulating.
It means the number isn't a throughput number. In a kitten benchmark run at the rate you're claiming, roughly 6.6 MB arrives per 60 Hz tick and 64 KiB of it gets parsed. You're read(2)-ing 100% of the data and parsing about 1% of it.
There are other minor issues (a small fixed scrollback in a preallocated ring buffer, no grapheme clustering, throwing away data like OSC 8 URIs, etc.), but the major one is simply that you're discarding ~99% of the input.
For plain text, e.g. your cat benchmark, the final screen ends up looking right, but the scrollback is missing 99% of the file and each retained chunk starts mid-line. As soon as there are escape sequences in the dropped spans, your emulator is fully out of sync and invalid: a cut inside a CSI prints the parameters as text, and any SGR, mode, title, or alt-screen change in the gap is just... gone.
FYI, this is why I don't like when people point at refterm as a terminal benchmark. refterm implements a TINY subset of what a terminal emulator must support, it's closer to a fast file reader, not a terminal emulator.
I also don't mean any shade by this. I like to look at technology objectively to try to learn something and improve my own craft and work. So I'm sharing what I found.
I modified your code very slightly to parse on every full buffer (rather than per tick). And the results are attached. Both use main commit in each repo at the time of this post.
Note the graph is in log scale, the discrepancy between performance for things like Kitty images is measured in GB/s.
Very happy with this workflow I built for preview environments on @laravel Cloud. 💪🏼
I'm giving Laravel Cloud a go because Preview Environments is such a neat feature.
But I wanted to use my own custom domain instead of the default one (some services require whitelisted domains, and I prefer Cloudflare Access over HTTP auth).
So I built it on @Cloudflare.
When a new preview environment is deployed, a Cloudflare Worker is notified via webhook. It turns off the default domain, sets up the custom domain, and updates the PR. Then it pings me on Slack when it's ready for review.
They're calling it Paw Patrol.
Sid ™️ retweeted
There must exists an app with PHP, deployed on Railway, with calls to cURL, with other services written in node that use Brotli compression running on a couple day old Linux, with their code self managed on GitLab
They are having a hell of a week
I wonder if everyone proxying their site via Cloudflare understands that it’s not enough.
Add a firewall to your server that whitelists Cloudflare IPs only.
cloudflare.com/ips-v4
cloudflare.com/ips-v6
If you want to go further, enable Authenticated Origin Pulls (mTLS) with a zone-level certificate.
developers.cloudflare.com/ss…
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Peak r/LinkedInLunatics material.
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Added my newest @claudeai skill, "artifact conventions" to Claude Kit.
It follows the project's DESIGN.md file if it exists or uses the bundled design file.
The best part is the "Decisions" block that artifacts usually have at the end. I made it interactive so that I can copy/paste my responses back into Claude Code.
Sid ™️ retweeted
we shipped a new type of model: an extraction model!
pass it unstructured data, and get a list of the details and probability back. try it out and let us know what you think!
blog.cloudflare.com/clairic-…



















