>_ Posts
Blog
Thoughts on development, engineering, and product.
- 01|
The internet turned into an AI-generated landing page factory - and the bill for that hasn't arrived yet
Vibe coding, no-code, and entire prompt-generated websites promise unlimited speed. The real problems - security, SEO, scaling ceilings, and platform dependency - are growing just as fast, they just haven't shown up on the screen yet for whoever is building right now.
- 02|
The 'just run AI locally' advice hides a bill almost nobody shows you
There's a wave of people recommending local AI like it's simple and cheap. In practice, the efficiency of these models on diverse tasks is very low - with a few narrow exceptions - and getting close to a real cloud-grade model pushes the hardware investment from thousands into the tens of thousands of dollars fast.
- 03|
TypeScript 7.0 already shipped - and the ecosystem hasn't caught up yet
After more than two years of work, Microsoft rewrote the entire TypeScript compiler in Go. Builds up to 12x faster, yes - but ESLint, Vue, Svelte, and Astro are stuck until version 7.1, which isn't expected until October. The topic dominating technical conversations this week.
- 04|
Opening a folder in Cursor can run malicious code by itself — and Cursor has known for seven months
An unpatched zero-day in Cursor for Windows lets any repository with a forged git.exe in its root execute code automatically, with no click, no warning, no confirmation. Mindgard reported it in December 2025; it went fully public in July 2026, after seven months of silence.
- 05|
The government already published the Swagger for real-time tax collection - and most Brazilian devs haven't seen it yet
Split Payment: starting January 2027, payment systems in Brazil will have to query a public API from the Federal Revenue Service before settling any Pix, boleto, or wire transfer. The channel Mano Deyvin broke down the full technical flow - I put together the summary plus links straight to the official documentation.
- 06|
Has the AI bubble already burst? The viral video summarizes four sources — and they don't contradict each other
Microsoft canceling data centers, Starbucks retiring an AI tool, a gap of hundreds of billions between capex and revenue, and the central bank of central banks comparing the AI boom to 19th-century railway mania. We went through the four sources behind the video and what each one actually says.
- 09|
Two attacks in four days, a package with 15,000 weekly downloads, and npm v12 arriving to try to stop the bleeding
Injective SDK and Jscrambler were compromised in July 2026, fitting the same pattern that already hit Axios, Red Hat, and node-ipc this year. npm v12, expected this month, promises to end automatic install scripts — but experts say that doesn't fix the real problem.
- 10|
Ben Awad: 'hand-written code is dead'. I agree with the premise, disagree with the conclusion.
In January 2026, Ben Awad posted a video that went viral: 'hand-written code is basically dead'. Months later, real cases started confirming the thesis — a single prompt modifying 500,000 lines, games with 95% AI-generated code, Steve Yegge building agents that coordinate agents. I agree manual typing is dying. I disagree that means the end of critical code review.
- 11|
Microsoft Build 2026: run Claude, Codex, and Copilot at the same time (and the hidden cost of it)
On June 2-3, 2026, Microsoft unveiled the GitHub Copilot app — a desktop experience for orchestrating multiple agents in parallel, with Claude, Codex, and Copilot running on the same task in isolated git worktrees. The industry is converging on a model where the developer becomes a director, not a typist. But the bill started arriving in June.
- 12|
110,000 layoffs, $725 billion in AI: the paradox that defines 2026
On June 22, 2026, Oracle revealed it had cut 21,000 people over 12 months. The same week, analysts calculated that Microsoft, Amazon, Meta, and Google will spend $725 billion on AI this year. The industry is laying off 864 devs a day while investing $370 million a day in data centers. The money has to come from somewhere — and it's coming from payroll.
- 13|
Hacker Attack on Brazil's Civil Defense: the 'misanthropy' alert that woke up the country
In the early hours of 06/20/2026, millions of Brazilians were woken up by an extreme alert containing the word 'misanthropy'. Here's what happened, how the Defesa Civil Alerta system was compromised, and what this incident tells us about the security of critical infrastructure.
- 14|
SaaS is eating the world — and tearing open just as many holes
The global SaaS market hit $299 billion and the average company runs 371 cloud applications. Meanwhile, 2026 is shaping up as the year of SaaS supply chain attacks — and the preferred entry point isn't the firewall anymore, it's an OAuth token from an integration nobody has reviewed in months.
- 15|
Vibe coding: hype, reality, and when it actually makes sense
In February 2025, Andrej Karpathy named vibe coding in a tweet. A year later, he himself called the term passé and adopted a new one: agentic engineering. Between the two ends of that arc lies a trail of careless prompts, exposed databases, and one embarrassing statistic: 45% of AI-generated code carries an OWASP vulnerability.