GitHub Actions Has a Package Manager, and It Might Be the Worst
GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning
Blog
I've been writing things online in some form since 2004. This is an attempt to bring it all together, regardless of it's shape or completeness. I'm following a "digital garden" model, where some posts are seeds meant to grow and some are weird political takes from ten years ago frozen in amber.
Featured
Redesigning a Blog with AI Design Tools
I used Claude Code's impeccable skill to bring visual cohesion to a blog that had been through four migrations. What worked, what didn't, and what still needs a human eye.
Read this → Also featured
You Are The Driver (The AI Is Just Typing)
After years of skepticism and months of daily use, here's what I've learned about actually working with AI coding agents. They're not replacing us, they're just really fast typers who need constant supervision. Plan first, stay engaged, review everything and the craft is still yours.
💡 TILTufte-Style Sidenotes in Astro
🎲 Random pickPodcast Recommendation: Mike Duncan's Revolutions Season 12
🌿 From Leafletthe media problem
Recent Reading From Friends
I love surfing the web, and I think we should all link to websites more often. Here are some links out to folks more interesting and clever than me.
Vanilla CSS is all you need
You can get almost everything done with Vanilla CSS.
Oakland Doesn’t Need Saving — Dispatches from Raimondi
I love Oakland, and I am so excited to go to more Oakland B's games next year. The community around the team is so fun, and I didn't really get a chance to experience that until the end of the first season.
Why Self-host?
Let me make the argument why you should start self-hosting more of your personal services.
A Pragmatic Guide to Modern CSS Colours PT 1
An excellent guide to using modern CSS color techniques, that make it easy to spin up entire color systems with just a few properties