Syntax - Tasty Web Development Treats
Hosted by Scott Tolinski and Wes Bos
Written by a model from the transcript; not yet reviewed.
Wes Bos and CJ Reynolds discuss the latest web development, AI, and hardware-hacking news. The hosts cover Void going open source after its acquisition by Cloudflare, new image and decision capabilities in Jev, and a viral trend of using the Android Development Bridge to strip ads and bloatware from smart TVs. They also explore the black market for API tokens, Anthropic's new internal source control and review tools, and various esoteric programming and browser-based side projects.
Hosts introduce the show, announce GitHub Universe, and preview topics.
CJ discusses repurposing a thrift store photo frame with AI to manage lunches.
Exploration of Void's open-source deployment platform and its new framework.
Introduction of Jev Images, its image decision capabilities, and pricing.
Discussion on hacking smart TVs via ADB to remove bloatware and improve UX.
Overview of the REA GitHub project and tools for reverse engineering devices.
Details of the Open Code console hack, impact, and response.
Exploration of API key theft, secondary market, and model distillation risks.
Debate on limiting AI access, Daybreak Blue, and future security measures.
The hosts discuss how PS3’s Linux capability is being exploited and the broader threat of prompt injection in large-scale agent usage.
They explain their new approach to storing API keys in OnePassword to simplify updates and enhance security.
The conversation turns to Anthropic’s custom source control and code review tools designed to handle massive monorepo workloads.
Void Framework Goes Open Sourceinsight
The Void meta-framework, which offers full type safety and server-side rendering for Cloudflare deployment, has officially gone open source.
Jev now supports image inputs via a specific header, allowing for extremely cheap visual question answering and security analysis.
Hacking Smart TVs with ADBstrategy
Developers are using the Android Development Bridge to strip ads, remove pre-installed bloatware, and replace slow smart TV home launchers.
AI Models Rejecting Hacker Promptsdebate
Cloud-hosted AI models like Claude Opus and GLM reject prompts attempting to bypass security or create custom firmware, pushing hackers toward open-weight models.
Open Code Console Security Breachstory
The Open Code console web dashboard was targeted in a cyberattack, impacting 1.4 percent of users and draining some OpenAI API key budgets.
API Token Black Market and Distillationinsight
The hosts discuss underground markets for AI tokens and how user prompts and outputs are harvested for distillation attacks to train competing models.
Anthropic Internal Source Controlinsight
Anthropic designed its own custom source control and code review systems, Scion and Antique, to handle massive monorepo scaling issues in the agentic era.
“I found a photo frame at a thrift store for 20 bucks. So that's, that's what I want to spend my week on is hacking that thing. Make it a smart, smart.”
“Void Deploy and it automatically deploys the cloud for, for you. And you don't have to manage like the Wrangler config and all of the other stuff.”
“They don't let up. And yeah, his tweet later was they've been nonstop trying to attack our systems for the past 48 hours.”
“PlayStation 3 shipped with the ability to run Linux on it straight up.”
“Because like, if you have thousands of agents all trying to hack at the same time, that's in some cases sort of a legitimate use of the agent in a sense.”
“The history of our main branch alone is almost 100 gigs and compressed working copies over 25 gigs.”
“I think the best was Opus 5, which got a 66%, but still couldn't figure out three of the problems.”
“We might as well do it to them.”
Wes, Scott, and CJ run through the week’s biggest web dev news: everyone’s hacking their TVs, VoidZero open-sourced its Void framework with Cloudflare deploys, OpenCode got hacked, and Anthropic built its own git replacement. Plus DeepSeek V4.1 Flash, Cloudflare’s security audit skill, Krea 3, a local LLM speed tester, and Killswitch, an esoteric language designed to break coding agents. Show Notes 00:00 Welcome to Syntax! 00:44 CJ Hacks a Round Thrift Store Photo Frame 02:18 VoidZero Open Sources the Void Framework 06:58 Jev Adds Image Support to Its Decision API 11:18 Local Security Cameras: Frigate and Custom Wyze Firmware 17:41 LLM Speed: Try Local Models Before You Buy Hardware 21:00 Everyone Is Hacking Their TVs With Clean Your TV 24:51 Are These the Final Days of Hardware Hacking With LLMs? 29:24 Reverse Engineer Everything: Skills for Agentic Hacking 31:42 Hacking a Tonal and Building a DIY Digital Resistance Gym 37:24 Brought to you by Sentry.io 38:34 OpenCode Console Hacked: What Happened and Who’s Affected 41:31 Black Market API Tokens and Distillation Attacks 44:13 Should Everyone Get Access to Cyber Models? 47:48 Managing API Keys With Varlock and 1Password 48:45 Anthropic Builds Its Own Git Replacement 55:15 What Are We Losing in the Agentic Era? 01:04:26 Killswitch: A Programming Language Built to Break LLMs 01:06:53 Cheng Lou Turns JavaScript Code Into a Neural Net 01:09:30 Antfu’s Furigana Font for Reading Japanese 01:12:32 Guitoro: Strum a Guitar in the Browser 01:17:39 Playing Snake on Network Switch Lights Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads
15,125 words · 3 speakers
Speaker names marked are inferred from speaking time and the show’s known hosts — they are not voice-verified.
Page updated · transcript and summary are machine-generated