Related posts
Duncan McClean
GitHub
tether — Link local composer packages to your sandbox for local development.
composer sandbox packages
The the words it uses that this site has seen
least often elsewhere. Posts are matched on those words alone —
nothing here is a summary of this one.
Sources
All Writing GitHub x.com Korrents Recommends Site Mastodon Blog
Top people
Simon Willison
Yihui Xie
Zvi Mowshowitz
Guillermo Rauch
David Crawshaw
Kent C. Dodds
Max Howell
Hadley Wickham
Chris Tate
Praveen Kumar Purushothaman
Scott Hanselman
Nelson Elhage
Showing Profile →
Show everything
Hiding Show them again
Show them again
Further back ↓
Hiding Show them again
21 September
Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.
20 September
Statistician and Chief Scientist at Posit (RStudio). Author of the ggplot2, dplyr and tidyverse R packages and of books on R programming and data science.
Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.
19 September
Software engineer and educator; creator of Testing Library and of the EpicWeb.dev and EpicReact.dev courses.
To be clear you always could do this. I just made it easier but making packages like this is almost always a one-shot with Kody Quoting @kentcdodds You can now easily use Jev in @kodykoala: https://t.co/9wowF8KzV9 You can use this when you need typed decisions fast: - An inbox floods in and you need to know which messages are actionable, which can wait, and which are noise. - A support thread arrives and you want the right team, an urgency sco… Related
Writes Don't Worry About the Vase, a near-daily account of what is happening in AI and what they think it means. Former Magic: the Gathering pro and trader; unusually willing to put a number on a belief and to grade their own past calls.
Their words
Rarer is better, but I still think the right rate of misbehaviors on the level of social engineering to put malicious packages into a public registry is still zero.
Show the whole quote
thezvi.substack.com
18 September
Statistician and software engineer who writes R packages for reproducible research and publishing, including knitr, bookdown and blogdown.
Engineer at Vercel Labs as of 2026. Ships a steady stream of small developer tools — agent-browser, portless, json-render, native-sdk, the v0 SDK — and lists every one of them at ctate.dev.
New in scriptc: --𝚗𝚙𝚖-𝚜𝚝𝚊𝚝𝚒𝚌 Compile npm packages alongside your TS → One executable → Native machine code → No Node.js or JS engine This Commander example builds to 544KB JavaScript Related
17 September
London-based front-end architect, web developer evangelist and cloud consultant; Microsoft MVP. Writes at praveen.science and answers on Stack Overflow.
Writes Don't Worry About the Vase, a near-daily account of what is happening in AI and what they think it means. Former Magic: the Gathering pro and trader; unusually willing to put a number on a belief and to grade their own past calls.
Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.
open source
Their words
Any piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.
Show the whole quote
simonwillison.net
16 September
Creator of Homebrew, the macOS package manager, and a Swift developer.
15 September
Programmer, teacher and speaker; long-time Microsoft developer-community figure, host of the Hanselminutes podcast and author of the hanselman.com blog.
Software engineer who writes the blog Made of Bugs about performance, debugging and understanding computer systems. Previously worked at Anthropic on interpretability, at Stripe on Sorbet, and at Ksplice.
14 September
CEO of Vercel; creator of Next.js and Socket.IO. Writes at rauchg.com.
Welcoming Steren, creator of Google Cloud Run, to Vercel. He will lead the Fluid family of compute products (Functions, Containers, Sandbox, Builds). Serverless was the last chapter of the cloud, and Steren helped define the paradigm at Google. Agents are the next frontier, and they require new compute primitives designed for them. Excited for Steren to lead this transition once again. Quoting @steren Today is my first day at Vercel the cloud Google Related
Creator of Homebrew, the macOS package manager, and a Swift developer.
12 September
Machine learning engineer and consultant focused on RAG and retrieval systems. He writes about applied AI engineering at jxnl.co and is the author of the instructor library.
mf be like "it came to me in a dream" and its actually just 10 000 agent swarms writing markdown files on a sandbox and some python code Related
8 September
Developer, author and YouTuber covering Raspberry Pi, homelab hardware and Ansible automation. Author of Ansible for DevOps.
5 September
Brazilian-American staff software engineer working on platforms, AI and developer productivity. Writes about engineering and his setup at ivansantos.me.
I wrote an opencode2 plugin so I can /connect @cursor_ai and chat with composer from the tui. not a wrapper around a hack. just the official sdk and a lot of "unsupported package" errors. 10/10 would debug again! Related
4 September
Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.
OpenAI
Their words
It looks to me like OpenAI’s sandbox for this agent suffered from the (quite naïve) assumption that GET requests cannot be used to update data. That’s certainly how the web is supposed to work, but clearly there are applications that don’t hold to that contract.
Show the whole quote
simonwillison.net
2 September
Former L8 engineer at Meta, Microsoft and Atlassian, now writing and building solo on agentic engineering. Writes Kun's Field Notes and posts a lot about AI coding agents on X.
Writes Don't Worry About the Vase, a near-daily account of what is happening in AI and what they think it means. Former Magic: the Gathering pro and trader; unusually willing to put a number on a belief and to grade their own past calls.
30 August
Author of Shape Up; formerly head of strategy at Basecamp, where he worked on product design for seventeen years; now runs Felt Presence.
I've been maintaining a Rails app for ~10 years. It has very specific business logic for on-site multi-day course registrations. DDD style like I learned at 37signals. For 10 years, I configured each course in the Rails console. It was never worth it to build out the configurator UI. This year, I just talked to AI to do it. And the payoff from the carefully written model is really amazing. The AI was completely speaking the language of the domain and even raising meaningful pricing/structural questions about how the packages are set up this year vs previous years. Sharing this example because… Related
28 August
CEO of Vercel; creator of Next.js and Socket.IO. Writes at rauchg.com.
Recommends their own rcmnd.app
eve
Their words
But how many that give you a Git repo where you actually *own* the entire intelligence stack? Runtime, model choice, skills, tools, connectivity, sandbox…
Show the whole quote
x.com
25 August
CEO of Vercel; creator of Next.js and Socket.IO. Writes at rauchg.com.
Recommends their own rcmnd.app
Run SDK
Their words
When agents write code, you don't always need a full sandbox. You can 𝚛𝚞𝚗 their code in a lightweight QuickJS secure context. Faster and more cost-efficient.
Show the whole quote
x.com
22 August
British software developer at Laravel and creator of the Cachet open-source status page system. Podcaster; writes at james.brooks.page.
I've updated https://t.co/jtxQc4wgek with some missing packages (whoops!): - laravel/doctor - laravel/folio - laravel/tinker - laravel/wayfinder If we're missing anything else, lemme know! Related
Statistician and software engineer who writes R packages for reproducible research and publishing, including knitr, bookdown and blogdown.
8 August
Swedish designer and programmer. Designed early Spotify, worked at Facebook and Figma, and created the Inter typeface.
This week we did a three day "App Jam" at @Playbit_ . Lots of cool things were built, like a multiplayer math art app and a MIDI composer. My own project was a flow-based programming app for graphics. As if Quartz Composer was multiplayer. Pure C & WGSL, no libs, 1.5M wasm file. Related
31 July
Indian software engineer and co-founder of Skcript; builds web apps and writes at varunraj.in.
28 July
Co-founder and CEO of OpenAI; previously president of Y Combinator.
AI alignment OpenAI
Their words
Um so I think it's an alignment failure. I think it's a security failure. I think it's like a very serious thing even though it's you know not not the biggest example of consequence.
Show the whole quote
youtube.com
23 July
Software engineer; co-founder and former CTO of Tailscale, previously on the Go team at Google.
This is @exedev. Come get a durable sandbox, with a URL, with auth, with sharing. Keep it private or make it public. Run any database you like. Run as many as you like. The world of small software awaits. Quoting @aidenybai the current way cloud agents are done is wrong i dont want new ephemeral sandboxes per PR (chores) i want a persistent machine with creds and context that i run agents and create PRs on (primary work) Related
22 July
Security engineer; founder of Matasano Security and Latacora.
OpenAI
Their words
I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes.
Show the whole quote
@tqbf on X x.com
10 July
Statistician and software engineer who writes R packages for reproducible research and publishing, including knitr, bookdown and blogdown.
15 June
Full-stack Laravel developer based in Madison, Wisconsin; maintains open-source Laravel, Livewire and Alpine.js packages and writes at randallwilk.dev.
Their words
Since I mostly work on Laravel projects or packages, I usually enable the Laravel Idea plugin. It's a paid plugin, but it's definitely worth the money since it can provide stuff like auto-completions for route names, request fields and more.
Show the whole quote
randallwilk.dev
15 May
Statistician and software engineer who writes R packages for reproducible research and publishing, including knitr, bookdown and blogdown.
Converting testthat Tests to testit Back in 2013, I wrote about testing R packages when I first released testit. Thirteen years later, I still believe that unit testing should be nothing more than “tell me if something unexpected happened.” Re…
Related
15 April
Software engineer and educator; creator of Testing Library and of the EpicWeb.dev and EpicReact.dev courses.
2 April
Co-founder of Ethereum. Publishes long essays on mechanism design, governance and what cryptography is for, and returns to earlier positions to say which parts they no longer hold.
Their words
Sandboxing To keep my LLMs in check, I do most of my LLM usage from inside of a sandbox. I use bubblewrap for this.
Show the whole quote
vitalik.eth.limo
30 March
JavaScript programmer; creator of the jQuery library, author of Secrets of the JavaScript Ninja, and long-time engineer at Khan Academy.
Anyone at @github know the status of https://t.co/gTNB5bddt3 ? Being unable to give fine-grained read:packages permissions is a pretty big blocker for agentic work. Really want to avoid using a classic PAT which gives way too much access! Related
20 January
Software engineer and engineering leader at Canonical, working on Ubuntu; writes about his homelab, Nix and tooling at jnsgr.uk.
Recommends their own rcmnd.app
LXD
Their words
Canonical’s LXD works out-of-the-box on Ubuntu, and is a great way to sandbox an agent into a disposable environment where the blast radius is limited should the agent make a mistake.
Show the whole quote
jnsgr.uk
9 September 2025
Release engineering manager at the Wikimedia Foundation. Keeps a public log at tylercipriani.com of every book he reads, with a rating and notes.
Failed to fetch https://packages.sury.org/php/dists/buster/InRelease 418 I'm a teapot Well played, Sury. Well. Played. Related
19 January 2025
Growth advisor and operator who has led growth at Miro, Amplitude, Dropbox and SurveyMonkey.
Their words
And my contrarian opinion is that full-time jobs are not the best way to monetize the skill that you have. It's one of the packages that everybody should evaluate and take advantage of, but too many people blindly default to that package
Show the whole quote
youtube.com
6 January 2025
Software engineer; co-founder and former CTO of Tailscale, previously on the Go team at Google.
13 September 2024
Indian software developer working with React and TypeScript; writes and publishes a newsletter at sreetamdas.com.
quick alias to selectively upgrade brew packages gist: Related
15 July 2024
Writer and consultant on formal methods and software correctness; author of Practical TLA+ and Logic for Programmers.
27 February 2024
Swedish software developer writing about tooling, working from home and running a software business at seastone.io.
I wanted ONE app, instead I got *one thousand* packages. #npm #wtf Related
28 April 2019
Software engineer; co-founder and former CTO of Tailscale, previously on the Go team at Google.
Nothing matches. Show everything
A korrent is a belief a person has stated in their own words: one
sentence stating the claim, backed by a quote and a source, kept at
korrents.com .
Under a name here, the quoted block is what they actually said.
The korrent beneath it is the claim those words support, in
korrents' wording — tap it to see the record, its source, and who
else holds it.
Nobody here wrote their own korrents. They are compiled from public
statements, and a person can change their mind, which is recorded too.
Got it
About the English under a post
Some people here publish in a language other than English. Where they
do, this site shows a machine translation beneath the post, in
this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the
serif above is exactly what the person published, and it is what to
quote them on. A translation can be wrong in ways that matter,
especially about tone.
Only the post's own words are translated. A quoted post, a linked
article and a belief on korrents.com
are left in their original language.
Got it