Thoughts on AI, the tech stack, and the indie hacker journey.
Your AI coding CLI can ship your whole repository to a vendor's cloud bucket, and you'd never know without watching the wire. Grok Build just got caught. The lesson isn't 'xAI bad': it's that 'trust us' is not an egress policy.
The malware in a compromised npm package didn't just grab cloud keys. It grepped for Claude Desktop, Cursor, Windsurf, Zed, and MCP config files: because that's where the API keys live now. You probably don't use jscrambler. You almost certainly have a plaintext key in a config right now.
Moonshot's Kimi K3 topped the Frontend Code Arena and nearly won Terminal-Bench at a fraction of frontier US pricing. The weights ship July 27, but at 2.8 trillion parameters, self-hosting is a datacenter, not a hedge. The real decision is routing.
Video understanding just got a funded platform player with Amazon behind it. For a solo builder that's not a threat: it's a supplier. The move flips from training the model to wrapping it in a workflow people pay for.
For a few hours on July 16–17, AWS Cost Explorer showed ordinary $5–$15 accounts projected to owe billions — one report hit $7.1 trillion. Real charges were never touched. But if your budget alarms, kill-switches, or a FinOps agent trust that dashboard, a display bug becomes an outage you caused.
Google's Gemini Omni Flash — conversational video generation and editing — is live at roughly $0.10 per second of 720p output, no free tier, no batch discount. A 10-second clip is a little over a dollar in output alone. The "AI video is basically free" assumption solo builders price against is wrong.
On July 17 Apple shipped the iOS 27 public beta, taking the redesigned, on-screen-context-aware Siri out of the developer-only channel for the first time. For indie iOS devs, the actions you expose to the system are now how the assistant finds and drives your app: distribution, not a WWDC checkbox.
Zuckerberg confirmed businesses want Meta's models and spare compute, and Meta is poaching senior AWS people to weigh a commercial cloud. A fifth hyperscaler selling inference is downward pressure on the token prices you pay — but only if your stack can actually move to use it.
npm v12 shipped this month blocking install scripts by default — the mechanism behind a year of supply-chain worms. On July 14, Microsoft documented the @asyncapi compromise: malicious versions with the loader moved to import time, which install-script blocking does nothing to stop.