Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Distributed data, centralized fixes
After a week of breaches and vulnerabilities (Railway, Zeabur, eMudhra, PHP, GitLab, LiteLLM and more), Miren's Paul Hinze sorts the incidents into three structural shapes - concentrated secrets, fragmented patching and hijacked update channels - and explains how Miren's self-hostable design aims to keep data distributed while centralizing fixes.
6 min · 1,278 words
The Hibernate Origin Story (Outsider Edition)
Charles Miller recounts, as a bystander in the room, how the Hibernate Java persistence library grew out of work at Sydney company Cirrus Technologies around 2001, why its root package was cirrus.inf, and how it came to be released under the LGPL.
5 min · 1,066 words
Gram 3.4.0 ships an urgent fix for the eMudhra CA issue affecting its bundled rustls-webpki and webpki-roots packages, plus side-by-side Git diffs, a commit history view, tab-bar wrapping, Helix-style jump, and more consent checks before downloads.
4 min · 1,029 words
Aikido's Dania Durnas tracks how the Brotli decompression flaw CVE-2026-111497, first disclosed for Node.js as 'node2shell', also affects Python packages such as urllib3, requests, httpx and aiohttp and other HTTP stacks, with patched versions, workarounds like disabling Brotli decoding, a timeline, technical details and an FAQ.
11 min · 2,503 words
Emacs finally folds to my liking
Josep Bigorra describes unifying code folding across every Emacs mode on Emacs 32 master using kirigami as a dispatcher over treesit-fold, Hideshow, Outline and Org, with one consistent keymap, Tree-sitter fold guides, Org-specific handling and tests that verify folds and key bindings.
6 min · 1,304 words
HumanLayer open-sources its core under Apache 2.0: the desktop and web apps, the daemon that runs Claude Code and Codex sessions, the cloud API and Electric sync proxy, plugins, RPI skills and Linear CLI, and the data model. Self-built copies have no telemetry; cloud users see no change for now.
2 min · 498 words
Twelve years of distributed SQLite
rqlite creator Philip O'Toole recounts the history of distributed SQLite from rqlite's 2014 launch (Raft + SQLite) through dqlite, Litestream, LiteFS, cr-sqlite, libSQL/Turso, SQLite Cloud and Cloudflare D1, arguing the design space has three corners (consensus, streaming, merge) and that the money went to the platforms.
5 min · 1,129 words
Moonshot AI introduces Kimi K3.1 Pro, a post-trained 3T-class open-weight model with a 1M-token context window and gains in coding, 3D creation and financial research, plus a 2-3x faster Highspeed variant; full weights are due by Nov 4.
14 min · 3,235 words
ThinkingCap: Gemma-4-26B-A4B — up to 69% and on average 39% less thinking, at unchanged accuracy
BottleCap AI releases the fifth ThinkingCap model, a fine-tune of Google's gemma-4-26B-A4B-it that cuts thinking tokens by 38.9% on average (up to 69.1%) across twelve benchmarks for a 0.15pp accuracy cost, with looping reduced from 3.6% to 0.8%.
6 min · 1,385 words
OrgWebAlchemy: Benchmarking, Profiling, and the Long Road to Real Org Support
Josep Bigorra details how the Guile OrgWebAlchemy Org-mode parser gained Markdown output, figures, named elements and table rows, and got up to 6.4x faster after profiling uncovered a quadratic collapse pass and a per-character scanner.
26 min · 6,059 words
Getting ready to operate Taler in Germany
The GNU Taler project announces Taler Operations AG, a new company in Bochum that will apply to BaFin for an e-money licence to operate the privacy-preserving Taler payment system in euros, first in Germany, and explains why a regulated operator is needed.
3 min · 803 words
Recreate the Apollo Guidance Computer
Raspberry Pi Official Magazine profiles avionics engineer Michael Newton's open source Recreate Apollo project, a 1:1 3D-printed Apollo DSKY replica driven by a Raspberry Pi running the Virtual AGC emulator with the Apollo 13 Command Module software.
6 min · 1,372 words
Brotli on NGINX thread pools: ngx_mbrotli vs ngx_brotli
Mikhail Panfilov benchmarks ngx_mbrotli, which runs on-the-fly Brotli compression on an NGINX thread pool, against google/ngx_brotli, measuring p99 latency for other requests, requests per second, large-response speed, CPU time and memory, plus configuration advice.
16 min · 3,701 words
Release notes for ZLS 0.17.0, the Zig language server from zigtools: feature improvements such as not following aliases when renaming symbols, bug fixes, and download links for all supported platforms.
2 min · 524 words
Your AI agent fixed the bug, but what else did it change?
Trail of Bits releases patching-bugs and regression-hunt, two agent plugins built through its Patch the Planet work with OpenAI that reproduce bugs, develop and test fixes, and check patches for regressions within a project's own threat model and patching guidelines.
8 min · 1,778 words
We just gave a million dollars to Open Source maintainers
Sentry raised its Open Source budget from $750,000 to $1,000,000 this year. The post explains why, its Open Source Pledge, and how the money was split among maintainers and foundations, with the full list of recipients.
3 min · 771 words
John Earnest's Beyond Loom tutorial uses Hershey vector fonts to teach Lil, Decker's APL-influenced scripting language: points, strokes, and paths as nested lists, then layout and drawing primitives for 2D vector text and shapes.
8 min · 1,784 words
John Earnest's annual retrospective on Decker, the HyperCard-inspired multimedia authoring tool, covering releases 1.61 to 1.71: new capabilities such as gamepad input, improvements to its scripting language Lil, highlights from the community of deck makers and jams, and a pledge for human creativity.
11 min · 2,597 words
New open-source method shows the same AI request emits 8.5 times more CO₂ in Texas than in Sweden
Berget AI releases an open-source, MIT-licensed method for calculating the carbon emissions of each individual AI request, developed with Stockholm Environment Institute, WattTime and Klimatkollen, showing grid location can change per-request emissions by a factor of 8.5.
5 min · 1,168 words
Patch the Planet: global response coordination as agents uncover critical vulnerabilities
OpenAI describes leading a coalition with PHP maintainers, Calif, Wiz, Cloudflare and others to fix critical PHP vulnerabilities found with AI, commits $1B in subsidized Daybreak access for frontline defenders, and proposes a five-stage framework for coordinating responses to critical bugs in widely used software.
8 min · 1,812 words