Vu Nguyen

Software engineer & founder with 15 years of building tech companies and turning ideas into reality 🚀

[Mitchell Hashimoto @mitchellh]

Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).

If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!

I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.

Feeling pretty swell about this mentality with all the supply chain attacks happening.

[Andrew Ng @AndrewYNg]

There will be no AI jobpocalypse.

The story that AI will lead to massive unemployment is stoking unnecessary fear. AI — like any other technology — does affect jobs, but telling overblown stories of large-scale unemployment is irresponsible and damaging. Let’s put a stop to it.

I’ve expressed skepticism about the jobpocalypse in previous posts. I’m glad to see that the popular press is now pushing back on this narrative. The image below features some recent headlines.

Software engineering is the sector most affected by AI tools, as coding agents race ahead. Yet hiring of software engineers remains strong! So while there are examples of AI taking away jobs, the trends strongly suggest the net job creation is vastly greater than the job destruction — just like earlier waves of technology. Further, despite all the exciting progress in AI, the U.S. unemployment rate remains a healthy 4.3%.

Why is the AI jobpocalypse narrative so popular? For one thing, frontier AI labs have a strong incentive to tell stories that make AI technology sound more powerful. At their most extreme, they promote science-fiction scenarios of AI “taking over” and causing human extinction. If a technology can replace many employees, surely that technology must be very valuable!

Also, a lot of SaaS software companies charge around $100-$1000 per user/year. But if an AI company can replace an employee who makes $100,000 — or make them 50% more productive — then charging even $10,000 starts to look reasonable. By anchoring not to typical SaaS prices but to salaries of employees, AI companies can charge a lot more.

Additionally, businesses have a strong incentive to talk about layoffs as if they were caused by AI. After all, talking about how they’re using AI to be far more productive with fewer staff makes them look smart. This is a better message than admitting they overhired during the pandemic when capital was abundant due to low interest rates and a massive government financial stimulus.

To be clear, I recognize that AI is causing a lot of people’s work to change. This is hard. This is stressful. (And to some, it can be fun.) I empathize with everyone affected. At the same time, this is very different from predicting a collapse of the job market.

Societies are capable of telling themselves stories for years that have little basis in reality and lead to poor society-wide decision making. For example, fears over nuclear plant safety led to under-investment in nuclear power. Fears of the “population bomb” in the 1960s led countries to implement harsh policies to reduce their populations. And worries about dietary fat led governments to promote unhealthy high-sugar diets for decades.

Now that mainstream media is openly skeptical about the jobpocalypse, I hope these stories will start to lose their teeth (much like fears of AI-driven human extinction have).

Contrary to the predictions of an AI jobpocalypse, I predict the opposite: There will be an AI jobapalooza! AI will lead to a lot more good AI engineering jobs, and I’m also optimistic about the future of the overall job market. What AI engineers do will be different from traditional software engineering, and many of these jobs will be in businesses other than traditional large employers of developers. In non-AI roles, too, the skills needed will change because of AI. That makes this a good time to encourage more people to become proficient in AI, and make sure they’re ready for the different but plentiful jobs of the future!

[Original text in The Batch newsletter.]

[philz1337x @philz1337x]

Clarity Pro is also very good at rendering text 🤩

[Vu Nguyen @ngtrvu]

@thatguybg Yes, please

[Mitchell Hashimoto @mitchellh]

Ghostty is leaving GitHub. I'm GitHub user 1299, joined Feb 2008. I've visited GitHub almost every single day for over 18 years. It's never been a question for me where I'd put my projects: always GitHub. I'm super sad to say this, but its time to go. https://t.co/DQDemHdytV

[Vu Nguyen @ngtrvu]

compare some popular coding agents

[Jon Yongfook @yongfook]

The idea of "one shotting" an app using AI is a fugazi.

If you had to describe my app and all the edge cases I have solved over the years, it would be a prompt the size of a small book, and my app isn't even that complicated.

The people promoting creating a business overnight with AI are just selling a get rich quick pipedream. Those grifters are present in every cycle.

AI has completely transformed how I work, but you can't push a button and make money. Doesn't work like that.

[Physics & Astronomy Zone @zone_astronomy]

The highest quality video of the moon was just released… this is so beautiful.

[Brian Halligan @bhalligan]

Tomorrow on Long Strange Trip: I get to talk to @jack on how to run companies in the AI era, joined by @roelofbotha

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Vu Nguyen @ngtrvu]

The internet real estate

[TBPN @tbpn]

After buying broadcast dotcom for $8,000 in 1997, @mcuban went on a domain name buying spree when he realized he could use simple URLs to route traffic to the site.

He says he bought democracy dotcom, baseball dotcom, mrpresident dotcom, sandwich dotcom, finalfour dotcom, and more.

"You name it, I've bought it."

[Guillermo Rauch @rauchg]

1961: We should ship a CLI
2026: We should ship a CLI

[Vu Nguyen @ngtrvu]

Seems like open source is dead

Clean room engineering
1. Robot A reads documentation
2. Generates specification
↓ firewall ↓
3. Robot B implements from spec
4. Liberated package

[Vu Nguyen @ngtrvu]

@aiedwardyi yeah, we will have it when we have a gateway, so that token/creds can be refresh automatically.
on the data systems, they should be managed by data owners (either agent or human)

[Vu Nguyen @ngtrvu]

Data CLI for your AI agents.

lets you connect to any data source, a database, a file, a data warehouse, and query it from the terminal. It is designed to work seamlessly with AI coding agents like Claude Code, OpenCode, and Gemini CLI, so your agent can explore, understand, and query your data without ever touching your credentials.

https://t.co/vgCHgoJYkS

[Vu Nguyen @ngtrvu]

trying to build a data cli for interact with data in a secure way on Claude Code.

the idea is that a data cli lets you connect to any data source, a database, a file, a data warehouse, query it from the terminal.

[Vu Nguyen @ngtrvu]

trying to build a data cli for interact with data in a secure way on Claude Code.

the idea is that a data cli lets you connect to any data source, a database, a file, a data warehouse, query it from the terminal.

[jack @jack]

is the future value of "open source" code anymore? i believe it's shifting to data, provenance, protocols, evals, and weights. in that order.

[sarah guo @saranormous]

Caught up with @karpathy for a new @NoPriorsPod: on the phase shift in engineering, AI psychosis, claws, AutoResearch, the opportunity for a SETI-at-Home like movement in AI, the model landscape, and second order effects

02:55 - What Capability Limits Remain?
06:15 - What Mastery of Coding Agents Looks Like
11:16 - Second Order Effects of Coding Agents
15:51 - Why AutoResearch
22:45 - Relevant Skills in the AI Era
28:25 - Model Speciation
32:30 - Collaboration Surfaces for Humans and AI
37:28 - Analysis of Jobs Market Data
48:25 - Open vs. Closed Source Models
53:51 - Autonomous Robotics and Atoms
1:00:59 - MicroGPT and Agentic Education
1:05:40 - End Thoughts