The xz-utils Backdoor Was a Preview — Software Supply Chain Security Is Broken
xz-utils, Log4j, event-stream — the pattern is clear. 60% of maintainers work unpaid. Supply chain attacks doubled in 2025. Here's what's actually broken.
Tag
10 articles
xz-utils, Log4j, event-stream — the pattern is clear. 60% of maintainers work unpaid. Supply chain attacks doubled in 2025. Here's what's actually broken.
Alibaba's Qwen hit 1B+ downloads, beats GPT-5.2 on instruction following, and costs 13x less than Claude. The open-source AI race is over.
uv is 10-100x faster than pip and replaces 7 tools. ruff replaces 10 linting/formatting tools. Migration takes 5 minutes. Here's how.
Python 3.14's free-threaded build is officially supported. 10x speedups on CPU-bound tasks, 51% package compatibility, and Django runs without the GIL.
uv, ruff, Polars, Pydantic v2, orjson — all Rust under the hood. 13 Python tools rewritten in Rust, all 10-100x faster. The 95/5 pattern explained.
Rakuten launched 'Japan's largest AI model' with government backing. It was a fine-tuned DeepSeek V3 with the MIT license deleted. The community caught it in four hours.
Bruno stores API collections as .bru files in Git. No cloud, no account, no subscription. After Postman killed free teams, I switched.
SQLMesh is 9x faster than dbt, with free dev environments. Fivetran-dbt merger raises lock-in concerns. Coalesce offers visual SQL. Decision framework.
Wasm cold starts in 40 microseconds vs 100ms for containers. 20x density advantage. 95% cost reduction. Production at Amazon, Adobe, Cloudflare.
Poor data quality costs $12.9M/year per enterprise. DataGovOps automates governance in CI/CD. EU AI Act makes it mandatory by August 2026.