Hey there, here's your monthly roundup of tech reads,
job offers, and community threads.
Debugging is twice as hard as writing the code in the
first place. Therefore, if you write the code as
cleverly as possible, you are, by definition, not
smart enough to debug it.
Brian W. Kernighan
Something to read 📖
A Critical Rails Vulnerability in Attackers'
Crosshairs — SecurityWeek
The Active Storage flaw disclosed back in July is now
being actively exploited in the wild — and plenty of
apps still haven't patched. It's the usual
uncomfortable debate in a fresh wrapper: whose job is
it to keep dependencies current, why do teams sit on
known-critical CVEs for months, and is "we'll upgrade
next sprint" a security decision you're allowed to
make. Check your Gemfile.lock today.
Bumping the Major Version of Your JavaScript Library
Is User Hostile — yob.id.au
A pointed argument that every "2.0" you ship is a bill
you send to thousands of downstream maintainers —
migration guides, codemods and broken CI included. The
author says most breaking changes could have been
opt-in flags, and that semver has become a license to
churn. Library authors in the replies are not taking
it well, which is exactly why it's worth reading.
htmx 4.0: The Anti-SPA Library's First Major Release
in Two Years — four.htmx.org
htmx 4.0 moves to the Fetch API, adds morphing swaps
and a new partial tag, and reopens the oldest argument
on the timeline: how much of your "app" actually needs
a client-side framework. Fans call it a return to
sanity; detractors call it 2009 with better marketing.
Either way, the hypermedia crowd just got a lot
louder.
Native HTML and CSS Features That Replaced
JavaScript — ronaldsvilcins.com
A running tally of things you used to reach for a
library for — accordions, dialogs, popovers, anchor
positioning, view transitions — that are now one HTML
attribute or a few lines of CSS. The subtext is
combative: a big slice of your bundle is solving
problems the platform already solved. Worth arguing
about at your next framework-choice meeting.
The Case for Tri-State Dark Mode Toggles —
bram.us
Most sites ship a two-state light/dark switch. This
piece argues that's a bug: once a user flips it, they
can never get back to "follow my system," which is the
setting most people actually want. The fix is a
three-way toggle — light, dark, system — and a
surprising amount of nuance about persistence, SSR
flashes and defaults. A small feature that developers
love to relitigate.
The New Go JSON API: Twice as Fast, or 1.5x Slower?
— Daniel Lemire
Go 1.27 ships a redesigned encoding/json.
Lemire benchmarks it and finds the headline "faster"
claim only half true: unmarshalling improves, but
marshalling slices of structs comes out around 1.5x
slower. A concrete reminder that "we rewrote it and
it's faster" deserves a profiler and your own workload
before you believe it.
Some job offers 🧐
|
osapiens is looking for a
Senior Full-Stack Developer (ReactJs / NodeJS / Typescript) — Hybrid, Madrid, Spain
|
Apply
|
|
One platform for sustainable growth. osapiens
develops software that empowers companies to
drive sustainable growth across their entire
value chain.
|
|
Oxigent Technologies is looking
for a
Data Security Engineer, DLP (Hybrid,
Barcelona)
|
Apply
|
|
A technology consultancy that bills itself as
the trusted partner of digital Barcelona,
working alongside its clients on innovative IT
projects.
|
|
Orbio AI is looking for an
AI Governance & Compliance Engineer
(Hybrid, Barcelona/Madrid)
|
Apply
|
|
One of the fastest-growing AI-native startups
in Spain, building AI workers deployed across
large enterprises worldwide to transform
hiring, onboarding and employee experience in
high-turnover sectors like retail, hospitality
and healthcare.
|
|
haddock is looking for an
AI Engineer (Hybrid, Barcelona)
|
Apply
|
|
The first B2B SaaS built for the HORECA
sector: from a single photo, restaurants
digitize invoices and delivery notes, track
price variations and integrate with POS
systems for real-time cost control.
|
Seen on the net 🌐
|
AprilNEA/OpenLogi
A native, local-first replacement for Logitech
Options+, written in Rust: remap buttons, DPI
and SmartShift straight over HID++ with no
account and no telemetry. Around 20k stars since
May — people really don't want a cloud login
just to configure a mouse.
|
|
tinygo-org/tinygo
The Go compiler for small places just shipped
0.42: recover finally works, and
there's a new UEFI target — meaning you can now
boot a bare PC straight into a Go program with
no operating system underneath. Microcontrollers,
WASM and now firmware, all from the language you
already know.
|
|
mame/quine-clique
From the author of the legendary quine-relay: 51
programs in 51 languages where every
one, run as-is, prints the complete source of
every other. Not useful for anything — and a
small masterpiece of what people build for the
pure joy of the puzzle.
|
|
tailscale/tailcat
"Like netcat, but over Tailscale's data plane,
without Tailscale's control plane." It borrows
the WireGuard crypto and NAT traversal but skips
the coordination server, giving you a raw
hole-punched pipe between two machines. A neat
demo of unbundling your own product's internals.
|
|
wader/fq
"jq for binary formats." Point it at a PNG, an
MP4, a TLS handshake, an ELF binary or a gzip
stream and query the decoded structure with a
jq-style language. The tool you reach for the
next time a file is "corrupt" and you need to
know exactly which byte.
|
|
GoogleChromeLabs/quicklink
Drop-in script that watches which links are in
the viewport and quietly prefetches them while
the browser is idle, so the next click loads
instantly. Resurfaced in Frontend Focus this
month as teams rediscover that a few KB of
prefetch beats another SPA-router rewrite.
|
Some events to attend 📍
AWS Community Day Spain 2026
A free, community-run day of AWS talks and
hands-on sessions led by local practitioners
and AWS Heroes, covering architecture, data
and serverless.
Santiago de Compostela, Spain (Free)
|
17 Oct
More
|
DevFest Aranjuez 2026
GDG Aranjuez's annual community conference: a
full day of talks on web, mobile, cloud and
cybersecurity, with breakfast and lunch
included.
Aranjuez, Spain (Free)
|
24 Oct
More
|
EuroRust 2026
Two conference days plus side events and
hackathons on Rust in production — distributed
systems, embedded, servers and WebAssembly.
On-site and online.
Barcelona, Spain (+ Online)
|
14–17 Oct
More
|
PGConf.EU 2026
The 16th PostgreSQL Conference Europe: four
days of talks, trainings and a community
events day for everyone working with Postgres.
Valencia, Spain
|
20–23 Oct
More
|
GitHub Universe 2026
GitHub's flagship developer conference:
keynotes, product announcements and hands-on
workshops, streamed free with a virtual pass.
Online (Free virtual pass)
|
28–29 Oct
More
|
Something to laugh (or not) 😂
We would love to know your feedback about this
newsletter. Help us filling this short 👉survey👈.
|
|
