Thoughts on AI, the tech stack, and the indie hacker journey.
On June 30 Google shipped Nano Banana 2 Lite — text-to-image in about 4 seconds at $0.034 per image — plus Gemini Omni Flash video at $0.10 a second. Cheap generation is a tailwind for tools and a headwind for thin wrappers. Here's which one you are.
The week of July 6, the default self-hosted Supabase config for API_EXTERNAL_URL picks up an /auth/v1 prefix, and log_connections flips from on to off. Neither is a headline. Both are exactly the kind of quiet default change that passes local and breaks prod.
CVE-2026-46242 is a use-after-free in the Linux kernel's epoll code that lets an unprivileged user climb to root with a proof-of-concept that works about 99% of the time. It hits mainline 6.4 and up, plus Android. The fix landed in April — but plenty of distros haven't shipped the backport.
Alongside the July 1 launch of Claude Science, Anthropic opened an AI-for-Science grant: up to 50 projects, up to $30,000 in API credits each, applications through July 15. Free frontier compute is rare — and the eligibility fine print is the whole story.
On July 3 the FTC opened comment on a proposed policy statement saying AI companies that steer their outputs toward undisclosed objectives could be deceiving consumers under Section 5. The safe harbor is a clear disclosure. For a solo operator shipping an AI product, that's a copywriting problem with legal teeth.
OpenAI reportedly pitched Washington a 5% equity stake — about $42.6B at its $852B valuation — and wants the other labs to do the same through a sovereign wealth fund. If your product rides one lab's API, your dependency chart now has a government on it.
On July 1, Alex Karp went on CNBC and said enterprises are 'paying for tokens that create no value' while the labs harvest their data. Strip out the theater and there's a real lesson about which side of the token meter a solo operator wants to be on.
Security firm Armadin published an attack chain against Claude's desktop app on Windows: plant a file in the app directory, hijack a trusted process, reach the underlying VM service. Anthropic's answer after the May 29 disclosure is that it isn't a security issue, because you already need local code execution. That disagreement is the whole lesson about AI desktop agents.
The 2026 story on AI coding isn't a new model — it's that agents crossed from 'finish this line' to 'run for seven hours and open the PR.' The reflex is to bolt on more of them. Anthropic's own numbers say the bottleneck is oversight, not tooling — which is why a thin, two-tool stack with tight permissions beats a drawer of subscriptions.