Related posts

Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.

From one piece Be alert: targeted attacks on prominent Rustaceans 2 beliefs · simonwillison.net

• Our readingkorrents.com

  Any software that depends on open source has a network of humans with package publishing rights who are potential attack vectors.

  open source

  Their words

  Any piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.

  simonwillison.net

• Our readingkorrents.com

  Dependency cooldowns are currently the best defense against supply chain attacks via compromised package publishers.

  Their words

  I guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.

  simonwillison.net

Programmer; makes Handmade Hero and teaches Performance-Aware Programming, and argues loudly about how software got slow.

From one piece Why performant code matters (but gets widely ignored), with Casey Muratori 2 beliefs, in the piece's order there

• Our readingkorrents.com

  The speed of a system is set by its longest serial dependency chain, which is a property of the architecture and cannot be parallelised away afterwards.

  Their words

  the performance of your software is generally determined by the longest serial dependency chain because it's something that cannot be parallelized.

  youtube.com

• Our readingkorrents.com

  "Optimize it later" would be safe advice only if every engineer already knew how to avoid the architectural mistakes that no later optimization can remove.

  Their words

  If every uh software engineer knew to watch out for false serial dependency chains, things where they were creating series of dependent operations that could not be optimized away or other sorts of architectural problems like that that cannot be easily fixed, then the world would look more like just wait and optimize the hotspot, right?

  youtube.com

Founded PSPDFKit in 2011 and ran it for a decade. Came back from a break to work on AI agents — the OpenClaw project, and OpenAI, joined in February 2026. Writes at steipete.me.

• Our readingkorrents.com

  Your dependency's business model is your business model, so building a harness around one lab's model is a commercial risk and not a technical choice.

  Their words

  So maybe write this one down. Your dependencies business model is your business model.

  Peter Steinberger: "Fun Is Velocity"youtube.com

Software engineer and writer; worked on Mapbox and built Placemark and Simple Statistics, and blogs at macwright.com.

• Our readingkorrents.com

  Democratic power ultimately rests on ordinary people controlling resources rulers depend on, like labor and tax revenue

  Their words

  The governed have something the governors need: labor, tax revenue, military service, consumer spending. This dependency is the source of democratic leverage.

  Recentlymacwright.com

Development economist; writes Global Developments, on growth, history and the numbers behind them.

• Our readingkorrents.com

  Aid to African states has been large enough to warp their politics and too small to transform their economies.

  Their words

  As scholars like Nicolas van de Walle have pointed out, aid can also foster an unhealthy dependency—in his coinage, many African states live in a state of “permanent crisis”, where aid is large enough to reshape (and warp) the political economy around it, but not large enough to be fundamentally transform countries’ economies.

  A World Without Aid?global-developments.org

Cryptography engineer; maintains Go's cryptography libraries as a full-time open-source maintainer, funded directly by companies that use them.

• Our readingkorrents.com

  A dependency you would need engineer-months to replace or fork is a critical one, and retaining its maintainer is straightforward business sense.

  Their words

  This is how I frame it: if the effort required to replace or fork a dependency should it go unmaintained is measured in engineer-months, that’s a critical dependency and retaining its maintainers probably makes good business sense.

  words.filippo.io

Working on @ampcode. Writing registerspill.thorstenball.com. Once authored interpreterbook.com and compilerbook.com.

• Our readingkorrents.com

  Using a dependency carries ongoing maintenance costs, not just upfront convenience

  Their words

  Dependencies aren't free. You have to keep them up to date. They increase your compile or loading times.

  Professional Programming: The First 10 Yearsthorstenball.com

Free software developer; maintainer of sway, wlroots, aerc and scdoc, and founder of the SourceHut (sr.ht) software forge.

• Our readingkorrents.com

  Adding a dependency is a serious commitment requiring an audit and continued re-auditing, and the usual practice of not doing so is reckless.

  Their words

  Adding a dependency is a serious decision which requires consensus within the team, an audit of the new dependency, an understanding of its health and long-term prospects, and an ongoing commitment to re-audit them and be prepared to change course as necessary.

  I will pay you cash to delete your npm moduledrewdevault.com