Thoughts on AI, the tech stack, and the indie hacker journey.
Astro 6.4 ships Sätteri, a Rust-based Markdown pipeline that saved over a minute per build on Astro's own docs site. For content-heavy sites it's a rare upgrade with measurable payoff — and exactly one tradeoff that decides whether you can use it yet.
Google, Amazon, Microsoft, and Meta plan roughly $725B in 2026 AI infrastructure spending — up 77% — while cutting staff to pay for it. The gap between bought capacity and shipped product is where independent builders get paid. Here's the window, and the real risk it closes.
The discount that was supposed to expire today isn't going away. At $0.435 per million input tokens, DeepSeek priced long-context inference low enough to break the rent-vs-own calculation for most solo builders — and that changes what you should actually run.
On May 28 one maintainer alias dropped 14 packages typosquatting OpenSearch, ElasticSearch, and DevOps libraries, built to lift cloud and CI/CD credentials. Typosquatting hits differently than an upstream compromise — the vulnerability is a typo in your install command. Here's the Saturday checklist.
Three major frameworks shipped within weeks of each other and all pushed routing to the front: more explicit, more controllable request handling. Next.js even renamed middleware to proxy. Here's the upgrade decision for a solo builder — including the one change I'm watching because this blog runs on Astro.
Baseten went from a $5B to an $11B valuation in under three months and from $200M to ~$600M annualized revenue in a single quarter. The pitch: inference will be two-thirds of all AI compute by year-end. The real question for a one-person shop isn't whether the round is real — it's where you sit on the API → managed → self-host curve.
Anthropic's new flagship gives you up to 2.5x output tokens per second — for a premium. Plus effort control and mid-conversation system messages. The interesting part isn't the benchmark; it's that latency-vs-cost is now an explicit per-request lever you set, and most builders are leaving it on the wrong default.
Google replaced its 25-year-old search box with AI agents and generative UI at I/O 2026, and within five days DuckDuckGo's US installs were up 30%. If your business depends on Google sending you visitors, the traffic model just got rewritten without your input — here's what to actually do about it.
On May 12 someone published the source for a credential-stealing worm on GitHub under an MIT license, then offered $1,000 on a breach forum for the biggest supply-chain attack built with it. The campaign has since hit 170+ packages with 518M cumulative weekly downloads. Here's the 30-minute defense for a solo operator.