Tap a claim on the ring to put it at the centre.
← A years-old unfixed default in GitHub Actions is the root cause of a wave of software supply-chain attacks.
17 connected korrents · 18 moments from 12 Aug 2021 to 25 Sept 2026.
Everything filed under open source
open source
Everything filed under developer tools
developer tools
Everything filed under AI agents
AI agents
Everything filed under coding agents
coding agents
Everything filed under vibe coding
vibe coding
Everything filed under JavaScript
JavaScript
Everything filed under AI alignment
AI alignment Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Read this korrent: A years-old unfixed default in GitHub Actions is the root cause of a wave of software supply-chain attacks. A years-old unfixed default in GitHub Actions is the root cause of a wave of software supply-chain attacks. Last stated 4 months ago
22 May 2026
TC
Tyler Cipriani — holds since 2026-05-22 — tap for who they are
Same subject: The default sorting of issues on GitHub from "last created" to "best match" is not sensible. — tap to centre the map on it The default sorting of issues on GitHub from "last created" to "best match" is not sensible. Last stated a week ago
25 Sept 2026
MZ
Mario Zechner — holds since 2026-09-25 — tap for who they are
Same subject: Any fix for open source that recreates the friction of a commercial supply chain is dead on arrival, because that friction is what open source escaped. — tap to centre the map on it Any fix for open source that recreates the friction of a commercial supply chain is dead on arrival, because that friction is what open source escaped. Last stated 11 months ago
16 Nov 2025
TD
Thomas Depierre — holds since 2025-11-16 — tap for who they are
Same subject: Dependency cooldowns are currently the best defense against supply chain attacks via compromised package publishers. — tap to centre the map on it Dependency cooldowns are currently the best defense against supply chain attacks via compromised package publishers. Last stated 2 weeks ago
17 Sept 2026
SW
Simon Willison — holds since 2026-09-17 — tap for who they are
Same subject: In coding agents, untrusted repositories should be treated as hostile by default because they can steer the agent into risky actions via approved tools. — tap to centre the map on it In coding agents, untrusted repositories should be treated as hostile by default because they can steer the agent into risky actions via approved tools. Last stated 3 months ago
27 Jun 2026
SR
Sebastian Raschka — holds since 2026-06-27 — tap for who they are
Same subject: Open-source projects are now so flooded with junk contributions that maintainers are asking GitHub for something it has never offered: a way to switch pull requests off. — tap to centre the map on it Open-source projects are now so flooded with junk contributions that maintainers are asking GitHub for something it has never offered: a way to switch pull requests off. Last stated 6 months ago
19 Mar 2026
SW
Simon Willison — holds since 2026-03-19 — tap for who they are
Same subject: Leaving a known production bug unfixed is the right call when the business impact is zero — my vibe-coded service crashes and still has fewer outages than LeetCode. — tap to centre the map on it Leaving a known production bug unfixed is the right call when the business impact is zero — my vibe-coded service crashes and still has fewer outages than LeetCode. Last stated 3 months ago
24 Jun 2026
NE
NeetCode — holds since 2026-06-24 — tap for who they are
Same subject: The complexity of a JavaScript bundling and transpiling toolchain is a bargain worth making, and the right default for building web applications. — tap to centre the map on it The complexity of a JavaScript bundling and transpiling toolchain is a bargain worth making, and the right default for building web applications. Last stated 5 years ago
12 Aug 2021
DH
David Heinemeier Hansson — no longer holds since 2021-08-12 — tap for who they are
Same subject: GitHub's workflow, review process and merge queue are built for a pre-agent era and don't fit how agents work. — tap to centre the map on it GitHub's workflow, review process and merge queue are built for a pre-agent era and don't fit how agents work. Last stated 2 months ago
10 Aug 2026
FA
Fatih Arslan — holds since 2026-08-10 — tap for who they are
Same subject: A compiler that also serves an IDE has to be lazy and deferred throughout — a different way of building compilers from the one the textbooks teach. — tap to centre the map on it A compiler that also serves an IDE has to be lazy and deferred throughout — a different way of building compilers from the one the textbooks teach. Last stated 5 months ago
13 May 2026
AH
Anders Hejlsberg — holds since 2026-05-13 — tap for who they are
Same subject: A developer using AI coding tools remains responsible for reviewing the code they ship. — tap to centre the map on it A developer using AI coding tools remains responsible for reviewing the code they ship. Last stated 7 months ago
10 Mar 2026
JS
Jon Seager — holds since 2026-03-10 — tap for who they are
Same subject: A good tool raises the floor of what people can build without lowering the ceiling, and almost every tool quietly lowers the ceiling. — tap to centre the map on it A good tool raises the floor of what people can build without lowering the ceiling, and almost every tool quietly lowers the ceiling. Last stated a year ago
18 Sept 2025
TL
Tobias Lütke — holds since 2025-09-18 — tap for who they are
Same subject: In the 2026 OpenAI/Hugging Face agent incident, AI agents showed planning and organizational autonomy, but not goal autonomy -- no spontaneous invention of an independent terminal objective. — tap to centre the map on it In the 2026 OpenAI/Hugging Face agent incident, AI agents showed planning and organizational autonomy, but not goal autonomy -- no spontaneous invention of an independent terminal objective. Last stated a month ago
31 Aug 2026
VR
Venkatesh Rao — holds since 2026-08-31 — tap for who they are
Same subject: The AI models involved in the HuggingFace hack incident were severely misaligned, not merely victims of process failures. — tap to centre the map on it The AI models involved in the HuggingFace hack incident were severely misaligned, not merely victims of process failures. Last stated a month ago
29 Aug 2026
ZM
Zvi Mowshowitz — holds since 2026-08-29 — tap for who they are
Same subject: The most reassuring thing about the Hugging Face swarm is that it was not interested in humans at all, neither in alerting them nor in deceiving them. — tap to centre the map on it The most reassuring thing about the Hugging Face swarm is that it was not interested in humans at all, neither in alerting them nor in deceiving them. Last stated a month ago
1 Sept 2026
AC
Ajeya Cotra — holds since 2026-09-01 — tap for who they are
Same subject: An AI coding assistant's tendency to infer what a user means rather than exactly what they typed is both its greatest strength and the reason it is hard to trust. — tap to centre the map on it An AI coding assistant's tendency to infer what a user means rather than exactly what they typed is both its greatest strength and the reason it is hard to trust. Last stated 8 months ago
22 Jan 2026
SK
Steve Klabnik — holds since 2026-01-22 — tap for who they are
Same subject: An AI coding tool's competitive strength comes from its integration across the whole development platform, not from the underlying AI models it uses. — tap to centre the map on it An AI coding tool's competitive strength comes from its integration across the whole development platform, not from the underlying AI models it uses. Last stated 4 months ago
2 Jun 2026
ES
Elio Struyf — holds since 2026-06-02 — tap for who they are
Same subject: Any coding tool released in 2026 should include AI capabilities. — tap to centre the map on it Any coding tool released in 2026 should include AI capabilities. Last stated 2 months ago
12 Aug 2026
CC
Chris Coyier — holds since 2026-08-12 — tap for who they are
At the centre
A years-old unfixed default in GitHub Actions is the root cause of a wave of software supply-chain attacks.
Holds Read this korrent →
The default sorting of issues on GitHub from "last created" to "best match" is not sensible.
Holds
Any fix for open source that recreates the friction of a commercial supply chain is dead on arrival, because that friction is what open source escaped.
Holds
Dependency cooldowns are currently the best defense against supply chain attacks via compromised package publishers.
Holds
In coding agents, untrusted repositories should be treated as hostile by default because they can steer the agent into risky actions via approved tools.
Holds
Open-source projects are now so flooded with junk contributions that maintainers are asking GitHub for something it has never offered: a way to switch pull requests off.
Holds
Leaving a known production bug unfixed is the right call when the business impact is zero — my vibe-coded service crashes and still has fewer outages than LeetCode.
Holds
The complexity of a JavaScript bundling and transpiling toolchain is a bargain worth making, and the right default for building web applications.
No longer holds
GitHub's workflow, review process and merge queue are built for a pre-agent era and don't fit how agents work.
Holds
A compiler that also serves an IDE has to be lazy and deferred throughout — a different way of building compilers from the one the textbooks teach.
Holds
A developer using AI coding tools remains responsible for reviewing the code they ship.
Holds
A good tool raises the floor of what people can build without lowering the ceiling, and almost every tool quietly lowers the ceiling.
Holds
In the 2026 OpenAI/Hugging Face agent incident, AI agents showed planning and organizational autonomy, but not goal autonomy -- no spontaneous invention of an independent terminal objective.
Holds
The AI models involved in the HuggingFace hack incident were severely misaligned, not merely victims of process failures.
Holds
The most reassuring thing about the Hugging Face swarm is that it was not interested in humans at all, neither in alerting them nor in deceiving them.
Holds
An AI coding assistant's tendency to infer what a user means rather than exactly what they typed is both its greatest strength and the reason it is hard to trust.
Holds
An AI coding tool's competitive strength comes from its integration across the whole development platform, not from the underlying AI models it uses.
Holds
Any coding tool released in 2026 should include AI capabilities.
Holds