Can we all please agree that "vibe coding" is a terrible term and we should just use a different one?

An allegory for our time. https://www.theatlantic.com/science/2026/05/yachats-beached-whale-rescue/686978/

Last August I was hacked by an extension installed in my VS Code. The hack then attempted to use claude code on my system. I debated publishing this, but its clear this issue is going to get worse before it gets better. This is what happened to me. https://briankohan.com/articles/i-was-hacked/

Required reading if you maintain any package on pypi: https://bernat.tech/posts/securing-python-supply-chain

A thing I keep wondering. Does the world need more software? Or does it need better software?

I've been using Zed the past week. It's still got its bumps but I have to say I really like it https://zed.dev

I have a lot of cranky old-man gripes about AI but I think one of my crankiest is the loss of personality in code. Cracking open a new code base is always a delight. Experienced engineers have different styles that I always learn things from. In the future I see nothing but a sea of averaged […]

Any discussion of what AI is doing to engineering needs about 10 pages of nuanced thought but here goes: I've been testing state of the art tooling with collaborative design review to start a few new greenfield apps. I think I will use this method going forward. BUT I have to say - I'm […]

There are lot of django site repo templates floating around. Here's my template for a django *app* - very different than how I'd lay out a full project: https://github.com/bckohan/django-app-template #django

The new IOS look feels like the inside of a bounce house with a bubble machine going full throttle

I think the agentic AI evangelists dramatically misunderstand how big of a barrier trust is going to be. They're so focused on capabilities that they don't seem to understand that the real value of most of the work they want to (and probably can!) automate is derived from how much it is trusted.

Anybody using passkey auth in Django sites? Any recommendations?

Getting a lot of 500s from github today...

Python 3.14 is fire. Time to startup and run one pytest test on a heavy django project with coverage enabled: 3.12: 27 seconds. 3.14: 11 seconds.

I was wondering why vscode started adding a period every time I hit double space. This was driving me absolutely nuts. This is a system level setting. Why OSX would enable this by default is beyond me...

It's always fun when you make mypy segfault

Nothing makes me feel more inadequate than reading the bio of an astronaut 😂

The events in Minneapolis are so deeply unconstitutional I don't even know where to start. A citizen was murdered for practicing his 1st and 2nd amendment rights thus violating his 4th, 8th and 9th amendment rights. Then the 10th amendment was violated by obstruction of the investigative […]

ICE is quickly becoming an American version of the brown shirts

One of the great things about OSS is that you get to work with people all over the world. Today I'm especially thinking about all those contributors from Iran I've seen over the years. I wish you peace and freedom.

hot take: Sphinx is better than markdown because it does more stuff and AI smooths out its obtuseness.

The older I get the more strong my negative reaction to software being described as "modern".

django-rest-polymorphic has now been included in django-polymorphic under contrib.drf. All you need to do to drop your dependency on django-rest-polymorphic is to update your import paths from rest_polymorphic.serializers to polymorphic.contrib.drf.serializers […]

[uspol] It's deeply unsettling to me that many Americans can watch the videos out of Minnesota and see anything other than an agent of the state murdering a citizen in cold blood.

Gen AI fought me every step of the way on fixing a library architectural issue I would describe as only moderately difficult. It is wrong, I am right. Take that modernity!

For users of django-polymorphic - I have just published a roadmap summarizing my intentions for moving forward. Thank you for your patience! https://github.com/jazzband/django-polymorphic/discussions/733 #django

What are the best self paced online python courses for beginners out there? Free is a major bonus.

My thoughts on Prop 50 that my fellow Californians should be voting on now. In short, its time limited and only in response to a power grab by other states so we've been forced into a YES vote. This endorsement is more thorough (and less edited) than most of my endorsements are but I feel that […]

Congrats @CodenameTim Well deserved!! https://www.djangoproject.com/weblog/2025/oct/10/malcolm-prize-awarded-to-tim-schilling

This got me https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware

RIP great American Jim Lovell. What a life! https://www.washingtonpost.com/obituaries/2025/08/08/james-lovell-dead-apollo-13/

New release of https://github.com/bckohan/django-routines This package is not well circulated but I reach for it on every django project. It's really nice to ship common management routines, like deployment directly in my wheels.

JPL management is operating under the assumption of a 46% budget cut next year. I've spent my entire career at national labs and in academia. I will miss it dearly.

Today on Volts: the California Environmental Quality Act (CEQA) has become a tool to delay & block new housing. I talk with two legislators -- @buffywicks.bsky.social & @scottwiener.bsky.social -- about their attempts to reform the landmark law & uncork housing abundance in CA.

Happy Father's Day! https://briankohan.com/articles/good-dads/

"My daughter will have to live in this country after I am gone. I want her to have what I had. A life where I was free to pursue the truth without fear of persecution or professional consequence. And if she does not have that, I want her to know that I fought for it." […]

Active duty US Marines have been deployed several miles from my house to quell a non-existent insurrection in hopes to generate politically useful footage of unrest so this unlawful administration can justify more authoritarianism.

Every now and then I still encounter a makefile and I thank god for modernity.

I’ve encountered this in my minuscule/obscure projects. I can’t imagine how bad it is for curl! https://arstechnica.com/gadgets/2025/05/open-source-project-curl-is-sick-of-users-submitting-ai-slop-vulnerabilities/

You can’t run organizations on vague notions of solidarity. Something like this will inevitably happen. https://www.latimes.com/california/story/2025-05-03/a-fight-over-a-progressive-l-a-news-site-leads-to-dueling-lawsuits

hmmm, dependabot is not smart enough to know it can't upgrade to dependency that don't support the project's lower bound Python? 🤔

so... having a github repo tab open in chrome consumes ~200MB of memory. What has become of us?

First release of django-enum through django-commons, everything went smooth! https://github.com/django-commons/django-enum

You can build a pretty good mental model of Trump by removing any understanding or appreciation of trust as a concept. Unfortunately trust is what the modern world runs on. Hold onto your butts.

On the bright side, if we survive it - this experience will scuttle protectionism for a generation.

3.1.0 of django-typer is out. Some highlights: * Django 5.2 trove classifier :P * shellcompletion install will now politely ask before touching any of your dotfiles * A few additional completers * Numerous bug fixes to shellcompletion, especially on fish/powershell […]

I have profound sympathies for anyone who has ever had to maintain tests that verify interactive i/o for multiple terminal systems across different platforms.

The upside of having robust tests is that you find lots of bugs. The downside is that you have to fix lots of bugs.

Are there any domain registrars that aren't complete ass? Does anyone like their registrar?