I think VMs with snapshots would negate the need for Vagrant.

With increasingly aggressive usage limits (Claude weekly usage now), "agentic" style of token burning seems much less practical to me. Coming from Aider and trying tools like OpenCode, the "use models to discover the relevant files" etc pattern seems very token heavy and even wasteful - whereas with Aider you include relevant files up front and use your tokens for the real work.

Agreed. Alternatives seem too "agentic" for me, where Aider strikes the right balance of AI pair programming.

One one hand, I can see the captcha is easy to fall for. On the other, nothing says "prove you aren't a machine" like "run this code that a machine could easily run."

If you have any sort of Experian bureau activity, you're at risk by this issue whether you manage your profile with this site or not

Experian allows unfreezing via their site in the article. If someone can easily recreate your account, they can unfreeze it which makes it pretty useless.

Yes, but if you have an account you’ll at least get an email notifying you that your account’s email address has changed (as a result of someone recreating your account). That’s how I was tipped off to someone trying to buy a car in my name (by pulling on the thread of calling customer support asking wtf I got that email). So it’s very useful to at least have an Experian account so you can know when someone is trying to go after you this way.

Now granted, it’s possible that the attacker won’t change your email address first, in which case I’m not sure if you get an email stating that your credit was unfrozen. But it’s likely they’ll change it in order to make it harder for you to mitigate the damage in a timely manner.

Exactly

defaultdict doesn't seem to easily solve for the main topic of deeply nested values.

+1 for Fiddler, though it doesn't sound like the author was in a position to forward traffic to an HTTP proxy at the time in prod

I was scratching my head on how he was capturing requests without mentioning a proxy cert, but then I saw the security note at the bottom.

  You'll see that the data for these products is sent in plaintext to and from their servers

The API seems to have a valid cert and is listening over HTTPS - strange that the app client uses plaintext.

  curl https://api.petkt.com/
  {"error":{"code":97,"msg":"App is out of date, please upgrade"}}

I find CORS is generally a good interview question for frontend or full stack engineers.