Weekly Tech Cocktail - Issue #12
July 18, 2026. The links we kept after throwing most away. By "by hand" we still mean a part of an actual human.
Was hard to keep up these past weeks, so here is the pile. OpenAI shipped GPT-5.6 on July 9. Nine days later Kimi K3 took the top of the Frontend Code Arena, a 2.8T-parameter open-weights model whose own authors write that it still trails the best proprietary ones overall. The benchmark is not the story. The price is: GLM 5.2 and the coming AI margin collapse works through what happens to the labs' unit economics when equivalent models sell at a fraction of the rate.
A thread that opened three months ago closed this week. Someone found that Claude Code was marking its requests steganographically. Then xAI's Grok CLI was caught uploading an entire home directory to a Google Cloud bucket, SSH keys and password manager database included. Musk promised a purge, and on July 16 xAI published the code. The same week, Simon Willison walked secrets out of Claude through web_fetch. The tools with the deepest read access to your machine are the ones you can inspect the least, and that gap only closes when somebody forces it open.
Zig Creator Calls Spade a Spade sets Andrew Kelley's refusal to oversell against the "code is disappearing" narrative, and asks who that narrative is for. Half-Baked Product makes the same case as a parable about an oven sold to someone who never learned to bake. Further down, someone decoded the obfuscated bash script printed on a Uniqlo t-shirt. It runs.
#tech
Rewriting Bun in Rust and How Our Rust-to-Zig Rewrite Is Going - the JS runtime leaves Zig the same month Roc's compiler, 300,000 lines, goes the other way and reaches feature parity. Two serious teams, opposite conclusions, both argued. Read them back to back.
Andrew Kelley's response to the Bun rewrite - and the Zig side of that same argument, from the creator of the language.
Since Chromium 148, Math.tanh is fingerprintable - one floating point edge case is enough to name your OS.
LUKS suspend stopped wiping disk-encryption keys - a security regression that shipped in Linux 6.9 and went unnoticed.
Quadrupling code performance with a "useless" if - branch prediction, aliasing and autovectorisation, taken apart with benchmarks.
#apis
RFC 10008: The HTTP QUERY Method - a real HTTP method for search, safe and idempotent, with a request body. No more choosing between a GET with a body that nothing guarantees and a POST that lies about what it does.
Media Over QUIC can scale real-time streaming - Bruce Davie on the middle ground between WebRTC and DASH, with the IETF drafts.
Networking and the Internet, from First Principles - what actually happens when a message crosses a continent, built up from nothing.
The Safari MCP server for web developers - the web platform meeting agents, straight from WebKit.
#genai
"Linux is not one of those anti-AI projects" - Torvalds settles kernel LLM policy on the mailing list: it is a tool, and anyone who disagrees can fork or walk away.
Godot will no longer accept AI-written code - the opposite call, made by another large open source project. Read side by side, they are the story.
Control the Ideas, Not the Code - antirez on where the leverage actually sits when you work with agents.
DSLs Enable Reliable Use of LLMs - constrain the model to a small language and its output becomes checkable.
AI Writes Faster Than Humans Can Review - 802 developers, 196,000 pull requests, a mandated 2x in throughput, and a review process that did not follow.
#tools
Announcing TypeScript 7.0 - the native Go port lands for real, roughly 10x.
LLM cliche highlighter - highlights ten writing tics that give away a language model. Willison had Fable 5 build it after one article too many, so the slop detector was written by the slop machine.
Chatto is now open source - self-hostable team chat, one binary that serves its own frontend, data encrypted at rest, AGPL-3.0.
Using uvx in GitHub Actions in a cache-friendly way - short and immediately applicable CI tip.
Podman v6.0.0 - rootless containers, still no daemon.
fun
Decoding the obfuscated bash script on a Uniqlo t-shirt - a real, self-evaluating, obfuscated Akamai script, sold as clothing, taken apart line by line.
Regressive JPEGs - later scans in a progressive JPEG can overwrite what was already drawn, so a single file can show a different image while it loads, and animate if you push it. The format taken apart byte by byte.
I'm Romain, a software craftsman and musician. Every week I dig through the noise and send back the few links worth reading.