Thoughts on AI, the tech stack, and the indie hacker journey.
Joby completed the first point-to-point electric air taxi flight in NYC history on April 27. JFK to West 30th Street, 7 minutes vs. 60–120 by car. Buried in the press coverage is the actual interesting story: Joby didn't build a new transit network. They bought a tiny existing one and rode along.
GitHub published GHSA-6w67-hwm5-92mq on April 21. By 03:35 UTC on April 22, a Sysdig honeypot caught the first exploitation attempt. No public PoC was ever needed. The threat model for self-hosted LLM servers just changed, and the math for solo operators changed with it.
Lovable is reportedly the fastest-growing European startup in history. v0, Bolt, and Lovable are now the dominant trio in the "describe an app and get a working full-stack project" category. After spending a week building three actual products with each one, I have a fairly opinionated answer that doesn't match either the breathless threads or the dismissive replies.
~20K senior tech workers are about to hit the market in a 60-day window with severance, no urgency, and AI tooling muscle memory. The mainstream read is "AI is taking jobs." The Solo Operator read is much more specific and almost nobody is writing it.
On April 27, Microsoft and OpenAI announced a renegotiated deal that ended Microsoft's exclusive license. The headline read like a corporate footnote. The substance is bigger: this is the first week the cloud-provider question is genuinely separable from the model question. Here's how the math actually changes for sub-$10K MRR products.
Quietly, on April 14, Netlify changed what a credit buys. Bandwidth went from 10 to 20 credits per GB. Compute went from 5 to 10 credits per GB-hour. Same dollar price — half the bandwidth, half the compute. If you migrated off Vercel for cost, your renewal is a different conversation now.
Next.js 16.2 shipped with Turbopack as the default bundler in dev mode and a claimed 400% faster cold dev start. The numbers are real. And yet I'm not moving this blog off Astro 5 + Keystatic, and I wouldn't recommend any solo operator rebuild in Next right now either.
The Rode RodeCaster Duo ships with SSH enabled by default, two pre-installed login keys hardcoded in firmware, and an OTA update mechanism with no signature verification. It's running Linux. It's on your network. The actual story isn't this specific bug — it's that your home office threat model hasn't caught up to 2026.
Stripe's Merchant of Record product, acquired through Lemon Squeezy in 2024, is now public. Polar has been quietly eating Lemon Squeezy's lunch for 12 months. The "should I switch payment processors" question is genuinely live for the first time since 2024. Here's the honest decision tree.