I really believed a whole generation of developers, who only know open source from npm and pypi, miss how open source actually used to work. When Debian or a Linux distribution ships a dependency they take responsibility of it. If there is a security issue and it’s not fixed by the developer upstream, they fix it for their users. Debian and others basically vendor every thing they distribute. They honor the license and they maintain patches. Most of the stuff that you get from your Linux distribution is basically a (small) fork. The same is true for Apple, Microsoft and others. The open source software they ship, they carry that responsibility. That doesn’t mean that security fixes are not upstreamed, but Apple or Debian or anyone else won’t jump in Twitter to shame a developer into compliance with their ways. They are not dependent on the health of a packaging infrastructure. They own their software including all the things it depends on. I want that thinking back. Because it fundamentally makes people feel more responsibility and it shares the burden of issues. It also does not put so much focus and attention on the one overworked developer who just happened to have too much of the world depend on their library. Remember: they carry a responsibility they never signed up to and they never got compensated for.

Writing ADR's for agents has been such a good decision Capturing all the non-obvious decisions in a codebase makes every agent in your stack that touches the stack smarter It's the thinnest layer of docs that captures the stuff code can't

It's been 12 days since I dropped Gas Town. The response has been off the charts. I've been working hard to keep up. Thanks to all the early adopters. I wrote up this survival guide. steve-yegge.medium.com/gas-t…