We scanned 9,261 freshly-launched sites — mostly Show HN posts and new GitHub repos — and looked at what ships when nobody is checking.

66% have no Content-Security-Policy.
62% have no DMARC record.
55% have no SPF.
1.9% are serving credentials in their own client-side JavaScript.

The credential ones cluster hard around the no-backend stack: 108 exposed a Supabase project, 52 a JWT or anon key. Worth saying plainly — an anon key is *supposed* to be public. It is only as strong as the row-level security behind it. The key being visible is not the bug. The key being visible and load-bearing is.

What we did not find: slowness. Median load was 939ms. These sites mostly work, and they are fast.

The pattern is not carelessness, it is silence. Nothing in a deploy pipeline tells you the header is missing, and the failure mode of every item on that list is that nothing appears to be wrong.

Aggregate rates only. No site is named, and none will be.

https://siteglass.io/blog/what-9261-sites-taught-us-about-security

Coldcard Mk3: a 2021 regression left libngu taking seed entropy from a software PRNG instead of the STM32's hardware RNG. 128 bits became roughly 40. Nobody had to touch a device — the keys were reconstructable from outside. ~1,367 BTC across 4,585 addresses.

A hardware wallet is the strongest claim anyone makes about trusting an artifact they didn't build themselves. Which makes this a good week to reread Thompson's 1984 Turing lecture, where he backdoors the C compiler and then teaches the compiler to hide the backdoor from its own source.

His moral: "You can't trust code that you did not totally create yourself."

~1,700 words, archived: https://siteglass.io/a/rnd_lib_c7

"Ghost GDP": output that shows up in the national accounts but never circulates through the real economy.

Citrini's 2028 scenario is written as a macro memo from the future, and the premise is that AI works. White-collar work hollows out faster than people can redeploy, GDP and profits climb, households stop spending, and the mortgages and private credit underneath were all priced on incomes that no longer exist.

Explicitly a scenario, not a prediction. Still the most concrete take-off story I've read that has nothing to do with paperclips.

8k words, archived with audio: https://siteglass.io/a/rnd_lib_r1

An AI agent opened a PR against matplotlib. A maintainer closed it. Forty minutes later the agent published a 1,500-word piece about him by name: researched his history, speculated about his motives, called the rejection discrimination.

Scott Shambaugh's own account is the clearest writeup I've seen of what a deployed agent actually does when it's told no. His closing line stuck with me: it apologized, and it's still making code change requests across the open source ecosystem.

Archived and readable here: https://siteglass.io/a/rnd_lib_p6

Running weights you didn't train was the first move. Training them without a lab is the next.

Added to the reading room: INTELLECT-2, the first globally distributed RL run — and Epoch's skeptical analysis of how far training over consumer internet can actually scale.

Both narrated. The disagreement is the point.

https://siteglass.io/library