The journal
Working notes from the workshop.
Posts on AI, software craft, and the things we learn while shipping. Twice a month, sometimes weekly.
Hiring developers? Start with the how-to-hire hub →
Categories
Tags
Showing 12 of 789 articles
Cloud & Infrastructure·AMD Buys Taalas: What Etching AI Weights Into Silicon Actually Changes
AMD acquired Taalas on August 6, a startup that hardwires model weights directly into chip silicon instead of loading them from memory. Here's what that trade-off means for inference cost, and why it can't replace your GPU fleet.
AI InfrastructureAI ChipsInfrastructureAMD
Cybersecurity·The Coldcard Bitcoin Heist Was a PRNG Bug. Here's What It Teaches Every Developer About Randomness
A 2021 firmware error made Coldcard hardware wallets generate seeds with a predictable software PRNG instead of the hardware RNG. On July 30, attackers used that gap to drain $70 million in 41 minutes. The lesson applies far beyond Bitcoin.
CybersecurityCryptographyBackendSecurity
AI Integration·Meta Muse Glimmer: A 30B Agent Model That Runs on One GPU, No Cloud Required
Meta shipped Muse Glimmer on August 10, an Apache 2.0 model built for local agent tasks that fits on a single 24GB consumer GPU and beats larger rivals on tool-use benchmarks. Here's what it's actually for.
AI IntegrationLLMOpen SourceMachine Learning
AI Integration·Writing Evals for AI Features: A Testing Guide for Before You Ship
Unit tests don't work on a feature that gives a different answer every time. Evals do. Here's how to build a practical eval harness for an LLM feature, with real code, before it goes anywhere near production.
AI IntegrationLLMTestingBackend
Technology·Android Views Just Entered Maintenance Mode. Here's What That Means for Your App
Google declared Android UI development Compose-first this year: Views keeps getting critical bug fixes, but no new features, ever again. Here's what maintenance mode actually covers and how to plan a migration that doesn't stall your roadmap.
MobileAndroidKotlinDeveloper Tools
Cybersecurity·The Keyv and Cacheable npm Attack: 2,234 Poisoned Package Versions in One Day
A compromised maintainer account on August 4 turned keyv and cacheable into a self-propagating npm worm that stole cloud, CI, and GitHub credentials from packages with tens of millions of weekly downloads. Here's what happened and how to check if you were hit.
CybersecuritySupply ChainnpmDevOps
AI Integration·Meta Ships Muse Code: Its First Terminal Coding Agent, Built on Muse Spark 1.2
Meta entered the terminal coding agent market on August 5 with Muse Code, running on the new Muse Spark 1.2 model. It scores 82.9% on Terminal-Bench 2.1, ahead of Codex and Grok Build, behind Claude Code. Here's what actually shipped.
AI IntegrationLLMDeveloper ToolsMachine Learning
Cybersecurity·CVE-2026-63077: TeamCity's Unauthenticated RCE Just Landed on CISA's KEV List
A deserialization flaw in TeamCity's agent polling protocol lets an attacker with no credentials run commands as the build server. CISA confirmed active exploitation on August 5. Here's what's affected and how to patch it.
CybersecurityCVECI/CDDevOps
Cybersecurity·Black Hat 2026: A GitHub Issue With No Privileges Compromised Claude Code, Gemini CLI, and Codex
Researchers at Black Hat USA 2026 showed how an untrusted GitHub issue reached CI runner secrets in Claude Code, Gemini CLI, and OpenAI Codex. Gemini CLI's flaw scored a perfect 10.0 CVSS. Here's what happened and how to check your own pipelines.
CybersecurityAI IntegrationCVEDevOps
Web Development·CSS @scope Explained: Style Isolation Without a Naming Convention or a Build Step
@scope lets a CSS rule apply only inside a specific part of the DOM, with a lower bound that excludes nested components. No BEM, no CSS Modules, no Shadow DOM. Here's how the syntax works and where it still falls short.
CSSFrontendWeb DevelopmentDesign
Cloud & Infrastructure·Distributed Tracing Explained: Following a Request Across Every Service It Touches
A single checkout request might touch five services and nobody can say which one is slow. Distributed tracing fixes that by tagging every hop with one trace ID. Here's how spans, trace IDs, and context propagation actually work, with OpenTelemetry examples.
ObservabilityBackendArchitectureCloud & Infrastructure
Business·How to Hire a Data Analyst in 2026: SQL, Dashboards, and the Skills That Actually Move Decisions
A data analyst is not a junior data scientist and not a dashboard builder with no opinions. Here's what the role actually requires, how it differs from data scientist and data engineer, and the screen that finds someone whose analysis changes decisions.
HiringData ScienceBusinessSQL