Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
The next circle of security hell
Gentoo developer Michał Górny revisits his 2021 'modern packager's security nightmare' and argues things have got worse: vulnerabilities arrive at unprecedented rates, rushed fixes and API breaks pile up on downstream packagers, and the community risks a breaking point where everyone bundles and fends for themselves.
3 min · 705 words
Jan Schaumann argues that cyber defense teams are effectively under a DDoS: AI-accelerated vulnerability discovery, broken embargoes and marketing-driven disclosure have outpaced vulnerability and patch management, and defenders cannot simply AI their way out, so the industry needs to rethink disclosure and triage before teams burn out.
10 min · 2,277 words
Why I'm no longer updating this repository
Paul Battley explains why he is archiving all his Ruby gems: Ruby was once designed for programmer joy and for humans, but with Rails controlled by a figure he opposes and Ruby itself now developed and repositioned around LLM agents, he no longer wants to contribute to a commons being strip-mined to feed AI.
2 min · 436 words
A critical essay arguing the Linux kernel is going all-in on AI: dropping Assisted-by tags for LLM-generated patches, what that means for tracing defects and copyright, and the attitude that AI never fails, only the humans using it.
6 min · 1,461 words
Anthropic’s Scion is heavily inspired by Mononoke
A former Mononoke engineer compares Anthropic's description of 'derived data' in its new Scion version control system with how Meta's open-source Mononoke source control server used the same idea years earlier, and argues that Anthropic should have credited Mononoke as prior art.
4 min · 855 words
Gentoo developer Michał Górny asks Python package maintainers not to adopt uv-build as their build backend, arguing that its size and Rust toolchain requirement break builds on less common architectures and downstream distributions, while its benefits over backends like flit-core or hatchling are minimal.
3 min · 579 words
Just say no to OpenAI and Anthropic
Security engineer Micah Lee argues against paying OpenAI and Anthropic, citing the frontier labs' AGI ideology, and explains why open-weight models (e.g. GLM) are now good enough for complex work, with private inference options like Tinfoil and cheap ones like OpenCode Go.
7 min · 1,529 words
Paul Anthony Webb reacts to Deno's team moving to Cloudflare and winding down runtime development within a year, the second VC-backed tool he depends on to be handed to the community. He announces Ende, his own Deno fork that drops Node compatibility and extras like Deploy, KV and Jupyter, aiming for a December soft launch.
3 min · 735 words
What I've been seeing lately (in software)
A personal survey of software culture amid generative AI: normalizing pro-human discussion, exacting design and organizing, the job question, beautiful work, and a growing European push toward self-hosted and public-sector open source.
4 min · 848 words
Attack of the Vibe Coded Photoshop Clones
Shokunin Studio tracks the dozen-plus AI 'vibe coded' clones of Photoshop and other Adobe, Microsoft, Avid and Autodesk apps, compares them to earlier waves of automated cloning, and argues vibe-cloned piracy undermines the incentive to build original creative software.
7 min · 1,496 words
The reverts will continue until morale improves
PostgreSQL committer Peter Eisentraut reflects on the unusually large wave of feature reverts after PostgreSQL 19 entered beta, why quality bar and unfinished design led to cutting ~8–10 significant features, and what that means for PostgreSQL 19 and 20.
5 min · 1,145 words
What ArtCraft’s Vibe-Coded Apps Say About Adobe
Tedium's Ernie Smith looks at ArtCraft, a project rebuilding Adobe's Creative Cloud apps such as Photoshop with clean-room, AI-first vibe-coding techniques, asks whether it is ethical, and argues it shows what happens when a company like Adobe ignores its users.
5 min · 1,049 words
Authoritarian tendencies of Android Developer Verification Program
Vikrant Singh Chauhan argues Google’s Android Developer Verification Program, sold as malware protection, centralizes who may ship apps and threatens sideloading and small open-source clients—drawing on his experience publishing ivx/ai Chat.
9 min · 2,029 words
kowalski7cc explains why Flatpak works for desktop GUI apps but is awkward for terminal tools: entrypoints, PATH, sandbox friction, and packaging tradeoffs that hurt CLI UX.
6 min · 1,268 words
The Era of Software Quality, or the Era of Ostriches?
Humans are bad at writing secure code, and GNOME developers are no exception. GNOME is primarily written using unsafe programming languages where simple mistakes in our code lead to devastating consequences for our users, and we make these mistakes all the time. No matter how much we try, GNOME developers will fail write secure code when using unsafe languages like C, C++, or Vala: it’s just too hard for even experienced developers to do properly.
16 min · 3,733 words
Vibe Coding Isn't the Problem. Ownership Is.
I had an interesting conversation today about “vibe coding” and whether it’s appropriate to contribute AI-generated code to open-source projects.
3 min · 725 words
GitHub has not removed malicious imitation software after 3 weeks
A software vendor reports a malware-laced GitHub imitation of Easy Data Transform that sat for weeks after reports—until the post hit Hacker News and the page disappeared within minutes.
1 min · 306 words
PlayTaurus argues guitarists should buy hardware for what it is and run community firmware on it—ESP32-class chips are cheap enough, NAM models are open, and closed pedal firmware is the last proprietary lock.
2 min · 477 words
Nobody pays for open source. We can force them to.
Thirty years of voluntary funding schemes haven't paid open source maintainers because asking doesn't scale. The real money already flows — to JFrog, Docker, Sonatype — at the registry layer. The fix: registries charge companies for supply (they already do), then route a slice automatically to the maintainers who make that supply worth having.
23 min · 5,396 words
Eric Bailey argues CSS-Tricks should become a co-op so the web keeps an independent, practitioner-owned home for frontend knowledge—after the site’s repeated near-deaths under corporate ownership.
3 min · 595 words