Popular, yes... but have you seen the issues? SOMETHING is going on in that repo: https://github.com/instructkr/claude-code/issues

Looks like mostly spam making fun of the code leak.

too much wechat QR Codes

What's going on with the issues in that repo? https://github.com/instructkr/claude-code/issues

It seems human. It taught me 合影, which seems to be Chinese slang for just wanting to be in the comments. Probably not a coincidence that it's after work time in China.

Really interesting to see Github turn into 4chan for a minute, like GH anons rolling for trips.

In this situation, it means "Hey I have been here and observed this!"

GitHub had always been about social coding from the beginning (e.g., forking and PRing repos)

合影 doesn't sound like any Chinese slang. That is just what "group photo" means.

There have been massive GitHub issue spams recently, including in Microsoft's WSL repository.

https://github.com/microsoft/WSL/issues/40028

trying to get github to nuke the repo? at a guess.

certainly nothing friendly.

I saw this on restic's main repository the other day.

oh wow, there are like 10 opened every minute. seems spam-y

I don't know about avoided, this kind of represents the WTF per minute code quality measurement. When I write WTF as a response to Claude, I would actually love if an Antrhopic engineer would take a look at what mess Claude has created.

WTF per minute strongly correlates to an increased token spending.

It may be decided at Anthropic at some moment to increase wtf/min metric, not decrease.

It also increases the number of former customers.

This leak just contributed to a new former customer, me. Flagging these phrases may explain exactly why I noticed cc almost immediatly change into grok lvl shit and never recover. Seriously wtf. (flagged again lol)

/feedback works for that i believe

And you can self-host the server if you want to! Running Ente Auth since quite a while now and am very happy with it.

Is he ever not under fire?

I really was wondering about the clickbaity title but it really is just a comparison:

Inspired by the thunderous footsteps of Tyrannosaurus rex, the IMENSUS engineers have designed a prototype rover that sends vibrations down through the ground beneath it to map out what resources might be there.

That isn't true, but I don't blame anyone for not understanding what Microsoft marketing is doing in terms of branding.

See for example: https://www.theverge.com/tech/856149/microsoft-365-office-re... or https://www.forbes.com/sites/zakdoffman/2026/01/11/office-is...

Microsoft Office still exists, the current version being Microsoft Office 2024 for Mac & Windows. But THIS Office is the the non-subscription version of Office, this is not the cloud-connected Apps being offered via Microsoft 365. This version of Office doesn't get all the latest cloud features and stuff happening in the subscription versions.

The cloud version of Office meanwhile is being renamed left and right. The office.com homepage now redirects to Copilot and is rebranded as Microsoft 365 Copilot just like you said. If you have any M365 business or enterprise plan Office is actually called "Microsoft 365 apps for business/enterprise".

Now why the Microsoft marketing team is adamant on changing and mucking about with such a long standing brand as "Microsoft Office" nobody understands.

I thought SOPS with age is what we were doing now. Do we need yet another tooling?

https://github.com/getsops/sops

There's also https://github.com/jdx/fnox

One of the first tasks I had for Claude was to build a protected KV store out of keepassx.cli. Out of the box I got a beautiful gui for seeding initial secrets while giving me a nice scriptable, non-interactive tool for injecting secrets into infrastructure bootstrapping.

"also" is a strong word for a project this young. It was started in October 2025, does not have any issues (at all) and is completely vibe coded. Not starting a discussion about security & vibe coding now, but I wouldn't blindly recommend such a nascent project if compared to something mature like SOPS.

Lol it's the guy who makes mise https://mise.jdx.dev, so I don't think it's a "vibe-coded" project)

Oh there are vibes; claude & copilot are a contributors on both misa and fnox, gemini even gets in on fnox (poor OpenAI)

SOPS with Age is simple, and simple is good. I strongly recommend this approach.

SOPS is simple? You are kidding me. Pass from https://www.passwordstore.org/ fame is simple. SOPS is ultra-complicated for a security tool.

I dunno, it seems mostly simple to me.

You have a .sops.yaml with some Age public keys, and then you run “sops secrets.yml” to create an encrypted file.

Can you explain what you find complicated about sops? I've used it with ease for the last two years, both personally and professionally.

Oh come on, now that I have a personal remote control already set up using hooks, specifically the PermissionRequest, and Home Assistant push notifications where I can allow or deny a specific action?

TIL that HA notifications can have associated actions. I have the exact same setup as you, except I only receive the notification and then walk over to the laptop to unblock the agent feeling like a human tool call. This will improve my workflow, thank you.

The notification payload for reference, you will also need a permission input_select (pending/allow/deny) and an automation that triggers upon mobile_app_notification_action:

  notification_payload=$(cat <<EOF
  {
    "message": "$escaped_message",
    "title": "$escaped_title",
    "data": {
      "tag": "$escaped_request_id",
      "group": "claude-code",
      "actions": [
        {
          "action": "CLAUDE_ALLOW",
          "title": " Allow"
        },
        {
          "action": "CLAUDE_DENY",
          "title": " Deny"
        }
      ]
    }
  }
  EOF
  )

Actionable notifications are a bit cumbersome on iOS since you need to long-press the notification for actions, but it does work.

I'm trying to understand the setup you have here.

So your hook -> HA -> push notification? And then you just tap to approve?

Exactly that. And the push notification includes what I am approving. Also with some sensible delay in sending out these pushes, because otherwise I may be bombarded with push notifications, while already having it manually approved.

Time and time again it is shown to *not* use your main account for everything. This goes for Apple and having a separate account for development work, for the App Store and your main iCloud account but this also goes for all other SaaS providers.

You are doing groundbreaking new and untested stuff with Claw? Do not use your main account. You want to access your main account's data? Sure, allow it via OAUTH/whatever possible way.

Have separate accounts, people. You don't want one product groups decision in those large SaaS corps to impact everything else.

> Time and time again it is shown to not use your main account for everything.

Good luck opening new google accounts for separation of concern. The new account is banned before the eula page finishes loading.

Google sends code via text msg to my main account phone number to unban, without me ever even filling a phone number.

After a day the account was banned again and pending automatic deletion. The appeal then took an artificial 5 days wait. I had to plead to what I presume is an AI. I had just paid $100 so it's not like I didn't show I was serious.

I am fairly certain that if they ban one account they will also ban the other anyways.

I have multiple Google Accounts and I am running them at the same time without problems. If you really want to separate things use different browser profiles per account. My work Google account never touches my private Google account in terms of browser profiles.

I never had issues with work accounts created via google workplace.

Google forbids you to have multiple identities. It's stated clear in their term of service. Any account you create must be linked to the same identity.

This means that it is trivial for them to ban all your accounts at once.

This also means that the 2factor is difficult to separate. Somebody with an unlocked access to my phone can hijack all my Google accounts by starting a password recovery.

Even though I made sure to never share my phone number to the new account, and I never loggued with it on my phone, and used a different browser session on desktop, it still forcefully sends a notification to my phone when I login because my login is suspicious it says. There is still no phone registered on the new account.

During reinstation of the banned accout I also got a scary msg essentially saying that if they denied my appeal, they might also ban my main account. Chilling.