https://blog.google/security/chrome-stronger-with-every-update/

https://tailscale.com/blog/hugging-face-intrusion

https://martinfowler.com/bliki/StranglerFigApplication.html

https://github.com/actions/reusable-workflows

https://vale.sh/

You posting yesterday's office hours soon?

https://superlogical.com/

https://www.blacksmith.sh/blog/why-i-joined-blacksmith-to-work-on-storage-again

https://www.anthropic.com/news/position-open-weights-models

https://github.com/vercel-labs/scriptc

🤦🏾
Another very interesting read on using backdoors to publish malway via PyPi:

An attacker took over a maintainer’s GitHub account, used the project’s own CI to steal its publishing token, and then uploaded a poisoned 0.7.4 straight to PyPI. The malicious code was injected into the published artifact only, so anyone reading the GitHub source would have seen nothing wrong.

stepsecurity.io/blog/compromised-pypi-mrmustard-0-7-4-credential-stealer

Hi Everyone glad to be onboard

https://runtimewire.com/article/jack-dorsey-block-buzz-team-chat-ai-agents-git

OpenAI accidentally hacked Huggingface

https://openai.com/index/hugging-face-model-evaluation-security-incident/

https://github.blog/security/application-security/how-github-gave-every-repository-a-durable-owner/

https://www.capitalone.com/tech/open-source/announcing-vulnhunter/

https://martinfowler.com/articles/llm-and-dsls.html

https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/

https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

https://www.thoughtworks.com/insights/blog/open-source/zero-cost-fallacy-open-source-agentic-era

https://blog.cloudflare.com/introducing-precursor/

https://alexalejandre.com/programming/interview-with-mitchell-hashimoto/

This is nice. One a week is kinda low though…maybe 2 would be nice. 😄

Each sandbox provides 8 hours of access from activation, with automatic cleanup afterward. Builders can request one sandbox per week (resetting every Sunday)

aws.amazon.com/about-aws/…/aws-builder-center-sandbox

Regarding the discussion around the new parallel steps feature in your last office hours video, it was Depot (not blacksmith) that introduced their own parallel support a few weeks before github, but you had to switch to their Depot CI offering. So it's good that it's now available by default in GHA. And for RunsOn, it was the max-parallel attribute that was not supported with the default Flex product, but Fleet now supports it.

https://www.cloudflare.com/drop

@elvis lim I missed your links!
2026-07-08 14:22:57 From Elvis Lim to Everyone:
Nvidia giving free access to models at build.nvidia.com. Go get it while it’s free!

2026-07-08 14:27:25 From Elvis Lim to Everyone:
nix.dev too portable environments

let's discuss next week

WOW! AWS route53 now supports ACME
aws.amazon.com/about-aws/…/aws-certificate-manager-acme

Security hub monitoring Azure? That caught me offguard! aws.amazon.com/about-aws/…/aws-security-hub-supports-monitoring-microsoft-azure

I think we covered this in the past, but I'm giving jj another shot now. I think it's practical compared to when it first started: https://github.com/jj-vcs/jj

https://techcrunch.com/2026/07/05/amazon-will-stop-accepting-new-customers-for-mechanical-turk/

https://epoch.ai/data-insights/cve-severity-spike

BSL terraform support mermaid output!

github.com/hashicorp/terraform/pull/38719

cc @Michael

https://webkit.org/blog/18136/introducing-the-safari-mcp-server-for-web-developers/

https://cloudboss.co/docs/unobin/v0.10.1/