Links

github.com

Boo: a terminal multiplexer built on libghostty, for people who think tmux and screen peaked too early. Young project.

github.com

Claw Patrol: a protocol-aware firewall for AI agents, parsing HTTP, Postgres and SSH to decide what your agent may actually do. See the intro for why you might want one.

blog.calif.io

Codex discovered a hidden HTTP/2 bomb: a flooding vulnerability found with an LLM in the loop. Vendor blog, but the bug is real and well documented.

daniel.haxx.se

Curl will not accept vulnerability reports during July 2026: Daniel Stenberg pauses the bug bounty, drowned in AI-generated slop reports.

github.com

Palate cleanser: πFS reminds you that your data is already in pi. You just have to find the offset.

brew.sh

Homebrew 6.0.0: a major release for the package manager half of us owe our laptops to, with a new trust mechanism for taps and Linux sandboxing.

mohkohn.co.uk

Building an HTML-first site doubled our users overnight. Twenty years of JavaScript later, the radical move is serving HTML.

simonwillison.net

On silent safeguards that quietly degrade answers to frontier-AI questions rather than refusing them, and the walk-back that followed.

github.com

Kage: shadow any website into a single binary for offline viewing. Open source, and it topped the charts for a reason.

world.hey.com

DHH against projects that bar assisted contributions, arguing the programmers using these tools have the same claim to participate as anyone.

gabrielweinberg.com

Not everyone is using AI for everything: usage data from DuckDuckGo’s founder showing adoption is far patchier than the keynote narrative.

blog.pyodide.org

Pyodide 314.0: Python packages can now publish WebAssembly wheels to PyPI. A concrete step for the Python-in-the-browser story.

axios.com

Reports Anthropic moving quickly to repair relations with the administration.

anthropic.com

Access suspended under an export control directive citing national security concerns about a jailbreak method.

blog.modelcontextprotocol.io

The MCP 2026-07-28 Specification Release Candidate: stateless core, formal extensions, hardened OAuth. The de-facto agent protocol grows up; final version expected July 28.

tomtunguz.com

The Thriving Ecosystem of Open Models: OpenRouter data suggests open models now outrun closed ones in actual usage.

blainsmith.com

Tracing HTTP requests with Go’s net/http/httptrace: instrument DNS, TCP, TLS and TTFB with nothing but the standard library.

newsletter.kentbeck.com

Trust Factory: Kent Beck on the new bottleneck. We’re accumulating code faster than we are accumulating trust.

typst.app

Typst 0.15.0: the typesetting system that wants to replace LaTeX ships another release. Open source.

tbray.org

XML and JSON in 2026: a state of both formats by Tim Bray, who co-created one of them and is unsentimental about it.