Posts

Cloudflare productizes its internal SRE stack as Flagship, taking dead aim at Datadog and PagerDuty. A clear-eyed essay on where pure next-token prediction stops working makes the front page. A different post argues the famous ’engineer who can say no’ was just a ZIRP-era artifact. V2EX is debating whether domestic Chinese code agents can actually replace Cursor, and whether Qwen3.7-Coder really beat GLM5.1. Publickey reports .NET MAUI is finally migrating from Mono to CoreCLR, and VS Code shipped an Agent window for multi-AI workflows. Wildcards: Anthropic publishes the first Glasswing consortium results, Google ships Gemini 3.5 Flash straight to GA, and xAI’s Grok Build enters beta with parallel sub-agents.

LinkedIn turns out to be probing browsers for 6,278 named extensions and shipping the result back encrypted on every request. Mozilla files a sharp ‘harmful’ standards position against Chrome’s Prompt API. A Shai-Hulud-themed npm/PyPI supply-chain campaign lands inside PyTorch Lightning. Docker GA’s an in-CLI AI agent (Gordon). .NET MAUI finally walks away from the Mono runtime. Belgium reverses its nuclear-decommissioning policy as data-center load forecasts blow past 2030 grid plans. Rivian ships a real ‘kill all telemetry’ switch. Armin Ronacher pushes back on AI-rewritten GitHub issues. Meta-theme: trust boundaries — between sites and your browser, between AI and your codebase, between AI-rewritten text and your bug tracker — are being redrawn in public this week.

Claude Code reportedly refuses requests or upsells when commit messages mention ‘OpenClaw’ — model behavior observability becomes a competitive issue for the first time. David Oks ties consumer-device memory inflation to HBM wafer allocation in one of the cleanest causal explanations of the AI hardware bill yet. xAI ships Grok Build CLI to enter the coding-agent race. Red Hat introduces an indefinite-life RHEL SKU. FTC fines Cox Media Group for the ‘Active Listening’ microphone-ad pitch — it never actually used voice data. CopyFail disclosure bypassed a Gentoo maintainer. Spain’s parliament moves to curb LaLiga’s collateral-damage IP blocks. Plus Pu.sh — a 400-line shell coding-agent harness — and two V2EX threads on how Chinese clouds are repricing free DNS and gamifying AI token consumption. Meta-theme: infrastructure pricing is being rewritten in the AI era.

Rivian documents a one-click switch that fully severs the vehicle from the internet. LinkedIn is found probing 6,278 browser extensions and shipping an encrypted fingerprint with every request. honker.dev packs durable queues, streams, pub/sub, and cron into a single SQLite file. A Shai-Hulud-themed malicious dependency lands inside PyTorch Lightning — the AI training supply chain just took a direct hit. V2EX has parallel threads on shaky Chinese token plans and engineers paying out of pocket to use Claude at work. Google ships Managed Agent API and Antigravity 2.0 as the post-I/O second wave. SpaceX’s S-1 reveals a $1.25B/month compute deal with Anthropic. Mozilla formally opposes Chrome’s built-in Prompt API. Today’s thread — the defaults for privacy, supply-chain trust, and compute economics are all being rewritten at once.

HBM eats into consumer memory wafers — cheap smartphones are about to get pricier. Opus 4.7 can reconstruct your real identity from writing style alone. Daniel Lemire shows how to beat binary search on modern CPUs. Zenn trending is dominated by Claude token-saving tactics and Vibe-Coding supply-chain attacks. Anthropic publishes Project Glasswing’s first six-month report. cPanel has an actively exploited bug. Today’s thread — AI is forcing a recalibration of every yardstick we use, from price tags to privacy defaults to engineering KPIs.

Rivian quietly ships a real off-switch for vehicle telemetry. The Shai-Hulud worm lands in PyTorch Lightning. Mozilla tells Chrome to slow down on the Prompt API. Simon Willison summarizes six months of LLM motion in five minutes. Anthropic buys Stainless. A 400-line shell script wants to be your coding agent. Today’s throughline is consolidation - of telemetry control, of supply chain attacks, and of the agent stack itself.

LinkedIn is fingerprinting 6,278 browser extensions on every request. Belgium reverses course on its nuclear shutdown, citing AI datacenter load. honker.dev stuffs durable queues, streams, pub-sub and cron into a single SQLite file. Google ships Antigravity 2.0 (Agent writes an OS from scratch, runs Doom) plus a Managed Agent API; Dell puts GB10 / GB300 on the desktop; Linux Foundation books Tokyo for AGNTCon + MCPCon. The throughline is unmistakable - Agents are now eating infrastructure, not just IDEs.

Simon Willison compresses six months of LLM history into a five-minute PyCon talk; a Shai-Hulud-style supply chain attack lands inside PyTorch Lightning; Mozilla formally opposes Chrome’s Prompt API; Anthropic absorbs Stainless to own the SDK pipeline and signs KPMG’s 276k workforce. Coding agents are now boring infrastructure — and the second-order problems are arriving on schedule.

Anthropic acquires SDK-generation company Stainless. PyTorch Lightning hit by Shai-Hulud-family malware — AI training is now a supply-chain target. Mozilla rejects Chrome’s Prompt API push. Plus Bun’s six-day Rust rewrite, Red Hat’s no-EOL RHEL, and HN’s Claude-Code OpenClaw screenshots.

honker.dev squeezes durable queues, streams, pub/sub, and cron into a single SQLite file. Simon Willison ships datasette-llm-limits to turn LLM bills into a first-class governance object. CopyFail re-opens the disclosure-ethics debate, and Belgium and Rivian both walk back things the industry treated as settled.

LinkedIn fingerprints 6,278 browser extensions, PyTorch Lightning gets a Shai-Hulud supply-chain hit, Anthropic ties up $200M with the Gates Foundation, and Mozilla draws a line against Chrome’s Prompt API.

Weekend edition. Browser politics meet AI plumbing again — Mozilla files a hard ’no’ on Chrome’s Prompt API (the one that lets pages call into a browser-bundled LLM), 564 points on HN. Shai-Hulud-style supply chain attack lands in PyTorch Lightning; AI training pipelines are now in the same threat model as npm. Two Japanese-source items: VS Code ships Agent window for parallel coding agents, Node.js 26 enables Temporal by default. From the Chinese dev community: ‘Gemini got worse this week’ and ‘AI coding is more exhausting than the old way’ — both early signals that the cost side of the AI coding ledger is finally being talked about.

Three threads this morning. (1) The platform layer is paying down years of debt at once: VS Code 1.108 ships a preview ‘Agent window’ for running multiple coding agents side-by-side, the long-running Bun rewrite-in-Rust PR finally lands on main, Node.js 26 turns on Temporal by default, and Mojo 1.0 hits Beta. (2) Security and privacy are pushing back hard: HN’s #1 story (442 pts) is an owner physically removing the DCM and GPS from a 2024 RAV4 hybrid, #2 is a public stack-overflow PoC against Nginx, and the V2EX thread of the day is a manager discovering coworkers resold the company’s LLM gateway key. (3) Skills as an interface have a real day in the sun: obra/superpowers cracks the GitHub trending top 5, and a Zenn write-up of Claude Code vs Codex playing Othello with identical Skills (final: 56-8) is making the rounds.

HN’s top three slots are all AI trust stories: Claude Code allegedly refusing or upcharging requests when commits mention ‘OpenClaw’ (865 pts); PyTorch Lightning hit by a Shai-Hulud-themed supply-chain attack (299 pts); Rivian shipping a real, vehicle-wide kill switch for cloud telemetry (331 pts). V2EX threads document a Gemini quality regression and a clean mihomo-via-Tailscale exit-node recipe. Publickey covers Node.js 26 enabling Temporal by default and Mojo reaching 1.0 Beta. Simon Willison ships a CSP allow-list iframe experiment and quotes Boris Mann’s deadpan: ‘11 AI agents’ is as meaningful as ‘11 browser tabs.’ On GitHub Trending, obra/superpowers — a packaging convention for Claude Code skills — keeps climbing.

LinkedIn probes 6,278 browser extensions and ships the encrypted result on every request — 299 points on HN. Mozilla files a formal ‘opposed’ on Chrome’s Prompt API push, opening the browser-AI standards war in earnest. Simon Willison reads GitLab’s Act 2 layoff post as the SaaS survival script for the agentic era. Zenn’s #1 today asks why some engineers viscerally hate software design principles. Publickey reports Claude Platform on AWS shipping GA. V2EX has parallel threads on the explosion of AI API resellers and on AI coding being more exhausting than writing it yourself. Plus CopyFail not getting disclosed to Gentoo, a 400-line shell coding-agent harness, and a Game Boy emulator in F#.

LinkedIn probes 6,278 browser extensions and ships the encrypted result on every request — 299 points on HN. Mozilla files a formal ‘opposed’ on Chrome’s Prompt API push, opening the browser-AI standards war in earnest. Simon Willison reads GitLab’s Act 2 layoff post as the SaaS survival script for the agentic era. Zenn’s #1 today asks why some engineers viscerally hate software design principles. Publickey reports Claude Platform on AWS shipping GA. V2EX has parallel threads on the explosion of AI API resellers and on AI coding being more exhausting than writing it yourself. Plus CopyFail not getting disclosed to Gentoo, a 400-line shell coding-agent harness, and a Game Boy emulator in F#.

Claude Code is reportedly refusing requests or up-charging when commits mention ‘OpenClaw’ — 865 points on HN and counting. Shai-Hulud lands in PyTorch Lightning. Simon Willison digs into Anthropic’s Colossus-1 lease and the new ‘Elon can yank the compute’ supply-chain risk. Bun migrates from Zig to Rust in a week with Claude. Zed 1.0 ships. V2EX has the bug-reintroduction complaint we’ve all been thinking. Plus Rivian’s hard-off privacy switch, durable queues inside SQLite, and Daniel Lemire on beating binary search.

Mozilla draws a hard line on Chrome’s Prompt API, Mozilla itself uses Claude Mythos to fix 423 Firefox security bugs in a single month, LinkedIn is caught fingerprinting browser extensions on every request, Shai-Hulud lands in PyTorch Lightning, and Anthropic teams up with Blackstone, Hellman & Friedman, and Goldman to spin up an enterprise AI services company. Meanwhile V2EX is having a Claude-Code-fatigue moment.

Louis Rossmann picks up the legal tab for the OrcaSlicer dev Bambu Lab is suing, NYT documents how Meta’s AI push is grinding employees down, Debian commits to reproducible packages as a release requirement, Zed ships a theme builder, a fresh FreeBSD execve LPE drops, and Simon Willison highlights Andrew Quinn’s case for reinventing four wheels — but not a thousand.

Louis Rossmann picks up the legal tab for the OrcaSlicer dev Bambu Lab is suing, NYT documents how Meta’s AI push is grinding employees down, Debian commits to reproducible packages as a release requirement, Zed ships a theme builder, a fresh FreeBSD execve LPE drops, and Simon Willison highlights Andrew Quinn’s case for reinventing four wheels — but not a thousand.