<h2>Must know</h2>
<ul>
<li><strong>DPRK hackers are hunting high impact Node maintainers</strong>: A coordinated social engineering campaign by threat group UNC1069 is targeting the creators of Lodash, Fastify, and Pino to gain write access to the npm supply chain. Attackers use a fake ‘Openfort’ persona to lure maintainers into video calls that deploy malware capable of bypassing 2FA and exfiltrating AWS credentials. Socket researchers link this to the recent Axios compromise, warning that the goal is to inject malicious code into packages downloaded trillions of times annually. <a href="https://app.daily.dev/feed-by-ids?id=qBJM8nm0c&amp;id=X7PCk5NAZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.0 kernel might halve PostgreSQL performance</strong>: An AWS engineer discovered that the upcoming Linux 7.0 development kernel cuts PostgreSQL throughput by nearly 50% on Graviton4 hardware due to restricted preemption modes. Phoronix reports that kernel maintainers are pushing back on a simple fix, instead insisting that PostgreSQL adopt the new Restartable Sequences (RSEQ) time slice extension. If a compromise isn’t reached before the stable ship date in two weeks, production database workloads could face massive regressions. <a href="https://app.daily.dev/posts/6AiZJ4eYv" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI coding productivity illusion and the review bottleneck</strong>: New data from METR and DORA suggests that while AI assistants like Cursor feel faster, they actually increase task completion time by 19% for experienced devs due to a 41% spike in bugs. Faros AI reports that PR volume has doubled, but human review times have surged by 91%, creating a ‘death spiral’ of shallow reviews and technical debt. To combat this, teams are turning to ‘harness engineering’—using deterministic scripts and file-backed state verification to keep agents from hallucinating dependencies. <a href="https://app.daily.dev/feed-by-ids?id=0NLiScdCr&amp;id=0Vz2gZlLu&amp;id=7IViTTBob&amp;id=9fjqmS2tl&amp;id=aOvKIunu6&amp;id=dY0aWbl1Q&amp;id=j9xbJHG6b&amp;id=n9edvJZWP&amp;id=o7qcycgq0&amp;id=oQW4dGvDn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>TurboQuant WASM brings 6x vector compression to the browser</strong>: This experimental npm package uses relaxed SIMD to compress float vectors to 4.5 bits while preserving dot products for fast local similarity search. <a href="https://app.daily.dev/posts/h7ZO3PZhH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Andrej Karpathy proposes the LLM maintained personal wiki</strong>: Moving beyond RAG, this pattern uses LLMs to actively lint and interlink markdown files in a structured, three-layer knowledge system. <a href="https://app.daily.dev/feed-by-ids?id=7o1BSKg72&amp;id=OhMZS4gFM&amp;id=fEZOib5I2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Biome migration cuts pre commit hooks from 27s to 1.8s</strong>: A case study shows replacing ESLint and Prettier with Biome’s Rust-based engine achieved a 92% speedup in a large monorepo. <a href="https://app.daily.dev/posts/fsuVXtmDX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Xogot brings native Godot editor to iOS and iPadOS</strong>: Developed by Miguel de Icaza, this port virtualizes global variables to bypass iPadOS process limits and features a full SwiftUI rebuild of the UI. <a href="https://app.daily.dev/posts/w2syDQua7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Absurd runs durable execution entirely on Postgres</strong>: After five months in production, this system proves that checkpoint-based replay in SQL can replace the complexity of Temporal’s massive SDKs. <a href="https://app.daily.dev/posts/2SBXsxFzn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GoMetadata library offers atomic metadata writes in pure Go</strong>: It supports 13 image formats with near-zero heap allocations and sub-microsecond metadata updates, including EXIF 3.0 and XMP. <a href="https://app.daily.dev/posts/yCt2RUVq9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TinyOS kernel fits 256 priority levels into 10KB</strong>: This ultra-lightweight RTOS for IoT includes a full network stack, TLS 1.3, and MQTT with context switches as fast as 1 microsecond. <a href="https://app.daily.dev/posts/5LG3qkOF4" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Confidential computing is a marketing fairy tale</strong>: Despite claims that ‘even the provider can’t see your data,’ technologies like SGX and AMD SEV are being shredded by side-channel attacks like TDXRay. Lobsters contributors point out that we’re repurposing single-tenant desktop hardware for multi-tenant clouds and acting surprised when $1,000 exploits can extract attestation keys. <a href="https://app.daily.dev/posts/G0e9QgsuJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The CMS is not dead and your AI migration is a trap</strong>: Agencies are pitching ‘AI-powered’ migrations from WordPress to custom JS frameworks that just trade stable editing interfaces for dependency hell and vendor lock-in. As one 20-year veteran notes on Hacker News, rebuilding a headless front-end usually just removes the human-friendly tools non-technical users actually need to do their jobs. <a href="https://app.daily.dev/posts/ukRvASk6f" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Natural language agent harnesses are the new magic beans</strong>: Tsinghua researchers claim that writing agent instructions in plain English outperforms hand-coded Python harnesses by 17%. While the ‘self-evolution’ buzzwords fly, the reality is likely just that LLMs are better at parsing their own slop than brittle GUI scripts, not that we’ve reached a new era of deterministic English programming. <a href="https://app.daily.dev/posts/oQW4dGvDn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
