Insights
Engineering perspectives on architecture, product development, AI, and the everyday decisions behind useful software.
From the engineering desk
Browse practical articles or follow the latest technology updates.
Subscribe via RSS →Curated links from external sources — not 360Softy original articles.
Article URL: https://xeiaso.net/notes/2026/everyone-slowdown-but-me/ Comments URL: https://news.ycombinator.com/item?id=49678683 Points: 797 # Comments: 450
TL;DR: OpenSea runs an undocumented MCP server at mcp.opensea.io/mcp. One of its tools hands out API keys to anyone who asks, and another lets you resolve any Ethereum address with an OpenSea profile to its owner's username. Reported to Bugcrowd, now sharing the story and a free recon kit. I was poking around OpenSea's tooling one afternoon — just trying to understand how some of their internal features worked. Nothing fancy, no scanners, no brute force. Just curiosity and a browser. That's when
Comments
The cataloguing step is supposed to be the easy win. You have a schema whose ecm_template_link and v_pmpm, your users ask questions I did that to a real 1,245-object schema. Recall went down. Not by a little. The table literally called contacts sat at rank 3 for the This post is what was actually happening, why the obvious fix doesn't work, Every description you generate is written in the same vocabulary as every BM25 scores a term by inverse document frequency: idf(t) = log(1 + (N - n_t + 0.5)
Spider, BIRD, LiveSQLBench. If you have evaluated a text-to-SQL system in the None of them ask who is asking. Every score you have seen was produced by a system with unrestricted read Benchmarking Text-to-SQL under Role-Based Access Control, by Yang Fei, The scale of the augmentation: 53 databases, 399 tables, 3,353 columns 21,502 role-annotated query instances policies at column-operation granularity — not "can this role read this table" but "can this role SELECT this column" roles synthesised
Milestone Reached: YINI Syntax Highlighting Is Now on the VS Code Marketplace A small but important YINI milestone has been reached: the official YINI Syntax Highlighting extension for Visual Studio Code has reached version 1.0.0 and is now available on the Visual Studio Marketplace. The extension targets YINI Specification 1.0.0 RC 6 and adds syntax highlighting for .yini configuration files directly in VS Code. It highlights YINI sections, keys, values, strings, numbers, comments, lists, ob
Se você já trabalhou com orientação a objetos por algum tempo, provavelmente já se deparou com este dilema: como adicionar novas funcionalidades a um objeto sem criar uma explosão de subclasses? Imagine um sistema de componentes gráficos onde você precisa combinar bordas, sombras, cores e efeitos de diferentes formas. Criar uma subclasse para cada combinação possível rapidamente se torna insustentável. É exatamente para resolver esse tipo de problema que existe o Decorator, um dos padrões de pro
Annotation mode keeps requests close to Java, but large integrations raise a fair question: do I want a wall of curl strings inside my service interfaces? JQuickCurl's XML mode answers with a firm no — you store every API definition in a separate XML file, and the business layer only sees plain Java interfaces with no annotations at all. This is the classic "declarative client" split: contract in configuration, behavior in code. In this post you'll learn to: Author an XML API catalog with the of
Let’s start with a conversation
An idea, a challenge, or a system that needs to work better. We’ll help you understand the next step.
Prefer email? [email protected]
