The PHP2Shell Vulnerability Heralds Cybersecurity Hell

Mike's Notes

Wiz looks impressive.

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Suhscriptions > IEEE Spectrum
  • Home > Handbook > 

Last Updated

08/11/2026

The PHP2Shell Vulnerability Heralds Cybersecurity Hell

By: Dina Genkina
IEEE Spectrum: 02/11/2026

Dina Genkina: Dina Genkina is the computing and hardware editor at IEEE Spectrum. She holds a PhD in atomic physics and lives in Brooklyn.

...

AI is forcing us to pay off 40 years of technical debt

...

In late October, a slew of major cybersecurity issues came to light. But none were bigger than the so-called PHP2Shell vulnerability, which put a plethora of websites, including those of NASA, Wikipedia, the White House, and all other sites that run on Wordpress or Drupal (among others) at risk of exploits capable of both reading sensitive data and running malicious code on the host server.

As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation, and a patch was released before any bad actors got their hands on the exploit. However, PHP2Shell may be the canary in the coal mine, serving as a warning sign for what’s to come in the age of AI.

“One of the things we’re witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed,” says Matt Suiche, AI security research lead at the cybersecurity startup Tolmo. “Now it is time for the technical debt to be paid off.”

PHP Legacy Bug and Memory Errors

PHP, which originally stood for “personal home page,” is a programming language created back in 1994 and largely used by legacy sites. The bug underlying the PHP2Shell vulnerability was reported to the PHP Foundation as far back as 2024. The bug caused a common type of issue called an out-of-memory error, in which the amount of memory allocated to a piece of data is too small to hold the data. Normally, this type of error causes the program to crash—an unpleasant but not inherently dangerous result. And so the bug remained unaddressed.

“If you look at any at any point of time, there will be a bunch of bug reports that are waiting to be fixed, which are just crashes. Most people don’t take them very seriously,” says Suman Jana, an associate professor of computer science at Columbia University.

“It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.” –Suman Jana, Columbia University

Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. Within two weeks, a researcher at Calif, aided by AI tools, found a way to use the out-of-memory bug to run arbitrary code on the host server, allowing a malicious actor to install malware or read critical data. Now, it was no longer a minor bug—it was a critical vulnerability, and the Calif team alerted the PHP foundation to start working on a patch immediately.

Jana says actually exploiting the bug requires carefully working out a way to jump to a specific point in the memory for a particular program running on the server, and work out exactly which bits to overwrite in what order to gain control of the system. “It’s not really rocket science,” he says. “It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.”

To be clear, the researchers at Calif (as well as OpenAI and Wiz, a cybersecurity company that confirmed and expanded the vulnerabilities) had deep knowledge of both cybersecurity and the PHP language. “I’m not claiming that AI can do it all by itself. It clearly cannot,” Jana says. “But it is improving a lot, so the top 0.1 percent [of experts] can get a lot more stuff done, and also just below the 0.1 percent now will be able to go there without understanding all the nitty-gritty details.”

AI Tools and Formal Verification in Security

After the exploits were disclosed to the PHP Foundation, a team of four engineers spent two months developing a patch to release as quickly as possible.

“There is a fundamental asymmetry in finding bugs and fixing bugs,” Jana says. “Because when you’re fixing bugs you have to make sure that you know all parts of that attack are closed, and also that you don’t break any existing functionality.”

This asymmetry puts a lot of strain on the defenders, especially for open-source software such as PHP. Maintaining open-source projects that don’t have clear revenue streams despite being widely used is a long-standing challenge that precedes AI hacking tools. But those tools make the issue more pressing than ever.

One way to stay ahead of such issues going forward is to empower the defenders with more money and access to frontier cybersecurity AI models. “These frontier labs are donating some of their token budgets to look into these bugs, which I think is great,” Jana says. “I think that should happen more, either through some concerted effort or through donations.”

Jana is also optimistic that formal verification tools to automate the patching side of the equation are also advancing quickly, including a new release from Anthropic on 22 October. “The patch is LLM-generated, and then an LLM generates the proof that the patch is correct,” says Jana. “The only thing not done by an LLM is the proof checker, because somebody has to check the proof, because LLMs hallucinate. So, you want something that is formal.”

Hopefully, the combination of specialized AI models and formal verification tools will make patching vulnerabilities nearly as automatable as finding them.

Matthew Green, an associate professor of computer science at Johns Hopkins University Information Security Institute, is less optimistic. “Nobody’s going to fix this problem until something really bad happens,” he says. “And PHP2Shell wasn’t bad enough to be really bad. So when something really bad happens, which is going to be maybe sometime in early 2027, something bad that normal people are upset by, then suddenly people will start doing this. We’re going to fund everything.”

In the meantime, Green says, update your software. “If your phone is like, ‘Hey, there’s a security update available, do you want to install it,’ don’t wait till next week. Just do it.”

One thing’s for sure—PHP2Shell is just the beginning. “This won’t be the last one for sure,” Jana says. “It’s just who finds it. Hopefully, the white-hat hackers find it first, like this one.”

The Wonder-Driven Builder — with Paige Bailey

Mike's Notes

Paige Bailey presented at the Gemini 4 Argon Launch: Founder Briefing on Thursday. The briefing was very interesting.

I got curious about Paige because she has a personal project at the Computer History Museum. One of her demos used Gemini 4 to create a video for the museum about Grace Hopper. One day, I hope to visit the museum and maybe meet Paige at a conference somewhere. 😎

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Subscriptions > Google Rising Founders
  • Home > Handbook > 

Last Updated

07/11/2026

The Wonder-Driven Builder — with Paige Bailey

By: 
Posit PBC: 10/06/2026

...

Paige Bailey is a developer relations engineering lead at Google DeepMind, a geophysicist-turned-AI-engineer who was once told by her professors that building open-source libraries was a waste of time. We talk about her path from planetary science to TensorFlow, why statisticians have a hidden edge in the age of AI, and what it means to be a curious generalist when the cost of building software is approaching zero. Bonus: installing solar-powered silent-film birdhouses as street art in San Francisco.

Paige Bailey (Google DeepMind) takes us from her rescued Apple II to GPU-accelerated geophysics simulations to the quiet thesis running through all of it (that the most interesting things happen at the intersections). We chat about why statisticians’ tolerance for uncertainty might be the most underrated AI skill, and Paige makes the case for getting roasted for your own music taste.

What's Inside:

  • From planetary science to TensorFlow, before it was GPU-capable
  • Geophysicists as early GPU adopters
  • The professors who said open-source wasn’t “real science”
  • Building silent-film birdhouses as San Francisco street art
  • Hiding Gemini API tests inside whimsical side projects
  • The right-tool-for-the-job case for mixing AI models
  • Why “taste” is the skill that matters when code costs nothing

The Wonder-Driven Builder — with Paige Bailey

The Test Set (YouTube) 48:17

Electronic health records explained

Mike's Notes

An excellent ISO description of the differences between EHR and EMR for the healthcare sector.

Workspaces for Health should be able to meet all the EHR standards described here.

Resources

References

  • ISO 13606-1:2019 Electronic health record communication — Part 1: Reference model
  • ISO 13131:2021 Telehealth services — Quality planning guidelines

Repository

  • Home > Ajabbi Research > Library > Subscriptions > IOS Insights
  • Home > Handbook > 

Last Updated

06/11/2026

Electronic health records explained

By: 
ISO Insights: 05/11/2026

...

A diagnosis, a prescription, a lab result, a discharge note: each records one moment in a patient’s care. The challenge for healthcare organizations is turning those separate moments into a dependable account that professionals can use wherever the patient is treated.

Electronic health records (EHRs) provide that continuity. An EHR is a digital record of a patient’s health information that develops over time and is designed to support care across different healthcare settings. It brings clinical and administrative information into one structured record, giving authorized users a clearer view of the patient and the care already provided.

For healthcare providers, this isn’t simply a question of replacing paper. EHR systems support clinical performance, coordination between services, operational efficiency, patient participation and the governance of sensitive information. To understand what EHRs can deliver, we need to look beyond the digital record itself to how information moves, how clinicians use it and how it supports the decisions that shape patient care.

What is an EHR?

The EHR meaning goes beyond digital recordkeeping: it is about connecting information to support a person’s care over time. Each diagnosis, test result and treatment adds to a clinical history that authorized professionals can draw on across healthcare settings. This gives them the context to make informed decisions and maintain continuity as the patient moves between services.

Although the content varies, an EHR typically includes:

  • A patient’s medical history and diagnoses
  • Medications, allergies and immunizations
  • Laboratory results and medical images
  • Treatment and care plans
  • Clinical notes, referrals and discharge information
  • Appointments, insurance and billing details

Together, these elements provide a shared basis for clinical decisions, coordination and follow-up, while sound information governance protects patient privacy and supports regulatory compliance. The key difference with an electronic medical record (EMR) is scope: an EHR is designed to support care across organizational boundaries.

EHR and EMR systems: the key differences

An electronic medical record, or EMR, is the digital equivalent of a patient’s paper chart, generally maintained by a single provider or healthcare organization. It supports clinical and administrative work within that setting, from documenting diagnoses and treatments to managing prescriptions and follow-up care.

An electronic health record, or EHR, has a broader reach. When systems are interoperable, information can follow the patient between primary care providers, specialists, hospitals, laboratories and other services. This gives professionals a more complete clinical picture, improves coordination and reduces the need to recreate information at each stage of the patient journey.

For healthcare organizations, this distinction matters because it affects what they need from their EHR system; supporting internal workflows is different from exchanging information that other providers can securely access, interpret and use.

What is EHR software?

EHR software is the technology used to create, manage and use electronic health records. It gives healthcare professionals, administrative teams and patients the tools to work with the information in those records, while supporting secure exchange between providers. Its configuration depends on the setting: inpatient systems must accommodate complex hospital workflows and coordination across departments, whereas outpatient – or ambulatory – systems serve individual practices, clinics and other non-hospital services.

Whatever the environment, core features include:

  • Patient records: tools to capture, organize, update and retrieve structured patient information
  • Orders and prescriptions: electronic ordering of tests, medications and treatments, with easy access to test results and reports
  • Decision support: alerts, prompts and evidence-based recommendations that help healthcare professionals make informed decisions at the point of care
  • Information exchange: secure sharing of information with laboratories, pharmacies and other authorized providers and systems
  • Privacy and security: identity management, access controls and audit trails that protect sensitive information and record how it is used
  • Billing and payments: functions for coding, claims processing, invoicing and payment management
  • Patient access: portals or applications for viewing health information, managing appointments and communicating with care providers

In practice, these features must work together, support daily workflows and meet the organization’s clinical, operational and regulatory requirements.

Benefits of electronic health records

EHR systems address a persistent problem in healthcare: fragmented information. When patient histories and test results are scattered across systems, professionals lose time, decisions are delayed and work is duplicated. EHRs help reduce these inefficiencies by making reliable, up-to-date information available when and where it is needed.

At the point of care, a fuller view of diagnoses, medications, allergies and previous results helps healthcare professionals identify risks, avoid unnecessary investigations and make informed decisions. Treatment can reflect the patient’s wider clinical history, rather than a single encounter.

Across the organization, shared information improves coordination between teams. Connecting documentation, appointments, prescriptions and billing reduces manual processing and opportunities for human error. More efficient workflows can lower costs and free up resources, while access controls and audit trails strengthen EHR privacy and accountability.

For patients, this can mean less repetition of their health history, fewer delays caused by missing information and care that is better tailored to their needs. Secure access to records also helps them understand their treatment and participate in decisions about their care.

More engaged patients

EHRs give patients a practical way to stay involved between appointments. Through patient portals, they can review test results, check medications and treatment plans, prepare questions for consultations and flag errors or omissions in their records. They can also share access with family members or caregivers who support their care.

For people managing long-term or complex conditions, these tools can help them track progress and follow through on treatment. Providers benefit too: patients arrive better prepared, discussions can focus on specific concerns, and care instructions remain available after the consultation.

Access alone, however, does not ensure patient engagement. Information must be clear, explained in context and designed for people with different language needs, levels of health literacy and access to technology. Healthcare organizations must also manage identity, consent and caregiver permissions carefully to protect EHR privacy. The true measure of success is whether patients can use this information to ask informed questions, make decisions with their care team and manage treatments between visits.

EHR systems: usability and workflows

Professionals also need information they can readily use. For those working with EHRs every day, that means being able to find, understand and act on it quickly and easily. If entering notes, reviewing results or ordering tests requires too many steps, productivity falls, data quality suffers and the risk of error increases. Effective EHR software reduces this friction, allowing health professionals to focus on care.

Usability must be considered across the organization. Clinicians need to document treatment and retrieve relevant information quickly, while administrative teams rely on the system to coordinate services, manage appointments and complete other essential tasks. The EHR interface must make these tasks straightforward, with clear navigation and consistent processes.

Introducing an EHR system is also an opportunity to improve workflows. Simply moving existing processes into a digital environment can carry over unnecessary steps and delays, so testing realistic clinical and administrative scenarios helps organizations find ways to simplify work and make information flow more smoothly between teams. Training and ongoing support then help staff use the system confidently as their work evolves.

Making EHR systems work

Achieving electronic health record benefits takes careful planning and effort. Organizations need to manage the disruption of introducing a new system, then commit the resources needed to keep it secure, reliable and useful.

During implementation, priorities include:

  • Funding and capacity: EHR software, hardware and integration require substantial investment, while migration and training draw on staff time alongside normal duties.
  • Reliable migration: Existing records must be transferred without losing information or carrying unresolved errors into the new system.
  • Staff readiness: Teams need role-specific training and workflows that allow them to use the system confidently without disrupting care.

Once the system is in use, the aim is to keep it working effectively:

  • Data quality and exchange: Records must remain accurate and current, and information must retain its meaning as it moves between systems and providers.
  • Security and privacy: Access controls, monitoring and clear governance are needed to protect sensitive information and maintain EHR privacy.
  • Service reliability: Infrastructure, backups, maintenance and ongoing support must keep information available when it is needed.

While many of these challenges can be managed internally, exchanging patient information across providers calls for a shared approach to recording, interpreting and protecting data. International Standards help establish that common foundation.

Standards for connected care

For an electronic health record to support connected care, the systems behind it need to interpret information consistently. A laboratory result sent to a hospital, for example, must retain its structure, meaning and context – and remain protected throughout its journey. International Standards help make this possible, so that information shared between systems remains understandable, usable and secure.

Within ISO, the technical committee on health informatics (ISO/TC 215) leads this work. Its broad portfolio includes the ISO 13606 series for exchanging EHR information, alongside standards covering architecture, terminology, data quality, interoperability, security and EHR privacy. Together, these standards provide a common foundation for sharing and protecting health information, so reliable data is available where and when it is needed.

  • ISO 13606-1:2019Electronic health record communication — Part 1: Reference model
  • ISO 13131:2021Telehealth services — Quality planning guidelines

The path to EHR adoption

A successful EHR transition starts with reliable technology and a clear understanding of the organization’s needs: how care is delivered, how information moves and where existing workflows create delays or uncertainty. These needs guide the choice of EHR software, from functionality and usability to interoperability and the ability to scale.

Once the software has been selected, organizations need a clear plan for the transition, with defined timelines, budgets and responsibilities. In particular, it should set out how data migration and workflow changes will be managed to maintain continuity of care. Planning these elements together helps healthcare providers anticipate pressure points and stay in control throughout implementation.

Staff and patients also need support through the change. Involving staff early, tailoring training to their roles and acting on their input helps the new EHR system fit into daily practice. Patients, too, need to understand what is changing, how to use the system and how their EHR privacy will be protected. A clear explanation of the benefits of electronic health records can build trust and encourage engagement, while continued feedback from both groups helps organizations assess whether the rollout is delivering the intended improvements.

Care you can count on

Every new consultation should be a step forward. For patients, that means less time reconstructing their medical history and greater confidence that the person treating them understands it. For health professionals, it means a clearer starting point for the clinical decisions ahead.

That’s an ambition worth building an EHR system around. As healthcare becomes more digital, success will be measured by how well information serves people: helping professionals exercise their judgement, giving patients a voice and making continuity of care an everyday expectation. Each of these advances brings us closer to the future we want for healthcare: connected, informed and centred on the patient.

Hackertube

Mike's Notes

A great resource.

"Andrej Karpathy builds a YouTube alternative in two hours: The OpenAI co-founder (now at Anthropic) just built HackerTube, a site that surfaces videos the Hacker News community keeps recommending. It sifts through 43M comments to find 6,454 videos worth watching. Inside Claude Code, Opus 5.5 handled the pipeline and deployment, while Sonnet 5.5 did the heavy lifting of labeling comments. Karpathy only stepped in to provide an API key, server, and domain. The labeling reportedly used 504M input tokens, though most were cached." - The Code

PhoenixAI NEXT QUERY 2026

Today, I'm watching PhoenixAI NEXT QUERY 2026 live. Learning heaps. 😎

"PhoenixAI NEXT QUERY 2026 features speakers from Microsoft AI, NVIDIA, Apple, Coinbase, and Intuit; virtual summit Nov 4 9am-4pm PT; free to attend"

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Subscriptions > The Code
  • Home > Handbook > 

Last Updated

05/11/2026

Hackertube

By: Andrej Karpathy
@karpathy: 01/11/2026

Andrej Karpathy: Andrej Karpathy is a Slovak-Canadian AI researcher, who co-founded and formerly worked at OpenAI, where he specialized in deep learning and computer vision. He also worked as the director of artificial intelligence and Autopilot Vision at Tesla, and in 2024 he founded Eureka Labs, an AI education platform.

...

Weekend hack: HackerTube. I was annoyed with YouTube's recommendations so I had Claude filter down 43M comments over 20 years of HN to 6,454 videos that keep being recommended. *Significantly* better viewing experience, ~2 hours with Opus 5.5:

hackertube.org/

  • Excellent recs without any logins (state is kept in local browser session)
  • Thumbnail is a representative frame from middle of the video instead of the super duper A/B test hyper-optimized user uploads
  • Underlying data from the comment analysis as one zip file, point your Claude at it and ask for your own version
  • HackerTube Longs ✊

A bit more on the process:

I use Claude Code (desktop app for Mac), Opus 5.5 on Medium effort as my default. I only talk to Claude and have it do everything, the only "manual work" I helped with in tandem was in the browser (reminiscent of MenuGen): 1) I had to create some kind of API key from Google Cloud UI to query YouTube for video metadata, 2) I booted up a VPS box for serving and 3) I bought the domain name. Once the box was up I gave Claude the IP and told it update, secure, harden, deploy and optimize the code, and it did the whole thing.

Many awesome projects that would have normally taken weeks/months even can now be few-shotted for breakfast. What else are we not thinking of.


6:14 PM UTC · Nov 1, 2026 · 3.3M Views

Fully funded international Master's opportunity in theoretical physics

Mike's Notes

Looks wonderful; Go and learn with the best.

Resources

References

  • Reference

Repository

  • Home > Ajabbi Research > Library > Subscriptions > Perimeter Institute Newsletter
  • Home > Handbook > 

Last Updated

13/11/2026

Fully funded international Master's opportunity in theoretical physics

By: Maïté Dupuis
Perimeter Institute for Theoretical Physics: 03/11/2026

Maïté Dupuis: Director, Training, Educational Outreach and Scientific Programs.

...

I am writing to ask for your help in informing talented physics students about the Perimeter Scholars International (PSI) Master's Program at Perimeter Institute for Theoretical Physics in Waterloo, Canada.

PSI is an intensive, one-year Master's program in theoretical physics offered in collaboration with the University of Waterloo. The program brings together exceptional students from around the world for advanced coursework and research training across the full breadth of modern theoretical physics, including quantum theory, cosmology, particle physics, quantum gravity, quantum information, and condensed matter theory. Students who successfully complete the program earn a Master of Science in Physics from the University of Waterloo as well as a PSI certificate from Perimeter Institute. 

PSI offers several distinctive advantages:

  • Full financial support, ensuring that cost is not a barrier to participation.
  • An exceptionally international cohort, bringing together students from leading universities across the world.
  • Instruction from Perimeter faculty and visiting researchers who are leaders in their fields.
  • Exposure to the full spectrum of theoretical physics before committing to a PhD specialization.
  • Direct immersion in one of the world's largest independent centres for theoretical physics research.
  • PSI is a strong pathway for students interested in pursuing a PhD at Perimeter Institute or other top institutions around the world.

For students considering doctoral studies in theoretical physics, PSI provides a unique environment that combines rigorous training, close interaction with researchers, and an international network of peers who often go on to leading PhD programs worldwide.

We would be grateful if you could share this poster and the above program information with interested students, particularly those who demonstrate exceptional academic ability and a strong interest in theoretical physics.

Applications are accepted online until January 24

Thank you for helping us reach talented students who may benefit from this opportunity.

With best regards,

Maïté Dupuis
Director, Training, Educational Outreach and Scientific Programs
Perimeter Institute for Theoretical Physics

A basket of useful free apps

Mike's Notes

Adding a note so I don't forget where to find these apps. I'm sure I have forgotten some of them. Other recommendations are very welcome, thanks. 😎

Resources

  • Resource

References

  • Reference

Repository

  • Home > Ajabbi Research > Library >
  • Home > Handbook > 

Last Updated

03/11/2026

A basket of useful free apps

By: Mike Peters
On a Sandy Beach: 03/11/2026

Mike Peters: Mike invented and designed Pipi and founded Ajabbi.

...

Here are links to the free web and desktop tools I use a lot. They are all fast and excellent quality. I will add more here in future. I may also give some of them some free ads on future Ajabbi websites to say thank you. 😎

BoxLang

BoxLang is a modern, dynamic, and modular scripting and programming language created and maintained by Ortus Solutions, built to run on the Java Virtual Machine (JVM).

CloudConvert

CloudConvert is an online file conversion utility and API that supports over 200 formats across documents, images, video, audio, spreadsheets, presentations, ebooks, vectors, and archives.

Core FTP

Core FTP LE is a freeware secure FTP client for Windows, developed by CoreFTP.com. Features include FTP, SSL/TLS, SFTP via SSH, and HTTP/HTTPS support.

DBeaver

DBeaver is a SQL client software application and a database administration tool. For relational databases, it uses the JDBC application programming interface to interact with databases via a JDBC driver. For other databases, it uses proprietary database drivers.

FontForge

FontForge is a free, open-source font editor that supports many common font formats.

    Google Blogger

    Google Blogger is a free, web-based content management system that lets you create, edit, and publish blogs.

    Google Search AI Mode

    AI Mode is a search feature used within Google Search. enabling users to input complex, multi-part queries and receive comprehensive, AI-generated responses.

    iNaturalist

    iNaturalist is a free, nonprofit social network and citizen science platform that lets users map and share biodiversity observations globally. Co-founded in 2008, it acts as a digital crowdsourced community connecting nature enthusiasts, hobbyists, and professional scientists to log sightings of plants, animals, fungi, and more.

    NoteTab

    NoteTab is a text and HTML editor for Windows, made by Fookes Software since 1996. Use it to replace Notepad, write and organise notes, edit web pages, or process text with Clips and scripts.

    NoteTab Std 8 and Pro 8 are in beta and will be freeware. NoteTab 7 is no longer sold.

    PostGIS

    PostGIS is an open-source software program that adds support for geographic objects to the PostgreSQL object-relational database. PostGIS follows the Simple Features for SQL specification from the Open Geospatial Consortium. PostGIS is implemented as a PostgreSQL extension.

    PostgreSQL

    PostgreSQL, also known as Postgres, is a free, open-source relational database management system that emphasises extensibility and SQL compliance.

    QRCode Monkey

    QRCode Monkey is one of the most popular free online QR code generators, with millions of QR codes already created. The high-resolution QR codes and powerful design options make it one of the best free QR code generators on the web for commercial and print use.

    Unicodeit

    To convert LaTeX mathematical expressions into Unicode online.

    VLC Media Player

    VLC media player (previously the VideoLAN Client) is a free, open-source, portable, cross-platform media player and streaming media server.

    Wireshark

    Wireshark is a free, open-source network protocol analyser used to capture, inspect, and dissect digital traffic running across a computer network in real time. Acting like a digital microscope for networks, it translates raw binary data streams into a structured, highly readable format. It is the de facto industry standard for network troubleshooting, cybersecurity analysis, and protocol development.

    Render Engine base-36 generator

    Mike's Notes

    The Render Engine (rnd) generates code (CFML, JAVA, Python, etc.), HTML, CSS, XML, JSON, YAML, SQL, PDFs, etc.  Many of these autonomous engines can run simultaneously, and they need to run much faster to scale massively.

    The Render Engine (rnd) is currently being rebuilt. A  base-36 generator is needed to create sequential 10-character strings using 0-9 and a-z.

    Eg:

    0000000001
    0000000002
    ...
    000000000a
    ...
    000000000z
    ...
    zzzzzzzzzzzz

    These strings will be used in an automated batch process to create uniquely named "temp" directories to hold rendered output, directory, and file structures before final assembly and deployment. This setup can support 36 quadrillion of these temp directories. 😎

    If needed, future major editions of Pipi, like "Pipi 15", could easily replace this generator with one that supports an even larger range. The other option is to recycle a pool of these strings, since they get deleted after use.

    I used Google Search AI mode to generate some sample code and find some reading references. I asked lots of dumb questions and gave what-if prompts to explore options. It only took a few minutes to sort out a solution. And no token bill.

    Below is an edited transcript, where I deleted all the dead ends to arrive at a workable, 100% reliable solution. The code is designed for PostgreSQL and CFML running on BoxLang on JDK 21.

    It still needs rewriting and testing, etc., but it's a good place to start from. Remember, "Use code with caution." 😎😎😎😎

    Resources

    References

    • Reference

    Repository

    • Home > Ajabbi Research > Library >
    • Home > Handbook > 

    Last Updated

    02/11/2026

    Render Engine base-36 generator

    By: Mike Peters & Google Search AI Mode
    On a Sandy Beach: 01/11/2026

    Mike Peters: Mike invented and designed Pipi and founded Ajabbi.

    Google Search AI Mode: Free and works very well.

    ...

    A base-36 10-character alphanumeric sequence (0-9, a-z) has over 3.6 quadrillion (36¹⁰) combinations

    ...

    To generate base-36 alphanumeric sequences (0-9, a-z) natively in PostgreSQL, you can use PostgreSQL's procedural system. The math is more reliable and infinitely customizable if you first create a lightweight helper function in PostgreSQL, then execute it via a single <cfquery> block.

    Here is how to set up and run the high-performance database-native approach:

    Step 1: Run this once in PostgreSQL

    Execute this script inside your database manager (like pgAdmin or DBeaver) to create a custom base-36 conversion function:

    sql
    CREATE OR REPLACE FUNCTION to_base36(digits bigint, min_width int DEFAULT 10) 
    RETURNS text AS $$
    DECLARE
        -- The complete alphanumeric sequence dictionary
        chars char[] := ARRAY['0','1','2','3','4','5','6','7','8','9',
                              'a','b','c','d','e','f','g','h','i','j',
                              'k','l','m','n','o','p','q','r','s','t',
                              'u','v','w','x','y','z'];
        ret text := '';
        val bigint := digits;
    BEGIN
        -- Loop to convert decimal base-10 to base-36
        WHILE val > 0 LOOP
            ret := chars[(val % 36) + 1] || ret;
            val := val / 36;
        END LOOP;
        
        -- If the value was 0, it won't enter the loop
        IF ret = '' THEN ret := '0'; END IF;
        
        -- Dynamically left-pad with zeros to match our required 10-char width
        RETURN lpad(ret, min_width, '0');
    END;
    $$ LANGUAGE plpgsql IMMUTABLE;

    Step 2: Your CFML Template Code

    Once that helper function exists, your tag-based CFML file needs only one query block to populate thousands or millions of sequential records instantly:

    cfml
    <!--- Configuration --->
    <cfset variables.datasource = "your_datasource_name">
    <cfset variables.startValue = 0>
    <cfset variables.endValue = 99999> <!--- This will instantly generate 100,000 unique records --->
    <cfsetting requesttimeout="600">
    <!--- Single high-performance multi-row native insert --->
    <cfquery datasource="#variables.datasource#">
        INSERT INTO your_table_name (your_column_name)
        SELECT to_base36(val, 10)
        FROM generate_series(
            <cfqueryparam value="#variables.startValue#" cfsqltype="CF_SQL_BIGINT">, 
            <cfqueryparam value="#variables.endValue#" cfsqltype="CF_SQL_BIGINT">
        ) AS val
    </cfquery>
    <cfoutput>
        <p>Success! Generation complete across the database layer.</p>
    </cfoutput>

    Why this is the best option for PostgreSQL:

    • Blazing Fast: Generating 100,000 rows takes less than a second because generate_series() evaluates entirely within the database engine's cache memory.
    • Network efficiency: CFML passes exactly 2 integer values to the server (startValue and endValue). The database does all the structural formatting, heavy lifting, and inserts internally.
    • No Out-of-Memory Crashes: Traditional server-side loops building massive string payloads can crash your ColdFusion/Lucee JVM heap space if the array size gets too high. This setup bypasses CFML's memory limits entirely.

    To meet your requirement of using each row once in sequence to create a directory and track its state, the best practice is to design a table that acts as a pre-generated "pool" of unique strings.

    Here is the blueprint to create the table, pre-populate it, and safely fetch the next sequential directory name without race conditions.

    Step 1: Create the Database Table

    Run this script in your PostgreSQL database. It creates a table with an auto-incrementing serial index, the 10-character Base-36 string, and a boolean flag (is_used) to track whether it has been turned into a directory.

    sql
    CREATE TABLE directory_pool (
        id bigserial PRIMARY KEY,
        dir_name varchar(10) NOT NULL UNIQUE,
        is_used boolean DEFAULT false NOT NULL
    );
    -- Index the is_used and id columns for lightning-fast lookups
    CREATE INDEX idx_pool_unused ON directory_pool (id) WHERE is_used = false;

    Step 2: Pre-populate the Table Instantly

    Using the to_base36 function we created earlier, you can populate your first batch of strings. For example, let's generate the first 100,000 sequential names (from 0000000000 to 0000002882 in Base-36) instantly:

    cfml
    <cfset variables.datasource = "your_datasource_name">
    <cfset variables.startValue = 0>
    <cfset variables.endValue = 99999>
    <cfquery datasource="#variables.datasource#">
        INSERT INTO directory_pool (dir_name)
        SELECT to_base36(val, 10)
        FROM generate_series(
            <cfqueryparam value="#variables.startValue#" cfsqltype="CF_SQL_BIGINT">, 
            <cfqueryparam value="#variables.endValue#" cfsqltype="CF_SQL_BIGINT">
        ) AS val;
    </cfquery>

    Step 3: Fetch and Lock the Next Row Atomically

    If multiple web requests try to create a directory at the exact same millisecond, they might grab the same name. To prevent this, use PostgreSQL's UPDATE ... RETURNING clause. This updates the flag and hands your CFML code the string in a single atomic action, blocking duplicate usage.

    cfml
    <cfset variables.datasource = "your_datasource_name">
    <cfset variables.baseDirectory = "/var/www/uploads/directories/">

    <!--- 
      Atomically claim the next unused sequence string.
      FOR UPDATE SKIP LOCKED ensures that if another thread is pulling a record,
      this thread ignores it and grabs the very next one cleanly.
    --->
    <cfquery name="qGetNextDir" datasource="#variables.datasource#">
        UPDATE directory_pool
        SET is_used = true
        WHERE id = (
            SELECT id 
            FROM directory_pool 
            WHERE is_used = false 
            ORDER BY id ASC 
            LIMIT 1
            FOR UPDATE SKIP LOCKED
        )
        RETURNING dir_name;
    </cfquery>

    <cfif qGetNextDir.recordCount IS 1>
        <cfset variables.newDirName = qGetNextDir.dir_name>
        <cfset variables.fullPath = variables.baseDirectory & variables.newDirName>
        
        <!--- Create the actual physical directory --->
        <cfdirectory action="create" directory="#variables.fullPath#">
        
        <cfoutput>
            <p>Successfully claimed sequence and created directory: <strong>#variables.newDirName#</strong></p>
        </cfoutput>
    <cfelse>
        <p>Error: The directory pool is empty! You need to generate more records.</p>
    </cfif>

    Why this design works perfectly:

    • Strict Sequence Execution: Sorting by id ASC guarantees you will strictly consume them in sequence (0000000000, 0000000001, 0000000002, etc.).
    • Concurrency Safe: Using FOR UPDATE SKIP LOCKED makes this system enterprise-safe. Hundreds of users can trigger directory generation simultaneously, and nobody will ever get the same directory name or lock up the database.
    • Audit Trail: You can easily run a query to check how many names are remaining (SELECT count(*) FROM directory_pool WHERE is_used = false;).

    How Not to Talk to Your Kids

    Mike's Notes

    Very wise advice here from Po Bronson.

    Resources

    References

    • Reference

    Repository

    • Home > Ajabbi Research > Library >
    • Home > Handbook > 

    Last Updated

    01/11/2026

    How Not to Talk to Your Kids

    By: Po Bronson
    New York Magazine: 09/02/2007

    Po Bronson: Po Bronson is an American journalist and author who lives in San Francisco. best known for his work in Wired magazine and other technology-related publications.

    ...

    Photo: Phillip Toledano; styling by Marie Blomquist for I Group; prop styling by Anne Koch; hair by Kristan Serafino for L'Oreal Professionnel; makeup by Viktorija Bowers for City Artists; clothing by Petit Bateau [shirt and pants]

    What do we make of a boy like Thomas?

    Thomas (his middle name) is a fifth-grader at the highly competitive P.S. 334, the Anderson School on West 84th. Slim as they get, Thomas recently had his long sandy-blond hair cut short to look like the new James Bond (he took a photo of Daniel Craig to the barber). Unlike Bond, he prefers a uniform of cargo pants and a T-shirt emblazoned with a photo of one of his heroes: Frank Zappa. Thomas hangs out with five friends from the Anderson School. They are “the smart kids.” Thomas’s one of them, and he likes belonging.

    Since Thomas could walk, he has heard constantly that he’s smart. Not just from his parents but from any adult who has come in contact with this precocious child. When he applied to Anderson for kindergarten, his intelligence was statistically confirmed. The school is reserved for the top one percent of all applicants, and an IQ test is required. Thomas didn’t just score in the top one percent. He scored in the top one percent of the top one percent.

    But as Thomas has progressed through school, this self-awareness that he’s smart hasn’t always translated into fearless confidence when attacking his schoolwork. In fact, Thomas’s father noticed just the opposite. “Thomas didn’t want to try things he wouldn’t be successful at,” his father says. “Some things came very quickly to him, but when they didn’t, he gave up almost immediately, concluding, ‘I’m not good at this.’ ” With no more than a glance, Thomas was dividing the world into two—things he was naturally good at and things he wasn’t.

    For instance, in the early grades, Thomas wasn’t very good at spelling, so he simply demurred from spelling out loud. When Thomas took his first look at fractions, he balked. The biggest hurdle came in third grade. He was supposed to learn cursive penmanship, but he wouldn’t even try for weeks. By then, his teacher was demanding homework be completed in cursive. Rather than play catch-up on his penmanship, Thomas refused outright. Thomas’s father tried to reason with him. “Look, just because you’re smart doesn’t mean you don’t have to put out some effort.” (Eventually, he mastered cursive, but not without a lot of cajoling from his father.)

    Why does this child, who is measurably at the very top of the charts, lack confidence about his ability to tackle routine school challenges?

    Thomas is not alone. For a few decades, it’s been noted that a large percentage of all gifted students (those who score in the top 10 percent on aptitude tests) severely underestimate their own abilities. Those afflicted with this lack of perceived competence adopt lower standards for success and expect less of themselves. They underrate the importance of effort, and they overrate how much help they need from a parent.

    When parents praise their children’s intelligence, they believe they are providing the solution to this problem. According to a survey conducted by Columbia University, 85 percent of American parents think it’s important to tell their kids that they’re smart. In and around the New York area, according to my own (admittedly nonscientific) poll, the number is more like 100 percent. Everyone does it, habitually. The constant praise is meant to be an angel on the shoulder, ensuring that children do not sell their talents short.

    But a growing body of research—and a new study from the trenches of the New York public-school system—strongly suggests it might be the other way around. Giving kids the label of “smart” does not prevent them from underperforming. It might actually be causing it.

    For the past ten years, psychologist Carol Dweck and her team at Columbia (she’s now at Stanford) studied the effect of praise on students in a dozen New York schools. Her seminal work—a series of experiments on 400 fifth-graders—paints the picture most clearly.

    Dweck sent four female research assistants into New York fifth-grade classrooms. The researchers would take a single child out of the classroom for a nonverbal IQ test consisting of a series of puzzles—puzzles easy enough that all the children would do fairly well. Once the child finished the test, the researchers told each student his score, then gave him a single line of praise. Randomly divided into groups, some were praised for their intelligence. They were told, “You must be smart at this.” Other students were praised for their effort: “You must have worked really hard.”

    Why just a single line of praise? “We wanted to see how sensitive children were,” Dweck explained. “We had a hunch that one line might be enough to see an effect.”

    Then the students were given a choice of test for the second round. One choice was a test that would be more difficult than the first, but the researchers told the kids that they’d learn a lot from attempting the puzzles. The other choice, Dweck’s team explained, was an easy test, just like the first. Of those praised for their effort, 90 percent chose the harder set of puzzles. Of those praised for their intelligence, a majority chose the easy test. The “smart” kids took the cop-out.

    Photo: Phillip Toledano; styling by Marie Blomquist for I Group; prop styling by Anne Koch; hair by Kristan Serafino for L'Oreal Professionnel; makeup by Viktorija Bowers for City Artists; clothing by Petit Bateau [dress]

    Why did this happen? “When we praise children for their intelligence,” Dweck wrote in her study summary, “we tell them that this is the name of the game: Look smart, don’t risk making mistakes.” And that’s what the fifth-graders did: They chose to look smart and avoid the risk of embarrassment.

    In a subsequent round, none of the fifth-graders had a choice. The test was difficult, designed for kids two years ahead of their grade level. Predictably, everyone failed. But again, the two groups of children, divided at random at the study’s start, responded differently. Those praised for their effort on the first test assumed they simply hadn’t focused hard enough on this test. “They got very involved, willing to try every solution to the puzzles,” Dweck recalled. “Many of them remarked, unprovoked, ‘This is my favorite test.’ ” Not so for those praised for their smarts. They assumed their failure was evidence that they weren’t really smart at all. “Just watching them, you could see the strain. They were sweating and miserable.”

    Having artificially induced a round of failure, Dweck’s researchers then gave all the fifth-graders a final round of tests that were engineered to be as easy as the first round. Those who had been praised for their effort significantly improved on their first score—by about 30 percent. Those who’d been told they were smart did worse than they had at the very beginning—by about 20 percent.

    Dweck had suspected that praise could backfire, but even she was surprised by the magnitude of the effect. “Emphasizing effort gives a child a variable that they can control,” she explains. “They come to see themselves as in control of their success. Emphasizing natural intelligence takes it out of the child’s control, and it provides no good recipe for responding to a failure.”

    In follow-up interviews, Dweck discovered that those who think that innate intelligence is the key to success begin to discount the importance of effort. I am smart, the kids’ reasoning goes; I don’t need to put out effort. Expending effort becomes stigmatized—it’s public proof that you can’t cut it on your natural gifts.

    Repeating her experiments, Dweck found this effect of praise on performance held true for students of every socioeconomic class. It hit both boys and girls—the very brightest girls especially (they collapsed the most following failure). Even preschoolers weren’t immune to the inverse power of praise.

    Jill Abraham is a mother of three in Scarsdale, and her view is typical of those in my straw poll. I told her about Dweck’s research on praise, and she flatly wasn’t interested in brief tests without long-term follow-up. Abraham is one of the 85 percent who think praising her children’s intelligence is important. Her kids are thriving, so she’s proved that praise works in the real world. “I don’t care what the experts say,” Jill says defiantly. “I’m living it.”

    Even those who’ve accepted the new research on praise have trouble putting it into practice. Sue Needleman is both a mother of two and an elementary-school teacher with eleven years’ experience. Last year, she was a fourth-grade teacher at Ridge Ranch Elementary in Paramus, New Jersey. She has never heard of Carol Dweck, but the gist of Dweck’s research has trickled down to her school, and Needleman has learned to say, “I like how you keep trying.” She tries to keep her praise specific, rather than general, so that a child knows exactly what she did to earn the praise (and thus can get more). She will occasionally tell a child, “You’re good at math,” but she’ll never tell a child he’s bad at math.

    But that’s at school, as a teacher. At home, old habits die hard. Her 8-year-old daughter and her 5-year-old son are indeed smart, and sometimes she hears herself saying, “You’re great. You did it. You’re smart.” When I press her on this, Needleman says that what comes out of academia often feels artificial. “When I read the mock dialogues, my first thought is, Oh, please. How corny.”

    No such qualms exist for teachers at the Life Sciences Secondary School in East Harlem, because they’ve seen Dweck’s theories applied to their junior-high students. Last week, Dweck and her protégée, Lisa Blackwell, published a report in the academic journal Child Development about the effect of a semester-long intervention conducted to improve students’ math scores.

    Life Sciences is a health-science magnet school with high aspirations but 700 students whose main attributes are being predominantly minority and low achieving. Blackwell split her kids into two groups for an eight-session workshop. The control group was taught study skills, and the others got study skills and a special module on how intelligence is not innate. These students took turns reading aloud an essay on how the brain grows new neurons when challenged. They saw slides of the brain and acted out skits. “Even as I was teaching these ideas,” Blackwell noted, “I would hear the students joking, calling one another ‘dummy’ or ‘stupid.’ ” After the module was concluded, Blackwell tracked her students’ grades to see if it had any effect.

    It didn’t take long. The teachers—who hadn’t known which students had been assigned to which workshop—could pick out the students who had been taught that intelligence can be developed. They improved their study habits and grades. In a single semester, Blackwell reversed the students’ longtime trend of decreasing math grades.

    The only difference between the control group and the test group were two lessons, a total of 50 minutes spent teaching not math but a single idea: that the brain is a muscle. Giving it a harder workout makes you smarter. That alone improved their math scores.

    “These are very persuasive findings,” says Columbia’s Dr. Geraldine Downey, a specialist in children’s sensitivity to rejection. “They show how you can take a specific theory and develop a curriculum that works.” Downey’s comment is typical of what other scholars in the field are saying. Dr. Mahzarin Banaji, a Harvard social psychologist who is an expert in stereotyping, told me, “Carol Dweck is a flat-out genius. I hope the work is taken seriously. It scares people when they see these results.”

    Since the 1969 publication of The Psychology of Self-Esteem, in which Nathaniel Branden opined that self-esteem was the single most important facet of a person, the belief that one must do whatever he can to achieve positive self-esteem has become a movement with broad societal effects. Anything potentially damaging to kids’ self-esteem was axed. Competitions were frowned upon. Soccer coaches stopped counting goals and handed out trophies to everyone. Teachers threw out their red pencils. Criticism was replaced with ubiquitous, even undeserved, praise.

    Dweck and Blackwell’s work is part of a larger academic challenge to one of the self-esteem movement’s key tenets: that praise, self-esteem, and performance rise and fall together. From 1970 to 2000, there were over 15,000 scholarly articles written on self-esteem and its relationship to everything—from sex to career advancement. But results were often contradictory or inconclusive. So in 2003 the Association for Psychological Science asked Dr. Roy Baumeister, then a leading proponent of self-esteem, to review this literature. His team concluded that self-esteem was polluted with flawed science. Only 200 of those 15,000 studies met their rigorous standards.

    "I am smart, the kids’ reasoning goes; I don’t need to put out effort. Expending effort becomes stigmatized—it’s public proof that you can’t cut it on your natural gifts."

    After reviewing those 200 studies, Baumeister concluded that having high self-esteem didn’t improve grades or career achievement. It didn’t even reduce alcohol usage. And it especially did not lower violence of any sort. (Highly aggressive, violent people happen to think very highly of themselves, debunking the theory that people are aggressive to make up for low self-esteem.) At the time, Baumeister was quoted as saying that his findings were “the biggest disappointment of my career.”

    Now he’s on Dweck’s side of the argument, and his work is going in a similar direction: He will soon publish an article showing that for college students on the verge of failing in class, esteem-building praise causes their grades to sink further. Baumeister has come to believe the continued appeal of self-esteem is largely tied to parents’ pride in their children’s achievements: It’s so strong that “when they praise their kids, it’s not that far from praising themselves.”

    By and large, the literature on praise shows that it can be effective—a positive, motivating force. In one study, University of Notre Dame researchers tested praise’s efficacy on a losing college hockey team. The experiment worked: The team got into the playoffs. But all praise is not equal—and, as Dweck demonstrated, the effects of praise can vary significantly depending on the praise given. To be effective, researchers have found, praise needs to be specific. (The hockey players were specifically complimented on the number of times they checked an opponent.)

    Sincerity of praise is also crucial. Just as we can sniff out the true meaning of a backhanded compliment or a disingenuous apology, children, too, scrutinize praise for hidden agendas. Only young children—under the age of 7—take praise at face value: Older children are just as suspicious of it as adults.

    Psychologist Wulf-Uwe Meyer, a pioneer in the field, conducted a series of studies where children watched other students receive praise. According to Meyer’s findings, by the age of 12, children believe that earning praise from a teacher is not a sign you did well—it’s actually a sign you lack ability and the teacher thinks you need extra encouragement. And teens, Meyer found, discounted praise to such an extent that they believed it’s a teacher’s criticism—not praise at all—that really conveys a positive belief in a student’s aptitude.

    In the opinion of cognitive scientist Daniel T. Willingham, a teacher who praises a child may be unwittingly sending the message that the student reached the limit of his innate ability, while a teacher who criticizes a pupil conveys the message that he can improve his performance even further.

    New York University professor of psychiatry Judith Brook explains that the issue for parents is one of credibility. “Praise is important, but not vacuous praise,” she says. “It has to be based on a real thing—some skill or talent they have.” Once children hear praise they interpret as meritless, they discount not just the insincere praise, but sincere praise as well.

    Scholars from Reed College and Stanford reviewed over 150 praise studies. Their meta-analysis determined that praised students become risk-averse and lack perceived autonomy. The scholars found consistent correlations between a liberal use of praise and students’ “shorter task persistence, more eye-checking with the teacher, and inflected speech such that answers have the intonation of questions.”

    Dweck’s research on overpraised kids strongly suggests that image maintenance becomes their primary concern—they are more competitive and more interested in tearing others down. A raft of very alarming studies illustrate this.

    In one, students are given two puzzle tests. Between the first and the second, they are offered a choice between learning a new puzzle strategy for the second test or finding out how they did compared with other students on the first test: They have only enough time to do one or the other. Students praised for intelligence choose to find out their class rank, rather than use the time to prepare.

    In another, students get a do-it-yourself report card and are told these forms will be mailed to students at another school—they’ll never meet these students and don’t know their names. Of the kids praised for their intelligence, 40 percent lie, inflating their scores. Of the kids praised for effort, few lie.

    When students transition into junior high, some who’d done well in elementary school inevitably struggle in the larger and more demanding environment. Those who equated their earlier success with their innate ability surmise they’ve been dumb all along. Their grades never recover because the likely key to their recovery—increasing effort—they view as just further proof of their failure. In interviews many confess they would “seriously consider cheating.”

    Students turn to cheating because they haven’t developed a strategy for handling failure. The problem is compounded when a parent ignores a child’s failures and insists he’ll do better next time. Michigan scholar Jennifer Crocker studies this exact scenario and explains that the child may come to believe failure is something so terrible, the family can’t acknowledge its existence. A child deprived of the opportunity to discuss mistakes can’t learn from them.

    My son, Luke, is in kindergarten. He seems supersensitive to the potential judgment of his peers. Luke justifies it by saying, “I’m shy,” but he’s not really shy. He has no fear of strange cities or talking to strangers, and at his school, he has sung in front of large audiences. Rather, I’d say he’s proud and self-conscious. His school has simple uniforms (navy T-shirt, navy pants), and he loves that his choice of clothes can’t be ridiculed, “because then they’d be teasing themselves too.”

    After reading Carol Dweck’s research, I began to alter how I praised him, but not completely. I suppose my hesitation was that the mind-set Dweck wants students to have—a firm belief that the way to bounce back from failure is to work harder—sounds awfully clichéd: Try, try again.

    But it turns out that the ability to repeatedly respond to failure by exerting more effort—instead of simply giving up—is a trait well studied in psychology. People with this trait, persistence, rebound well and can sustain their motivation through long periods of delayed gratification. Delving into this research, I learned that persistence turns out to be more than a conscious act of will; it’s also an unconscious response, governed by a circuit in the brain. Dr. Robert Cloninger at Washington University in St. Louis located the circuit in a part of the brain called the orbital and medial prefrontal cortex. It monitors the reward center of the brain, and like a switch, it intervenes when there’s a lack of immediate reward. When it switches on, it’s telling the rest of the brain, “Don’t stop trying. There’s dopa [the brain’s chemical reward for success] on the horizon.” While putting people through MRI scans, Cloninger could see this switch lighting up regularly in some. In others, barely at all.

    What makes some people wired to have an active circuit?

    Cloninger has trained rats and mice in mazes to have persistence by carefully not rewarding them when they get to the finish. “The key is intermittent reinforcement,” says Cloninger. The brain has to learn that frustrating spells can be worked through. “A person who grows up getting too frequent rewards will not have persistence, because they’ll quit when the rewards disappear.”

    That sold me. I’d thought “praise junkie” was just an expression—but suddenly, it seemed as if I could be setting up my son’s brain for an actual chemical need for constant reward.

    What would it mean, to give up praising our children so often? Well, if I am one example, there are stages of withdrawal, each of them subtle. In the first stage, I fell off the wagon around other parents when they were busy praising their kids. I didn’t want Luke to feel left out. I felt like a former alcoholic who continues to drink socially. I became a Social Praiser.

    Then I tried to use the specific-type praise that Dweck recommends. I praised Luke, but I attempted to praise his “process.” This was easier said than done. What are the processes that go on in a 5-year-old’s mind? In my impression, 80 percent of his brain processes lengthy scenarios for his action figures.

    But every night he has math homework and is supposed to read a phonics book aloud. Each takes about five minutes if he concentrates, but he’s easily distracted. So I praised him for concentrating without asking to take a break. If he listened to instructions carefully, I praised him for that. After soccer games, I praised him for looking to pass, rather than just saying, “You played great.” And if he worked hard to get to the ball, I praised the effort he applied.

    Just as the research promised, this focused praise helped him see strategies he could apply the next day. It was remarkable how noticeably effective this new form of praise was.

    Truth be told, while my son was getting along fine under the new praise regime, it was I who was suffering. It turns out that I was the real praise junkie in the family. Praising him for just a particular skill or task felt like I left other parts of him ignored and unappreciated. I recognized that praising him with the universal “You’re great—I’m proud of you” was a way I expressed unconditional love.

    Offering praise has become a sort of panacea for the anxieties of modern parenting. Out of our children’s lives from breakfast to dinner, we turn it up a notch when we get home. In those few hours together, we want them to hear the things we can’t say during the day—We are in your corner, we are here for you, we believe in you.

    In a similar way, we put our children in high-pressure environments, seeking out the best schools we can find, then we use the constant praise to soften the intensity of those environments. We expect so much of them, but we hide our expectations behind constant glowing praise. The duplicity became glaring to me.

    Eventually, in my final stage of praise withdrawal, I realized that not telling my son he was smart meant I was leaving it up to him to make his own conclusion about his intelligence. Jumping in with praise is like jumping in too soon with the answer to a homework problem—it robs him of the chance to make the deduction himself.

    But what if he makes the wrong conclusion?

    Can I really leave this up to him, at his age?

    I’m still an anxious parent. This morning, I tested him on the way to school: “What happens to your brain, again, when it gets to think about something hard?”

    “It gets bigger, like a muscle,” he responded, having aced this one before.

    Additional reporting by Ashley Merryman