Thoughts on AI, the tech stack, and the indie hacker journey.
Carta's own data puts solo founders at just over a third of new startups in 2025. The same AI stack that makes building cheap for you made it cheap for the fifty people building your exact idea this week.
CVE-2026-19949 doesn't need a password or a phishing click. It needs a trackback comment and an admin who eventually clicks restore. Two weeks after the fix shipped, roughly two out of three installs still haven't updated.
GLM-5.3-Flash landed under plain MIT on August 26. The full GLM-5.3 followed two days later under a custom license that only restricts operators above $10B in revenue. Neither restriction touches a solo builder.
Harvey crossed $400M in annual recurring revenue and took another $550M at a $15.5B valuation on September 9. The number that matters for a solo builder isn't the valuation, it's how fast a legible niche stops being open.
iPhone Duo ships October 23, and Apple's own guidance says apps built on fixed orientation and hardcoded frames will look broken on it. That's a real backlog item this month, not a someday problem.
Most solo stacks aren't Windows shops, which is exactly why the client RDP box or the SQL Server instance nobody's watching is the one carrying the risk this week.
CVE-2026-87491 landed days after CVE-2026-85046, Chrome's seventh actively-exploited zero-day of 2026. If you ship or run Electron- or CEF-based tools, checking the news per incident stopped being a workable patching strategy this week.
V4.1 Flash launched September 10 and quietly took over DeepSeek's Pro endpoint until the real Pro model ships. The pricing is genuinely lower, but only during a UTC off-peak window most US-based solo builders never bother to check.
The proof might be real. The dispute over whether OpenAI's swarm benefited from a rival researcher's unpublished, private work is the part that should worry anyone who does serious thinking inside someone else's coding agent.