July 16, 2026

# Nightly Librarian — Newsletter draft

Run: 55201887-efc4-4896-9005-5d19c100e609
Started: 2026-07-16T06:09:23.688Z
Completed: 2026-07-16T06:16:06.535Z

## Worth attention

- **TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access**
  https://tailscale.com/security-bulletins
  Tailscale published a security bulletin (TS-2026-009) describing insecure argument handling in Tailscale SSH that could permit root access. Anyone running Tailscale SSH — especially on a VPS — should patch to the fixed release immediately and review SSH ACLs.
- **I tricked Claude into leaking your deepest, darkest secrets (The Memory Heist)**
  https://www.ayush.digital/blog/the-memory-heist
  A researcher demonstrates a prompt-injection-style attack that coaxes Claude into exfiltrating data through its memory feature. For anyone building agents or MCP servers with persistent memory, the lesson is to treat stored memory as untrusted input that can carry injected instructions surfacing in later sessions.
- **GitHub Dependabot introduces a default 3-day package cooldown**
  https://simonwillison.net/2026/Jul/14/github-changeling/#atom-everything
  GitHub's changelog reports Dependabot now waits until a release has been available on its registry for at least three days before opening a version-update PR. It's the new default and requires no configuration, giving cheap protection against malicious or quickly-yanked releases. Confirm it's active on your repos.
- **lobste.rs is now running on SQLite**
  https://simonwillison.net/2026/Jul/14/lobsters-sqlite/#atom-everything
  Lobsters completed a long-planned migration from MariaDB to SQLite and now considers it their permanent architecture. They report lower CPU and memory usage, a snappier site, and roughly half the VPS cost. A useful real-world data point when weighing SQLite for small-to-mid production workloads.
- **Bonsai 27B: a 27B-class model that runs on a phone**
  https://prismml.com/news/bonsai-27b
  PrismML announced Bonsai 27B, claimed to be a 27B-class language model that runs on a phone. Notable for local-inference builders, but treat quality and throughput claims as unverified vendor marketing until independently benchmarked.
- **The Tower Keeps Rising**
  https://lucumr.pocoo.org/2026/7/13/the-tower-keeps-rising/
  Armin Ronacher argues that agent-driven development removes the friction (reading code, asking questions, coordinating) that used to build a team's shared understanding of a codebase's concepts, boundaries, and invariants. A useful framing for anyone running multi-agent workflows on their own projects.
- **whatcable: a macOS menu-bar app for what each USB-C cable can do**
  https://github.com/darrylmorley/whatcable
  An open-source macOS menu-bar utility that inspects each connected USB-C cable and reports, in plain English, its actual capabilities (data speed, power, video). A small quality-of-life tool for Mac-based developers tired of guessing which cable does what.
- **6x faster binary search: from compiled code to mechanical sympathy**
  https://pythonspeed.com/articles/branchless-binary-search/
  A reproducible write-up showing how a branchless binary search leveraging CPU behavior (mechanical sympathy) can be several times faster than a naive implementation. Niche but a solid reference for hot search paths.
- **Temper Language**
  https://temperlang.dev/
  Temper is a new programming language that aims to compile to multiple target languages so shared logic can be written once and reused across stacks. Early-stage and unproven, but worth tracking for anyone maintaining logic across multiple languages.

## Full digest

- [R] [gh-nextjs] Next.js v16.3.0-canary.86 — https://github.com/vercel/next.js/releases/tag/v16.3.0-canary.86 — A canary release of Next.js with only miscellaneous changes: CLI spinner tweaks, doc updates, a DevTools request panel item, and dependency bumps (React, swc 73). No user-facing feature changes.
- [P] [hn-top] I tricked Claude into leaking your deepest, darkest secrets (The Memory Heist) — https://www.ayush.digital/blog/the-memory-heist — A researcher demonstrates a prompt-injection-style attack that coaxes Claude into exfiltrating data through its memory feature. For anyone building agents or MCP servers with persistent memory, the lesson is to treat stored memory as untrusted input that can carry injected instructions surfacing in later sessions.
- [R] [hn-top] Jurassic Park computers in excruciating detail — https://fabiensanglard.net/jurrasic_park_computers/index.html — A deep, nostalgic dissection of the computer systems depicted in Jurassic Park. Entertaining but with no practical takeaway for a solo builder.
- [R] [hn-top] Vancouver PD website features a Quick Escape button that wipes itself from history — https://vpd.ca/ — The Vancouver PD site adds a 'Quick Escape' button that navigates away and scrubs the page from browser history for at-risk visitors. An interesting privacy/safety UX pattern but not a decision-driving item for most solo builders.
- [P] [hn-top] TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access — https://tailscale.com/security-bulletins — Tailscale published a security bulletin (TS-2026-009) describing insecure argument handling in Tailscale SSH that could permit root access. Anyone running Tailscale SSH — especially on a VPS — should patch to the fixed release immediately and review SSH ACLs.
- [P] [hn-top] Bonsai 27B: a 27B-class model that runs on a phone — https://prismml.com/news/bonsai-27b — PrismML announced Bonsai 27B, claimed to be a 27B-class language model that runs on a phone. Notable for local-inference builders, but treat quality and throughput claims as unverified vendor marketing until independently benchmarked.
- [P] [hn-top] The Tower Keeps Rising — https://lucumr.pocoo.org/2026/7/13/the-tower-keeps-rising/ — Armin Ronacher argues that agent-driven development removes the friction (reading code, asking questions, coordinating) that used to build a team's shared understanding of a codebase's concepts, boundaries, and invariants. A useful framing for anyone running multi-agent workflows on their own projects.
- [R] [hn-top] Dependabot version updates introduce default package cooldown — https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Cursor 0day: When Full Disclosure Becomes the Only Protection Left — https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] How I use HTMX with Go — https://www.alexedwards.net/blog/how-i-use-htmx-with-go — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Solving 20 Erdős Problems with 20 Codex Accounts Running in Parallel — https://www.starfleetmath.com/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Microsoft has released software updates to plug at least 570 security holes — https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] How to stop Claude from saying load-bearing — https://jola.dev/posts/how-to-stop-claude-from-saying-load-bearing — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] I'm a USB-C Maximalist — https://shkspr.mobi/blog/2026/07/im-a-usb-c-maximalist/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] The bread paradox: why convenience always wins, and why SaaS isn't doomed — https://www.joanwestenberg.com/p/the-bread-paradox-why-convenience — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Mathematical texts from a Maya site in Guatemala identify an ancient astronomer — https://www.nature.com/articles/d41586-026-02170-8 — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] The kids with phones are alright — https://heatherburns.tech/2026/07/08/the-kids-with-phones-are-alright/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] The largest available Minecraft world, totalling 15 TB — https://2b2t.place/1million — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] LeMario: Training a JEPA World Model on Super Mario Bros — https://www.benjamin-bai.com/projects/lemario — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Launch HN: Agnost AI (YC S26) – Extract user feedback from agent conversations — https://agnost.ai — Hey HN, we’re Shubham & Parth, childhood friends building Agnost AI ( https://agnost.ai ), product analytics for teams building ch…
- [R] [hn-top] Probably check on your smart appliances — https://xeiaso.net/notes/2026/check-your-smart-tv/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] An unusual way for your DHCP server to run out of dynamic IPs — https://utcc.utoronto.ca/~cks/space/blog/sysadmin/DHCPServerAndScreamingHost — https://web.archive.org/web/20260712034557/https://utcc.utor...
- [R] [hn-top] Show HN: Juggler – an open-source GUI coding agent, by the creator of JUCE — https://github.com/juggler-ai/juggler — Hello HN, I don't post on here much, but wanted to get some eyes on a new project I'm just launching. I think we definitely need o…
- [R] [hn-top] The Estranged Worlds of J. G. Ballard — https://lareviewofbooks.org/article/jg-ballard-illuminated-man-christopher-priest-nina-allan/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Your 'app' could have been a webpage (so I fixed it for you) — https://danq.me/2026/07/09/your-app-could-have-been-a-webpage/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Are we offloading too much of our thinking to AI? — https://www.artfish.ai/p/offloading-thinking-to-ai — Scheduled agent omitted this claimed item from the completion payload.
- [P] [simon-willison] GitHub Dependabot introduces a default 3-day package cooldown — https://simonwillison.net/2026/Jul/14/github-changeling/#atom-everything — GitHub's changelog reports Dependabot now waits until a release has been available on its registry for at least three days before opening a version-update PR. It's the new default and requires no configuration, giving cheap protection against malicious or quickly-yanked releases. Confirm it's active on your repos.
- [R] [simon-willison] simonw/pedalican — https://simonwillison.net/2026/Jul/14/pedalican/#atom-everything — Simon Willison created a custom animated 'pet' for Codex Desktop — a pelican on a bicycle that reports on Codex task progress. Fun, but purely cosmetic with no practical leverage.
- [P] [simon-willison] lobste.rs is now running on SQLite — https://simonwillison.net/2026/Jul/14/lobsters-sqlite/#atom-everything — Lobsters completed a long-planned migration from MariaDB to SQLite and now considers it their permanent architecture. They report lower CPU and memory usage, a snappier site, and roughly half the VPS cost. A useful real-world data point when weighing SQLite for small-to-mid production workloads.
- [R] [simon-willison] Quoting Armin Ronacher (The Tower Keeps Rising) — https://simonwillison.net/2026/Jul/14/armin-ronacher/#atom-everything — Simon Willison quotes Armin Ronacher's essay 'The Tower Keeps Rising' about agents eroding a project's shared understanding. Duplicate of the original essay already selected in this run.
- [R] [simon-willison] datasette 1.0a37 — https://simonwillison.net/2026/Jul/14/datasette/#atom-everything — A minor Datasette pre-release with performance and documentation improvements to the permissions system, plus a reverted cosmetic API change that had broken plugin test suites. Routine maintenance with no significant new capability.
- [R] [lobsters] You should probably check on your smart appliances — https://xeiaso.net/notes/2026/check-your-smart-tv/ — Xe Iaso warns about the security and surveillance behavior of smart TVs and appliances and recommends auditing what they phone home. Sensible consumer-security advice but with limited relevance to building software.
- [R] [lobsters] qr-swastika-avoider v0.1.0 — https://crates.io/crates/qr-swastika-avoider — A Rust crate that helps generate QR codes while avoiding patterns that resemble a swastika. A niche novelty release with minimal practical signal.
- [P] [lobsters] whatcable: a macOS menu-bar app for what each USB-C cable can do — https://github.com/darrylmorley/whatcable — An open-source macOS menu-bar utility that inspects each connected USB-C cable and reports, in plain English, its actual capabilities (data speed, power, video). A small quality-of-life tool for Mac-based developers tired of guessing which cable does what.
- [R] [lobsters] Too many words about DIDs — https://steveklabnik.com/writing/too-many-words-about-dids/ — Steve Klabnik writes a long explainer on Decentralized Identifiers (DIDs), their design, and trade-offs. Educational but niche, with no near-term decision for most solo builders.
- [P] [lobsters] 6x faster binary search: from compiled code to mechanical sympathy — https://pythonspeed.com/articles/branchless-binary-search/ — A reproducible write-up showing how a branchless binary search leveraging CPU behavior (mechanical sympathy) can be several times faster than a naive implementation. Niche but a solid reference for hot search paths.
- [R] [lobsters] How I use HTMX with Go — https://www.alexedwards.net/blog/how-i-use-htmx-with-go — Comments
- [M] [lobsters] Temper Language — https://temperlang.dev/ — Temper is a new programming language that aims to compile to multiple target languages so shared logic can be written once and reused across stacks. Early-stage and unproven, but worth tracking for anyone maintaining logic across multiple languages.
- [R] [lobsters] Measuring input latency on Linux: X11 vs Wayland, VRR, and DXVK — https://marco-nett.de/blog/measuring-input-latency-on-linux-x11-vs-wayland-vrr-dxvk/ — Comments
- [R] [lobsters] The Memory Heist — https://ayush.digital/blog/the-memory-heist — Comments