Anubis shows up everywhere

i think that as AI advances, the self-describing, dynamic APIs of hypermedia might become more valuable than data APIs

"When we detect unauthorized crawling, rather than blocking the request, we will link to a series of AI-generated pages that are convincing enough to entice a crawler to traverse them. . . . No real human would go four links deep into a maze of AI-generated nonsense. Any visitor that does is very likely to be a bot, so this gives us a brand-new tool to identify and fingerprint bad bots, which we add to our list of known bad actors."

Google dropped their A2A specification for enabling agent communication. It's basically WSDL for agents. It's a blend of OpenAPI concepts with Agent concepts. What it could potentially enable is a world where you can put your agent on a server and talk to it over http in a fairly standard way. While MCP focuses more on giving agents tools they need to run, A2A focuses more on how do you invoke a remote agent. Some notes on the spec: - Provides a standard file to drop in your web server for "discovery" (./well-known/agent.json) - Provides a spec for defining"agent cards" (name, skills, capabilities, examples). Kind of mixed feelings there. This is mostly fluff, but moves toward an agent registry. - Provides a spec for spawning / cancelling / watching / being notified about task runs from agents. - Does not have anything in the spec for tool usage, so still need something like MCP for tool discovery. - Reuses OpenAPI auth concepts - Runs on top of http/json-rpc/sse - Spawning a task with an agent takes a message that is like a single item in an llm completion message list. Lots of thoughts, but going to let it gel for a bit.

Analyzed a phishing case in M365: attacker bypassed MFA using axios HTTP client, leaving a telltale "axios/1.7.7" in sign-in logs. Lesson: regularly check sign-in logs for unusual user-agents to spot suspicious activity.

been telling friends this for weeks, gonna say it again: mcp isn’t the final destination