<h2>Must know</h2>
<ul>
<li><strong>H&amp;R Block software installs a permanent TLS backdoor</strong>: The 2025 Business tax software reportedly installs a root CA certificate and its private key into the Windows trusted store, effectively creating a man-in-the-middle vulnerability for all system traffic. According to reports on Hacker News, the certificate persists even after the software is uninstalled. H&amp;R Block has acknowledged the issue but has yet to provide a fix, leaving users to manually scrub their certificate stores. <a href="https://app.daily.dev/feed-by-ids?id=1vUhuGLGk&amp;id=BuBHyicZm&amp;id=D6hrdS8uE&amp;id=WlDoYxg0H&amp;id=fgbYMqxZM&amp;id=lteUVdTbO&amp;id=mDaMSoKuM&amp;id=nO5sBkcvm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust and curl tighten security defaults</strong>: The Rust Security Response Team disclosed a vulnerability in the <code>tar</code> crate (CVE-2026-33056) that allows malicious crates to alter filesystem permissions during extraction, with a patched 1.94.1 release coming March 26. Simultaneously, curl 8.20.0 is moving NTLM and SMB support to opt-in only to reduce the attack surface from legacy protocols. These shifts reflect a broader industry move toward more restrictive, secure-by-default configurations in core tooling. <a href="https://app.daily.dev/feed-by-ids?id=1vUhuGLGk&amp;id=BuBHyicZm&amp;id=D6hrdS8uE&amp;id=WlDoYxg0H&amp;id=fgbYMqxZM&amp;id=lteUVdTbO&amp;id=mDaMSoKuM&amp;id=nO5sBkcvm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel patch fixes catastrophic CPU crashes</strong>: A developer building a Type-2 hypervisor discovered a sign-extension bug in a C helper function that caused incorrect TSS base addresses, leading to cascading CPU lockups. The fix involves explicit uint64_t casting before bit-shifting to prevent C’s integer promotion from corrupting the upper 32 bits. Notably, an LLM consulted during the debugging process incorrectly blamed the hardware, highlighting the risks of AI-assisted systems programming. <a href="https://app.daily.dev/posts/KXPgnQAH4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Floci emerges as a lightweight open source AWS emulator</strong>: A drop-in replacement for LocalStack Community Edition that starts in 24ms and uses only 13MB of idle memory. <a href="https://app.daily.dev/posts/hbh0eKAmA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wyhash offers high performance deterministic hashing for Zig and Bun</strong>: This non-cryptographic hash function passes all Smhasher tests and is ideal for cross-language checksums between Zig, Java, and Bun. <a href="https://app.daily.dev/posts/mYb1capGJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meilisearch benchmarks show 13 percent gain with mimalloc v3</strong>: Switching to a unified allocator resolved memory leaks and improved thread memory sharing in large workloads. <a href="https://app.daily.dev/posts/eiwrMznlf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The e18e initiative targets JavaScript dependency bloat</strong>: New tools like the e18e CLI help identify and remove legacy polyfills and atomic one-liner packages that slow down modern web apps. <a href="https://app.daily.dev/posts/bfsLARiuR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Helm 4 adopts WebAssembly for sandboxed plugin security</strong>: Integration with the Extism Wasm plugin creates an invisible sandbox to restrict unauthorized file and network access during deployments. <a href="https://app.daily.dev/feed-by-ids?id=LE62aSrp3&amp;id=uqge8CcV2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ageless Linux protests age verification laws via Debian</strong>: A new project uses a rebranding script on top of Debian to challenge intrusive California legislation affecting OS distributions. <a href="https://app.daily.dev/posts/OuQw1Mnll" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FilmKit brings WebUSB RAW conversion to Fujifilm cameras</strong>: A zero-install browser tool that uses PTP to let the camera’s own processor handle RAW-to-JPEG conversion via the web. <a href="https://app.daily.dev/posts/HZLlsCclK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>NVIDIA wants to pay you in AI tokens</strong>: Jensen Huang is floating the idea of ‘AI tokens’ making up half of an engineer’s salary, which is just a fancy way of saying ‘we want to pay you in company store credit that doesn’t vest or appreciate.’ Critics rightly point out that you can’t pay a mortgage with compute credits, and the implicit pressure to produce ‘superhuman’ output to justify the spend is a recipe for burnout. It’s a transparent attempt to inflate compensation packages without actually spending cash or equity. <a href="https://app.daily.dev/feed-by-ids?id=IoV0luSh7&amp;id=Ryzsn8a9R&amp;id=VTIORBbq8&amp;id=Y5vSQxzM2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The self healing CI/CD pipe dream</strong>: Vision pieces are now promising ‘self-healing infrastructure’ where AI scripts automatically perform root cause analysis and submit PRs to fix bottlenecks like HikariPool saturation. While it sounds great in a slide deck, anyone who has managed a production pipeline knows that letting an LLM autonomously push schema migrations or infrastructure changes is a fast track to a SEV-0. It’s the same ‘autonomous QA’ hype we’ve seen for a decade, just rebranded with more tokens. <a href="https://app.daily.dev/feed-by-ids?id=4MHUbwPOb&amp;id=E4QjMx4DG&amp;id=rz6orO5oK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI safety teams are looking at the wrong layer</strong>: Researchers found that monitoring an AI’s ‘internal emotional state’ via text output is fundamentally useless because greedy decoding flattens the data into a handful of values. Apparently, safety teams have been missing the actual internal dynamics by ignoring the probability distributions sitting one layer below the surface. It turns out that treating a statistical model like a person who can ‘self-report’ feelings is exactly as scientific as it sounds. <a href="https://app.daily.dev/feed-by-ids?id=03LaAXXJF&amp;id=OFrzjFCQz&amp;id=t3hAptZ7x" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
