A Clean Audit Is Not a Safe Version
On 16 October npm audit passed next@16.4.0, two days after two Critical RCE advisories named it, while the older 16.3.5 failed. GitHub's Advisory Database, OSV and the npm feed all lacked the new advi...
The Door Was Patched. The Room Was Not.
Langflow's first advisory for CVE-2026-105740 names 1.9.0 as the patch, published seven weeks after the full fix shipped in 1.10.3. 1.9.0 validated the settings API; the launcher kept running commands...
The Attestation Was Valid. The Source Wasn't.
A valid npm provenance attestation proves which pipeline built a package, not that its source was honest. What the tensorlake and GHAPPIER attacks show, and the check that failed my test....
Why I Still Trust Make Over Modern Build Tools
A contrarian defense of Make (1976) over modern JavaScript build tools. Make is boring, understood, and still works....
Web Spy: The Personal Web Crawler I Never Released
I built Web Spy - a desktop app that crawled and cached websites for offline reading. This was before HTTrack, before Pocket, before Instapaper. Never shipped it....
Write Your Own Build Scripts
Build tool complexity has gotten out of control. A 50-line shell script often does the job better than any framework....
Why Engineers Should Own Their Build System
Build systems have become black boxes that nobody understands. When they break, teams are helpless....
The Framework Treadmill: Relearning the Same Patterns
The JavaScript framework ecosystem keeps solving the same problems with new syntax every 2-3 years....