Deep dives on AI, web engineering and the infrastructure underneath — written for people who have to run the thing in production. Diagrams and measured numbers over adjectives.
cfsolve claims to solve Cloudflare Turnstile with no headless browser. Reading its source offline shows it replays recordings of a real browser, and what that means for a site owner.
GitHub, npm and Open VSX all skip 2.1.313, yet Cursor says a malicious build with that number was served for 11 hours. What the reports agree on, where they conflict, and a read-only check of one PC.
A Hacker News post said Claude Code burns 15 to 20 percent of tokens on a status line. The status line is innocent. I reproduced the real culprit, an agent summary, and measured what it costs.
I modeled the KV-cache page reuse behind Cloudflare's GLM-5.3 leak. A fresh pool leaks nothing, a warm one hands over other customers' pages, and every reply still returns HTTP 200.
Node, .NET, curl and others each carry their own Brotli decoder. I counted the places on one Windows PC and tested which clients decode Brotli they never asked for.
I unpacked Python images layer by layer and rebuilt them with common Dockerfile habits. A later rm saved nothing on the wire, and half of pandas in the image was its own test suite.