JC Coder

🚨 Go warns: Go 1.24+ apps on Linux accept multipath TCP connections by default. That's what Anthropic's remote root exploit for Linux kernel flaw CVE-2026-98432 targeted. Stopgap: GODEBUG=multipathtcp=0 (Go calls it "fragile") Best fix: patched kernel

Supabase has become one of the default backends for the AI coding era. The open source Postgres platform now has 13 million users, spins up more than a million databases every week, and roughly 70% of its new activity is coming from agents. As coding shifts from developers writing software by hand to agents building on their behalf, Supabase has been rebuilding itself around that new user. Supabase co-founder and CEO Paul Copplestone joins Garry, Harj, and Jared on the Lightcone to talk about what happens when everyone can become a builder. They dive into why personal software may become as common as personal documents, how to design products that agents actually want to use, and why knowing what to build may matter more than knowing how to build it. 01:18 - Growth and 4x Revenue 02:35 - Three Eras of Supabase 04:34 - “Builders” vs. Traditional Devs 08:42 - Personalized Apps 12:12 - Personal Databases & Data Ownership 15:56 - Scaling to Billions 17:58 - AI Adoption At Supabase 19:58 - Lessons Learned Along The Way 27:29 - Building For Personal Agents, Dogfooding 30:01 - Agent-First Design and Evals 38:42 - The Future Of Coding 42:36 - Opening Up More Entrepreneurship

I see this conversation a lot: - Someone: "I built X" - Comments: "You didn't build it; Claude/Codex did" Yeah, ofc. Agents writing the code is the norm from now on. We can move past this and accept that the two mean the same thing, so we can focus on the product.

We're removing the 5-hour limit for verified Ultra accounts.

Massively underreported: an official Claude Code extension was compromised and installed backdoors on developer machines. Could it be behind the Binance hack?

‼️ WARNING: Updating the poisoned Claude Code extension won't remove its backdoor, Kevin Beaumont says. Cursor, which served the bad build to up to 5,000 users, warns that even uninstalling it may not be enough. The backdoor never lived only in the extension. On loading, it planted the attacker's SSH key and its own startup scripts, which keep trying to open a tunnel to the attacker every 60 seconds or so. An update swaps the extension's files but leaves the key and the scripts in place.

Correct, NVIDIA has a $10K/dev/month limit, a dev a trading firm I talked to (who wants to keep it anonymous) said its $25K and mainly traders who get close Full: newsletter.pragmaticengineer…

if you use claude code inside cursor , windsurf or any vs code fork , check the extension version. A backdoored anthropic.claude-code 2.1.313 showed up on open vsx and it adds an ssh key to your machine. look in ~/.ssh/authorized_keys for anything you didn’t put there. we have to be careful the way updates and installs are done these days.

Next question: why are you still using branches? We talked about PRs. I don't think they make sense anymore, if you rethink them from first principles. Yes, if you only use them to trigger CI, then sure, go ahead. That's a fat commit, not a PR. But for mandatory code review? Knowledge sharing? C'mon. But some of you said: "we use PRs because we use branches! I love to keep my stuff on branches." And I'm here to tell you: you don't need branches! You can just push to main. It's called trunk-based development and the idea behind it is true continuous integration: you continuously integrate your changes with the trunk, the main branch. It's been around for a while, it works. Just yesterday I talked with someone who said they've used it in an org with 400 engineers, without any issues. Ruby, the project, uses trunk-based development. The main idea is that you want to avoid long-lived branches. They're bad, because branches can diverge and merging can turn into a thing. And you don't want routine operations to become a thing. Even when I worked in teams that used PRs and branches, I considered it a smell when a branch lived for longer than a day or two. But when I shared this with others, I'd often get something back like this: "Well, good for you, but no. MY thing, what I'm working on, that can't be done on main. It needs to be on a branch! It has a database migration, it changes the underlying shape, the architecture, it refactors this and changes that. It can't go on main yet! I need to merge it all at the end." And then I'd say: "Nah, I can merge nearly anything continuously in small commits to main. You split things up. Add the column first, merge that, deploy it, now it's out, works, safe. Add the helpers first, merge them, get them out. Want to migrate from legacy pattern A to new pattern B? Don't do it all at once. Add the dependency, then migrate A to B, one by one, safe." If it can be merged in a large change, I bet it can be done in small increments that you merge to main. Yes, there are exceptions, but it's 0.5% of cases, not 50%. But there was a real problem with this approach: it was hard! There's a lot of "meta programming" you have to do: make sure this small first change compiles and runs and the tests work, merge it, get it out, monitor it; then do the next small piece, make sure that works and get it out; then maybe push some still-unused dead code, add a feature flag, add a config variable; or keep both configurations working at the same time, etc. That meant sometimes it was just easier to do it in a big fat branch. But big fat branches are risky! A system that continuously flows is safer than a system that starts and stops in spurts. But -- you guessed it -- here's the good news: Now, with agents, all of these chores are no chores at all! Agents are great at adding feature flags, they're great at splitting up code, they're great at keeping track of three changes and merging them one by one and watching them roll out. They're great at keeping two configurations working for a day. They're great at migrating one by one. In other words: it's now 10x easier to just work on main and make sure everything is continuously integrated and working. It's now easy to make sure the system constantly flows. And look, ... I'm not here to convince you to switch to trunk-based development. Just a ruse to get you to read this. (But also, hey: try it! Pushing to main is amazing.) I'm here to make you RETHINK how you develop software. Don't just use agents to replace your typing. Use agents as the magic code-writing machines they are. Everything that was hard about software development because it involved writing code -- even the meta programming -- has become easier. You can now reach for the stars! But you need to look up.

Multigres is now in private alpha: high availability for Supabase Postgres. If your database fails, a standby copy takes over on its own, and data your app already saved is not lost. Organizations on paid plans can request access. Learn more → supabase.com/blog/multigres-…

Day 25/ We are doubling all usage limits for all Pro 100/200/500 tiers and Business Premium, effective today. We heard your kind feedback and won’t be reducing usage limits for Pro 200, so your Work and Codex usage will stay the same. We’re also going to continue offering extended limits for dots for now, and usage of your dot will still continue to be separate from your default usage. And we'll of course also keep shipping better models and other efficiency improvements that increase your effective usage over time.

A tool call times out. Your agent retries. Did the action happen twice? @EOEboh brings payments lessons to AI agents: idempotency, retries and replay. Watch his Sailsconf 2026 talk on YouTube: youtu.be/PsggKjzaBbw

there’s an npm package that steals your github token and if you revoke it , it wipes your home directory. crazy how people come up with things like this