#office-hours - July 2026

https://cloudboss.co/docs/unobin/v0.10.1/

https://webkit.org/blog/18136/introducing-the-safari-mcp-server-for-web-developers/

BSL terraform support mermaid output!

github.com/hashicorp/terraform/pull/38719

cc @Michael

https://epoch.ai/data-insights/cve-severity-spike

https://techcrunch.com/2026/07/05/amazon-will-stop-accepting-new-customers-for-mechanical-turk/

I think we covered this in the past, but I'm giving jj another shot now. I think it's practical compared to when it first started: https://github.com/jj-vcs/jj

Security hub monitoring Azure? That caught me offguard! aws.amazon.com/about-aws/…/aws-security-hub-supports-monitoring-microsoft-azure

WOW! AWS route53 now supports ACME
aws.amazon.com/about-aws/…/aws-certificate-manager-acme

@elvis lim I missed your links!
2026-07-08 14:22:57 From Elvis Lim to Everyone:
Nvidia giving free access to models at build.nvidia.com. Go get it while it’s free!

2026-07-08 14:27:25 From Elvis Lim to Everyone:
nix.dev too portable environments

let's discuss next week

https://www.cloudflare.com/drop

Regarding the discussion around the new parallel steps feature in your last office hours video, it was Depot (not blacksmith) that introduced their own parallel support a few weeks before github, but you had to switch to their Depot CI offering. So it's good that it's now available by default in GHA. And for RunsOn, it was the max-parallel attribute that was not supported with the default Flex product, but Fleet now supports it.

This is nice. One a week is kinda low though…maybe 2 would be nice. 😄

Each sandbox provides 8 hours of access from activation, with automatic cleanup afterward. Builders can request one sandbox per week (resetting every Sunday)

aws.amazon.com/about-aws/…/aws-builder-center-sandbox

https://alexalejandre.com/programming/interview-with-mitchell-hashimoto/

https://blog.cloudflare.com/introducing-precursor/

https://www.thoughtworks.com/insights/blog/open-source/zero-cost-fallacy-open-source-agentic-era

https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/

https://martinfowler.com/articles/llm-and-dsls.html

https://www.capitalone.com/tech/open-source/announcing-vulnhunter/

https://github.blog/security/application-security/how-github-gave-every-repository-a-durable-owner/

OpenAI accidentally hacked Huggingface

https://openai.com/index/hugging-face-model-evaluation-security-incident/

https://runtimewire.com/article/jack-dorsey-block-buzz-team-chat-ai-agents-git

Hi Everyone glad to be onboard

🤦🏾
Another very interesting read on using backdoors to publish malway via PyPi:

An attacker took over a maintainer’s GitHub account, used the project’s own CI to steal its publishing token, and then uploaded a poisoned 0.7.4 straight to PyPI. The malicious code was injected into the published artifact only, so anyone reading the GitHub source would have seen nothing wrong.

stepsecurity.io/blog/compromised-pypi-mrmustard-0-7-4-credential-stealer

https://github.com/vercel-labs/scriptc

https://www.anthropic.com/news/position-open-weights-models

https://www.blacksmith.sh/blog/why-i-joined-blacksmith-to-work-on-storage-again

https://superlogical.com/

You posting yesterday's office hours soon?

https://vale.sh/

https://github.com/actions/reusable-workflows

https://martinfowler.com/bliki/StranglerFigApplication.html

https://tailscale.com/blog/hugging-face-intrusion

https://blog.google/security/chrome-stronger-with-every-update/