Our full conversation with Andrew Kelley, creator of Zig, is out now. No AI policy, leaving GitHub, a $670K nonprofit, and why there's no 1.0 (yet). Watch here: jb.gg/zig-interview

Their infrastructure not depending on github and discord is very refreshing to see. There's so much talk about reducing dependencies, please don't just focus on lockfiles when there is a much bigger picture to look at.

ziglang 👏 ziglang.org/code-of-cond...

"In addition, an AI model will automatically assess in the background whether the user is an adult; based on existing account age, device, and activity data." Activity data like message content and usage habits. Profiling every user in the background. Discord is for sale and so is your data. Leave

🚨Warning: #Discord age verification is going live any day now. While huge public backlash put Discord's plans on hold, they were never abandoned. 👉 Learn here what's next & how to protect your #identity: tuta.com/blog/discord... #IDcheck #anonymity #privacy #AgeVerification

turns out deleting all your @tangled.org records on your pds is not enough, some data still remains tangled.org/tangled.org/... tangled.org/terms is full of gems, but "governed by the laws of Finland, without regard to its conflict of law provisions" takes the cake. This is not how laws work.

The actions of google in the past few weeks are just a glimpse of what is coming. Open the website, Chrome. I'm sorry, Dave. I'm afraid I can't do that. Literally. There won't be a way to enter a url or click a link, just a dystopian simulation to keep and manipulate you. Find alternatives now.

npms staged publishing is not *gold standard* or *the missing piece*. It was long overdue (the first RFC for it is over 5 years old) github.com/npm/rfcs/pul... docs.npmjs.com/cli/v11/comm... and only addresses one attack vector if maintainers opt-in by updating their publishing workflow.

All of you supporting and using these ai tools, are you happy yet with killing the web? None of this is inevitable, your actions make it possible.

When you have unlimited tokens budget...

Remember how amazon undercut 3rd party sellers profitable products utilizing insider information? Keep playing code casino to find out what these honorable ai companies are going to do with your inputs.

Turns out deleting your @tangled.org account is a lot more complicated than signing up. tangled.org/did:plc:j5hm...

The *trust* in oidc trusted publishing from @github.com to @npmjs.bsky.social is broken. Signatures contain metadata about repo/branch/workflow and award a nice green checkmark, but tell you nothing about the configuration, code that was executed or the published content.

There's a time and place for AI. It's never, and nowhere.

Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google Chrome silently installs a 4 GB Gemini Nano AI model on your device ❌ No consent ❌ No opt-in ❌ No real opt-out for regular users This isn’t a small experiment & it’s on billions of devices. ➡️ Read more: www.thatprivacyguy.com/blog/chrome-...

we need IDEs that do not contain ai features at all. github.com/microsoft/vs... @zed.dev any chance you are going to release a variant? central opt-out switches are not enough

This di.day is my hardest yet. Bye discord, github and npmjs registry. (there may be some cleanup activities in the coming days but no more active contributions, accounts are inactivated to prevent imposter takeover) Unfortunately this means i also am no longer an active vite team member.

Is there a static web hoster in Europe that blocks LLM traffic? Is that even truly possible? I’m constantly seeing Cloudflare’s approach and I’m not sure how effective it is – while significantly downgrading the user experience for humans.

@tangled.org is introducing a social scoring system under the guise of llm spam filtering. blog.tangled.org/vouching/ The fact that a downvote is called "denounce" speaks volumes. en.wikipedia.org/wiki/Denunci... Are users asked for their consent to be put on these lists in *public* records?

@vite.dev would not be the same without @sapphi.red Thank you so much for your incredible work over 4 years Sapphi!

how in the world are tech companies getting away with playing the end of history card?

Long weekend coming up in europe with labor day on may 1st and Sunday it's di.day again. Good occasion to leave and boycott services that are outright hostile to their own users and even employees (Hey meta, microsoft, google, ...)

The process to secure oidc publishing from github actions to the npmjs.com registry is too complex and insecure by default. If you use it, you *must* set up an environment with branch protection rules or a single leaked gh token with write access can turn your package into malware.

Shipping 7.0 without programmatic api is a mistake. This alias mapping + reexport is going to be a messy web come 6-8 months when 7.1 rolls out

vitest and vite (and a lot of others) have seen a big increase in their npm download stats since start of 2026. www.npmcharts.com/compare/vite... But for me this is not a reason to celebrate.

You've seen a very small sample size of reports they actually sent. The is just another round of the "oh we made something so powerful" marketing schtick. I'm tired.

Manifold Security tricked Claude' GitHub bot to merge malicious code to repositories by spoofing their requests under the names of famous developers www.manifold.security/blog/spoofed...

did @npmjs.bsky.social just break `pnpm audit` for everyone? This must be the improved supplychain security work they are talking about... github.com/pnpm/pnpm/is...

The "pnpm docs" and "pnpm home" commands will open @npmx.dev in pnpm v11.

It really bothers me that so many posts of the people i am following no longer contain links. The web is links, you are breaking it.

The little things take up so much space on mobile ui... 3 items visible above the fold.

`tsnapi` - a snapshot testing utility for the public API for library maintainers. Snapshots for both JavaScript and TypeScript declarations. It would help prevent unintended breaking changes on public API signatures. Thanks @sxzz.dev for the initial idea and implementation. github.com/antfu/tsnapi

Hey @discord.com how come you are able to profile your users to access their age but we still have to manually clean up/ban cam-girl spam invites with discord-gg links from new joining users? Connect with your peers on other platforms and prepare to leave discord...

Friendly reminder that npmjs.com lacks proper 2FA validation on editing package settings. - do not leave authenticated browser tabs open - do not stay authenticated on cli / keep a token in your .npmrc

Just published a new version of `create-vite-extra` matching the new designs and setup from `create-vite`!

German bureaucrats might know how to spell digital sovereignty, but they still don’t understand what it entails.

this! also available as text version: www.terrygodier.com/the-last-qui...

It's di.day again next Sunday. If you are still using instagram, time to leave.

You may have heard me being critical of vibe coding. But with Anthropic finally open sourcing claude code cli, i wasted no time to dive into it and build you the svelte vibe coding tool you deserve: `npx svibe` happy svibing!

@npmx.dev also has a builtin diff viewer that even includes a dependency change summary: npmx.dev/diff/axios/v...

Hey @github.com, maybe you want to clear that up on your own site/blog and also clarify what your stance on these "suggestions" is for the future? > this was surfaced more frequently than intended alongside other feature suggestions My preferred frequency is 0, thanks.

Made a site to compare projects on Open Collective. Some are managing funds really well while others are burning through quite a bit. octrends.bjornlu.com

Just remembered to check my #sveltekit build times on Vercel after updating to #Vite8. Thanks @voidzero.dev @dominikg.dev

🚨No Joke: Conservatives in the EU Parliament (EVP) want the vote on #ChatControl 1.0 to be repeated this Thursday - even though the Parliament already voted NO! 😡 Make sure your MP stays strong. Contact them now! 👉 fightchatcontrol.eu#contact-tool

hacking away at a new @npmx.dev feature of course 👀

Join the Vite ecosystem tomorrow to celebrate the Vite Team 5th Anniversary by rewatching together the Vite Documentary! Let's remember the stories of the people who connected to extend together our shared commons. And stay at 3:45 PM UTC to participate in the live stage after the movie 💜

⚡️ Vite 8.0 is here! The most significant architectural change since Vite 2. ⏬ Powered by @rolldown.rs bringing faster production builds and more consistency 🛤️ New features such as tsconfig paths and emitDecoratorMetadata support vite.dev/blog/announc...

It’s here. github.com/vitejs/vite/...