Jeremy Ettlinger

Calls, puts & mise en place

Appel & Mise

Vol. IWednesday, September 16, 2026 · 65° & cloudy on the UWSThe daily, for Jeremy Ettlinger
BTC$75,971-1.2%ETH$2,404-2.9%S&P 5007,586-0.4%

The lede

We got admin access to Baseten's production GitHub

Strix

A live GitHub personal access token for `basetenbot` was sitting in a publicly readable image in Baseten's Harbor registry — not in a filesystem layer, where every secret scanner looks, but in the image config's build history, where a `GITHUB_TOKEN` build arg had been expanded into a RUN command in March 2023 and stayed legible for three years. It carried admin and push on the main product repo, the GitOps repo that drives their clusters, and the Homebrew tap. The lesson generalizes badly in a good way: deleting the file does nothing, `docker history` is a credential store nobody audits, and an AI infrastructure company with real security practice still shipped it.

AI & Agents

Mark Seemann

On learning programming in an age of LLMs

A reader writes to Seemann with the honest version of the anxiety: I have built a large TypeScript system that works and is above my own level of understanding. His answer refuses both the panic and the reassurance — programmers have always worked above abstractions they can't see the bottom of, but the old rule of mastering one level up and one level down got harder when the generation stopped being rate-limited by your own typing. The useful distinction is which questions to hand a model at all: falsifiable ones, yes; "what should I learn next," no.

Google

Gemini 3.8 Live and 3.8 Live Extended Thinking

The genuinely new mechanism is reasoning and speaking at the same time — the model narrates a multi-step background task while it runs rather than going silent and coming back, using filler like "let me check that" the way a person buys thinking time. Add mid-sentence switching across 97 languages and near-real-time visual grounding and you have the first voice stack where a long tool call doesn't feel like a dropped call. If anyone on his team is building an agent people talk to, this is the bar it now gets measured against.

Engineering & Leadership

LeadDev

Stop asking engineers how many machines they need

Capacity planning had grown from weeks to four months because every team padded its own number reasonably and the padding compounded invisibly, leaving finance with a total nobody could trace to a business reason. The fix was to stop asking for machine counts and start asking product teams about intent — traffic growth, retention windows — then cascade that through the service graph automatically and check the forecast against what actually got used. It is the same move as roadmapping in outcomes rather than tickets, and here it's worth hundreds of millions in kit that never had to be bought.

Web & Product Craft

Cloudflare · made the Sunday

Give every teammate and agent the right level of access to your Workers

Worker-level roles at last: metadata read-only, content read-only, editor and admin, scoped to a single Worker instead of the whole account, which is the thing that has made handing a deploy token to anything — a CI job, a coding agent — an all-or-nothing decision. An editor token on one Worker can ship a version and cannot touch a neighbor or delete the resource. For a fleet of small Cloudflare sites this is a free afternoon of blast-radius reduction.

Internet Archive

An update on Wayback Machine access

The Archive is now throwing 429s under waves of automated traffic, and it says plainly that the filter catches real people by mistake — the polite way of admitting that the cost of crawling everything has landed on the one institution that exists to keep the web readable. Worth knowing before you point a script at web.archive.org and conclude your code is broken.

New York & the Table

Diversions

Aftermath

What really caused the video game crash of 1983?

Alexander Smith's case is that the bargain bins everyone remembers were a symptom, not a cause — roughly twice as much product shipped as there was demand to absorb, and a market that oversupplied that badly would have collapsed even if every cartridge had been great. "It takes more than bad games to kill an industry" is a sentence worth keeping around for any market where supply is suddenly cheap to manufacture.

Loose Change

99% Invisible · made the Sunday

Doves Type

Two men cut a typeface together for the Doves Press in Hammersmith, fell out irreparably over who owned it, and one of them settled the question by carrying the metal down to the bridge and dropping it into the Thames — two tons of lead, in installments, at night. Helen Zaltzman tells it as a live show, which is the right register for a story where the artifact and the grudge are the same object.

The Back Page

The Guardian

When did football fans first start wearing replica kits?

The Knowledge traces the whole apparatus back to Don Revie and Admiral's Bert Patrick agreeing something over a cafe table in 1973 — £7,000 for a logo on the shirt, and the copyright to sell children's replicas at about a fiver. Four years later 84 of the 92 league clubs had a manufacturer's mark, German kids were sewing badges onto blank Adidas shirts themselves, and adults had to wait until England's 1982 World Cup shirt for one that fit.

Around town

Sat Sep 19 · 9:00am

HealthTech Launchathon & ClawCamp

Arya Health, 307 W 36th St, Garment District

A weekend of clinicians, patients and technologists building prototypes together, with the explicit promise that you leave with something running rather than a deck. Free, and the interesting constraint is the room — domain experts who cannot code sitting next to people who can.

professional

Sun Sep 20 · 5:00pm

The New Sustainability

Scandinavia House, 58 Park Ave, Murray Hill

The Nordic kickoff reception for Climate Week and the General Assembly, with Georg Kell — who built the UN Global Compact — and new research on how Fortune 2000 companies have quietly changed the words they use for all of this. Free, and the language-drift study is the part worth showing up early for.

professional

Sun Sep 20 · 11:00am

Film Forum Jr.: The Cameraman (Buster Keaton, 1928)

Film Forum, 209 W Houston St, West Village

Keaton as a tintype photographer trying to make it as a newsreel cameraman, at eleven in the morning, for fourteen dollars, in a room full of five-year-olds who have never been told silent comedy is homework. The gags were engineered to the frame and they still land.

casual

Quote of the day

“LLMs don't hallucinate; they bullshit.”

— Mark Seemann

On this day

September 16, 1920 — a horse-drawn wagon packed with dynamite and cast-iron sash weights explodes outside 23 Wall Street at noon, killing 38 and scarring the Morgan building's limestone. The pockmarks are still there, never repaired, and nobody was ever charged.

The puzzle corner

The Mini · Wordle · Connections

Two of today's items are the same story told from opposite ends: a credential nobody scoped, and a platform finally letting you scope one.