<h2>Must know</h2>
<ul>
<li><strong>The AI coding agent security and cost crisis</strong>: A QCon London keynote by Birgitta Böckeler warns that the shift from ‘vibe coding’ to autonomous agent swarms is creating a nightmare security landscape, including a documented case of an unsupervised agent leaking secrets to an NPM registry. Beyond prompt injection risks, the hidden token costs of Model Context Protocol (MCP) tool schemas are exploding, with 90 tools potentially consuming over 50,000 tokens per request. To combat this ‘update trap’ where 95% of AI pilots fail to deliver ROI, organizations are increasingly turning to abstraction layers like LiteLLM and OpenRouter to mitigate vendor lock-in. <a href="https://app.daily.dev/feed-by-ids?id=Ur5RHzsG2&amp;id=VPYYe9XNN&amp;id=bCQotnt4R&amp;id=eNry4HYqW&amp;id=f6EHrsEI8&amp;id=sow9Hx2sg&amp;id=xNA0t95XE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Flash MoE brings 397B parameter models to MacBooks</strong>: A new pure C and Metal inference engine called Flash-MoE has achieved 4.4 tokens per second running the massive Qwen3.5-397B model on a standard 48GB RAM MacBook Pro. By streaming the 209GB model from SSD and loading only four active experts per layer into RAM, the project demonstrates that consumer hardware can handle frontier-scale Mixture-of-Experts models. The developer, danveloper, noted on GitHub that relying on the OS page cache actually outperformed every custom caching method they tested during 58 different experiments. <a href="https://app.daily.dev/posts/xsGaEEFUf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GrapheneOS defies global age verification mandates</strong>: Privacy-focused GrapheneOS has publicly refused to comply with new age verification laws in Brazil and California, stating it will never collect personal identification even if it results in regional sales bans. This hardline stance complicates their upcoming 2027 hardware partnership with Motorola but reinforces their commitment to a zero-account, zero-telemetry mobile ecosystem. Meanwhile, the broader Linux community faces a philosophical crisis as commercial providers like Red Hat and Canonical may be forced to implement ID-based verification at the OS level to remain compliant. <a href="https://app.daily.dev/feed-by-ids?id=3oUfmyp1R&amp;id=f2c1Srdfh&amp;id=u4yVQPhrL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cursor admits Composer 2 is built on Moonshot AI base</strong>: Cursor’s VP of education confirmed their new ‘frontier-level’ model is actually a fine-tuned version of the Chinese open-source model Kimi k2.5. <a href="https://app.daily.dev/posts/2O2HmWwMM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel Workflow adds automatic end to end encryption</strong>: The platform now uses per-run HKDF-SHA256 key derivation and AES-256-GCM to encrypt all step arguments and return values by default. <a href="https://app.daily.dev/posts/0r6jV9CyY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MkDocs ecosystem collapses amid maintainer infighting</strong>: The popular documentation tool has fractured into three competing forks—ProperDocs, MaterialX, and Zensical—after the original founder returned to push an incompatible rewrite. <a href="https://app.daily.dev/posts/GedRmjUpE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Meta releases translation for 1600 languages</strong>: The new Omnilingual Machine Translation system uses a specialized LLaMA3-based architecture to match 70B model performance on endangered language generation. <a href="https://app.daily.dev/posts/7NovNgh69" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Project Detroit reopens to bring Python to the JVM</strong>: The initiative leverages the Foreign Function and Memory API to integrate JavaScript and Python directly into the Jakarta EE ecosystem. <a href="https://app.daily.dev/posts/24VxbiILg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Atomic knowledge base launches with MCP support</strong>: This Rust-based personal knowledge graph uses sqlite-vec for local vector search and provides an MCP server for deep Claude integration. <a href="https://app.daily.dev/posts/y5RZTff20" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.0 rc5 stabilizes for April release</strong>: Linus Torvalds notes the cycle is calming down, featuring improved Logitech MX Master 4 support and fixes for legacy Radeon GPUs. <a href="https://app.daily.dev/posts/1tWnyX7nj" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The 80 percent AI generated production SaaS</strong>: A new ‘free course’ claims to teach you how to build a production SaaS that is 80% AI-generated, which is just a fancy way of saying they’ve automated the creation of technical debt. The marketing relies on this unverified 80% figure to sell a curriculum on ‘architectural patterns’ that most senior devs just call ‘basic engineering.’ It’s the classic ‘sell shovels during a gold rush’ move, except the shovels are made of hallucinated spaghetti code. <a href="https://app.daily.dev/posts/IoV0luSh7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vellox and the machine speed adversary buzzword</strong>: Booz Allen Hamilton is hitting RSAC 2026 with ‘Vellox,’ an AI-native suite designed to fight ‘machine-speed adversaries’ using 30 years of federal data. While they promise autonomous remediation and attack emulation, it sounds like a rebranding of standard SOAR tools with a heavy layer of defense-contractor-grade hype. If their ‘autonomous responder’ is as fast as government procurement, the adversaries have nothing to worry about. <a href="https://app.daily.dev/posts/lljljIGzG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 2 byte persistent mouse storage breakthrough</strong>: A developer spent hours reverse-engineering the HID++ protocol to discover they could store exactly two bytes of data in a Logitech mouse’s DPI register. While framed as a ‘hardware hacking exercise,’ it’s the ultimate example of diminishing returns in the pursuit of ‘persistent cross-computer storage.’ Congratulations, you can now carry a single Unicode character in your mouse; just don’t expect to fit a README in there. <a href="https://app.daily.dev/posts/uG0HL5oPv" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
