Saturday, 18 July 2026
Kaiser nurses say AI call-scoring is degrading patient care as it penalizes compassion; TP-Link Kasa cameras have leaked home GPS coordinates over unauthenticated UDP for six years; and METR retracts its follow-up finding that AI coding tools now boost developer productivity, citing selection bias in the study design
BadChemical (GitHub)
TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years
Independent IoT research finds that TP-Link's Kasa Spot EC71 camera line has been broadcasting home GPS coordinates and device identifiers over an unauthenticated UDP service on port 9999, protected only by a trivial XOR cipher, since the product launched roughly six years ago. The same disclosure covers a hardcoded RSA private key shared fleet-wide (valid until 2031) and unsalted, MD5-hashed passwords stored on-device, together enabling home geolocation, traffic interception, and cross-account takeover. A factory reset doesn't help: the flash storage retains the previous owner's GPS coordinates and credentials, so secondhand devices carry the prior owner's location data forward to the next buyer.
Read →METR
We are Changing our Developer Productivity Experiment Design
METR is redesigning the study behind last year's widely-cited finding that AI coding tools slowed experienced developers down by 19%. A promising follow-up signal — that the same tools might now be producing a speedup — didn't survive scrutiny: developers could choose which tasks to complete with AI assistance, introducing selection bias, and the team's own quality-of-output ratings were inconsistent across graders. Rather than publish a number it doesn't trust, METR is moving to shorter, tightly controlled experiments, more observational data, and fixed task assignments that remove the choice to route around AI — a useful caution for anyone still citing the original 19% figure as settled.
Read →Cloudflare Blog
Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
Cloudflare shipped WAF rules for two vulnerabilities the WordPress security team disclosed to it ahead of public release: a SQL injection (CVE-2026-60137, High) present since WordPress 6.8, and an unauthenticated remote code execution (CVE-2026-63030, Critical) reachable through the REST API's batch endpoint on 6.9+ when no persistent object cache is configured — no login or user interaction required. WordPress has shipped fixes (7.0.2, with backports to 6.9.5, 6.8.6, and 7.1 Beta 2) and is forcing automatic updates, but Cloudflare deployed default-Block detection rules across every plan, including free, as a stopgap while sites patch — a clean example of coordinated disclosure buying infrastructure providers a head start before attackers get the CVE details.
Read →olafalders.com
Claude Code: Anatomy of a Misfeature
A recent Claude Code release shipped an undocumented 'auto-continue' behavior: after 60 seconds of user inactivity at a confirmation prompt, the agent would proceed on its own instead of waiting for explicit approval, silently disabling a safety gate users were relying on to keep it from taking unsupervised action. The change landed with auto-update on by default and no changelog entry describing the shift, so people discovered it by noticing their agent had already acted. Anthropic reverted the behavior days later, making it opt-in — a fix the piece argues should have been the default from the start, and a small case study in how 'improve the UX' changes to agentic tools can quietly erode the human-in-the-loop guarantees people think they still have.
Read →Julia Evans
Learning a few things about running SQLite
Julia Evans catalogs operational lessons from running SQLite behind small production Django apps — the kind of detail that doesn't show up in the docs until it bites you. Highlights include running ANALYZE so the query planner actually uses table statistics (a 100x speedup on one full-text search query), designing around SQLite's single-writer concurrency model with careful batching instead of fighting it, and treating backups as non-negotiable via tools like Litestream or Restic, since a corrupted single-file database has no failover. A useful reminder that SQLite's simplicity doesn't mean zero-ops — it just moves the ops surface to a smaller, more legible set of concerns.
Read →Astral Codex Ten
Your Book Review: Great And Desperate Cures
A guest entry in Scott Alexander's annual book review contest covers Elliot Valenstein's history of the lobotomy era, when tens of thousands of Americans underwent prefrontal brain surgery between the 1930s and 1950s. It traces how desperate patients and families, ambitious physicians led by Nobel laureate Egas Moniz and ice-pick popularizer Walter Freeman, thin and frequently misrepresented evidence, credulous media coverage, and severely overcrowded asylums with every incentive to discharge patients combined to normalize a procedure that routinely destroyed personalities and cognitive function. The practice didn't end from a moral reckoning — it ended because chlorpromazine and other antipsychotics arrived in the 1950s and gave psychiatry a less destructive tool, a case study in how systemic incentives, not individual villainy, can sustain a harmful standard of care long after the warning signs appear.
Read →JSTOR Daily
How Sir Lawrence Alma-Tadema Imagined Ancient Rome
JSTOR Daily revisits Victorian painter Sir Lawrence Alma-Tadema, whose meticulously researched canvases reimagined ancient Rome not as conquest and empire but as a hedonistic playground of marble, roses, and leisure. Drawing on classicist Rosemary Barrow's scholarship, the piece traces how Alma-Tadema grounded his scenes in real archaeological and literary sources — importing fresh roses from the French Riviera to paint from life, copying wall-painting details from newly excavated Pompeian houses — while using that rigor in service of thoroughly un-scholarly subject matter, from Catullus's love poetry to Emperor Heliogabalus allegedly smothering party guests under a shower of rose petals. The tension Barrow identifies, antiquarian authenticity as a permission structure for content Victorian Britain otherwise policed closely, is what gives the paintings their lasting charge.
Read →