Robert Starsi

Web developer and founder, specializing in Ruby on Rails and infrastructure.

[Robert Starsi @klevo]

Envirobly has been my three-year obsession. I launched it in October 2025 after iterating relentlessly—and then realized the story was only half told.

https://t.co/FZ7HF2Z5TR

[Robert Starsi @klevo]

Same here.

[Uncle Bob Martin @unclebobmartin]

I am absolutely more productive using agents. I don't know the factor but it's large. However much of that productivity is spent tuning the agents and hardening the product. I'm guessing 30%-40%.

Some might consider that a waste; but I don't. The software I'm creating nowadays is vastly more robust than I'd ever been able to create manually.

I don't mean that the code is better. I mean the surrounding tests are vastly better. I have a higher degree of confidence than I ever had manually -- even when I used very disciplined TDD and Acceptance testing.

And then there's the ability to quickly reorganize the modules and the architecture while keeping those robust tests running. That is a tremendous boon.

[Robert Starsi @klevo]

Been driving GPT 5.5 in default mode in OpenCode in the last few days and it's fast, accurate and gets the job done. Especially the speed is far above Opus 4.7.

[DHH @dhh]

For complicated agent work, it's amazing how much GPT5.5 has improved. I found 5.2 to be very far behind Opus. Now using Opus 4.7 after 5.5 feels like a big step backwards. Gotta love this level of competion! Strong comeback for OpenAI.

[DHH @dhh]

The reason agents are so good at Linux is that all 40 million lines of kernel code was part of the pre training. Along with every other open source dependency. This really does make every obscure error message shallow, and the system completely malleable.

[Mitchell Hashimoto @mitchellh]

Supply chain attacks and OSS sustainability go hand in hand. I've semi-seriously joked for years that OSS upstreams should periodically purposely inject full vulns into their code and let downstreams fuck around and find out. Downstreams can pay to get the non-FAFO version.

The not joke part is simply that OSS maintainers aren't a supply chain. OSS maintainers are not responsible for monitoring CVEs (because, they are not a supply chain). OSS maintainers are not at fault when bad shit happens to downstreams, because basically every OSS license (MIT, Apache, GPL, etc.) literally says: the software is provided "as-is, without warranty." You get what you pay for (that is to say: absolutely nothing!)

Now, the joke part is that I do believe there is an ethical obligation to try to prevent harm downstream. But "try" is the key word. So, this isn't a serious proposal.

But, if you're using OSS code and you're not paying for a license with a contract that promises some kind of warranty, you have no supply chain. You (the downstream user of an OSS lib) ARE the supply chain.

To use a metaphor: physical goods have a real supply chain. Car manufacturers, chips, clothes, toys, etc. You have a signed commercial agreement with all your suppliers that promises quantity AND quality and blowback if either are missed. Thats a supply chain.

If someone puts some chips on the side of the road with a "FREE" sign, then you integrate those into a product, then find out those chips are hacking customers, its your fault, not the person who dropped them on the side of the road.

[Terminal Trove @terminaltrove]

wrkflw is a CLI and TUI tool for testing and running CI jobs locally.

You can validate GitHub / GitLab CI workflows, run jobs, watch logs, manage secrets, use Docker, Podman runtimes and more.

@bahdotshx made wrkflw using @ratatui_rs and is Terminal Tool of the Week! ⭐️

[Robert Starsi @klevo]

lol, spam these days

[Robert Starsi @klevo]

Cancelling the Premium X subscription for now. Primarily disappointed by complete lack of human customer support. Further, there are still ads and I haven't noticed any post boost effect whatsoever. X is a good platform but this didn't feel "premium" at all.

[DHH @dhh]

Ternus has a unique chance to reset the relationship between developers and Apple: 1) Tear down the App Store tollbooth, 2) reintroduce Boot Camp for M macs so we can run Linux on them, and 3) fix the infuriating 500ms workspace animation delay. Approval rating +50% instantly.

[DHH @dhh]

In 2023, we spent $3,934,099 on AWS + other hosting. In 2026, our hosting + support bill is down to ~$1m/year due to the cloud exit. Even including all the hardware buying, we will already have saved ~$4m by the end of this year. And going forward, it's ~$3m/yr in savings 🤑

[Marco Roth @marcoroth_]

I just released a new version of the Stimulus LSP that is now fully powered by the power and intelligence of the Herb toolchain! 🌿

I'm so happy that this finally came full circle. These features are initially what prompted me to start working on Herb!

[Nate Berkopec @nateberkopec]

Puma 8.0 "Into The Arena" has been released!

1. Framework/lib authors can move threads into a special "high IO" pool
2. single/cluster DSL hooks for easier config
3. API for adjusting threadpool size at runtime (who would want to that? stay tuned...)

[Robert Starsi @klevo]

Nice!

[Jesse Duffield @DuffieldJesse]

As of the new lazygit release you can now see github PR statuses against each branch! (Requires the `gh` CLI tool installed)
https://t.co/FkLCTsur97

[DHH @dhh]

"This is the kingliness of Friendship." — C.S. Lewis

[dax @thdxr]

right now everything in the world is telling you to go faster, ship more, add that feature, start another project

so i'm actively working on feeling ok not doing any of that

[Gianfranco @gianfrancopiana]

https://t.co/Lk1JSMCRGS

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[daz @MetamateDaz]

You used to have your bet ideas in the shower, now you have a waterproof speaker. You used to get lost in thought waiting for the train, now you have a phone to fill the gap. You used to daydream on long flights, now there's a screen in your hand and on the seat in front of you. You used to think on your morning commute, now you have a podcast playing before you leave the house.
We used to stare in to the sky or into a fire and let our minds drift, now we have TVs and phone to replace that. We filled every silence and lost all of our peace, creativity and ideas that lived within that silence.

[dax @thdxr]

opencode 1.3.0 will no longer autoload the claude max plugin

we did our best to convince anthropic to support developer choice but they sent lawyers

it's your right to access services however you wish but it is also their right to block whoever they want

we can't maintain an official plugin so it's been removed from github and marked deprecated on npm

appreciate our partners at openai, github and gitlab who are going the other direction and supporting developer freedom

[Mike McQuaid @MikeMcQuaid]

Today I’m proud to announce the release of Homebrew 5.1.0. The most significant changes since 5.0.0 are expanded brew bundle support, brew version-install, new -full formula handling and installer updates.

https://t.co/LH7h7Hvo7g

[Robert Starsi @klevo]

Limits and quotas left and right on new accounts. It’s a jungle gym.

[dax @thdxr]

it took us several days to get our new AWS accounts properly provisioned with the right capacity limits to deploy our stuff

it's crazy how things have regressed here