June 2026

tbray.org

XML and JSON in 2026: a state of both formats by Tim Bray, who co-created one of them and is unsentimental about it.

typst.app

Typst 0.15.0: the typesetting system that wants to replace LaTeX ships another release. Open source.

newsletter.kentbeck.com

Trust Factory: Kent Beck on the new bottleneck. We’re accumulating code faster than we are accumulating trust.

blainsmith.com

Tracing HTTP requests with Go’s net/http/httptrace: instrument DNS, TCP, TLS and TTFB with nothing but the standard library.

tomtunguz.com

The Thriving Ecosystem of Open Models: OpenRouter data suggests open models now outrun closed ones in actual usage.

blog.modelcontextprotocol.io

The MCP 2026-07-28 Specification Release Candidate: stateless core, formal extensions, hardened OAuth. The de-facto agent protocol grows up; final version expected July 28.

anthropic.com

Access suspended under an export control directive citing national security concerns about a jailbreak method.

axios.com

Reports Anthropic moving quickly to repair relations with the administration.

blog.pyodide.org

Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI. A concrete step for the Python-in-the-browser story.

gabrielweinberg.com

Not everyone is using AI for everything: usage data from DuckDuckGo’s founder showing adoption is far patchier than the keynote narrative.

world.hey.com

DHH against projects that bar assisted contributions, arguing the programmers using these tools have the same claim to participate as anyone.

github.com

Kage: shadow any website into a single binary for offline viewing. Open source, and it topped the charts for a reason.

simonwillison.net

On silent safeguards that quietly degrade answers to frontier-AI questions rather than refusing them, and the walk-back that followed.

mohkohn.co.uk

Building an HTML-first site doubled our users overnight. Twenty years of JavaScript later, the radical move is serving HTML.

brew.sh

Homebrew 6.0.0: a major release for the package manager half of us owe our laptops to, with a new trust mechanism for taps and Linux sandboxing.

github.com

Palate cleanser: πFS reminds you that your data is already in pi. You just have to find the offset.

daniel.haxx.se

Curl will not accept vulnerability reports during July 2026: Daniel Stenberg pauses the bug bounty, drowned in AI-generated slop reports.

blog.calif.io

Codex discovered a hidden HTTP/2 bomb: a flooding vulnerability found with an LLM in the loop. Vendor blog, but the bug is real and well documented.

github.com

Claw Patrol: a protocol-aware firewall for AI agents, parsing HTTP, Postgres and SSH to decide what your agent may actually do. See the intro for why you might want one.

github.com

Boo: a terminal multiplexer built on libghostty, for people who think tmux and screen peaked too early. Young project.