GoKawiil
Tech News
A Fly.io team post examines VSCode's remote SSH extension, noting that rather than running lightweight shell commands like Emacs's Tramp does, it deploys a Bash script that downloads and installs a full agent, including a Node.js binary, on the remote machine. The authors say they are exploring integration with this remote-editing flow because so many developers now use VSCode forks paired with LLM code-generation agents.
A new workplace advice piece examines how some professionals appear competent or engaged in meetings without substantively contributing, and offers cues for spotting this behavior. It cites an estimate that the average American professional spends more than 14 years of their working career in meetings, underscoring how central meetings are to office life.
A new analysis argues that how companies decide where employees work matters as much as the final policy itself. It notes that more than six years after COVID-19 began, over one in five U.S. workers able to work remotely still do so full-time or part-time.
Jotform founder Aytekin Tank describes building the online form-builder outside Silicon Valley's typical playbook, launching the product free for its first two years before introducing pricing. He says he avoided venture capital, skipped relocating to Silicon Valley, and built the company around long-term thinking and teamwork rather than rapid VC-fueled growth.
A new website called Shov lets visitors pay to remotely aim and fire real pneumatic weapons loaded with .68-caliber rubber 'less lethal' rounds at targets in a physical firing range, all through a web browser. Users buy credits—$5 for five shots—and control one of twelve gun turrets shown via live video feed, competing to hit targets that change color when struck.
Security researchers at SafeDep discovered that a malicious npm package called mathmain, disguised as a copy of the popular mathjs library, contains a hidden remote access implant. The malicious code stays encrypted and dormant until a specific equation is solved using the library's lusolve() solver function, which acts as a decryption key to unlock and execute the payload.
Researcher Paulos Yibelo of pwn.ai disclosed a WordPress Core vulnerability, called Click2Shell, that chains a cross-site request forgery bug with the theme Customizer preview to achieve remote PHP execution. The flaw lets an attacker trick a logged-in administrator into visiting a malicious link, silently installing a theme from the WordPress.org catalog and running arbitrary PHP through the Customizer preview even before activation. WordPress fixed the issue in version 7.1.1 after it was reported in late August.
Smart TVs still rely on remote controls, and many now support using a smartphone as a substitute via built-in IR blasters or app-based connectivity. Certain Android phones have infrared hardware and pre-installed universal remote apps that let users pair with their TV brand and control power, volume, and navigation. Devices from Apple, Samsung, and Google lack this IR hardware, but alternative software-based remote options exist for those users.
Cybersecurity agencies from Japan, the US, Australia and Germany issued a joint advisory identifying North Korea's WaterPlum group as the actor behind malware hidden in fake job application coding tests. The scheme has infected over 30,000 devices across 100 countries and compromised more than 7,000 crypto wallets, netting $10.71 million believed to fund the North Korean government.
Security researchers at Accomplish AI discovered two ways to break out of the sandbox that isolates OpenAI's Codex coding agent from a user's system. The worse of the two, dubbed Heapjack, let a malicious repository trigger unsandboxed code execution on a victim's machine simply by having Codex answer a question about that repo's code, with no approval prompt or visible warning. Both bugs were reported to OpenAI on August 12 and patched within eight days.
A workplace productivity tip argues that opening chat messages with greetings like 'hi, you around?' before stating the actual request wastes time. Because typing is slower than speaking, making a colleague wait through a greeting exchange before hearing the real question delays responses unnecessarily. The advice: state the question or request immediately in the first message.
Safeguard Global, an Austin-based workforce management firm, tested a four-day workweek in 2023 aiming to boost recruitment and retention. The company ended the pilot after discovering that many employees were secretly continuing to work on their supposed day off, undermining the program's intent.