Thoughts on AI, the tech stack, and the indie hacker journey.
CVE-2026-34197 is an RCE in Apache ActiveMQ that's been sitting in the code since 2013. A security researcher found it during a casual Claude session. It's now on CISA's KEV list with a federal patch deadline of April 30. The real story for solo operators isn't "AI finds bugs." It's that the rate of newly-discovered legacy bugs is about to go up sharply.
OpenAI shipped "Codex for (almost) everything" on April 16. Computer use, integrated browser, 90+ plugins, PR review, SSH devboxes, and a Claude Code plugin for cross-provider review. I spent five days actually using it on production code. It's good. It's not a drop-in replacement. The real solo-dev decision is more interesting than the launch posts made it sound.
Scroll through Indie Hackers today and you'll notice the MRR screenshots are thinner. Several loud founders have scrubbed their profiles. The reason isn't burnout — it's that AI vibe-coding has made good ideas trivially cloneable, and transparency has become a clone signal. If "build in public" was your whole growth strategy, the game just changed.
OpenAI announced on March 24 that the Sora app shuts down April 26 and the API shuts down September 24. Seven months from launch to grave for a product that was supposed to own AI video. If you built a pipeline on Sora, you have a long weekend to migrate — and a specific lesson to take with you about building on anyone's consumer AI app.
A Context.ai employee got infected with Lumma infostealer while downloading Roblox cheats. Two months later, ShinyHunters was selling Vercel customer tokens on BreachForums. The attack path is a straight line through the AI productivity tools you've been clicking "Allow all" on. Here's the 30-minute OAuth audit every solo operator should run this week.
Amazon just announced that every Kindle shipped in 2012 or earlier loses Store access on May 20. Factory reset the device after that and it literally cannot be re-registered. It only affects ~3% of users — and that's exactly the point. If you're building a subscription product, this is the clearest case study in platform risk and graceful deprecation I've seen this year.
There's a post climbing the HN front page called "Stop trying to engineer your way out of listening to people." I've done exactly that — built dashboards, feedback bots, session replays, AI-summarized survey pipelines — all to avoid the 30-minute call where a user tells you something uncomfortable. None of it worked. The call always works.
TypeScript 6.0 shipped in March as the last JavaScript-based release. TypeScript 7 — rewritten in Go, 10× faster builds, dramatically lower memory — is in nightly preview as @typescript/native-preview and close to GA. Most coverage is aimed at big teams. Here's the short version for solo builders: three commands, one config flag, done.
Uber spent $3.4B on R&D this year, encouraged every engineer to use Claude Code, and exhausted its planned AI budget before Q2. The cause isn't hype spend — it's Anthropic's hybrid "per-seat + pre-committed tokens" pricing. The same dynamics are biting solo devs. Here's what the Uber story actually teaches you about AI bills, and what to do about it before your next invoice.