Just got this email from Framework:

Dear Valued Framework Customer,

We are writing to inform you of a data breach at our business intelligence database provider Metabase that resulted in an attacker accessing customer names, email addresses, phone numbers, and addresses. Your information was in the database that was accessed in this breach. This breach did not include order or payment information.

We have full details on the incident below. We are deeply sorry for this breach of information, and are reviewing and improving our methodology for data storage in external database vendors.

We are also in the process of notifying the regulatory authorities in each region where relevant regulations exist. Note that while regulations in most regions do not require notification for breaches of names, email addresses, phone numbers, and addresses, we are sending this email to you regardless to ensure you have visibility and can take any actions needed.

What happened?

On August 6th, 2026 at 9am Pacific Time, Metabase notified us of a breach of their systems with the following email message:

On Monday, August 3, we discovered that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability. We notified law enforcement, and we have engaged with a third party forensics firm to conduct an independent investigation.

Your instance of Metabase was vulnerable to this 0-day. Therefore, to protect your company, we recommend you:

Rotate the credentials for every database connected to your instance; and

Review the admin accounts on your instance and remove anything you don't recognize.

We also discovered that the attacker was able to gain access to your instance. We created a report on the actions we believe the attacker took on your instance, which includes log files, and which you can get from the Metabase Store at [removed url].

(If you do not have access to the Metabase Store, are having issues accessing the report, or do not want to click on a link in an unexpected email, you can log into your instance directly and reach us at Help > Get help in the grid menu in the upper right hand corner. We'll confirm this message is from us and email you the report.)

This report is based on our own application logs. We did not query or read the data in your connected databases.

Depending on the jurisdictions in which you operate and kinds of data your instance connects to, you may have notification obligations under applicable laws. If you have concerns in this regard, we recommend you assess potential notification obligations with your company’s legal or compliance experts.

We regret any inconvenience this incident may cause you, and we are here to support you. If you have questions, please reply to this email or email us at [removed email address], and we'll get back to you as quickly as we can.

Sameer Al-Sakran

Founder and CEO

Metabase

We immediately investigated the logs Metabase provided to us and confirmed that our database instance was accessed by the attacker. We confirmed that the following information was accessed:

• Full name
• Email address
• Login IPs
• Billing and shipping address information
  • Country
  • Address
  • City
  • State
  • Zip code
  • Phone number
  • Company

For Framework for Business customers, we are investigating whether the following information may additionally have been accessed:

• Company
• Phone
• VAT
• EIN
• Billing Email
• No other personally identifiable information, order information, or payment information was accessed.

Note that Metabase has additionally flagged:

Important: This is a preliminary update based on our current knowledge.

We are working with a third-party forensic investigation firm to understand the full nature and scope of the event.

We are providing you this interim update in advance of completing our investigation to allow you to better understand any potential impact and secure your data.

Our investigation is ongoing and the information shared now is preliminary.

Please look at the application logs as well as the queries executed that are provided as separate files in the zip file for detailed activity and a potential timeline.

We’re providing you notice of the breach in the meantime to ensure you have the earliest possible visibility. In the event Metabase notifies us of additional information that impacts you, we will send a follow-up email.

What was done to resolve the issue?

After we were notified of the breach by Metabase, we rotated credentials on all databases associated with our Metabase instance and confirmed that there were no changes in admin access or access to systems outside of Metabase.

What steps have you taken to ensure this doesn’t happen in the future?

We are evaluating the breadth and depth of data shared with business intelligence platforms, and scoping down their access to only the columns required for analysis.

Nirav Patel and the Framework Team

I could still turn it on for now but there's a warning that it's no longer supported. I have ADHD and I can't live without cosmetic filtering. (I'm not tech-oriented enough to know if that's the right term for it. I mean the ability to point at elements on a page and say "take this off for me".)

I use the function to remove YouTube shorts, recommendations, the block that nudges me to get Premium and probably a gazillion other bells and whistles that I've already forgotten about. I wouldn't use YT at all if I couldn't do this. Same deal for Reddit.

I also use it to remove moving graphics and other things on some web stores that break my focus. I wouldn't be able to get through my workday without that option. I have to source countless small items for my business from sites that are already complex enough to navigate without any additional distractions. The site designers likely have no clue how much worse their animated banners etc. make my day. That's okay. They can't take everything and everyone into account at all times. But I must be able to adapt environments to be kinder to my brain if I am to retain my executive function so I can do my job.

Are there other similar options out there that you guys can recommend? Another extension I absolutely have to have is called "You're fired". It removes everything I don't like from my YT feed based on search terms. It's perfect because interacting with the unwanted stuff doesn't seem like a good idea (at least it doesn't remove it from my feed even if it's supposed to). I don't have to interact, just add a search term one single time and it'll be gone for good. That extension wasn't widely available for other browsers last I checked so I'd like to keep using Brave if possible.

Not sure where this goes but I am looking for an app to help fill in between other reading practice we do with our 5 year old.

This won't be the main tool to help them learn, just trying to find something fun to help learn a bit. Does anyone have recommendations for fun and educational reading apps?

Hopefully the Tilderen aren't completely sick of the topic of AI writing.

To summarize my take: I think LLM agents are profoundly useful. And problematic. And I really really dislike AI writing when I encounter it outside of documentation. It's not only that it usually has a poor signal to noise ratio and a lot of annoying tropes, it also breaks a contract that has existed since writing was invented. And I dislike that it displaces human writing. Human writing is beautiful, we need more of it, not less.

By breaking a contract I mean that human writing implies an investment. The author invested time in creating it and has (sometimes) invested their reputation by publishing it. Whereas LLM prose requires minimal effort and thought. One great summary is:

"If you didn't take the time to write it, why should I take the time to read it?"

But it's not just about time or preference. We rely on signals of investment and competence to judge the value of information both personally and professionally. LLMs short circuit that completely. They incorporate signals of effort despite there being no effort involved. Signals that we could once rely on that someone has a deep understanding of a subject, or did extensive research, or is reasonably intelligent, or interesting, don't have any meaning when it's LLM prose.

Recently, while investigating Fable failure modes (while working in Claude Code), it outputted a summary that I think captures the situation really well: "My polish costs nothing".

Which is to say that LLM prose folds in signals of authority, competence, rigor and insight without any of those things needing to be present in the content. A fluent human is often worth listening to while a fluent LLM is just the default, the fluency carries no information. I think that's part of the reason for AI psychosis, I think it effectively uses, now outdated, expectations to hijack perception.

The reason that I sometimes take the time to investigate why an agent went wrong is partly to refine the scaffolding and partly to remind myself how dumb they are. Each generation is a little bit better, confidently right a little more than it's confidently wrong, so I make a point not to let myself fall into the trap of trusting their output too much.

I suppose I'm just posting to pass on the reminder.

I prefer physical buttons and something that does not have a large screen and looks simple enough that it could be OEM. Does anything like this exist? All options seem to be cheap and ugly with flashing lights, or a giant touch screen.

It looks like we’re finally getting some real options in the space, so I’m interested in people’s thoughts and experiences!

I’ve been running a pair of LG 27MD5KL monitors forever, and they’ve been largely great - but they’re really showing their age at this point, and I’m being forced to upgrade either way because my new job requires using a Windows laptop (likely a Dell Pro 14, but TBC), and those old LGs use an esoteric dual link DP variant that only Apple supports. I’ll also be keeping my personal MacBook Pro, so smooth compatibility with both is a must. Use will largely be software work: lots of documentation, lots of terminal windows, lots of dark mode, but some design review work as well where decent colour accuracy helps.

Options I’m seeing at the moment are:

• Asus ProArt PA27JCV
• Asus ROG Strix XG27JCG
• LG 27GM950B
• BenQ MA270S
• Apple Studio Display
• Apple Studio Display XDR

I get the impression that Apple’s the better option where possible, but I’m concerned about compatibility, especially when I don’t directly control the choice of laptop. If anyone has real world experience on that one I’d be interested, especially the difference between “technically works on non-Apple laptops” vs “is an equivalently good experience on non-Apple laptops”.

I’m guessing just using separate inputs for each laptop will be fine on whatever I go for, but I’m open to getting a KVM if needed (L1Techs? I haven’t actually checked how hard it is to find one that supports 2x 5K yet…). Couldn’t immediately see anything that’ll take Thunderbolt input from the Mac and HDMI input from the Windows laptop and push both to Thunderbolt output, which might otherwise have been a way to bridge the Apple display question.

Probably going for 27” 5K rather than 32” 6K, unless there’s a compelling argument for the latter. I briefly tried a Dell 32” 6K a few years back and other than horrible backlight bleed, sitting that close to a 32” display ended up feeling like I was craning my neck rather than moving my eyes to see edge to edge.

So, what do people think would be best here?

Sending up a bat signal for @gary and @ButteredToast - you guys both know your stuff on this one!

Right now, I have a Samsung Galaxy A12 phone, which has done everything I need for quite some time. It was bottom of the barrel in the Samsung lineup, and it quit receiving updates of any kind back in November of 2024. For a cheap phone, I've been pleased with it.

My use case is unusual. I rarely use my phone to go online, but on occasion, I am forced to do so. Most of the time I use it to make calls, or send and receive texts. SMS is fine for me. I don't play games on it, though I do use the camera now and again.

One slightly unusual task is tethering. When my internet goes down on my computers at home, the mobile network is often still available, so I tether my desktop to the phone connection. Visible will slow the connection speed tremendously, so I use an app that disguises the tether connection, and I get full speeds. So I need this app to work when the main internet connection goes wonky.

One year and eight months without security updates makes me a little more cautious about using the phone for anything online. I don't use it for bank accounts or credit cards, no instant payments of any kind, and there are no passwords saved within it. Even if I still got updates, I wouldn't use it for any type of financial transactions. I don't even check email with it.

In reality, a dumb phone would probably work for me, but Visible is notoriously picky about Android phones they will accept. And I don't use Apple for anything. No plans to change that.

I have been more and more interested in ditching Google software. I was recently forced to switch to Google Messages, since Samsung is turning their messaging app out to pasture. A Pixel 10a with GrapheneOS is something I'm considering. Visible will accept any modern Pixel phone, so they aren't a problem.

The question is, is any change necessary with how little I use the phone online? Perhaps I should just wait till the battery dies, but that doesn't help me in my efforts to de-Googlize.