Thoughts on AI, the tech stack, and the indie hacker journey.
The payload is AES-256-GCM ciphertext. Guardrails classify text, they do not run it, so the only way to read the attack is to execute it. Which is exactly what the model does.
Lovable and Bolt sell you a place to build apps. The v0 API sells the builder itself, which means your product can be the interface. Here is what you are actually renting.
A developer spent an evening working out why his music stopped whenever an AliExpress tab was open. The answer was two zero-gain WebAudio graphs from Alibaba's anti-abuse scripts, and the browser's mute button cannot touch them.
The endpoints going dark on August 26 is the part everyone planned for. The part nobody planned for: OpenAI is not shipping an automated migration for Threads, so the conversation history is what you actually lose.
The August 14 changelog led with multiple redirect URIs and refresh tokens. Near the bottom sits the disclosure that every app registered with a single callback URL has had wildcard matching enabled all along.
Everyone read the headline about allowScripts defaulting to off. The two defaults underneath it, allow-git and allow-remote both going to none, are the ones that fail your CI on a Tuesday morning.
Sonnet 5 lists at $2/$10 against Sonnet 4.6's $3/$15, which reads as a 33% cut. Two paragraphs below the table, the same page says Claude 4.7 and later use a tokenizer that produces about 30% more tokens for the same text.
Go 1.27 landed on August 19 with a UUID package in the standard library and a rewritten JSON implementation that now backs encoding/json by default. One of those is free cleanup. The other changes behavior in a package your app almost certainly imports.
Teams with a coding agent went from 21 weekly pull requests to 65. Teams without one went from 8 to 10. And the time spent on everything else did not fall by a single minute. Linear's own phrase for this is a Jevons paradox.