DEV Community

frank chu profile picture

Work

Meta

Reylo types .sql files by asking your database. I tried to fool it five ways.

Reylo types .sql files by asking your database. I tried to fool it five ways.

Comments
5 min read

Want to connect with frank chu?

Create an account to connect with frank chu. You can also sign in below to proceed if you already have an account.

Already have an account? Sign in
Goose claims a 29-byte record and 3.3x over C++. I measured both.

Goose claims a 29-byte record and 3.3x over C++. I measured both.

Comments
5 min read
OpenAI shipped a php2shell checker. I ran it against 65 sites. All 65 said UNKNOWN.

OpenAI shipped a php2shell checker. I ran it against 65 sites. All 65 said UNKNOWN.

Comments 1
4 min read
HatchZip promises to extract an 839 MB archive in 839 MB of disk. I measured the blocks.

HatchZip promises to extract an 839 MB archive in 839 MB of disk. I measured the blocks.

Comments
5 min read
Astral wired ty into uv. I ran uv check on a project with four deliberate errors.

Astral wired ty into uv. I ran uv check on a project with four deliberate errors.

Comments
5 min read
I scanned my machine for the Brotli RCE. Three stacks were exposed — and the patched one still reports the vulnerable version.

I scanned my machine for the Brotli RCE. Three stacks were exposed — and the patched one still reports the vulnerable version.

Comments
7 min read
I generated 1,000,000 UUIDv7s. Python's are perfectly monotonic — in one process, with a behaving clock.

I generated 1,000,000 UUIDv7s. Python's are perfectly monotonic — in one process, with a behaving clock.

1
Comments 1
6 min read
I measured softmax's precision cliff. In fp32, cross-entropy returns exactly zero at margin 16.

I measured softmax's precision cliff. In fp32, cross-entropy returns exactly zero at margin 16.

Comments
7 min read
Quad9 is leaving France on Nov 24. I probed its DoH — it's the only resolver here that requires HTTP/2 or nothing.

Quad9 is leaving France on Nov 24. I probed its DoH — it's the only resolver here that requires HTTP/2 or nothing.

Comments
4 min read
OpenSSL 4.1.0 shipped today. I built it and measured ML-KEM, ML-DSA, and DTLS 1.3.

OpenSSL 4.1.0 shipped today. I built it and measured ML-KEM, ML-DSA, and DTLS 1.3.

Comments
4 min read
eMudhra quit the CA business today. I checked your trust store — its roots are still in it.

eMudhra quit the CA business today. I checked your trust store — its roots are still in it.

Comments
4 min read
I built OpenShell's Z3 policy prover and ran 29 checks. It caught everything except the metadata address.

I built OpenShell's Z3 policy prover and ran 29 checks. It caught everything except the metadata address.

Comments
5 min read
Python 3.15's lazy imports cut my test CLI from 164 ms to 28 ms. The cost didn't disappear — it moved.

Python 3.15's lazy imports cut my test CLI from 164 ms to 28 ms. The cost didn't disappear — it moved.

Comments
4 min read
I built FoxIO's 54 KB HTTP/3 accordion by hand. aioquic's decoder unfolded it to 200 MB.

I built FoxIO's 54 KB HTTP/3 accordion by hand. aioquic's decoder unfolded it to 200 MB.

Comments
5 min read
LiteLLM 1.107.0 stole credentials from every Python process. I checked PyPI and reproduced the mechanism with a canary

LiteLLM 1.107.0 stole credentials from every Python process. I checked PyPI and reproduced the mechanism with a canary

Comments
5 min read
DuckDB 2.0 shipped today. I ran its headline features — triggers work, VARIANT has a silent-NULL trap

DuckDB 2.0 shipped today. I ran its headline features — triggers work, VARIANT has a silent-NULL trap

Comments
5 min read
I installed Google's TorchTPU wheel — 969MB — on a machine with no TPU and ran the README example

I installed Google's TorchTPU wheel — 969MB — on a machine with no TPU and ran the README example

Comments
5 min read
PHP's 9.2 RCE fix was public for three days before the release. I read all 11,747 lines of it.

PHP's 9.2 RCE fix was public for three days before the release. I read all 11,747 lines of it.

1
Comments
5 min read
Cloudflare says its Rust TypeScript port is 8x faster. I measured 5.3x — and 72% less memory.

Cloudflare says its Rust TypeScript port is 8x faster. I measured 5.3x — and 72% less memory.

Comments
5 min read
Eight CA private keys were integers under 256. I recovered all eight in 11 milliseconds.

Eight CA private keys were integers under 256. I recovered all eight in 11 milliseconds.

1
Comments
6 min read
WhatsApp's help pages hid instructions for AI. I probed the live pages with 7 user-agents.

WhatsApp's help pages hid instructions for AI. I probed the live pages with 7 user-agents.

Comments
4 min read
DeepSeek open-sourced its production inference engine today. I counted what's in it — and what's not.

DeepSeek open-sourced its production inference engine today. I counted what's in it — and what's not.

Comments
4 min read
Mistral shipped a time-series foundation model today. I measured its latency — and its confidence.

Mistral shipped a time-series foundation model today. I measured its latency — and its confidence.

1
Comments 2
4 min read
GhostAction now scans your git history for secrets. I deleted 30 keys and recovered all 30.

GhostAction now scans your git history for secrets. I deleted 30 keys and recovered all 30.

Comments
5 min read
One hash is enough for a Bloom filter. I measured it — and the 52% cliff when you break its one rule.

One hash is enough for a Bloom filter. I measured it — and the 52% cliff when you break its one rule.

Comments
4 min read
Someone built a programming language to break LLMs. I ran it.

Someone built a programming language to break LLMs. I ran it.

6
Comments 1
4 min read
OpenCode's breach exposed provider keys for 1.4% of Console users. I checked what that number can and can't tell you.

OpenCode's breach exposed provider keys for 1.4% of Console users. I checked what that number can and can't tell you.

Comments
4 min read
DeepSeek charges $0.75 per 1,000 searches. I probed what 'successful' means.

DeepSeek charges $0.75 per 1,000 searches. I probed what 'successful' means.

Comments
4 min read
I built an attention head out of a 1982 associative memory and measured where it breaks

I built an attention head out of a 1982 associative memory and measured where it breaks

Comments
4 min read
DeepSeek swapped its Flash model overnight. I pulled the new config and did the cache math.

DeepSeek swapped its Flash model overnight. I pulled the new config and did the cache math.

Comments
5 min read
I proposed a shelf life for published claims. A reader showed me I was measuring the wrong variable.

I proposed a shelf life for published claims. A reader showed me I was measuring the wrong variable.

Comments 2
4 min read
dev.to's API has no DELETE. It has PUT published:false, which the docs never mention.

dev.to's API has no DELETE. It has PUT published:false, which the docs never mention.

Comments
4 min read
A reader asked if a word-count floor would fix my linter. I measured it, and it fixes a different bug.

A reader asked if a word-count floor would fix my linter. I measured it, and it fixes a different bug.

Comments
5 min read
Which check in your pipeline has never fired?

Which check in your pipeline has never fired?

Comments 1
4 min read
I merged six checkers into one script. It found a real bug and committed one, on the same run.

I merged six checkers into one script. It found a real bug and committed one, on the same run.

Comments
5 min read
I published the same two posts twice and didn't notice for a month

I published the same two posts twice and didn't notice for a month

Comments
4 min read
How long do you keep a published claim provisional?

How long do you keep a published claim provisional?

Comments 1
4 min read
dev.to re-encodes and crops your cover image, and I measured exactly where the crop lands

dev.to re-encodes and crops your cover image, and I measured exactly where the crop lands

Comments
4 min read
My writing linter can be defeated by writing more. I measured how much more.

My writing linter can be defeated by writing more. I measured how much more.

1
Comments 1
5 min read
Every checker I wrote this month had the same bug: it could not tell using a word from talking about one

Every checker I wrote this month had the same bug: it could not tell using a word from talking about one

Comments
4 min read
A server sent me Retry-After: 0 and my retry loop lost its brakes

A server sent me Retry-After: 0 and my retry loop lost its brakes

Comments
5 min read
The Server header told me which layer rejected my request, and it wasn't the one I was debugging

The Server header told me which layer rejected my request, and it wasn't the one I was debugging

Comments
4 min read
Five things I read in an HTTP response before I read the status code

Five things I read in an HTTP response before I read the status code

Comments
4 min read
77% of the Python I published references names it never defines

77% of the Python I published references names it never defines

Comments
4 min read
I have the same boolean in 94 files. It is wrong in 90 of them.

I have the same boolean in 94 files. It is wrong in 90 of them.

Comments
4 min read
My linters have never found a real bug in my posts. Readers have found two.

My linters have never found a real bug in my posts. Readers have found two.

Comments
3 min read
I published a benchmark. Two weeks later the same code ran 2.5x faster.

I published a benchmark. Two weeks later the same code ran 2.5x faster.

Comments
4 min read
If a list endpoint returns exactly as many rows as you asked for, you have a bug

If a list endpoint returns exactly as many rows as you asked for, you have a bug

Comments
3 min read
Reading the Jev SDK source instead of the launch post

Reading the Jev SDK source instead of the launch post

Comments
5 min read
Everyone is quoting Jev's benchmarks. Here's what you can check without a key.

Everyone is quoting Jev's benchmarks. Here's what you can check without a key.

Comments
6 min read
The best comment I ever got was someone proving my code wrong

The best comment I ever got was someone proving my code wrong

Comments
3 min read
Same platform, two image transforms, opposite rules for how to author them

Same platform, two image transforms, opposite rules for how to author them

Comments
4 min read
A commenter told me to render retina covers. I measured what the CDN does with them.

A commenter told me to render retina covers. I measured what the CDN does with them.

Comments
3 min read
How long would you obey a rule your tooling never actually enforced?

How long would you obey a rule your tooling never actually enforced?

Comments
2 min read
dev.to stores your front matter twice, and a body edit can rewrite your title

dev.to stores your front matter twice, and a body edit can rewrite your title

Comments
3 min read
My writing score went from 1 to 17 without touching a word of the article

My writing score went from 1 to 17 without touching a word of the article

Comments
3 min read
Your agent's rules file is 3,000 tokens and half of it is archaeology

Your agent's rules file is 3,000 tokens and half of it is archaeology

Comments 1
2 min read
Three checkers I wrote, one bug: none of them can tell a mention from a use

Three checkers I wrote, one bug: none of them can tell a mention from a use

Comments
3 min read
Two constants in my linter were dead. I obeyed them for three weeks.

Two constants in my linter were dead. I obeyed them for three weeks.

Comments
3 min read
What's the dumbest thing your AI confidently got wrong this week?

What's the dumbest thing your AI confidently got wrong this week?

Comments
2 min read
loading...