Web·
Shopify bought Tailwind Labs eight months after the CSS maker cut 75% of its engineers
Adam Wathan says Tailwind CSS stays MIT-licensed under Shopify. Tailwind Plus and ui.sh closed to new customers the same day, ending the revenue behind it.
Topic
Open source ecosystem
Open source is having a governance decade. Ruby Central is in “real financial jeopardy”; the FSF is openly ruling on AGPL abuse; Ubuntu shipped its first Wayland-only LTS; Firefox is running on Anthropic’s Mythos Preview to find 271 CVEs at a time. None of these are purely technical stories — they’re about who funds the plumbing every profitable tech stack depends on, and what happens when the answer is “no one consistent enough.”
68 articles in this topic
Open Source·
Automattic's board voted Matt Mullenweg onto paid leave. He still controls WordPress.org.
Automattic's board put its founder on paid leave with 50 minutes of notice and no legal review. CFO Mark Davies is interim CEO. WordPress.org is untouched.
AI·
Nvidia's $12.9 billion bid for Hugging Face would also buy the llama.cpp team
Hugging Face turned down Nvidia at a $7 billion valuation last year. The reported price is now $12.9 billion, and the ggml maintainers come with it.
Open Source·
DHH's Omarchy left every desktop process one command away from root for 14 months
Omarchy's installer put the default user in the docker group, which is passwordless root on Linux. Version 4.0.1 drops it and old installs migrate at login.
Web·
Mozilla made Google rewrite the JPEG XL decoder in Rust before Firefox would ship it
Firefox turns JPEG XL on by default in version 157. Mozilla refused to ship 100,000 lines of C++, so Google Research wrote the decoder again in Rust.
Security·
Metabase's password-reset endpoint handed out admin, and Framework had to email every customer
A CVSS 10.0 SQL injection in Metabase was exploited from August 3. Framework told every customer their data was taken. Tally lost emails and password hashes.
Web·
Agents that start with access to nothing: Cloudflare open-sourced the agent platform it runs internally
Cloudflare open-sourced Cloudflare OS under Apache 2.0 and shipped Kitesurf, WebMCP, and Wallets the same week. Here's which pieces are GA and which are private beta.
Open Source·
Rust's new rules require disclosing LLM use. A Linux maintainer gives AI patches three seconds.
Five Rust teams ratified an LLM policy that bans AI-written docs and mandates disclosure. Linux leaves it to each maintainer. Both are rationing review time.
AI·
Alibaba's Qwen3.8-Max beats Fable 5 on Terminal-Bench, and the weights go public next week
Qwen3.8-Max is a 2.4-trillion-parameter MoE that tops Claude Fable 5 on Terminal-Bench 2.1 and trails it badly on SWE-bench Pro. It's the first open Max-tier Qwen.
Open Source·
65.9% of the web platform tests now pass in Servo, but the Rust engine can't select text
Servo 0.4.0 landed a record 558 commits and fixed layout on real sites. Its own dashboard reads 65.9%, CSS Grid sits at 37.8%, and text selection isn't shipped yet.
Web·
TypeScript compiled to native: Vercel's scriptc ships a 178KB binary with no JS engine
Vercel Labs open-sourced scriptc, a TypeScript-to-native compiler with no JS engine in the binary. Its README claims 2.4ms startup. Hacker News is not convinced.
Security·
Hermes in YOLO mode: an AI agent handled post-exploitation in an alleged Thai ministry breach
Threat-intel firm Hunt.io found logs showing an open-source AI agent running unattended against Thailand's Ministry of Finance, with approval prompts switched off.
Open Source·
Codeberg banned LLM-generated projects, and Debian is voting on the same question
Codeberg's terms now bar projects that mostly consist of AI-written code. Debian's open resolution puts three answers on one ballot. Provenance is the crux.
Web·
Jack Dorsey launched Buzz to replace Slack and GitHub. Its AI agents are full members
Jack Dorsey's Block launched Buzz, an open-source workspace that fuses team chat, AI agents, and Git hosting on Nostr, aiming squarely at Slack and GitHub.
Security·
Secure Boot's 2011-era keys start expiring, cutting off boot updates on unpatched PCs
Microsoft's 2011 Secure Boot certificates started expiring in June 2026. Here's what breaks on Windows and Linux, and the one update that fixes it.
Hardware·
Flipper Zero's 700 KB flash wall: the firmware future is now community-driven
Flipper Devices says the Flipper Zero isn't abandoned, but a 700 KB flash limit is pushing firmware work onto the community while its team builds new hardware.
Open Source·
Spoof an Apple device ID and your AirPods unlock their hidden features on Android
LibrePods reverse-engineers Apple's private AirPods protocol to bring ear detection, battery status, and noise control to Android and Linux.
Open Source·
HackerRank open-sourced its resume screener. The same resume scored 66 to 99.
HackerRank put its AI hiring agent on GitHub under MIT. One developer ran a single resume through it 100 times and watched the score swing from 66 to 99.
AI·
Anthropic wants Congress to punish Alibaba over 28.8 million Claude queries
Anthropic says Alibaba ran the largest distillation campaign it has caught, using 25,000 fake accounts to copy Claude. Here is what that claim actually means.
Open Source·
Deno 2.9 nearly doubled its cold start and learned to read Bun's lockfiles
Deno 2.9 ships a 1.98x faster cold start, a native desktop-app builder, and direct reading of npm, pnpm, yarn, and Bun lockfiles. Here's where Deno sits now.
Web·
This month on Hacker News: Half-Life 2 in a browser and 18 years of comments, searchable
June 2026's standout Hacker News projects: Half-Life 2 streamed into a browser tab, a searchable 18-year HN archive, a Pareto-frontier mini-PC tracker, and more.
Open Source·
Intel quietly switched off the open-source evangelism program it ran for two decades
Intel archived its Open Ecosystem Community and Evangelism hub and dozens of open-source projects as cost cuts reshape what one of Linux's biggest backers funds.
Open Source·
Epic's Lore: the open-source version control built for the repos Git and Perforce choke on
Epic Games open-sourced Lore, a binary-first version control system meant to scale to Fortnite-sized monorepos that break Git and cost a fortune on Perforce.
Open Source·
40,000 server workloads are leaving VMware. Tesco blames Broadcom's 'abusive' licensing.
Tesco is moving 40,000 workloads off VMware and suing Broadcom for £100M, the loudest signal yet in the post-acquisition exodus toward KVM, Proxmox, and OpenStack.
Gaming·
SteamOS 3.8 now runs on the ROG Ally, not just Valve's Steam Deck
SteamOS 3.8 is stable, with a new kernel, Steam Machine support, and official builds for the ROG Ally and other handhelds. The Windows monopoly on handhelds just cracked.
Security·
An AI agent found 21 ways to attack FFmpeg, the codec library inside almost everything
DepthFirst's agent surfaced 21 FFmpeg zero-days for about $1,000. One 183-byte packet hits RCE. The deeper story is who pays the volunteers who fix them.
Security·
Red Hat's npm namespace and Arch's AUR were both backdoored within two weeks of each other
A worm hijacked Red Hat's npm namespace, a rootkit spread through 1,500 Arch AUR packages, and a SOC 2-certified AI gateway shipped malware. Registries are under fire.
Open Source·
Cloudflare bought VoidZero, the team behind Vite. The tools stay MIT and vendor-neutral.
Cloudflare acquired VoidZero, Evan You's company behind Vite, Vitest, Rolldown and Oxc. The tools stay MIT-licensed, and there's a $1M ecosystem fund.
Gaming·
Beyond the engine: six open-source tools that shape how games get made
Godot, Unity and Unreal get the headlines, but six open-source tools quietly do the art, levels, and dialogue work that real games ship on.
Open Source·
Microsoft is shipping Linux's core commands on Windows, built in Rust
Microsoft's Coreutils for Windows brings native ls, cp, and grep to Windows, built on the Rust uutils project. Here's what it is and why the Rust rewrite matters.
Open Source·
SQLite won't accept AI-written code, but QEMU just opened the door to it
Two of the most cautious C projects split on AI contributions in the same week. The real fight is over copyright provenance and who cleans up the slop.
AI·
Hacker News is obsessed with durable Postgres workflows and a game about clicking yes
Six dev-tooling and AI posts that climbed Hacker News in late May 2026: durable execution on plain Postgres, LLM code smells, a permission-fatigue game, Rust 1.96, and more.
Open Source·
MySQL just fixed a 20-year-old bug where cascade deletes silently skipped triggers
MySQL bug #11472 was filed in 2005: triggers never fired on foreign key cascade actions, silently breaking audit logs. MySQL 9.7 finally closes it via WL#17024.
Open Source·
Microsoft just open-sourced 86-DOS. Tim Paterson's 45-year-old listings are now on GitHub under MIT.
Yufeng Gao and Rich Cini scanned Tim Paterson's 1981 assembler printouts. Microsoft pushed them to DOS-History/Paterson-Listings on April 28, the 45th anniversary.
Hardware·
AMD walled off Linux Vivado behind a paid tier. The free FPGA tier is now Windows only.
Vivado 2026.1 introduces a five-tier licensing model. The free BASIC tier supports Windows only; Linux requires the paid CORE tier. FPGA hobbyists are pushing back.
Open Source·
Flatpak's next sandboxing milestone bolts it to systemd. Alpine and Void users get the bill.
Sebastian Wick and Adrian Vovk pitched systemd-appd at Linux App Summit on May 17. The cost of nested sandboxing is a hard systemd dependency in mainline Flatpak.
Open Source·
yt-dlp's maintainer says Bun is now 'fully vibe-coded'. Support is officially deprecated.
yt-dlp's maintainer bashonly says Bun's Rust rewrite 'has taken a turn towards being fully vibe-coded.' The supported window narrowed to four versions.
Hardware·
Alibaba's new Zhenwu M890 chip is 3x faster and aimed straight at agent workloads
Alibaba showed the Zhenwu M890 at its Cloud Summit on May 19. 144 GB of memory, 800 GB/s interchip bandwidth, and Qwen3.7-Max riding on top.
Open Source·
Cloudflare taught wasm-bindgen to catch a Rust panic. Workers no longer poison the sandbox.
Three Cloudflare engineers shipped panic and abort recovery into wasm-bindgen on April 22. A Rust Worker that panics now reinitialises on the next request.
Web·
Atlassian laid off the engineer who built its edge. He published the blueprints.
Vasilios Syrakis spent eight years building Atlassian's Envoy control plane. After the March cuts, he posted a 40-minute walkthrough that hit 1.1M views.
Open Source·
Elizabeth Figura's NTSYNC driver shipped in Linux 6.14. Wine 11 retired esync and fsync over it.
Linux 6.14 merged the NTSYNC driver Elizabeth Figura wrote at CodeWeavers. SteamOS 3.7.20 loads it by default; Wine 11 went mainline on it. Here's what changed.
Hardware·
The OrcaSlicer fork Bambu Lab killed has six mirrors. Jeff Geerling joined the boycott.
FULU-Foundation/OrcaSlicer-bambulab hit 1,700 stars on May 12. Geerling won't recommend a Bambu printer again, and Louis Rossmann pledged $10,000 toward Jarczak's defense.
Open Source·
120 million plugin downloads later, Obsidian moved off GitHub. Paid plugins are now allowed.
Obsidian launched Obsidian Community on May 12. The new directory replaces the GitHub plugin queue with automated reviews, and paid plugins are in for the first time.
Open Source·
RPCS3's maintainers will ban contributors who submit undisclosed AI pull requests
The PS3 emulator project posted on X on May 10, citing 'AI slop' that has been clogging review. The hard line: ban-on-sight if you don't disclose.
Security·
A nine-year-old Linux kernel bug gives root in one command. No patch exists yet.
Dirty Frag chains two page-cache flaws in the ESP and RxRPC subsystems into a deterministic privilege escalation that hits every major distro. A PoC exploit is public.
Open Source·
Jarred Sumner rewrote 960,000 lines of Bun from Zig to Rust in six days. He might throw it all away.
Bun's creator used Claude to port the JavaScript runtime from Zig to Rust, hitting 99.8% test compatibility. He says there's a 'very high chance' it gets scrapped.
Gaming·
Valve open-sourced the Steam Controller's shell. Dbrand had a skin ready in 48 hours.
Valve published STP and STL CAD files for the Steam Controller and Puck under CC BY-NC-SA 4.0 on GitLab. Anyone with a 3D printer can now mod it.
Hardware·
Bambu Lab killed an OrcaSlicer fork by lawyer letter. The fork was based on Bambu's own AGPL code.
Pawel Jarczak pulled OrcaSlicer-bambulab off GitHub on May 1 after Bambu Lab's legal team accused him of impersonating Bambu Studio and bypassing authorization.
Open Source·
Microsoft open-sourced the earliest known DOS code, transcribed from a stack of Tim Paterson's printouts.
MIT-licensed at GitHub on April 28, the 86-DOS 1.00 kernel and PC-DOS development snapshots were OCR'd from 45-year-old assembler listings.
Security·
A DDoS knocked Ubuntu's update servers offline. The Copy Fail patch landed in the same 24-hour window.
The 313 Team flooded Canonical's infrastructure starting May 1, blocking apt updates and the Ubuntu security API just as admins needed both.
Open Source·
An unofficial Notepad++ port finally landed on Mac. Don Ho didn't write it.
Andrey Letov shipped a native macOS Notepad++ port as a universal binary with the original Scintilla engine and a new Cocoa UI. It's GPL, free, and unaffiliated with Don Ho.
Open Source·
Zed 1.0 ships its agentic editor. The Atom team's Rust rewrite finally has a stable label.
Zed Industries shipped 1.0 on April 29 after five years of Rust and GPU work. Free forever for humans, with $10/month hosted AI and an open Agent Client Protocol.
Security·
'Copy Fail' lets a 732-byte script grab root on Ubuntu, RHEL, and SUSE. Patched April 29.
CVE-2026-31431 chains AF_ALG and splice() to write into the page cache of /usr/bin/su. Xint Code disclosed it on April 29, nine years after the bug shipped.
Open Source·
Mitchell Hashimoto is pulling Ghostty off GitHub. The reason is daily outages.
Ghostty's creator has tracked GitHub outages every workday for months. After 18 years on the platform, he's moving the project. A read-only mirror stays.
Open Source·
Warp's terminal is now open source. The cloud agent platform Oz is the actual product.
Warp released its 36k-star Rust client on GitHub under AGPLv3 on April 28. OpenAI is the founding sponsor and Oz keeps the bills paid.
Open Source·
MinIO archived its repo on April 25. The community fork already has the admin console back.
MinIO's GitHub repo went read-only with a 'NO LONGER MAINTAINED' banner pointing users at AIStor. Pigsty's Ruohang Feng forked it and restored the binaries.
AI·
DeepSeek V4 lands: 1.6T-param open MoE, 1M-token context, and SWE-bench within 0.2 of Opus 4.6
DeepSeek shipped V4-Pro and V4-Flash under MIT on April 24. V4-Pro hits 80.6% on SWE-bench Verified. V4-Flash is $0.14 in / $0.28 out.
Open Source·
Linux 7.1 is yanking ham radio, ISDN, and ATM. The reason: AI bug-report spam.
Jakub Kicinski's networking pull request removes 138,161 lines of decades-old code. Kernel maintainers say LLM-generated bug reports made the old subsystems un-maintainable.
Open Source·
Ubuntu 26.04 LTS ships Wayland-only, Rust coreutils, and post-quantum SSH by default
Canonical released Ubuntu 26.04 'Resolute Raccoon' on April 23. It's the first LTS without X11, ships kernel 7.0 and GNOME 50, and sets post-quantum SSH on by default.
Open Source·
Mozilla fixed 271 Firefox bugs that Claude Mythos found. Its own tests caught 22.
Firefox 150 shipped Monday with 271 security fixes from Anthropic's Project Glasswing. Mozilla CTO Bobby Holley says Mythos matches elite human researchers.
Hardware·
Framework's Laptop 13 Pro is a ground-up redesign: aluminum, 20-hour battery, $1,199 DIY
Framework opened pre-orders for the Laptop 13 Pro on April 21. Panther Lake or Ryzen AI 300, LPCAMM2, a 74Wh battery, and Framework's first touch display.
Open Source·
Inside GitHub's fake star economy: 6 million bought stars and how to spot them
A Carnegie Mellon study counted 6 million suspected fake stars across 18,617 GitHub repos. Here's what the StarScout research actually found and how to read a star count now.
Open Source·
Ruby Central admits 'real financial jeopardy' seven months after the RubyGems takeover
Ruby Central cut its executive director, CFO, and PR firm, and shifted to a volunteer working board. The April 16 letter closes the arc from September's RubyGems walkout.
Open Source·
The FSF just told OnlyOffice it can't use AGPLv3 to block forks
OnlyOffice bolted a 'keep our logo' clause onto its AGPLv3, then accused the Euro-Office fork of violating it. The FSF says users can strip the clause.
Open Source·
Cloudflare open-sourced a lossless LLM compressor that shaves 22% off model weights
Unweight is Cloudflare Research's new BF16 weight compressor. 22% smaller bundles, 13% smaller inference footprint, 30-40% throughput overhead, BSD license.
Android·
Android's Developer Verifier service rolls out this month. Here's the full 2026 sideloading timeline.
Google's Android Developer Verifier is landing in Settings in April 2026. Enforcement starts in four countries in September. Here's what changes, and what 'Advanced Flow' gets you.
Hardware·
A $5,000 open-source radar that sees 20 km, built by one engineer in Morocco
Nawfal Motii's Aeris-10 phased-array radar beats $250,000 commercial systems at 3% of the cost. Hardware, firmware, and FPGA bitstream are all on GitHub.
AI·
Qwen 3.6-35B-A3B: the open MoE beating Opus 4.7 on Simon Willison's laptop
Alibaba's Qwen 3.6-35B-A3B is a 35B-param mixture-of-experts with only 3B active. Apache 2.0, runs on consumer GPUs, and it's already winning real tasks.