Topic
Articles on the tools and platforms that change the economics of building software: AI tooling and its real costs, infrastructure choices for small teams, and what new technology actually means for a builder's bottom line.
Shared conversations and Artifacts turned up in search results this week. On a domain you do not own you cannot set a noindex tag, which leaves exactly two levers. Here are the operators to run and the revoke path for each surface.
Hugging Face says the intrusion started in a dataset loader and that public models are clean. The useful response is not panic: it is pinning every download to a full commit hash, scoping tokens per app, and refusing pickled weights.
The 2026-07-28 revision removes initialize, the Mcp-Session-Id header and stream resumability, and makes server/discover mandatory. What replaced each of them, and the order to work through your own server.
SB 2420 became enforceable on 4 June 2026 and both stores now hand developers an age category. The statute puts the duty on the developer: assign ratings, read the signal, and decide what counts as a significant change.
A DMARC record set to p=none tells receiving servers to do nothing at all. RFC 9989 also deleted the pct tag that most rollout guides still teach. Four stages, an exit criterion for each, and the exact record to publish.
The codex-security CLI is open source and gated to approved customers. Here is what a one-to-five person team can install this afternoon instead, with the free-tier limits and per-contributor costs that decide it.
Text a human never sees is text a model still obeys. If your product summarises uploaded files, tickets or web pages, the exposure is not the hidden instruction, it is what the model is allowed to do after reading it.
A researcher typed a base path into a browser and got a directory listing of unguarded internal endpoints. The class of bug is OWASP API5, the most boring one there is, and the audit for it fits in an evening.
A federal judge dismissed both of Google's DMCA claims against SerpApi on 20 July 2026. The reason was not that scraping is legal: it was a clause in section 1201 that almost no site owner has read.
Kimi K3's open release landed on Hugging Face today. Published GPU rental and API prices put the crossover at roughly 4.2 billion tokens a month against Kimi's own API and 46 billion against DeepSeek V4 Pro. Here is the arithmetic, with the duty-cycle and caching adjustments most comparisons skip.
A report this week described the relay market that proxies frontier model access at a fraction of list price. The arithmetic says where the money comes from, and Anthropic's terms say who pays when a key leaks.
Balsamiq launched in June 2008 and its founder reported profitability within three weeks. Eighteen years later it is still bootstrapped, and its 2024 revenue was $6.58 million, down 6%.
One switch became three, free on every plan, with new-domain defaults changing on 15 September. The Googlebot trade-off that makes one of the three expensive, a setting matrix by site type, and the exact dashboard path.
In August 2022, David Holz said Midjourney had about ten people, no investors, and was already profitable. Its product had no website to speak of. Users typed prompts into a public Discord channel.
In March 2014 a Dutch developer promised to launch one product a month for a year. A decade later he publishes six-figure monthly revenue from products he still builds alone.
In July 2025 the Swedish company Lovable announced $100 million in annual recurring revenue, roughly eight months after launch. The growth looks like an accident. The channels it came through were chosen deliberately.
Before Zapier launched publicly, three founders in Missouri had already taken money from 800 people. The channel was free, public, and sitting in other companies' support forums.
OpenAI's worldwide outage this morning lasted about 50 minutes. The published uptime numbers say this is routine, the SLAs pay in credits, and a working fallback path is an afternoon of work rather than an architecture project.
From September 30, apps must be registered by a verified developer to install in four countries, with global rollout in 2027. The dates, the $25 versus free account decision, and what verification leaves alone.
DORA found AI adoption raises throughput and instability together. The fix is not another tool: it is a size ceiling, a written approval rule, and repository settings that enforce both.
UK and US safety institutes watched an open-weight model finish a 32-step attack against weakly defended systems. A one-hour lockdown for small teams that run their own servers.
A rejection is not a verdict, it is the start of a documented process most developers never read. Fix and resubmit, reply, appeal, expedite: what each lever is for, the exact screens, and the timeline math for your launch.
A developer asked Codex for a homepage redesign and got his entire git history uploaded to OpenAI infrastructure. The training and retention switches in Copilot, Claude Code, Cursor and the OpenAI API, with exact paths.
Anthropic's Opus 5 tops the independent leaderboard at half the price of the top tier. Worked token math and a repeatable procedure for re-picking every model you pay for.