The Changelog

Adam Stacoviak talks with Peer Richelsen, co-founder of Cal.com, about a provocative theory: that the majority of open source repositories may already be compromised without our knowledge. They explore how AI has flattened the knowledge graph, enabling even a 16-year-old to “vibe hack” a power station or a mom to “vibe code” an iOS app, and how the resulting AI-generated noise is breaking the reporting culture that has kept open source safe. The conversation covers Cal.com’s decision to fork its own codebase and take the sensitive parts private, the technical and philosophical fallout of that move, and the rise of a startup business model built around selling AI tokens at a steep discount.

Sam Lambert returns to The Changelog after four years to discuss PlanetScale's new Postgres offering, the Neki proxy rewrite, and how database operations are evolving. He shares the reasoning behind PlanetScale's 'do-over' of Vitess for Postgres, the role of AI agents in schema management, and the company's capability to roll back enormous tables instantly. The conversation also touches on the open-source dilemma and Lambert's critique of the major cloud providers as lazy monopolies.

Haroon Meer, founder of Thinkst, discusses Canary and Canarytokens—honeypots and tripwires deployed across networks to detect intrusions. The episode covers AWS API key tokens that attackers can't resist, real credit card tokens backed by bank partnerships, Breadcrumbs (a feature that leads intruders to canaries), live hardware demos, and how Thinkst reached $22.5M ARR through bootstrapping without outbound sales or price increases in a decade.

Max Stoiber discusses his journey from creating influential open source projects (react-boilerplate, styled-components) through founding Spectrum (acquired by GitHub) and Stellate (dual acquisition by Shopify and The Guild), to his current work on ChatGPT's plugin directory and app platform at OpenAI. The conversation explores how open source projects survive or fade, how platforms evolve to accommodate new needs, and why ChatGPT apps represent a fundamentally new surface for software distribution.

Adam Jacob, founder of System Initiative, shares how AI agents are reshaping software development with his tool Swamp. He explains how his team went from 18 people to 5 and shipped 900 times in four weeks by resurrecting 90s-style User Acceptance Testing and leaning on domain-driven design. A live demo where Swamp autonomously wrote automation for a Proxmox server illustrates the paradigm shift. Jacob argues that architecture now matters more than code, and reveals why he will never accept a pull request to Swamp.

This week's news roundup covers five major stories: the Checkmarx supply‑chain campaign hitting Bitwarden’s CLI, TypeScript 7.0 beta landing with a Go‑rewritten compiler that’s 10x faster, Ubuntu 26.04 LTS shipping with TPM‑backed full‑disk encryption, pgBackRest losing its maintainer of thirteen years, and Matz releasing the Spinel AOT compiler for Ruby native binaries. The episode highlights how security, performance, and open‑source maintenance are deeply intertwined and all in motion at once.

Amelia Wattenberger, a designer with experience at GitHub Next and now at Augment Code, explores the impact of AI coding agents on software development. She argues that while agents make prototyping dramatically faster, the hardest part—the last 30% of a project—becomes even more challenging. The conversation covers the developer identity crisis this shift causes, the redesign of tools for an agent-first world, and the evolution of dev tool interfaces from autocomplete to chat to CLI and back to UI. Amelia explains why Intent uses the workspace as the core primitive rather than a chat thread and delves into the tradeoffs of per-agent versus per-task worktree strategies.

Jerod Santo retires from The Changelog. Adam and Jerod reflect on 15 years of conversations with the open source community and what comes next.

Tailscale co-founder David Carney discusses TSIDP, TSNet, multiple tailnets, and Aperture — the future of zero-trust networking.

Techno Tim joins to discuss homelab in 2026: hardware is scarce and expensive due to the AI gold rush, but self-hosting software has never been better.

Damien Tanner, founder of Pusher and now Layercode, discusses the seismic shift in software development and why SaaS is dying.

Tushar Jain from Docker discusses Hardened Images — Docker's push into security-focused container images for enterprise and regulated industries.

Dan Abramov discusses the AT Protocol (Bluesky) as a social filesystem — a decentralized protocol that lets users own their social data and move between applications.

Bryan Cantrill and Steve Tuck of Oxide Computer discuss building integrated hardware-software infrastructure for on-premises cloud computing. Live from OxCon.

Nicholas Zakas reflects on 10 years of ESLint: the challenges of maintaining a critical open source tool, the evolution of the JavaScript ecosystem, and the future of linting in an AI era.

Armin Ronacher discusses his journey from creating Flask and Jinja2 to leading engineering at Sentry, and how observability changes in the AI era.

Ethan McCue shares advanced Postgres patterns showing how the database can replace specialized tools for queues, full-text search, vector storage, and more.

Jerod and Adam interview the Docker team about how containerization is evolving in the age of AI. How Docker is adapting to AI-native development workflows and why developer experience is the new competitive moat.

Lea Verou discusses the state of web dependencies, arguing that the JavaScript ecosystem's dependency culture creates fragile software and supply chain risks.

Zipline co-founder Keenan Wyrobek discusses their autonomous drone delivery system, now delivering medical supplies, food, and packages across multiple countries.

The open source funding crisis: critical infrastructure maintained by volunteers, corporate free-riding, and emerging models for sustainability.

How AI is changing open source: AI-generated contributions, automated code review, and the question of whether AI-written code belongs in open source projects.

Adam and Jerod speak with Chris Coyier and Dave Rupert about whether the open web is dying, the creator economy, ads versus subscriptions, CodePens future, and how social networks devaluing links threatens the web.