Capability-based sandboxing in Wasm can lock down the external communication leg of @simonwillison.net's AI lethal trifecta. Private data via APIs + user prompt (untrusted content) + no fetch capability. This is what Microsoft is going for with Wassette opensource.microsoft.com/blog/2025/08...

The State of CSS 2025 survey results are now available: 2025.stateofcss.com/en-US/ Big thanks to @amitsheen.bsky.social, @saron.bsky.social, @miocene.io, @sjoy.lol, @joshwcomeau.com, @kilianvalkhof.com, and all the other contributors!

State of CSS 2025

2025.stateofcss.com

Moving to NYC! 🇺🇸 Packing the essentials

Today's the day! We're releasing a new major feature of @tanstack.com Form for all adapters that allows you to change the validation mode based on submission. (For React nerds that's how RHF works OOTB) No breaking changes, trivial to implement; try it out! tanstack.com/form/latest/...

Dynamic Validation | TanStack Form React Docs

In many cases, you want to change the validation rules based depending on the state of the form or other conditions. The most popular example of this is when you want to validate a field differently b...

tanstack.com

Wow - CNN’s front page is the investigation “Inside North Korea’s effort to infiltrate US companies.” 4 months ago covered this same threat in @pragmaticengineer.com with exactly this AI filter. If you’re hiring full remote as a tech company, you NEED to expect NK to try and infiltrate

🔥 The MacOS Stickies app is so underrated. - Little floating windows to take notes throughout the day - Can pin/float on top of whatever you're doing - Can color-coat to organize thoughts ...Probably hasn't been changed since the 90s, but you can't knock stable software

Reviewed github.com/9001/copyparty for the @console.dev newsletter this week. Makes anything a file server with resumable downloads/uploads + web UI. Also a great example of a super comprehensive README!

GitHub - 9001/copyparty: Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps

Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps - 9001/copyparty

github.com

So many JS runtimes. Node.js. Edge runtime. Bun. Deno. workerd. At least one of these has already been deprecated, which is an issue if you've built your entire app around its APIs!

TypeScript 5.9 is now available! 📣 This release brings: ✅ An updated tsc --init ✅ Type-checking for the new 'import defer' ✅ Actual summaries in more DOM APIs ✅ Expandable quick info hovers (✨preview✨) and more! Read up more on our blog: devblogs.microsoft.com/typescript/a...

Announcing TypeScript 5.9 - TypeScript

Today we are excited to announce the release of TypeScript 5.9! If you’re not familiar with TypeScript, it’s a language that builds on JavaScript by adding syntax for types. With types, TypeScript mak...

devblogs.microsoft.com

The S in MCP stands for security

A prize to anyone who can name all my laptop stickers 👀 www.youtube.com/watch?v=Cuem...

Useful security assumptions for 2025: - All your personal data has already been "lost" - A random dependency has been compromised with a malware post-install script - Your washing machine has a zero day and is now part of a botnet

That you need to use react-hook-form to do anything more than the most basic form... The next Next.js <Form> component is a good first step, but it only supports POST requests right now yorickpeterse.com/articles/thr...

Three HTTP versions later, forms are still a mess

The last few weeks I've been working on adding an HTTP 1.1 stack to the standard library of Inko as part of this pull request. The work is still ongoing but the initial set of changes will include an…

yorickpeterse.com

With Tom Lehrer's passing, I suppose this is a moment to share the story of the prank he played on the National Security Agency, and how it went undiscovered for nearly 60 years.

One of the best examples of LLM developer tooling I've heard is from a team that supports software from the 80s-90s. Their only source of documentation is *video interviews* with retired employees. So they feed them into transcription software and get summarized searchable notes out the other end.

Join us at another episode of Tech on the Rocks, this time with @davidmytton.social of Arcjet. We talk about security as code, security in a world of AI and dev tooling. Check the episode here: https://buff.ly/4ggWGeO

A friend got her (Android) phone stolen and the thieves were able to quickly pivot into her Google account and then bank. I’ve been wondering how they did that and my best guess is SMS password resets (aka SMS 1FA). So yeah, SIM PINs (or eSIMs) might help. Also no text body on lock screens.

Arrigo Triulzi@cynicalsecurity.bsky.social · 2y ago

Upgraded one of my phones to iOS 18.1 and was puzzled because I found it several times rebooted and SIM-locked (yes, I have PINs on my SIMs). I thought it was a bug but… turns out there is a new inactivity reboot!¹ Brilliant analysis, "must read"™! __ ¹ naehrdine.blogspot.com/2024/11/reve...

'AI Engineer' means you build things that contain AI - LLM chains, agents, multi-modal stuff. So, what is its opposite? What do we call a 'normal' software engineer?

Creating an email parser requires combining local part parsing with domain parsing to ensure we validate the syntax against the RFCs...but of course just following the RFC doesn't quite work in the real world!

Developer <-> security interaction today is pretty negative. After coding, testing, deploying...they get hit from 2 angles:

Love the minimalism of iCloud Mail on the web especially now it has primary inbox, and dark mode that works properly. Gmail's "dark" theme really is terrible - the web UI is such a mess.

The ultimate Next.js SaaS template: next-forge.com ORM, auth, billing, analytics, website, blog, cron jobs, dark mode, email, testing. Built with @nextjs.org @vercel.com @prisma.io and a great set of amazing tools

Production-grade Turborepo template for Next.js apps

A monorepo template designed to have everything you need to build your new SaaS app as quick as possible. Authentication, billing, analytics, SEO, database ORM and more — it's all here.

next-forge.com

Go is the best

Julia Evans@b0rk.jvns.ca · 2y ago

tried cross compiling in Go for the first time and it’s really amazing how “GOARCH=amd64 GOOS=linux go build” just works immediately

🫠

Sam Rose@samwho.dev · 2y ago

Security advisory from Okta suggesting it was possible to log in to user accounts without the password if the username was longer than 52 characters? 🤯 trust.okta.com/security-adv...

Interesting devtool of the week: rsbuild.dev by @rspack.bsky.social What we like: Designed as an alternative to Vite and Create React App/Webpack. Compiles TypeScript, Sass, Wasm, JSX. Handles image compression, CSS builds e.g. PostCSS, and type checking. Not tied to a UI framework

Rsbuild

The Rspack-based build tool

rsbuild.dev

Great seeing so many developers and founders interested in devtools & infra on Monday at the first console.dev San Francisco devtools meetup!