Back in June 2025, I submitted a security Capture-The-Flag (CTF) challenge for the annual The InfoSecurity Challenge (TISC) 2025, organized by Centre for Strategic Infocomm Technologies (CSIT), an agency in the Ministry of Defense of Singapore, and it revolves around Passkey.

I was lucky to have my challenge selected for TISC. TISC 2025 consists of 12 CTF challenges. My Passkey CTF challenge is 1 of the 3 community challenges that were accepted — with the remaining either developed internally by CSIT or developed/commissioned by CSIT-related entities. This nets me a cool $1000! :)

Remember back in the pre-GUI OS days when everything was done with commands typed on keyboard?

Remember how fast and efficient one can get with just keyboard commands and shortcuts? Remember your Lotus-123 or WordPerfect days? That's efficiency.

Before world wide web (WWW) took over everything, many systems were designed with purely keyboard-operatable shortcuts or commands.

It has been a dream of mine for 20 years to one day attend DEF CON, and it has finally happened.

It was an amazing experience — way larger than I had imagined. What I love most is seeing passionate, like-minded people gather in one spot and show off beautiful things and projects they care about. The scale is massive: it occupied all three levels of the West Hall of the Las Vegas Convention Center, with many villages, talk areas, merch booths, vendors, party/chillout areas, and more. At any one time, there were probably 15 talks and 30 activities happening simultaneously — it was truly overwhelming. Just look at the schedule.

TL;DR: Passkey has a clever design that allows users to know if your keys are silently stolen and cloned, but the feature is currently not very useful today because its major providers such as Apple, Google and Microsoft do not play ball.

Released Passcay over the weekend. Passcay is an open source Zig library for Passkey relying party, i.e. websites that want to support secure Passkey authentications. Passcay is pronounced exactly the same as "passkey". In hindsight, I probably should have named it Passquay, still pronounced the exact same way, to add a touch of Singaporean flair to it.

I've been using Zig as my primary language for about 1.5 month now, and I'm feeling increasingly confident with it. I do miss a few things from Rust — especially ownership and the memory safety it enforces — but overall, I’m happy with the switch. One downside: LLMs don’t seem to work as well for Zig as they do for Rust or JavaScript, likely due to the smaller corpus of example code available.

I made Passcay to solve my own problem. I am working on a web service that would be having passkey as native authentication rather than as 2nd factor authentication, above the insecure and privacy-affecting email-password login.

Another day, another AI coding agent. OpenAI just announced Codex, modeled after Anthropic's Claude Code.

I have just found my happy place only a few days ago with Claude Code and Visual Studio Code Agent Mode + GitHub Copilot. Nonetheless, happy to be evaluating Codex. OpenAI's UX are usually polished and what I like about it already is that it's open source. This means it will get better so much faster than many of their competitors.

Tried to peek under the hood of Claude Code last week but it's all obfuscated.

Fun project. 16 years ago today, in 2009, I built this dashboard for IMDA (then Media Development Authority of Singapore [MDA]) to showcase the traffic to MDA-funded startups.

It was a "simulated" live data of all visitors to all the tracked sites, with the data source being Google Analytics. At least one of the startups then is now a unicorn. You can probably guess which one - Sea, then Garena.

Thank you Bernard Leong, a friend, fellow entrepreneur & technologist for the kind invitation.

It was an honor to return to my alma mater and speak at National University of Singapore (NUS) Business School for the Master of Science in Venture Creation students about a long-time passion of mine: the open web. In my talk, I covered the inception of the web in the 1990s, the destructive influence of social media algorithms, and the promise of the fediverse and open protocols in shaping the next phase of the web. I also explained why Web3 is not part of that evolution.

Tech companies today should look into integrating open source into their business strategies and contribute to building open protocols. I shared case studies on companies that have successfully done so, Anthropic's Model Context Procol (MCP), Meta's Llama & Singapore's own Menlo Research.

My journey started casually enough—working on Tixie, I was looking into simpler ways to deploy Rust-based Lambda functions when I came across Cargo Lambda. What got my attention was that it is so easy to cross-compile with it, mainly due to Zig's powerful build system. Even though it was built for Rust developers, it utilizes Zig for cross-compilation, allowing me to compile ARM binaries that worked on AWS Graviton on my Apple Silicon Mac.

That was the start of a series of rabbit holes that consumed me for more than a week.

The Roadmap Pitfall

If you run a company, do not release roadmaps or make future promises. You owe your customers nothing beyond what they're paying for right now. Your customers pay for what you sell today, not what you will be selling tomorrow.

I call this the Roadmap Pitfall. It is a common mistake and trap that many companies, especially startups, fall into. The tech landscape is littered with companies that have overpromised and underdelivered through their public roadmaps, hurting their reputations. Some infamous examples are Tesla's Robotaxi, Meta's Libra and Metaverse, Google Stadia. They are selling products that might become revolutionary tomorrow but not today.

Spelling, or 听写, is a very familiar process for parents of Singaporeans with primary-school-going children, or in fact, for parents worldwide. Every week, each of our children is to learn two sets of words and phrases, one in English and one in Chinese, to be tested in school. Each set consists of 15-20 phrases and sentences.

A usual process for us would be first having each of our children study, on their own, the words or phrases for the upcoming spelling test, and once they are ready, passing us parents the list for us to read aloud to test them. I'm sure many parents in Singapore are very familiar with it. Rinse and repeat every week.

I created Tixie to facilitate the latter read-aloud process, allowing it to be conducted solo by the students only, without involving parents or another person.

Digg is coming back!

Digg was one of the very first social news aggregators back in the 2005-ish. It's one of the inspiration that led to me creating and launching Ping.sg in 2006. Ping.sg was a social blog aggregator for mainly Singpaore blogs.

To me, that's a sign of revival of free and open web independent of big techs.

Watch the OpenAI GPT 4.5 announcement video.

Messages from the announcement, some obvious, some not so:

1. GPT 4.5 is going to be awesome.

2. We got a glimpse of GPT 1 (08:34), circa-2018. Spoiler alert: it sucked.

3. The engineering team that worked at OpenAI is just as awkward in social settings as your company's engineering team.

My workflow with generative AI has been changing quite rapidly over the past two weeks. DeepSeek's release really sped up innovation and release cycle among its competitors.

I may draft a longer note covering my workflow next time; I'm writing a quick one to share how impressive Claude Code is.

Claude Code hit a homerun

Since the introduction of Perplexity's Deep Research on Feb 14, 2025, now the 3rd major deep research AI offerings after OpenAI ChatGPT's, and Google Gemini's, I have been using it rather extensively. It helps greatly on a research project I am working on.

Early findings on Perplexity Deep Research, it often takes 5-20 minutes, not quite 2-4 minutes as advertised. Perhaps it is due to the spike in usage since the introduction, or perhaps it is a tweak to make it appear as if it's working comparatively hard as the other 2 Deep Research offerings. Overall, I do not have an issue with the response time. I can also see its thought process throughout the thinking time.

I am a subscriber of ChatGPT Plus ($20/month) and Perplexity Pro ($20/month). As such, I do not yet have access to ChatGPT Deep Research, which, as of today, is only available to ChatGPT Pro ($200/month) subscribers.

My preliminary findings on Perplexity Deep Research after about 24 hours of rather extensive use.

Q: Would you consider releasing some model weights, and publishing some research?

Sam Altman: yes, we are discussing. i personally think we have been on the wrong side of history here and need to figure out a different open source strategy; not everyone at openai shares this view, and it's also not our current highest priority.

Source: AMA with OpenAI's team

It is interesting that Sam Altman said what he said, considering the ongoing legal battle between Elon Musk and OpenAI on the similar topic. It is even more intriguing that DeepSeek appears to be a catalyst for this shift in thought.

It must have been be a challenging week for the folks at OpenAI and other similar closed-source foundational AI model companies. The release of DeepSeek, which is not only better than OpenAI's o1 model but also free, has sent shockwaves through the industry. The fact that DeepSeek has managed to achieve this feat with only a fraction of the resources that it took for other comparable models to be trained is even more surprising.

Foundational closed-source AI companies are usually making a loss on the consumer products through the likes of ChatGPT Plus, Claude Pro. It is also commonly believed that these consumer subscription-based AI products do not bring in much profits. It is not surprising to find that some of these subscription plans are even loss-making, such as that of $200 a month of ChatGPT Pro plan.

The foundational AI companies are still figuring out ways to turn profitable. The revenue model today is largely relying on the API and enterprise sales, i.e. the "AI wrappers" and existing apps racing to support AI feature.

Sam Altman: The honest answer is we have no idea [on how to bring in revenue]. We have never made any revenue. We have no current plans to make revenue. We have no idea how we may one day generate revenue. We have made a soft promise to investors that once we've built this sort of generally intelligent system, basically we will ask it to figure out a way to generate an investment return for you. [The Journal by WSJ]

A proud moment that started with a simple catch-up with a good friend.

I briefly shared that I am working on a project related to self-publishing. My friend, Chandra, shared that he has been considered blogging and asked me to set one up for him on the spot. He also shared that he would prefer self-publishing than contributing content on social media platforms. That was music to my ears!

I am on a mission to bring self-publishing back. More on that later.

Let’s Build Like It’s 2005

Software engineering has become overwhelmingly complex.

Want to build something today? Good luck. First, you’ll need to wade through an ocean of decisions: which tech stack to choose, how to set it up, which JS/CSS/TS/TSX frameworks to use, which build tools, linters, and testing environments to adopt, how to structure your project, organize your repository, and configure CI/CD pipelines. The list goes on. If this is something to built by a product + engineering team, despite more headcount, the complexity is often compounded even more.

Even after spending days setting everything up, you’ll never quite feel satisfied. You’ll tinker, tweak, and second-guess every decision for weeks. You’ll obsess over improving your stack, striving for a perfection that always seems just out of reach.

Meanwhile, only 5% of your time goes into building your actual product. The other 95%? That’s spent on the stack.

It's exhausting. It's frustrating.