Weekly Tech Cocktail - Issue #16
Authors of "polished" PRs no longer necessarily understand their code... maybe code was (at least a part of) the hard part?
The Rust project published an LLM policy last week. For twenty years, a polished, well-tested, detailed pull request meant something, and Rust mentored the people who sent them: an author was a (potential) future maintainer. That signal is gone: "Polished PRs no longer indicate effort; authors of polished PRs no longer necessarily understand their code."
Code was never the hard part? Senko Rašić takes it apart: if code was never the hard part, why the salaries, why the burnout, why leetcode interviews, and why is so much software still broken?
In the teams that pushed automation furthest, nobody reads the code before it ships. What disappears is the visible artifact of the job, not the job. We ask for senior judgment while deleting the work that produces seniors.
And now, for something completely different: tomorrow evening the moon passes in front of the sun over Greenland, Iceland and northern Spain. This map will help you plan, if you'd like to see it.
#tech
A meeting recorder left 180,000 meeting transcripts readable without authentication. The writeup walks through the hole and the disclosure. Every note-taking bot you invite to a call gets a full copy of everything said in it, and due diligence on those vendors runs somewhere between light and imaginary.
Postgres was designed when the disk was the bottleneck. pgrust rebuilds the query engine for a world where the CPU is, taking the optimisations apart one by one from a miniature engine.
The Shai-Hulud worm is back on npm, this time through Keyv and friends, packages a very large share of the ecosystem depends on.
#apis
Agent Plugins 1.0 is one package format for an agent's skills and MCP servers: a folder, a JSON manifest, a
skillssubfolder, anmcp.json.The valley of webhooks: the system everybody rebuilds and nobody names. Signature verification, a deduplication table, a reordering buffer, the initial backfill, and the 3am reconciliation cron. Inbound half of a problem we spend our days on from the outbound side, so yes, we may have opinions.
Same URL, same second: 303 KB of HTML for Chrome, 13 KB of markdown with ads baked in. TIME is serving AI bots a different website, reproducible one User-Agent header at a time.
#genai
Do dynamic languages cost two to three times fewer tokens? Dan Luu ran the evals: a full zstd decoder from the RFC, then Pandoc test-first. At medium effort dynamic languages look ahead; at maximum effort static languages take the top spots.
6,080 patches generated for six CVEs by two frontier models: 26% fix the bug cleanly, 49% leave at least one exploitation path open, 2.3% fix it while introducing a new flaw. Dataset and code are open.
Three models, five inference engines, six benchmark suites: about 39% of the behaviour difference you see out of the box comes from the engine, not the model.
#tools
FFmpeg 9.0. Major release for all video pipelining tooling we all use.
Sonic Pi replaced their audio engine, and you can now hot-swap input, output, sample rate or buffer size without losing the music that is playing. Cool right?
Triton passes DirectX 11 from a QEMU guest through to the host, with no dedicated card to hand over.
fun
Dithered QR codes: hide a picture inside a QR code. Without breaking it.
Tuxedo No. 2, a careful, quiet cocktail database. We had to.
I'm Romain, a software craftsman and musician. Every week I dig through the noise and send back the few links worth reading.