Jonathan

all things open source
vp developer products @linuxfoundation, prev founded (acq)

[Jonathan @jonathimer]

What if your AI coding assistant actually understood developer marketing?

I made 30+ skills that teach Claude Code, Cursor, and Windsurf how to:

• Write Show HN posts that don't get flagged
• Create docs that actually convert
• Engage Reddit without getting roasted
• Build newsletters devs actually read

Open source. MIT licensed.

https://t.co/zE2UxgHCdJ

[Agentic AI Foundation @AgenticAIFdn]

The lead maintainer of MCP, Den Delimarsky, has a warning:

"Don't translate your entire API into an MCP server." 100 endpoints as 100 tools is chaos for your AI client.

Design around user scenarios. Expose only what solves the workflow.

Full podcast: https://t.co/Y2Thvcak63

[Jonathan @jonathimer]

Agentic AI Foundation (AAIF) is the fastest growing open source organization in history

Now at 190 corporate members – 5 months after launch

[Agentic AI Foundation @AgenticAIFdn]

The Agentic AI Foundation Welcomes 43 New Members Amid Surging Enterprise and Government Interest in Open Agent Standards.

The latest cohort of members — @F5, @GoDaddy, @stripe, @trondao, and others — brings deep technical expertise spanning the entire modern AI infrastructure stack, from application delivery and payment processing to cybersecurity, robotics, and cloud-native development.

Through their membership, these organizations will collaborate across ecosystems and contribute to the development of interoperable, standardized agentic infrastructure.

Read the full press release here: https://t.co/O7bnnZ0TgW

[Jonathan @jonathimer]

@victoria_framer probably Claude

[Jonathan @jonathimer]

OpenClaw creator @steipete took over as world's #1 open source contributor

measured by number of contributions to critical oss projects in last 12 months, source: lfx insights

[Andrej Karpathy @karpathy]

This works really well btw, at the end of your query ask your LLM to "structure your response as HTML", then view the generated file in your browser. I've also had some success asking the LLM to present its output as slideshows, etc.

More generally, imo audio is the human-preferred input to AIs but vision (images/animations/video) is the preferred output from them. Around a ~third of our brains are a massively parallel processor dedicated to vision, it is the 10-lane superhighway of information into brain. As AI improves, I think we'll see a progression that takes advantage:

1) raw text (hard/effortful to read)
2) markdown (bold, italic, headings, tables, a bit easier on the eyes) <-- current default
3) HTML (still procedural with underlying code, but a lot more flexibility on the graphics, layout, even interactivity) <-- early but forming new good default
...4,5,6,...
n) interactive neural videos/simulations

Imo the extrapolation (though the technology doesn't exist just yet) ends in some kind of interactive videos generated directly by a diffusion neural net. Many open questions as to how exact/procedural "Software 1.0" artifacts (e.g. interactive simulations) may be woven together with neural artifacts (diffusion grids), but generally something in the direction of the recently viral https://t.co/z21CP5iQfu

There are also improvements necessary and pending at the input. Audio nor text nor video alone are not enough, e.g. I feel a need to point/gesture to things on the screen, similar to all the things you would do with a person physically next to you and your computer screen.

TLDR The input/output mind meld between humans and AIs is ongoing and there is a lot of work to do and significant progress to be made, way before jumping all the way into neuralink-esque BCIs and all that. For what's worth exploring at the current stage, hot tip try ask for HTML.

[Jonathan @jonathimer]

@LottiSchmitt railway is really a funny keyword to track 😅

[Charlotte Schmitt @LottiSchmitt]

https://t.co/vlIBBiYAJO

[clem 🤗 @ClementDelangue]

Weird how some people always target open-source in AI!

First it was:
“Open-source AI will destroy the world” (spoiler: it didn't and it won't)
Now:
“Open-source is a cybersecurity threat because of AI”

Both narratives are far too simplistic.

The truth is that the exact same risks exist in closed-source systems, often even more so. For example, in practice, APIs can create much bigger data and security vulnerabilities than open systems you can inspect, self-host, and secure yourself.

And as with software more broadly, open-source often ends up more secure because it benefits from far more scrutiny than private internal systems.

The reality is not “open vs closed.”

The reality is that AI is raising cybersecurity stakes across the board, and we need to tackle that seriously together.

[Jonathan @jonathimer]

@calcom just went closed source, because of "AI security threats"

A skilled attacker will find your bugs regardless of code visibility. You may delay discovery through obscurity, but it will find you if the project is interesting enough.

The entire field of security engineering rejects "security through obscurity."

Over time, open source projects have the potential to become more secure than closed alternatives: more eyes on the code means faster vulnerability discovery and more detailed fixes.

What really doesn't sit right: using this moment to declare open source dead with a click-baity statement.

Open source is the movement that made Cal the company it is today. Their contributors, their their funding, their customers was all built on that promise.

I can respect any business decision but why use it to dunk on open source as a whole?

Open source is far from dead.

[Sumit Kumar @TweetsOfSumit]

In Deutschland traut sich kein Gründer auch nur 1€ ohne korrekte Umsatzsteuer-ID und -Ausweisung in Rechnung zu stellen.

In den USA fangen Startups bei $200M ARR dann mal gemächlich an sich überhaupt mit USt zu beschäftigen...

[Jonathan @jonathimer]

where does the 5-10x come from?

your blog post says: "In controlled benchmark testing using the publicly available XBow validation suite, access to source code increased vulnerability detection by approximately 20% compared to black-box testing."

i'm seriously interested to understand this as it contradicts everything i know about open source security

[Jonathan @jonathimer]

@calcom just went closed source, because of "AI security threats"

A skilled attacker will find your bugs regardless of code visibility. You may delay discovery through obscurity, but it will find you if the project is interesting enough.

The entire field of security engineering rejects "security through obscurity."

Over time, open source projects have the potential to become more secure than closed alternatives: more eyes on the code means faster vulnerability discovery and more detailed fixes.

What really doesn't sit right: using this moment to declare open source dead with a click-baity statement.

Open source is the movement that made Cal the company it is today. Their contributors, their their funding, their customers was all built on that promise.

I can respect any business decision but why use it to dunk on open source as a whole?

Open source is far from dead.

[Bailey Pumfleet @pumfleet]

Open source is dead.

That’s not a statement we ever thought we’d make.

@calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up.

AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost.

In that world, transparency becomes exposure. Especially at scale.

After a lot of deliberation, we’ve made the decision to close the core @calcom codebase.

This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible.

We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple:

Protecting our customers and community at all costs.

This may not be the most popular call.

But we believe many companies will come to the same conclusion.

My full explanation below ↓

[Beka @bekacru]

Understand the point, not sure if I understand why you guys needed to clickbait it.

Every company including cal relies and will continue to rely on a ton of oss projects and all those people work hard at this time to do that same thing cal is running from to keep everyone safe. Mostly for free.

You can change your mind for any reason and that’s fine but no need to make a huge assertion like this as a marketing stunt.

If anything, it sounds like oss will become more secure in the long run

[Peter Steinberger 🦞 @steipete]

If you look at GPT 5.4-Cyber and it's ability for closed source reverse engineering, I have bad news for you.

I do very much feel the pain though, there's hundreds of teams that try to poke holes into @openclaw. Our response has been of rapid iteration and code hardening. Which did introduce occasiaonal regression (and yes you all been yelling at me), but I see as the only way forward.

I would be very careful of other open source projects/harnesses that ignore this work and do not publish their advisories. https://t.co/NBaCouMs3i

[Jonathan @jonathimer]

AI brings new risks, but nothing a motivated hacker couldn't already do with your open source repo when you started the project. That fundamentally hasn't changed.

If you see an open codebase as a liability, you probably shouldn't have started an open source company.

Your AGPL license always signaled to the community that something like this couldn't happen. I'm not sure it even can legally.

I've always admired Cal as a company, but this looks like a textbook open source rug pull.

[Jonathan @jonathimer]

@TweetsOfSumit @ClickHouseDB check out @tinybird

[Anthropic @AnthropicAI]

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.

It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7

[Jonathan @jonathimer]

@LokiUnchained @linuxfoundation security is a real concern here, but I think the tooling maintainers have available is also getting better

@linuxfoundation recently announced $12.5M in grants to support open source security

[Jonathan @jonathimer]

we built an ai code tracker for the world's most critical open source projects at @linuxfoundation

- ai commits went from 2% to 8% in 6 months
- code claude is exploding since start of 2026

this means that ai coding is happening in critical infrastructure: the projects that power the internet, cloud, security.

i want to expand this report (break it down by stack, programming language, etc).

which insights would you be interested in?

[Jonathan @jonathimer]

what if agents could recreate any open source project from scratch?

malus[.]sh went viral on HN two weeks ago with exactly this idea.

the pitch: legally distinct code. corporate-friendly licensing. no attribution. no copyleft. no problems.

except there's one problem: somebody has to maintain all of it.

it's almost safe to say that code is becoming a commodity. but responsibility for code isn't.

you still need somebody to reach out to if things break

the value of code → 0.
the value of ownership → up.

the question is what this means for maintainers of open source projects

(btw, malus was a thought experiment presented at FOSDEM this year)