TV4 Blamed AI for a Deleted Show. The Real Bug Was an Untested Backup.
TV4 denied an AI agent deleted its reality show's final cut. Its own program director says a backup system failed, and nobody had tested it.
Blog: Go, PostgreSQL, AI agents, engineering careers and leading small teams
PostgreSQL & pREST
pREST v2.5 Adds MySQL: A REST API and MCP Server for Your MySQL Database
pREST v2.5 turns a MySQL 8 database into a REST API and an MCP endpoint for AI agents. Set engine = "mysql" and point it at your database. Docker quickstart, auth, and what differs from Postgres.
Go · Go in productioneasypprof: Production-Safe pprof for Go Services
easypprof serves Go's pprof on a loopback listener with token auth, a duration cap, a concurrency limit and an audit log, so production profiling is safe.
Latest
Why Anthropic Had to Replace Git With Scion
Anthropic was merging 30,000 code changes a day and git could not keep up, so it built Scion: a centralized, always-online version control system with real prior art in Google Piper and Meta Sapling.
Why Deleting Your Cookies Doesn't Stop Browser Fingerprinting
royfish's breakdown of browser fingerprinting shows why cookies were never the real privacy threat. Deleting them does nothing about tracking built from your hardware, and the fix is messier than installing a privacy extension.
What Git 3.0's SHA-256 Migration Gets Wrong About Real Attacks
GitHub co-founder Scott Chacon argues Git 3.0's switch to SHA-256 will cost the industry years of broken tooling to defend against an attack nobody has actually pulled off. Developers in the discussion pushed back hard, and not all of it held up.
Idempotency Keys for Money Movement: Preventing Double Charges
An idempotency key is a client-generated value that lets a payments API recognize a retry and replay the original result instead of charging twice.
When AI-Assisted Code Reinvents a Protocol, Badly
A federated, IRC-speaking chat network shipped this week with working tests and full docs, built largely with an AI coding assistant. Developers reviewing it say it reinvents about half of XMPP, without XMPP's years of hardening.
What Government NixOS Migrations Get Right About Vendor Lock-In
Governments in the Netherlands, France and Germany are rebuilding their desktop stack on declarative Linux instead of Windows. Developers say the operating system was the easy swap, and point to where these projects will really stall.
AI-Written PR Descriptions: Why Reviewers Stop Reading
Colin Breck's essay on AI-written docs hit #3 on Hacker News. Why generated PR descriptions lose reviewers, the best pushback from the thread, and what to write yourself.
Reviewing AI-Generated Pull Requests: A Staff Engineer's Checklist
How to review AI-generated pull requests: read the diff before the description, check that tests assert something, find hidden scope and invented APIs.
pREST in 10 Minutes: Docker Compose to REST API to MCP Endpoint
Run pREST v2.4.2 with Docker Compose, query a Postgres table over REST, turn on JWT auth and a table ACL, add a bound custom query and call /_mcp.
pREST v2 Guide: Versions, Upgrade Path and Where to Start
pREST is an open-source Go server that turns PostgreSQL or MySQL into a REST API and a read-only MCP endpoint. Every v2 release, the advisories, and where to start.
win95 v2.0.0 and v2.0.1: A Windows 95 Theme for VS Code and Cursor
win95 v2.0.0 reworks the Windows 95 VS Code theme for readability — silver-gray editor, navy activity bar, teal status bar. v2.0.1 publishes it to Open VSX so Cursor, VSCodium and Windsurf can install it.
Careers · Staff Engineer guide
Staff vs Principal vs Distinguished Engineer: How the Titles Map Across Companies
Staff, Principal and Distinguished are the IC rungs above Senior, but the same word means different scopes at Google, Amazon, Microsoft and a startup.
Go · Go in production
How the Go Scheduler Works: G, M and P Explained With What You See in pprof
The Go scheduler multiplexes goroutines (G) onto OS threads (M) via per-P run queues, with a global queue, work stealing and handoff on blocking syscalls.
Leadership · Fractional CTO guide
Technical Due Diligence Checklist for Non-Technical Founders
A one-week technical due diligence checklist a non-technical founder can run with a borrowed engineer: ownership, code, data, security, ops, team, cost.
Careers · Staff Engineer guide
Staff Engineer Interview: The Four Rounds and What Interviewers Actually Score
A Staff engineer interview has four rounds: coding, system design, behavioral and a project retrospective. What panels score, and how strong Seniors fail.
pREST v2.4.1 and v2.4.2: You Cannot Blacklist Your Way Out of SQL Injection
pREST v2.4.1 closes an 8.6 SQL injection in _QUERIES templates and an /_mcp catalog-exposure bypass — then its SQL-keyword blacklist silently blanked 17.5% of one production catalog. v2.4.2 replaces screening with real parameter binding, adds script path-traversal containment, and enforces RFC 7518 minimum JWT key sizes.
Go · Go in production
Go Microservices in Production: Lessons From Building a Distributed Platform From Scratch
Go microservices hold up when each service owns its data, every call has a timeout and a request is traceable end to end. Lessons from LodgeLink and 90POE.
Postgres MCP Servers Compared: Read-Only Posture, Auth and Auditability
Six Postgres MCP servers compared on write posture, auth and audit trail: Anthropic's archived reference, Postgres MCP Pro, Supabase, Neon, pgEdge, pREST.
pREST v2.4.0: pgvector Search, OpenTelemetry, and Six More SQL Injection Fixes
pREST v2.4.0 adds pgvector nearest-neighbor search and distance filtering, opt-in OpenTelemetry tracing/metrics/logs with a local SigNoz stack, and closes six SQL-injection-adjacent security gaps found via advisory review — including a sibling of the v2.3.0 _select fix living in _groupby.