Thoughts on AI, the tech stack, and the indie hacker journey.
An actively-exploited, pre-auth RCE chain in PaperCut got an emergency patch on August 28, then a second emergency patch hours later after researchers bypassed the first one.
Bun 1.4 shipped on August 19 as the first version of Bun written in Rust instead of Zig. The published benchmarks (5x less idle CPU, 7x faster CI installs) are the boring, verifiable part. The claimed 64-agent, 11-day porting workflow is the part worth reading carefully.
Anthropic's official account announced a permanent 25% increase to Claude Code weekly limits starting September 14. What it didn't lead with: everyone is currently using a temporary 50% boost that expires the same day, which makes the real change a 17% reduction.
Lambda raised roughly $1 billion in private debt this week, arranged by JPMorgan, to buy more Nvidia GPUs. It's the company's third debt-financed chip purchase since May. Nvidia is both Lambda's supplier and one of its investors, which is worth understanding if you rent compute from any neocloud.
OpenAI told Cursor on August 29 it's ending direct model access on November 12, because SpaceX now owns the company. Cursor's CEO says it barely matters: OpenAI models handle about 5% of its traffic. That number is the actual lesson for anyone routing their stack through a single vendor.
US District Judge Rita Lin ruled on August 27 that the Pentagon's supply chain risk designation against Anthropic was First Amendment retaliation and a due process violation. The ruling matters beyond Anthropic: it's the first real court test of whether an agency can informally blacklist a vendor over policy disagreements.
An open-weights lab held back its flagship weights over offensive security capability, not chatbot misuse. If your cost model has "worst case, I self-host" in it, that line just lost its date.
htmx 4.0 landed on August 28 after eight months of work, and 2.x stays as npm latest until early 2027. The one change worth acting on today is attribute inheritance, because it silently breaks CSRF headers.
Tracer.AI filed a DMCA notice against Luanti on Microsoft's behalf citing a Minecraft copyright registration and naming no infringing asset. The statutory restoration window is 10 to 14 business days. In 2023 the same app waited 46.