For me, fulfillment comes from two things: seeing people finding use in the things I build and the craft itself. A job can help with the former, but it definitely doesn't help with the latter.

At my current job politics and "process" often take priority over the software engineering part. The advent of AI isn't making things better, some people are cranking out buggy slop at speed and there's no room for pushback with ever more ambitious deadlines.

I'd rather just work on my own passion projects, maybe contribute back open source that have brought me a lot of utility over the years.

Careful what you wish for. WASM-rendered pages could spell the end of ad-blockers and other extensions that modify or read page content. You'll have only binary blobs being downloaded rendering something on a canvas surface.

"Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change the smart contract logic of our ETH cold wallet. This resulted Hacker took control of the specific ETH cold wallet we signed and transfered all ETH in the cold wallet to this unidentified address."

[yes, it says 'musked', assuming they meant masked. @safe is https://safe.global/wallet]

Unfortunately most hardware wallets can't interpret EVM smart contract transactions and asks you to sign a big binary blob that is supposed to match what you see on your computer screen (it's literally called blind signing). He said in the tweet and later on a live stream that they verified that the URL was correct, and there were several signers in different locations on different machines.

Logically the UI must have been manipulated for all of them, which I can think of a few different ways to do:

- The signing link was replaced somehow over whatever medium they sent it to each other, pointing to something that either looks like the original UI (perhaps IDN homograph domain) or is the actual site if it has some weakness that allows script injection to manipulate the page

- The server side was exploited to serve a manipulated page

- Client side malware that injects something in the browser to manipulate the page

- Some kind of network/DNS attack combined with mis-issued TLS certificate (or injected CA)

It points to some level of sophistication and long-term observation of their internal systems to know what the process looks like and devising an attack.

Will be interesting to read when/if they release a full analysis.

My concern is if I jump on another startup and it doesn't go well, I will have even less chance to land a decent gig afterwards. Who knows what AI capabilities will be five years down the line?

I have some friends that work in government that could help me get a job there where you are basically unfireable and even get a pension, but the work is not very technically interesting. They all say it's soul-killing but stay for the stability and benefits.

Is a large tech company a better bet? I consider my self a very good developer but not sure if I can pass through all filters and the leetcode gauntlet either.

Deciding which road to go down is giving me more anxiety than ever before.