New post on supply chain security for npm packages — covering the publishing workflow I push in the projects I maintain, plus the consumer side: why pnpm is a better default than npm, its native minimumReleaseAge config, and trustPolicy: no-downgrade to catch provenance regressions automatically.

Switching over from Ollama to llama.cpp after reading this: sleepingrobots.com/dreams/stop-... Today I'm setting up a Grand Competition (Phoenix evals) between itty bitty models to see who is going to be the Top (local) Model for Mima (with Prompt Engineering, of course)

The @historylink.bsky.social has chronicled the historic March 28, 2026 grand opening of light rail on a Lake Washington floating bridge. www.historylink.org/File/23523

As 2026 midterms approach, here’s an awareness article on how to spot and dissect misleading election fraud rumors.

Thanks @caidan.dev for the solid beta! I really like your concept of leaning into the terminal and the power of piping commands together, while introducing an infinite canvas to visually contain and persist the whole workflow.

There is SO MUCH happening at CascadiaJS 2026 we couldn't fit it into 280 characters, so here's a video 📺 The full talk schedule is up, Rockbox Karaoke is bought out and we can't wait to see you all soon! cascadiajs.com/2026/schedule

finally posted thoughts about the atmosphere conf (along with an illustration and a bunch of tweaks to the blog) macwright.com/2026/04/05/i...

$25 in API charges after one day running OpenClaw on defaults. A few config changes cut that dramatically. www.briangershon.com/blog/opencla...

Building OpenClaw-style agents? Here is how to run skills without API keys in the agent container. Pattern: two containers - agent posts to an internal URL, tool service holds the credential. The key never crosses into agent space. www.briangershon.com/blog/securin...

Claude Code was asked what tools would make it most effective. Top picks: ast-grep for structural code search, difftastic for AST-based diffs, shellcheck for shell script safety. Tools that let AI work on code structure - not just text patterns. batsov.com/articles/202...

Our first SeattleJS meetup of 2026 is coming up next Wednesday! New year, new content format: We're going to be hosting a moderated panel discussion on using AI in developer workflows. Curious about how other people are using LLM-based tools? Bring your questions for our panelists! RSVP:

Want to try vibe coding without production software complexity? HTML tools are the perfect playground for LLM-assisted development. Single files, no deployment, no dependencies. Just experiment and iterate. www.briangershon.com/blog/make-to...

AI coding assistants index your entire codebase, including credentials and customer data. Each AI coding tool handles security differently. Configure exclusions and teach AI tools what's off-limits. www.briangershon.com/blog/securin... #AICoding #DevTools

I wanted portable AI tools you can spin up by describing them, not hand-coding MCP servers. Describe what you want once. A registry turns that into MCP servers and CLIs that any AI coding assistant can use. One definition, every assistant and format you need. www.briangershon.com/blog/build-a...

When AI summarizes customer reviews, it often invents names and numbers that look real but aren’t. We saw this in weekly reports across Google, DoorDash, Yelp. Strong insights, wrong facts. Fix: teach AI to verify its own work, not just summarize data. www.briangershon.com/blog/feedbac...

As teams adopt AI coding tools, they face familiar challenges: maintaining code quality and consistency with team standards. The same principles that help developers write better code can also guide AI tools. Read more at: www.briangershon.com/blog/check-c... #AI #DevTools

Billions of requests across MCP servers deployed on Vercel, including Zapier, Solana, and our own. A key insight: wrapping your API in an MCP server isn't enough. Here's what's working best so far: vercel.com/blog/the-se...

I met Mikeal at the first NodeConf, which he helped organize. He’s the earliest and most vibrant memory I have of the excitement and community he helped form during the early days of Node.js, and as a strong voice in the JavaScript ecosystem. Rest in peace Mikeal.

I jumped full-time on the JavaScript train 2008, as Node.js was just starting up as well. Fun to run through this timeline and remember the birth of npm, Backbone (and spine.js), Atom Shell (Electron), React, Gulp, ... deno.com/blog/history...

A handy tool for discovering and cleaning up code debt in your TypeScript projects: `npx ts-unused-exports tsconfig.json`

How do you gracefully sunset an open source project? 🌇 Get valuable do's & don'ts from three experienced maintainers and set up a smooth transition for your community. 👇

If you are trying to use OpenAI Files API in Node.js and running into duplex and other errors uploading files: You will fall down a lot of rabbit holes on the internet and with LLMs. Instead, `npm add undici` to update Node to the latest version of `fetch`. philna.sh/blog/2025/01...

What are the risks and hidden costs of modern social networks and platforms? medium.com/@sergeyshand... #social-network #digital-rights #dweb #web3 #fediverse

Bluesky / #atproto hack: Filter posts about a rarely used topic (e.g. a small city you live in or any other *very* specific keyword) with Firesky like this: firesky.tv?filter=speci... Then click on the "(rss)" link, put this into your RSS reader. Now you will get updates for this topic there.

Here's the full workshop handout plus annotated slides from "Building software on top of Large Language Models", a three hour tutorial I presented yesterday at PyCon US #PyConUS simonwillison.net/2025/May/15/...

Congrats to @ngerakines.me for a new version of @smokesignal.events. This is a very major rewrite, and also open sourcing of the whole codebase - with more features yet to come! Events connect people - the exact kind of thing that should be available on an open protocol.

this might finally get me to publish sh.tangled.*

A handy site for looking up the latest LLM models. (though I didn't see the OpenAI o3 family in there) modelname.ai

Businesses intentionally allocate budget (includes both human beings and direct spend) on specific projects / initiatives / requirements / oppys / problems / etc.. They 𝘸𝘪𝘭𝘭 spend on whatever they've decided are the top few priorities. (1/5)

This week's Bluesky and ATProto news - ATmosphere Report #114 - First EU atproto conf with @ahoy.eu - Verification on Bluesky with checkmarks - @stream.place gets 500k in funding - A 50k grant from @freeourfeeds.com for developing IndieSky with dev community fediversereport.com/atmosphere-r...

Nice write-up! “While chat is powerful, for most products chatting with the underlying LLM should be more of a debug interface – a fallback mode – and not the primary UX. So, how is AI making our software more useful, if not via chat? Let’s do a tour.”

I'm thrilled about where OctoGuide is going to go. It does the work of several actions used in create-typescript-app for a while. Plus it's got centralized+friendly docs, a robust platform for rules, and a great URL (lol). Please try OctoGuide out and let me know how it feels! 💚 octo.guide 8/8

What MCP Must Get Right to Succeed seanfalconer.medium.com/is-mcp-the-n...

This post from @rudyfraser.com, founder of @blacksky.app, is bursting with ideas for how communities can tailor federated social platforms to their needs and further unleash the prosocial potential embedded within the AT Protocol and Bluesky.

The fourth in the series on "Developing with ADHD", I talk about Discovery Trees and how helpful they are in visually tracking my work. Discovery Trees: Visible Tasks Tracking for ADHD developers: softwareascraft.com/adhd/discove...

I invented a new phone to help save time in the morning

My painting COASTAL POPPIES

If you ask your LLM to write tests for existing code, and it happens to mock EVERYTHING, you will want to be more specific. 😎 Make sure tests: - do actually fail, say if the implementation was missing - are easily understandable to avoid bugs - use no mocks, or use mocks sparingly

Seattle light rail delays thru April 23rd

See you tonight!

I've been using Bash forever and didn't know you could call Shell Functions directly on the command line. In .bashrc a function like this: markdown_newline() { sed 's/\\n/\n/g' } Can be called via `cat myfile | markdown_newline` so I don't need to remember the `sed` command. Easy.

Interesting read re: Go channels. Author suggests you may want to use callbacks instead, or other concurrency primitives.

A nice overview of latest Copilot features in VS Code: www.youtube.com/watch?v=duty...

Released latest version of github.com/briangershon... with a simplified code base to make it easier to integrate, and improved docs. This package retrieves your daily Bluesky feed as simplified JSON to work with programatically.

extremely rad slice of Manhattan for #ptpx from @taylorbaldwin.bsky.social

One of @jakelazaroff.com's first projects at @jamsocket.com, and he totally knocked it out of the park 😍

SeattleJS is in session and it is PACKED! Great to see everyone here in person.

DSA unveils revamped First & Pike public space at iconic intersection: downtownseattle.org/2025/04/dsa-...