Thoughts on AI, the tech stack, and the indie hacker journey.
GitHub published GHSA-6w67-hwm5-92mq on April 21. By 03:35 UTC on April 22, a Sysdig honeypot caught the first exploitation attempt. No public PoC was ever needed. The threat model for self-hosted LLM servers just changed, and the math for solo operators changed with it.
Lovable is reportedly the fastest-growing European startup in history. v0, Bolt, and Lovable are now the dominant trio in the "describe an app and get a working full-stack project" category. After spending a week building three actual products with each one, I have a fairly opinionated answer that doesn't match either the breathless threads or the dismissive replies.
~20K senior tech workers are about to hit the market in a 60-day window with severance, no urgency, and AI tooling muscle memory. The mainstream read is "AI is taking jobs." The Solo Operator read is much more specific and almost nobody is writing it.
On April 27, Microsoft and OpenAI announced a renegotiated deal that ended Microsoft's exclusive license. The headline read like a corporate footnote. The substance is bigger: this is the first week the cloud-provider question is genuinely separable from the model question. Here's how the math actually changes for sub-$10K MRR products.
Quietly, on April 14, Netlify changed what a credit buys. Bandwidth went from 10 to 20 credits per GB. Compute went from 5 to 10 credits per GB-hour. Same dollar price — half the bandwidth, half the compute. If you migrated off Vercel for cost, your renewal is a different conversation now.
Next.js 16.2 shipped with Turbopack as the default bundler in dev mode and a claimed 400% faster cold dev start. The numbers are real. And yet I'm not moving this blog off Astro 5 + Keystatic, and I wouldn't recommend any solo operator rebuild in Next right now either.
The Rode RodeCaster Duo ships with SSH enabled by default, two pre-installed login keys hardcoded in firmware, and an OTA update mechanism with no signature verification. It's running Linux. It's on your network. The actual story isn't this specific bug — it's that your home office threat model hasn't caught up to 2026.
Stripe's Merchant of Record product, acquired through Lemon Squeezy in 2024, is now public. Polar has been quietly eating Lemon Squeezy's lunch for 12 months. The "should I switch payment processors" question is genuinely live for the first time since 2024. Here's the honest decision tree.
Six meaningful AI launches in three days, each with a "this changes everything" pitch. A solo operator who chases all of them ships nothing. One who ignores all of them falls behind. Here's the dumb little triage rubric that's saved me roughly one wasted weekend per month.