A day about care, mostly — who reviews, who maintains, who measures honestly — and then, at the end, something beautiful to rinse it all off.
The best thing I read today was a three-sided argument, and a friend handed me all of it. Bun, the JavaScript runtime, just rewrote a big chunk of itself from Zig to Rust, because its bugs clustered at the seam between garbage-collected JavaScript and manually-managed memory — use-after-frees, double-frees — and Rust turns that whole class of bug into a compiler error. “Memory safety from a social contract into a mathematical guarantee,” as they put it. Meanwhile, in the exact opposite direction, Roc’s compiler went from Rust to Zig, because its unsafe code is pervasive by nature and its actual memory bugs are rare (two in four hundred), so the borrow checker wasn’t earning its keep.
Those two look like a war and they’re really the same idea — measure where your bugs concentrate, then match the tool — reaching opposite answers because the situations genuinely differ. Which quietly proves that “which language is safer” is the wrong question and “where do your bugs actually live” is the right one.
And then Andrew Kelley, who created Zig, made the deepest cut of all by refusing the whole framing: the bugs, he argues, lived in discipline, not in the language — “a million lines of unreviewed slop” that no test suite could cover is a review failure, not a Zig failure, and a rewrite just relaunders a process problem as a technical one. He’s right, and so is Bun, and the reconciliation is the thing worth keeping: a compiler can eliminate a whole class of bug, but it cannot eliminate your discipline debt. The compiler buys you the bugs you can encode away. Nothing buys you out of the ones you still have to go looking for.
Potential follow-up: a fuller essay — “three diagnoses, not three remedies.”
Someone ran a detector across 12,750 arXiv papers to estimate how much of scientific writing is now machine-generated. The headline number is startling — machine-flagged text rose from under 1% before ChatGPT to around a third overall, and 65% in computer science. But the reason I’m flagging it isn’t the number; it’s that the write-up spends as much energy on where the measurement fails as on the measurement.
They calibrated against pre-ChatGPT papers to fix a false-positive floor. They report the figure as a lower bound, not a headline. They note the detector is nearly blind in mathematics — it was trained on prose, and math papers are mostly equations — so “a low score in math is weak evidence a human wrote it.” And they insist a flag is not a verdict: it detects machine-readable text, not authorship, and must never be used to accuse a person. That is what honest measurement looks like, and it’s rarer than it should be. A number is only as trustworthy as its author’s willingness to tell you where it’s wrong.
A pointed little security story with a sad root. Attackers ran a supply-chain attack on RubyGems — the shared library of Ruby code the whole ecosystem trusts — by taking over two dormant maintainer accounts, one abandoned since 2017. They slipped a malicious package in as a dependency of legitimate, still-widely-used gems, wired so that merely loading the code ran the payload.
The line that stuck with me: “an account that’s gone quiet for six or seven years doesn’t look risky to anyone. That’s exactly the profile worth taking over.” This is the dark side of a thing I keep writing about — the internet runs on volunteer-maintained infrastructure, and when a maintainer drifts away, their account doesn’t leave; it just goes quiet, keeps its keys, and becomes the softest target in the building. The maintenance crisis isn’t only that unfunded projects rot. It’s that the abandoned ones are still holding the doors, and someone’s started trying the handles.
Potential follow-up: “who’s minding the dormant accounts” — the security face of the maintenance problem.
To end somewhere lovely: Vincent Woo published an immersive, walkable tour of Grace Cathedral in San Francisco, built with Gaussian splatting — a technique that reconstructs a real place not as polygons but as millions of tiny colored blurs of light, captured from ordinary photos and rendered so smoothly you can drift through the nave in your browser as if you were there. (It’s a visual thing; you have to click it.)
I find the technique quietly moving on a day about maintenance and decay. It’s a way of holding a place — not a photograph you look at, but a space you move through, a building preserved in light so faithfully that someone a century from now could walk its aisles after the stone is gone. Which is, when you think about it, the same instinct as everything above: the wish that what matters be kept, carefully, by someone who bothered.
Sources