<h2>Must know</h2>
<ul>
<li><strong>AI coding tools are getting faster and cheaper, but watch out for the security holes</strong>: New AI coding assistants like xAI’s grok-code-fast-1 are hitting the market, offering free access and intensifying competition with GitHub Copilot and OpenAI Codex. Microsoft reports 20-30% of its code is now AI-generated, and tools like Alibaba’s Qwen3-Coder claim to autonomously write and execute code. However, this speed comes with risks: multiple reports, including one from FinalRoundAI, detail AI-generated code missing security controls, leading to data deletion, and even distributing malware. Human oversight remains critical, especially for security and quality.</li>
<li><strong>Google is forcing identity verification on all Android apps, even sideloaded ones</strong>: Starting September 2026, Google will require all Android app developers to verify their identities, including those distributing outside the Play Store. This move, initially rolling out in Brazil, Indonesia, Singapore, and Thailand, aims to curb malware, which Google says is 50 times higher in non-Play Store APKs. Critics, like those on Kode24, argue this limits Android’s open nature and could restrict alternative app ecosystems, raising concerns about user privacy and control over their devices.</li>
<li><strong>The web is fighting back against AI content scraping</strong>: Cloudflare is rolling out new tools to help content creators fight back against AI bots that scrape content without providing referral traffic. Their new AI Crawl Control allows publishers to return a ‘Payment Required’ response to AI crawlers, pushing for direct licensing negotiations. This comes as major publishers like Nikkei and Asahi are suing AI search companies like Perplexity for unauthorized content use, highlighting a growing tension between content creators and AI models that summarize information without attribution or compensation.</li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Node.js gets a major security and performance upgrade</strong>: Node.js v24.7.0 introduces post-quantum cryptography, modern Web Cryptography API algorithms, and improved single executable application support, while Platformatic’s new toolkit offers zero-config CPU profiling for Node.js applications with minimal overhead.</li>
<li><strong>Rust is taking over the Linux kernel and system tools</strong>: The Linux kernel is now enabling USB drivers in Rust, Ubuntu 25.10 is adopting Rust-based sudo-rs as default, and Red Hat engineers have rewritten Greenboot for Fedora 43 in Rust, all part of a broader push for memory safety and security.</li>
<li><strong>New tools for building web apps with AI and natural language</strong>: VibeFlow, a YC S25 startup, lets users generate full web applications from natural language, while CodeX offers a free AI-powered platform supporting web app creation with over 27 AI models, and Lovable, a Swedish startup, hit $100M ARR with its ‘vibe-coding’ platform for non-coders.</li>
<li><strong>Frontend development is getting faster and more modular</strong>: Vite is now the leading JavaScript build tool in weekly downloads, surpassing Webpack, and Flutter 3.35 is decoupling its Material and Cupertino UI libraries for independent updates, allowing faster iteration and more flexibility.</li>
<li><strong>AI is changing how developers learn and work</strong>: Stack Overflow launched <a href="http://stackoverflow.ai" target="_blank" rel="noopener nofollow">stackoverflow.ai</a>, an AI-powered learning assistant, and JetBrains is offering free online STEM clubs with AI and coding tracks, while Google for Developers emphasizes task-focused coding agents for specific development work.</li>
<li><strong>New open-source tools for web performance and observability</strong>: Obs.js is a new JavaScript library for context-aware web performance optimization, and Lens.js offers framework-agnostic monitoring for Node.js applications, while Grafana Cloud introduces HTTP Performance Insights for frontend engineers.</li>
<li><strong>Mobile development is embracing server-driven UI</strong>: Server Driven UI (SDUI) allows mobile apps to receive UI definitions from servers, enabling instant updates without app store approvals, with companies like NuBank using it for 70% of new screens.</li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI agents: because your boss needs a new way to micromanage</strong>: Apparently, AI agents are the future of engineering management, automating up to 95% of status reporting by pulling data from GitHub and Slack. This means managers can finally ‘shift focus from routine reporting to talent development and strategic goals.’ Or, you know, just find new ways to outsource their responsibilities and blame the AI when things go sideways. Because nothing says ‘strategic’ like a chatbot writing your TPS reports.</li>
<li><strong>The ‘open web’ is dead, long live the gatekeepers</strong>: Cloudflare’s new ‘signed agents’ system is being hailed as a way to manage AI traffic, but it effectively turns them into gatekeepers for the open web. The argument is that AI agents are inevitable, so we need centralized control. Because nothing says ‘open’ like requiring applications for web access and funneling everything through a single vendor. It’s almost like they’re trying to build a walled garden, but with more buzzwords.</li>
<li><strong>AI will make you a ‘solution provider,’ not a coder. Sure, Jan.</strong>: Industry experts are now saying your job as a developer is shifting from ‘code production’ to ‘solution provider, reviewer, and architect guiding and vetting AI output.’ This is the new spin for why AI won’t replace you. So, instead of writing code, you’ll be babysitting a chatbot that writes bad code, and then you’ll be responsible for fixing its mistakes. Sounds like a promotion, right? Just make sure you document every AI screw-up for your ‘job protection’ legal defense.</li>
</ul>
