Capability-based sandboxing in Wasm can lock down the external communication leg of @simonwillison.net's AI lethal trifecta. Private data via APIs + user prompt (untrusted content) + no fetch capability. This is what Microsoft is going for with Wassette opensource.microsoft.com/blog/2025/08...

The State of CSS 2025 survey results are now available: 2025.stateofcss.com/en-US/ Big thanks to @amitsheen.bsky.social, @saron.bsky.social, @miocene.io, @sjoy.lol, @joshwcomeau.com, @kilianvalkhof.com, and all the other contributors!

Moving to NYC! 🇺🇸 Packing the essentials

Today's the day! We're releasing a new major feature of @tanstack.com Form for all adapters that allows you to change the validation mode based on submission. (For React nerds that's how RHF works OOTB) No breaking changes, trivial to implement; try it out! tanstack.com/form/latest/...

Wow - CNN’s front page is the investigation “Inside North Korea’s effort to infiltrate US companies.” 4 months ago covered this same threat in @pragmaticengineer.com with exactly this AI filter. If you’re hiring full remote as a tech company, you NEED to expect NK to try and infiltrate

🔥 The MacOS Stickies app is so underrated. - Little floating windows to take notes throughout the day - Can pin/float on top of whatever you're doing - Can color-coat to organize thoughts ...Probably hasn't been changed since the 90s, but you can't knock stable software

Reviewed github.com/9001/copyparty for the @console.dev newsletter this week. Makes anything a file server with resumable downloads/uploads + web UI. Also a great example of a super comprehensive README!

So many JS runtimes. Node.js. Edge runtime. Bun. Deno. workerd. At least one of these has already been deprecated, which is an issue if you've built your entire app around its APIs!

TypeScript 5.9 is now available! 📣 This release brings: ✅ An updated tsc --init ✅ Type-checking for the new 'import defer' ✅ Actual summaries in more DOM APIs ✅ Expandable quick info hovers (✨preview✨) and more! Read up more on our blog: devblogs.microsoft.com/typescript/a...

The S in MCP stands for security

A prize to anyone who can name all my laptop stickers 👀 www.youtube.com/watch?v=Cuem...

Useful security assumptions for 2025: - All your personal data has already been "lost" - A random dependency has been compromised with a malware post-install script - Your washing machine has a zero day and is now part of a botnet

That you need to use react-hook-form to do anything more than the most basic form... The next Next.js <Form> component is a good first step, but it only supports POST requests right now yorickpeterse.com/articles/thr...

With Tom Lehrer's passing, I suppose this is a moment to share the story of the prank he played on the National Security Agency, and how it went undiscovered for nearly 60 years.

One of the best examples of LLM developer tooling I've heard is from a team that supports software from the 80s-90s. Their only source of documentation is *video interviews* with retired employees. So they feed them into transcription software and get summarized searchable notes out the other end.

Join us at another episode of Tech on the Rocks, this time with @davidmytton.social of Arcjet. We talk about security as code, security in a world of AI and dev tooling. Check the episode here: https://buff.ly/4ggWGeO

A friend got her (Android) phone stolen and the thieves were able to quickly pivot into her Google account and then bank. I’ve been wondering how they did that and my best guess is SMS password resets (aka SMS 1FA). So yeah, SIM PINs (or eSIMs) might help. Also no text body on lock screens.

'AI Engineer' means you build things that contain AI - LLM chains, agents, multi-modal stuff. So, what is its opposite? What do we call a 'normal' software engineer?

Creating an email parser requires combining local part parsing with domain parsing to ensure we validate the syntax against the RFCs...but of course just following the RFC doesn't quite work in the real world!

Developer <-> security interaction today is pretty negative. After coding, testing, deploying...they get hit from 2 angles:

Love the minimalism of iCloud Mail on the web especially now it has primary inbox, and dark mode that works properly. Gmail's "dark" theme really is terrible - the web UI is such a mess.

The ultimate Next.js SaaS template: next-forge.com ORM, auth, billing, analytics, website, blog, cron jobs, dark mode, email, testing. Built with @nextjs.org @vercel.com @prisma.io and a great set of amazing tools

Go is the best

🫠

Interesting devtool of the week: rsbuild.dev by @rspack.bsky.social What we like: Designed as an alternative to Vite and Create React App/Webpack. Compiles TypeScript, Sass, Wasm, JSX. Handles image compression, CSS builds e.g. PostCSS, and type checking. Not tied to a UI framework

Great seeing so many developers and founders interested in devtools & infra on Monday at the first console.dev San Francisco devtools meetup!