co-authors: Obaid, Opus4.8

this post is an experiment in parallelizing the power of LLM research with telling my own story, something I've found surprisingly difficult to do. if this works (in terms of telling my story the way i want to), expect more

the narrative outside blocks is all mine, and within all Opus 4.8

Prologue

Since I was 7 years old, I’ve been an avid reader. When I look at how old kids are at 7 now it is hard to believe myself, but thankfully I do have the receipts which means I don’t end up gaslighting myself — stale digital records of torrented books and pixelated videos through Nokia handhelds and me reading as people shout, tables fall, and my little world (the home I knew) descends into chaos all around.

Of course, I was a technically savvy kid. At around the same age (I don’t remember when), there was an incident: somehow, I ended up changing the WiFi password of our network without knowing anything or ever remembering using the 192.168… local address. To this day, I don’t know how that was possible, but I have a backup in trusted, shared memory from my brother who still remembers pressing me on how I did that — the answer I had for him then is the same I would have now: I was just playing with the settings and I don’t know.

Later when my brother (CS major, top of his batch, and one of the first iOS developers at Venture Dive/Careem) got too busy, this meant the duties of managing our home’s technical admin naturally fell to me.

I was also devious: I remember using carefully placed mirrors to find people’s device passwords and secretly used them at night when no one could find out — having bounded creativity and strict parents will do that to you.

The same restrictions extended to books. The way I used to devour books grew from something initially supported into apparently serious concern. My book-reading time became limited, and so did the restrictions on their content. My mom didn’t understand it, and so she put a halt to it. To this day one of the principles I’ve derived for my life has an origin in learning of how harmful this is.

I remember when I borrowed a book from the son of a family friend, Alex Rider: Eagle Strike, my mom had my brother read it cover-to-cover and with a black marker erase all text that had anything to do with girl-to-boy interactions or “kissing”. I can’t tell you what it did to my psyche over the next 10 years, but I can tell you that extensive control extended far further.

I cried when I found out, not because of the censorship, that I was used to, but because I didn’t know I could explain the markings when giving it back. And my mother knew who I’d borrowed it from, so it was actually even more insane. I’m almost cracking up thinking about the absolute insanity of it now. Though in hindsight, that was probably for the better: at least someone from the outside had a window into this insanity.

This is sounding more like a confessional therapy session than it does a story about a fanfiction site, but perhaps that is the necessary prelude I’ve been wanting to put out all along.

I learned to torrent because of my obsession with books too. My mom used to take me to a used book stall in Hyderi, where the books were stacked taller than our height, no categorization, and prices were between Rs 100–400. Our monthly trip had a limit of 4 books per sibling, no more, and that, obviously, was not nearly enough for me.

I learned to torrent. I knew what it was because my siblings used to download the matriarch-approved flicks to put on show for the family, but the recipes for those were always gatekept. As anything as an early GenZ, I used the internet to find that recipe.

The books I downloaded were nearly always continuations of series I’d started but never found the full cycles for, and soon I remembered not to beg my mom to go to Liberty Books or ask for books I couldn’t find at the stalls. My reading had become all-digital.

I remember on our first-ever out-of-Karachi trip, to Islamabad, we stumbled into Saeed Book Bank and I found on the shelf the then newly-released finale of the Artemis Fowl series: The Last Guardian. I was hooked, but I knew to skim through for as long as we were there, and then quietly get up only to launch uTorrent the moment I got back home to Karachi.

Soon, that desire for continuation turned into something else: the discovery of fanfiction. A way to stay in denial about the stories that I’d learned had already ended.

My sister had a role in that introduction to this world, and learning what I did later about the depths of insanity it went to, I often wondered about her adult due-dilligence in that.

My life up till that point represented the new. I was determined to turn everyone using anything backwards up to that point — whether that was paper records not yet adapted to Google Sheets, or literally anything else — into the “modern” way. And that desire extended to my newly discovered fanfiction community with a new website, the “modern” way of reading fanfiction.

fanfiction.online.

Chapter One · The Build

I launched this under an anonymous name, very easy to do as I’d found in my Reddit stalking, primarily out of fear of retribution from my family or other circles I was in accidentally discovering me.

And I began making a more modern website. The thing is, I didn’t know how. I’d used WordPress to create websites before and my early foray into it at 8/9, learned to make HTML and JavaScript websites, but the only full live tool I knew how to use was WordPress. I’d used WordPress to create a few sites then, and chose to use it again. And I did.

I knew WordPress.org existed with more customization. And I knew how to use one-click deployments. So I used my dad’s newly (badly sustaining) business website that used a cPanel hosting and that I managed, and set up an alternate site on it.

And it was live. But the preset theme I used didn’t make sense. And the admin panel, despite all the hooks and customizations to remove panels, was still clunky. And I didn’t want the WordPress logo to show anywhere.

So one-by-one, step-by-step, in one of the greatest learning curves I think I have surpassed in my life, I learned to build all of that on PHP and from scratch, learning what code even was along the way. The process was simple: I saw a button I didn’t like, and googled “hook to remove xyz button”, kept researching until I found the right guide, article, reddit thread, or stack overflow post. Tried a few, then dug deep into the HOW when I found one that worked.

Slowly, this turned into me replacing the entire admin panel with a custom one, using the same APIs, and then even not, stripping away all aspects of the WordPress core until I was able to delete the entire wp_includes directory and only the MySQL database schema remained.

The bundler

Chapter Two · The Platform

The site wasn’t one feature. It was sixteen interlocking systems — each its own PHP class, its own database tables, its own notification hook — built by someone who’d never heard the term “microservice” but arrived at the shape anyway.

Authors and readers I reached out to, to join the site, often mentioned they’d love an app and would prefer it over a website. And after hours of researching the tradeoffs of WebViews, taking on the complexities and learning of React Native, and much much more — this was the first decision I made to prioritize, of choosing not to build something.

I instead maximized every single, however-new-feature of PWAs and turned the entire website in something that background-auto-downloaded into an offline app the first time you visit, and where you could save any story to read offline with just button, and read again, Wi-Fi off, directly from your browser.

Even today in 2026, there is barely a website I know of that manages to do this: even with the ease of Claude Code simplifying all the weird complexities of service workers into a couple back-and-forth chats.

Chapter Three · The Measurement

Perhaps my crown jewel and most loved-feature, inspired by the conspiracy theories of Zuckerberg, his taped laptop camera, and how he tracked every single movement of every person and what they were thinking. I was an easily-inspired child, and I wanted to build something of my own like it.

Chapter Four · The Outreach

So I engineered a scraper that bypassed Cloudflare through a rotating outwards proxy, logged into fanfiction.net with 5 rotating accounts, and sent personal DMs to a total of 8,500+ top authors, inviting them to the website. I don’t think I knew what cold outreach or email lists even was at the time, but I knew I wanted to speak to authors, and I’d figured out it was a numbers game.

All on a $5/mo cPanel hosting, shared with one more, though mostly dead website.

The verification handshake

The response wasn’t great. I learnt that people wouldn’t use an empty site, less than 10 out of 8,500+ of them. But it did get some results — multiple authors created threads on Reddit, Tumblr, and other forums about the horror of being approached like this and how I was a money-sucking leech (I’d never monetized it, but they assumed somehow) bonding in their trauma. Yes, the response was that negative, almost bordering on harassment.

I was struggling — months of development and all other corners of fanfiction communities, the people I was building it for, seemed to hate me. Only one corner of the internet, a Harry Potter-centered fanfiction Discord, seemed to welcome me and provided support and, might I say, older developers who offered me guidance.

Until my big lucky break.

Chapter Five · The Crash

A viral post on Tumblr ranted against Ao3 for various reasons and referenced my website as where they were moving. It was a miracle — overnight from 50 I hit 10,000+ signed-in users and could have been a lot more, except the cPanel hosting finally gave up, the internal email service I had used to deliver verification codes refused to deliver, and I was left stranded.

In all times of difficulties since then in my life, I’ve always had an inkling of an idea of what I would do. In this case, I had none.

At the same time, anticipating some need I had started making some money and had a whole $35 stuck in Payoneer. I knew within those limits I had to figure out a solution. So I started researching and learning what servers were — I spent night and day, and in the most literal sense possible. I didn’t sleep for nearly 3 nights and days worried I would miss out on my lucky break of users — and I wasn’t wrong, I did.

And I wasn’t able to figure the migration and setup of my newly discovered $5 droplet on DO in time — the site was unavailable, and the hype died.

# build.py — the whole deploy pipeline
host = "root@167.99.11.178"
upload_to = "/home/runcloud/webapps/"

subprocess.call("scp content.zip " + host + ":" + upload_to, shell=True)
subprocess.call("scp static.zip  " + host + ":" + upload_to, shell=True)

cmds = [
    "rm -r -f " + upload_to + main_app + "/content",
    "unzip content.zip -d " + upload_to + main_app + "/",
]
subprocess.call("ssh " + host + ' "' + " && ".join(cmds) + '"', shell=True)

Chapter Six · The Engine

After the crash, I did some rudimentary benchmarking — eyeballing the DO instance’s memory graph, inserting timers into PHP template scripts. One of the two biggest reasons for the crash: WordPress’ query engine took on average 20s for a single filtered query, sometimes up to 2 minutes.

Rather than fidget against WordPress for a 2-3x speedup, I hand-rolled it all. PHP 8 had just been released with promises for efficient low-level array functions, so I built my own query engine and brought 90% of complex queries down to < 3s.

Toggle filters — click to include (green), again to exclude (red), third to clear:

Chapter Seven · The Mail Server

I was finally able to get it together and set up my own mail server, but that too, was eventually rate-limited.

Epilogue

I’d vaguely known about it, sometimes coming across it in more literary publications like the NYT, but never the way I was being taught: as a paired bracket: not to explain what you said previous but to neatly unroll your overthinking into.

as a chronic over-thinker, it stuck with me, and without realizing it bled into my native languages like blood, until I realized there was barely an essay I wrote that went without including this strange, foreign glyph.

2. A lot of shallowness and lack of intelligence hides behind labels and jargon. I’ve always had an intuition that forcing myself not to use labels often pushed me into breaking down concepts to their core, most minute level in a way that few invested the effort in doing: But I think it just clicked properly for me how universal and obvious that filter is.

3. If someone has an idea for a specific sound that doesn’t yet exist and they want to mix, experiment with, or create, and the human mind although never having heard it before would be emotionally and physically moved by it — as music and auditory experiences have the capacity of doing — does that sound not deserve its place in humanity’s museum of existence even though it can? or should its creation be made difficult, its license restricted only to the holders of specific software, instruments, and money to buy them?

the answer seems obvious, except when that tool becomes AI? There are cases where the moral argument against AI can be legitimate, but for most I think it needs to be re-evaluated how much of it is a cloak around selfishness preventing the advancement of humanity’s cumulative archive and experience.

because at the core of it, all such realizations about AI skip the fact that it reduces the barrier of entry for things we might see created in the world.

4. My best creative eras begin and end with moments of extreme happiness or a thrill of emotions; my best, most poetic writings come from anger, sadness, or any enormous magnitude of emotions, and that ability I am unable to tap into without them. I’m not quite sure I hate that, because it makes me very human. Very real. What is a “human” if it is tied to “systems” and imitating the very creatures we created to try and imitate us? The most physical manifestation of the dead internet theory, an endless loop where we imitate the characteristics of our imitators and they our imitation until our graph of self-improvement attains complete… loss.

Edited videos are its evolution, but still somehow, very different. The focus of “video-editing” isn’t on on the timeline, but the canvas: images are placed on any of its parts, either cleanly in grids or overlapping, as a series of moving pictures or still, and for any duration of time.

But unlike film which had one dimension, the timeline, video-editing has two:

the timeline… and now, the canvas.

and it is that exponential explosion of creative possibilities which has led into the art form we know as video-editing today.

And that art-form I tried to experiment with to learn, how much of it can be a repeatable workflow edited by Claude, and how much of it completely original.

I should mention that my theory on this is my own. Actually original. I intentionally block out and avoid research when theorizing or thinking deeply, to avoid polluting my headspace with ideas only occurring as a result of external reinforcement.

theory is complete. So we begin.

I don’t know what to say after. I don’t have the energy to complete this article, so it’s time to publish and move on. Maybe later I will come back and tie together the pieces left untied.

I consider this intuition of what-deserves-your-effort-and-time and will survive or thrive in an AI age, both in the short-term, medium, and long my biggest edge.

Public self-flattery has a way of sometimes truly biting your loud mouth in the ass. Let’s hope this is not of those cases.

2. Since I started working on things that made me money and honed my skills from the age of 17, I’ve never set yearly goals. I was always in a rush to solve the next week or month of problems, some because of the cards life played me, some self-created because they allowed me to hold a sense of urgency and importance.

The second half of last year and this was the first I intentionally stopped creating “urgent problems” and for the first time, actually, life matched that symphony and gave me greater peace.

So this year, it kind of made sense to have something: a structure, and some new years’ goals. But what I realized was, a lot of my life I couldn’t or didn’t want to fit into strict time boxes.

Two of my priorities in life are pursuing spontaneity (because many of my biggest wins and best ideas come from this) + deeper friendships, and caring for + prioritizing those connections.

These values are non-negotiable, and often at a perpendicular to strict time boxes and mapping my schedule out months in advance.

So I did something else instead: I mapped out loose goals and habits: gym 20x in a month, learn 3 songs on the piano every 3 months, stuff like that. It was my discretion to be carefully consistent, load it all up top, or rush and get it done last minute. And deciding to stay out at a party until 4am means I always know the tradeoffs. I like it this way, and 3 and a half months into 2026, I know it’s what works for me.

3. One thing I’ve learnt from Huberman’s Lab that has helped me immensely over the last 2 months was… sitting in sunlight, looking directly or only tangentially apart into the sun. It’s been a life changer in solving fatigue and just the general feeling of feeling-drained, and I didn’t realize how painfully oblivious so many of us are to how necessary this is for us, our brains, and health.

Every day I’ve done that, my day has been better than baseline, and everyday I’ve woken up to do it earlier in the morning, even better so. But the way my internal conflict of priorities has been colliding has made that waking up early a rarity rather than the norm.

The other habits I started logging at the start of the year, I don’t anymore because I consider them learnt. They’re ingrained into me and my mind has learned the benefits of being regular with them and I no longer have to force myself to remember or practice them.

So I’m adding a new one. Waking up at 7:30am, 3x a week for now. Full 8 hours of sleep is now de-prioritized relative to waking up early, but I think 3 times is generous enough that it won’t need to come to that. Generous enough to fit Murtaza Qilbash this weekend and various other plans the next.

My productivity right now very much varies on a scale of 100x-0 depending on days, but I think just a guarantee of 3x productive days a week means I can achieve more than most dream of in their lifetime.

Of course, I know that isn’t my competition or bar though, it will be higher — but this is the first step. I remember the same thing Ben Affleck told Matt Damon in Good Will Hunting: “I’ll fucking kill you.”

Though this aesthetic centers around rejecting this new-found mastery of craft by a non-human, there will be another enabled by the now-lifted ceiling of limitation. The one that sticks will be one that cannot be one-shotted, or have enough variance in minor prompt variation that makes it a unique expression.

2. The power you wield with AI can even be utilized for original creations, but that power is gradually diminished as you approach originality. All original creations have elements of the been-done, some more, some less, and it is that % of the been-done that determines how capable AI will be at helping you.

3. There is immense mastery in the craft of communication. Not just the conventional way we view it through speech but through all our senses and branched into all the ways those senses are interpreted by our intelligence: through music that evokes emotion, switches of association with culture we trip in people’s minds, and the mirror neurons fired when we see a performance.

I have a very surface-level understanding of what each of those are, but that is what I am a student of when I seek to understand the “overton window” and culture. It is delusional perhaps, even in a way that I consider it to be so, to expect myself to master each of those crafts when many incredible humans made it the purpose of their entire lives to master just one. But I think there’s a certain magic to be found in the interspersion of those, or optimistically, a common symphony I might find that lets me understand, express and judge those crafts comparable to those with a much-higher mastery of the individuals.

[final note: various versions of this jotbook have been lying in my drafts for a while, this is but a short clip from those as I’ve rushed to post in an effort to prevent myself from further procrastination-perfection. god hopes they come out soon.]

And as I click publish on this post, the database is still, publicly exposed and has not been patched.

At exactly 4:32pm, 16.02.2026, I discovered something I think was absolutely insane.

Most anyone in the city’s heard of them: The Arts Council of Pakistan Karachi has a school that now offers full 4-year diploma courses and also happens to be one of the biggest organizers of events in Karachi today.

They also have a website to list their events and that website, as I discovered, is powered by a Supabase database with disabled security controls, and an API Key being used publicly from the web app. In. Raw. Text.

Not only that, but this events database is being used for their entire offline ticketing and attendee management, exposing 20,000+ people’s personal information: names, emails, phone numbers, order QRs, payment amounts, and much, much more.

If I were to draw an analogy for non-technical people, this data breach is not me finding a crevice in the wall I could use to slip a hook in and open the window. This is leaving the door to your most valuable safe wide-open, and then leaving a trail of breadcrumbs and carefully placed cardboard signs to it screaming “I’m exposed and vulnerable.”.

This is leaving the door to your most valuable safe wide-open, and then leaving a trail of breadcrumbs and carefully placed cardboard signs to it screaming “I’m exposed and vulnerable.”.

As a thought experiment, let’s examine a few possibilities of what could have happened (or perhaps has been secretly happening) because of this leak:

1. Someone could sell this personal data dump on some online anonymous forums, for idk, some bitcoin. 2. Scammers could pose as the Arts Council, building trust as they knew people’s exact details, exactly where they were on given dates down to how much they paid for each event. 3. Use it to issue themselves free tickets for events, without any pre-screening or payment: Perhaps even set up a third-party market for Arts Council events selling tickets for 100Rs each.

And what’s worse, this vulnerability couldn’t possibly be just an oversight.

Before you are allowed to disable Supabase’s default security settings, you must confirm repeatedly you are aware of the dangers and consequences of doing so, and not only that, but while it is disabled you are repeatedly sent notifications, emails, and reminders telling you to re-enable it.

Some irresponsible and reckless developer, somewhere, chose to intentionally ignore all that. The API key was also not exposed recently: I’ve found traces of it in web backups going all the way back to September 2025.

Many of own friends, regular attendees of Arts Council events’ who trusted the administration with their names, numbers, and contact information, and personal details have their data publicly exposed within, so this is personal to me.

Since I discovered this vulnerability, I have been worried sick about how to reach out to the Arts Council without alerting any bad actors, and worried whether I could even communicate to them the sensitivity of what they have wrought, because let’s be frank, someone who exposed their entire system and the personal information of 20,000+ people has to be an icon of irresponsibility and callousness.

Right now, the website and database are still exposed as they were. But I’m making this announcement publicly and alerting the Arts Council because before doing so because I’ve replaced data of the 20,000+ attendees with a non-sensitive, synthetic dataset that both protects the original attendees and doesn’t break the Arts Council’s systems.

Beyond my need to protect these innocent people (including my friends) who have been put at risk due to no fault of their own, I do not have the tools to do anything else.

I’ve also sent an email to the Arts Council at info@acpkhi.com, with a link to this article and informing them of this bug. I hope they fix this quickly before their system crashes, and I wish them the best of luck if on top of this recklessness, they have made no backups and had their financial accounting also, solely dependent on this database.

But I see an educational moment in this. The next part of this post is targeted specifically at developers, engineers, data scientists, and people interested in binary sciences… for whom I will use this breach as a practical example of what NOT to do, demonstrate the dangers of ignoring security, and break down all the attack vectors I can think of leveraging against an exposed database like this… and how to in the future, protect against them.

The vulnerability

was that the Row-Level-Security of the database was purposefully, intentionally, disabled. Supabase warns you repeatedly of the consequences before letting you do that, and those warnings were ignored. Its “security adviser” sends you notifications and follow-up emails regularly if RLS is left disabled for too long, and those warnings too, presumably, were ignored.

This was not a temporary security relaxation for whatever reason, I traced its history through the Wayback Machine, and although the site isn’t archived frequently, I was able to use the wildcard URL feature to discover some JS bundles have been saved periodically. And what did I discover? The first time this exact API Key (not even refreshed!) was seen in the bundle on September 2025: almost 5 months now.

Producing the synthetic dataset

I needed to protect the attendee’s (including my friends!) data before announcing, but also make sure I didn’t break the site. So after being inspired by some discussions with a friend, I had an interesting idea: replacing the original attendees with a synthetic dataset.

Now, any random dataset with the same schema would do, but I wanted to do a little experiment: How close could LLMs and matching statistical distribution get the synthetic to the original dataset?

And you can judge, because this is what our produced final-dataset looks like:

Since RLS was re-enabled, the synthetic dataset now loads from a CSV file instead. Download the full dataset (with QR codes) here.

btw, the sheet above is loading directly from the Arts Council’s Supabase database, now filled with our synthetic attendees. You can see exactly HOW bad the situation is.

So how did I go about producing it? I analyzed, with help from Claude ofc, the statistical distribution and patterns in the original dataset and discovered some hyper-specific and extremely niche patterns, for example:

• Order numbers are almost always sequential, except for 18 gaps in the middle, so I simulated the original dataset by producing randomly, between 9 and 27 total gaps (+- 50% displacement).

  Each gap was of random size, between 1-5 numbers long, and then there was always ONE gap which was between 30 and 70. The +-50% random displacement from the original dataset’s distributions was a general rule across patterns.

• Membership numbers were
  • MN-NNNN, 63% of the time.
  • L-NNNN, 35% of the time.
  • PM-, E-, or literal Member/M/MEMBER, 2% of the time.

  That, was also matched to look like the original dataset :)

• Attendees usually purchased tickets together in groups (of at least 2), but how big of a group was and what % of the attendees were in groups vs by themselves was heavily dependent on the event, so we calculated the per-event distributions individually and matched that in the synthetic (with +- 50% random displacement again, of course).

• Mobiles and emails were almost always recorded for attendees except for the free events, in which case were mostly not.

  But this heavy correlation didn’t just extend to events but also to specific ticket types. VIPs for example, almost never had their name, email or anything recorded. Which makes sense. How many of the attendees would have their information recorded was also matched hyper-specifically to the original dataset, per-event-per-ticket-type, then displaced by the same +-50% random displacement.

All this extremely niche statistical programming was done to produce a dataset near-unrecognizable from the original, but even this wouldn’t be enough to achieve that perfect result.

Using LLMs as a name-generator

The names in our original dataset were Pakistani, riddled with typos, spelling variations, and had characters and numbers in the emails that made them look very uniquely real.

This, was not a job for statistical rules in a Python script. For this, I had to invoke our society’s greatest accomplishment in statistical engineering: SOTA LLMs.

Using Sonnet 4.6, I first generated, at random, triplets of Pakistani names (both two-word and one), emails and mobiles, in the same format, all riddled with similar typos and patterns as the original dataset.

Since I needed to generate thousands of rows and Claude was expensive/slow… I experimented with other APIs: ChatGPT was bad, and so was GLM-5. Amusingly, they both leaned towards famous Pakistani personalites even when I made it explicity clear I didn’t want that.

GLM-5 though, did prove to give survivable results after a few rounds of prompt engineering when I generated the first 100 synthetics from Claude and used those as an example for GLM-5 to copy.

Probabilistically, the script had already calculated which fields need to be filled in vs. left empty. Once this LLM-generated CSV of triplets was ready, all I needed to do was row-by-row, fill them in.

* As a final note on this topic, people who depend on AI for agentic behaviour, this is sometimes what it lacks. This idea of statistically copying patterns of the database with some randomization… even after I gave Claude the hint I wanted to replace the database and prompted it for ideas, it didn’t suggest.

Only when I explicitly mentioned it did it go “oh, that’s an amazing idea”. LLMs still very much lack in creative imagination.

QR code tickets

One of the fields was qr_codes, a base64 png image directly stored as a text field and presumably used at the ticketing counter. Decoding it revealed the pattern {order_number}-{index_in_a_group_buying_tickets_together}.

After the synthetic data was produced, I simply followed the same pattern to encode it back and produce a QR code ticket for all synthetic attendees.

Image as an attack vector

While investigating the events table to see what would be vulnerable to an XSS attack, I noticed nearly all fields were text and the app was built with Vue. Because modern PWAs protect very well against such injections by default, I looked for alternatives.

One field caught my eye: the image URL.

Now, I could probably store and fetch excessive amounts of data on load and possibly overload the database, make the arts council’s egress bill skyrocket, or prevent the site from loading for visitors, but that would be immediately obvious.

So, I set up an edge function. With a simple script that would masquerade as an image (with .jpeg extension), capture information about the visitor, and quietly redirect to the real image.

To a visitor, there would be no difference. They’re still seeing the image.

But even for anyone looking at the source: I used the original Supabase project’s id in my edge function so the URL difference was almost imperceptible.

https://dciofyiyfblqtlozqbzw.supabase.co/storage/v1/object/public/events/event-images/ycvtq5s8kn_1770818564643.jpeg

➡ up.railway.app

Because of just this tiny change to one image URL, I (and anyone else could) have been collecting the exact location (through IP address), time, device (user agent), and other extensive analytics on every single person who’s visited the Arts Council’s website for the past 5 days.

and an actor with bad intentions wouldn’t be interested in just researching this.

• We have all already started to realize just how harmful smartphones and especially infinite-scrolling apps like TikTok, IG Reels, and YT Shorts are, but they have their benefits and are perhaps the only form of social communities which is a human necessity, for the globally connected world that exists today. Going cold turkey is not a solution.

• I’ve been learning as much as I can for the past 8 months from Huberman, from my new book, and various other research papers and studies Claude summarizes for me. I cannot stress how incredibly life-changing it has been for me to understand those patterns and easily predict how my body and mind will function in the next few days after I feed it junk (attention-invading content).

2. I have never seen two apparently distinct attributes found more commonly together than ego and insecurity, and likewise on the flip-side, humility and confidence. Intelligent, talented and resourceful people are often detached from this curse, and are nearly always better people to have around simply because their self of identity comes from their own achievements. They realize that shrinking the pie’s size might give them get them a wider slice, but never actually, a greater chunk of pie.

3. Forgiveness, I’m learning, is valuable. I always used to believe in the proportional relation between discipline of training to the exceptionality of outcomes, but funnily, Duolingo over the past year has made me think differently. I think, their forgiveness of inconsistent behaviour over time has made me more disciplined with practice, and overall increased the amount I would have learnt otherwise.

This was empirically reinforced when diving down the rabbit hole of simulation studies around the prisoner’s dilemma. Molander (1985) found that noisy, uncertain environments like the world we find ourselves in need forgiveness. We self-sabotage ourselves by punishing each and every mistake without leaving margin for uncertainty.

2. You might have seen the news that Anna’s Archive has archived, through scraping, the near-entirety of Spotify’s songs catalogue, equivalent to 99.6% of its (ambiguous, but presumably all-time) listens.

• I have followed and been a supporter of Anna’s Archive for a long time, they have a very noble mission to preserve human knowledge, and generally try to provide a catalogue of all books and research papers on the planet, for free. They have without a doubt, the most comprehensive website in the world for this.

This is also a significant contribution to where I consider the arc of humanity should bend towards: removing all barriers of entry to knowledge and education, making it accessible to all.

• The technical difficulty of going completely undetected by Spotify while scraping 300! terabytes from their platform is a herculean task, and the anonymous people who made this happen could easily be earning upwards of a $quarter-million (or maybe even are) at a Silicon Valley big-tech, but they chose to dedicate their time, and effort instead into moving this goalpost for humanity forward. I think their effort should be celebrated more.

• I don’t think this will cause any noticeable increase in piracy at all. Spotify is one of the few success stories in history that coalesced a HEAVILY pirated market back into the mainstream through their incredible user experience and extremely affordable pricing. Piracy has an inconvenience attached to it, and even in lower-income markets like Pakistan, their regional pricing makes them the best, wallet-friendly choice.

Whether they are “fair” in the sense of paying more per-stream to the biggest artists compared to the rest is a debate for another time.

• Splitting hairs (a lot of numbers): Though the archive catalogues 99.9% of all songs’ metadata (name, artist, genre etc.) which is important, the actual music archived is just 33.6% of Spotify’s library… this represents 99.6% of what people listen to because popular songs are listened to a lot more, of course: two-thirds of all songs on Spotify are only listened to by 0.4% of the people.

• Since AI and platforms like Suno, the number of albums released per year have exploded and a lot might be wholly or partially AI-generated. We might realize many years later how important it was to have a cultural archive of all music pre-AI.

Number of albums released per year:

2024 ╢████████████████████ (11.07m)
2023 ╢███████████████
2022 ╢████████████
2021 ╢█████████
2020 ╢████████
2019 ╢█████
2018 ╢███
2017 ╢██
2016 ╢██
2015 ╢██
2014 ╢██

• The most popular Pakistani song by no. of all-time listens is Jhol, coming in at 792nd on the list overall. Since Spotify is by far the biggest platform and loosely follows the rankings of others, we can pretty much be certain… Jhol is the 792nd most overall, and most popular Pakistani song in the history of music. Congrats to Maanu and Annural Khalid?!

• Is Anna’s Archive “Russian-backed”? I don’t know. But I do think even if this is somewhat true, this is very immature fear-mongering.

The talented engineers, and I suspect the vast majority of funders and incredibly intelligent people who came together and volunteered everything to make this happen, didn’t do it because they personally knew the leadership or funders, they were in it for its mission, and if that mission is achieved it will be an incredible step forward for humanity, whoever is at the helm of it.

And secondly, perhaps its something to think about whether Western jurisdictions are long-overdue an overhaul in terms of how they balance intellectual property vs. accessibility to knowledge and culture and use actual studies of why piracy occurs instead of relying on Cold-War-era “communism” fear-mongering to define their policies.

My perception of a models’ coding ability and its benchmarks used to be pretty similar but in this last year both have started diverging to the point where I’ve stopped paying attention to them (data leakage, or benchmarks testing for the wrong things).

Opus and Sonnet are absolute elite-tier models for coding, far above competition, and Gemini or any OpenAI model do not come close. Distilled models like GLM and others seem to have weird bugs and inconsistent behaviour. Benchmarks do not convince me otherwise.

2. Libya’s army chief was mysteriously killed in a plane crash a day after news broke that it had a signed $4b arms deal with Pakistan. Naturally, I was curious.

Turns out Libya is actually controlled by two different factions.

• One is Tripoli-based, UN-recognized, and backed by Turkey (who even stepped in militarily to defend it in 2019) and Qatar. Is a coalition-based “national government”, controls most of Western Libya.

• And the anti-islamist Haftar faction, supported mainly by Egypt+UAE and loosely by Russia (used Wagner to support Haftar in 2019 until Turkey intervened, at which point they withdrew) controls the East and South.

• Tripoli has been subject to infighting over recent years while Haftar relatively stable so even huge backers like Turkey have begun hedging their bets by making some contacts w Haftar.

• I guess the army chief flew to Turkey seeking their support after seeing Pakistan signing an arms deal with their rival. Plane crashed within Turkey’s airspace on the way back.

• Even Haftar declared three days of national mourning in honour of the killed army chief, I imagine to dispel any rumour of their involvement.

Super interesting story, had no idea about Libya’s situation before this rabbit hole.

Maybe it’s the unholy pretentiousness of so many of the posters I see on here that triggers this or the absolute aversion of my nature to the “corporate” culture and identities we’ve collectively built around them, I don’t know. But I do know I will stop myself before I fall down this rabbit hole that might take anything from a few hours to weeks of my life from existential burnout.

Most top researchers and discoveries, I’ve noticed, have quite a bias for “good” and “kind” things. Just look at the Nobel Prizes for the last couple of years in which there weren’t really any earth-shattering discoveries. You’ll find that aplenty. Which is probably a better thing for a less antagonistic world, but intriguing nonetheless. Do they reflect the general distribution of humanity, or is this some by-product of the academia they surround themselves in that pushes them towards that bias?

All of this as a tangent to say, yes, there is a counter-point to the acceptability of the 92’ Nowak & Sigmund paper GTFT paper so I am not accused of being a propagandist for “goodness” at the compromise of truth… but the paper essentially found that forgiveness was a necessary part of all successful strategies when playing a multi-round, noisy like the real world, Prisoners Dilemma. (I would hate to gate-keep behind jargon, you can research each of these individual terms if you want to read more - you will find them).

I’m going to give LinkedIn one more chance, basically. And starting today, I’m running an experiment: I’m unfollowing everyone, and all new connections will be unfollowed by default. I will build out a new “following” list from scratch based on posts I’m interested in, and will see how the new feed treats me.

2) I will post, maybe, I think. But I will essentially treat it as a public jotbook, I will write for myself and perhaps often not be that coherent. It will be thoughts about Claude Code vs Cursor (as I have one thought now), or it could be a random shower thought I had about Apple’s long-term lead in desktops because of solid early decisions, despite a now-lack of innovation (one I shared with a friend earlier today). It could be more philosophical too.

The point is, don’t expect much. I’m certain if I feel anyone does I will be more hesitant to post anything until I polish it a million times over. So I’d like to think you don’t expect much, but I do hope it becomes something that makes you start to.