The journal
Working notes from the workshop.
Posts on AI, software craft, and the things we learn while shipping. Twice a month, sometimes weekly.
Hiring developers? Start with the how-to-hire hub →
Browse by topic
- AI Integration 218
- Web Development 216
- Business 118
- Cybersecurity 88
- Cloud & Infrastructure 77
- Technology 44
- Career 21
- Industry News 19
- Design 7
- AI & ML 7
- Science 7
- Developer Tools 3
Or read straight through: page 2 · page 3 · page 4 · page 5 · page 6 · page 7 · page 8 · page 9 · last
Categories
Tags
Showing 12 of 825 articles
Cybersecurity·CVE-2026-19478: GitLab's Critical GraphQL Flaw Lets Anyone Delete Your Public Projects
An unauthenticated attacker can inject code through a GitLab GraphQL directive and delete or modify public projects and user data. CVSS 9.4, patched in 19.2.4. Here's what's affected and how to check your instance.
CybersecurityCVEGitLabDevOps
Web Development·How to Prevent SQL Injection: Parameterized Queries, ORMs, and the Gaps They Miss
SQL injection is still landing CVSS 10.0 vulnerabilities in production software in 2026, including the Metabase bug that led to real breaches this month. Here's how parameterized queries actually stop it, where ORMs quietly reintroduce the bug, and how to verify your app is actually safe.
Web DevelopmentSecurityBackendDatabase
AI Integration·GPT-5.6 vs Gemini 3.7 Flash vs Grok 4.6: API Pricing Compared (August 2026)
A side-by-side look at what OpenAI, Google, and xAI actually charge per million tokens right now, including the tiers within each model family, so you can price out a real workload before you pick a provider.
AI IntegrationLLMCost OptimizationAPI
Cybersecurity·Framework and Trezor's Shipping Partner Both Got Breached Through Metabase
Two unrelated companies disclosed breaches in the same week, both tracing back to a vulnerability in Metabase, the business intelligence tool their vendors used. Here's what happened, how it lines up with the CVE we covered days earlier, and what to actually check.
CybersecurityData BreachThird-Party RiskBusiness Intelligence
Business·Oracle Is Borrowing Tens of Billions for AI Data Centers. What That Means If You Build on OCI.
Oracle cut roughly 21,000 jobs in fiscal 2026 while capital spending on AI data centers nearly tripled, and reporting points to another round of cuts this month to help cover the bill. Here's the actual math and what it should change about vendor risk if you run on Oracle Cloud.
BusinessCloud & InfrastructureIndustry NewsAI
Cloud & Infrastructure·Leader Election Explained: How a Cluster Picks Who's in Charge
Run three copies of a service for availability and you've created a new problem: only one of them should do certain jobs at a time. Here's how leader election actually works, from Raft's term-based voting to the etcd lease pattern most teams use in practice.
ArchitectureBackendCloud & InfrastructureKubernetes
AI Integration·Stripe Bought OpenRouter for $7B. Here's What It Means If You Route LLM Calls
Stripe is acquiring the AI model gateway OpenRouter for more than $7 billion, roughly 50x its annualized revenue. Nothing changes in the API today, but the bet behind the price tells you where model routing and billing are headed.
AI IntegrationBusinessAIInfrastructure
Cloud & Infrastructure·Structured Logging Done Right: JSON, Correlation IDs, and What to Skip
A log line that's just a sentence is fine until you have to search a million of them at 2am. Here's how structured logging actually works, how to thread a correlation ID through a request, and which fields are worth the storage cost.
BackendDeveloper ToolsProductionCloud & Infrastructure
Cybersecurity·CVE-2026-59309 and 59310: VMware vCenter Bugs Attackers Hit in Five Days
Two critical, unauthenticated vCenter flaws let attackers bypass login entirely and run code on the management plane. Exploitation started five days after the patch shipped. Here's what's affected and how to check for compromise.
CybersecurityCVEVMwareSecurity
Cybersecurity·The Ceva Logistics Breach Shows Why Your Vendor's Vendor Is Your Problem
A hack at shipping giant Ceva Logistics that started July 29 has exposed customer data for Bol, ING, Ajax, Ace & Tate, and Valve's Steam hardware buyers, none of whom were breached directly. Here's what happened and what it means for how you assess vendor risk.
CybersecuritySecurityData BreachInfrastructure
Industry News·Cognition's $40B Devin Round: What It Actually Signals for Buyers
Cognition is reportedly in talks to raise at a $40 billion valuation, up from $26 billion three months ago, on revenue nowhere near that multiple. Here's what the round says about where AI coding agent money is going, and what it means if you're evaluating one.
AIAI IntegrationDeveloper ToolsIndustry News
Cybersecurity·CVE-2026-62878: The Wormable Windows DNS Server Bug You Need to Patch Now
A stack-based buffer overflow in Windows DNS Server lets an unauthenticated attacker run code with a single crafted packet, no user interaction required. It hasn't been seen exploited yet, but it has the exact shape of a bug that gets weaponized fast. Here's what to patch and in what order.
CybersecurityCVEWindowsSecurity