Benjamin Lannon

Weeknotes #89 (July 18, 2026)

Benjamin Lannon — Sat, 18 Jul 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I consumed

I watched this week's Game Changer: Count the Rice, where that is definitely the only thing they do. Just counting rice, nothing else.
Juniper Dev made a video about a very serious game jam she put on. Always fun to see what types of games people can make with limited time in game jams.

Weeknotes #88 (July 11, 2026)

Benjamin Lannon — Sat, 11 Jul 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I worked on

I used Raycast Script Commands to quickly throw the temperature from my various rooms in my apartment from Home Assistant into the One Thing menu bar widget.
GPT 5.6 was released this week and as part of it is 3 classes of models, Luna, Terra, and Sol. As such I was testing some prompts I previously ran on 5.5 and I definitely noticed 5.6 Luna is a cheaper model and shouldn't be used for everything, but Terra and Sol definitely were either at 5.5 levels or slightly better.

Things I consumed

"Litslop" video by Man Carrying Thing was a good watch going over how some people on social media considering some books classic literature being considered "slop" with The Count of Monte Cristo as an example and Man Carrying Thing trying to argue against such.
Knockoff is a browser extension that tries to deprioritize Chinese drop shipping brands on Amazon which I personally happy to see people try pushing back against such as if you have 1 actual product from a factory being branded by dozens or hundreds of different names of all caps letters, it just pollutes the marketplace from brands that are actually trying to stick out rather than selling you stuff for cheap.

Weeknotes #87 (July 04, 2026)

Benjamin Lannon — Sat, 04 Jul 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I worked on

Wrote a post about The Future of Node Security in 2026 and but focused in on things that are available right now as far as Node 26 which is going LTS this October.

Things I consumed

Sony announced that PlayStation going digital only in 2028. The online response was overwhelming negative, and this is a blow to video game preservation and games aren't really being purchased but rather just being licensed to you.
This Steam Machine "Review" by Craft Computing was a good watch where at the end this isn't really even a video about the Steam Machine.

The Future of Node Security in 2026

Benjamin Lannon — Sun, 28 Jun 2026 00:00:00 +0000

I wanted to do an analysis of where the Node ecosystem is going into the next few years, and in particular around the security layer Node provides. With the rise of AI, supply chain attacks are continuing to happen and if things aren't hardened can be quite dangerous. On this front, I wanted to not just guess where things could get better, but see what tools are actually available right now in Node and the ecosystem that pushes for a more secure Node.js.

Permissions API

By default, Node had the ability to run any command, send HTTP requests to any site, or anything that the host user had access to do. With a lot of supply chain attacks that try to grab credentials across your system and exfiltrate them, this was a space that really needed some improvements, and as of the Node 22 LTS line, the Permissions API provides every Node process the ability to lock down what it has access to on your system via controls for filesystem access or child processes, as well as what it can access via the internet with network controls. Filesystem permissions is currently the only ones that you can manage with actual granular filepath controls, while everything else is an explicit on / off flag, but I hope to see future progress on this front.

Blocking install scripts by default

One of the biggest issues with a lot of Node modules that become compromised via supply chain attacks is the concept of a postinstall script that will execute code as soon as the module is downloaded onto your system. pnpm added functionality to block this back in January 2025 with pnpm v10.0.0 but npm proper is also implementing such and will be available in npm 12 which estimated in July 2026. This means it will be available in the Node 26 LTS release in October.

Minimum release age

On a similar note, one of the easiest protections against supply chain attacks is a time buffer to block extremely new releases. Most attacks are found within hours of the publish to npm, so preventing your systems being infected could be as little as waiting a day to update to that new package. Matteo Collina wrote up a gist on how to configure minimum release age across npm, pnpm, and yarn. This functionality came with npm within the Node 24 LTS cycle. On the CI side, Dependabot and Renovate also support this.

Misc builtin functionality

Some other things to highlight include enhancements to Node's standard library at its core. Things like a native sqlite module, node:sqlite as of Node 22, or native support for .env files with the --env-file flag in Node 24. As well, pulling in the newly stabilized Temporal library as of Node 26 pushes date-time functionality that is native to both browsers and Node. All of these are signs towards taking popular tooling that many projects use and bringing it to be bundled by the runtime by default that can lead towards cleaner dependency trees with a smaller surface area for attack.

Organizations pushing things forward

The two orgs around the Node ecosystem I am following that are pushing things forward in terms of a modernization / security focus are Socket & e18e respectively. Socket came out of a need for looking at the various avenues packages can be exploited and provide stats and findings to users for initially npm, but now a variety of other package managers like PyPi, Maven, Cargo, Go Modules, NuGet, RubyGems, among others. e18e which stands for Ecosystem Performance is a Node specific push for understanding the ecosystem has modernized over the past decade and as such deep dependency trees can be cleaned up or you can replace modules with better alternatives.

Where to go from here

I don't use absolutely everything that I listed above, but it is good to know that the Node ecosystem itself is growing and becoming more secure over time. Beyond what I listed, I try to keep a mindset of even if I am having more AI write code for me, I still want to be in control of the security around my projects and how I use Node. With such, I appreciate that either the Node project itself or tooling surrounding it are similarly understanding the attack vectors that are increasing and trying to find solutions to prevent them.

Weeknotes #86 (June 27, 2026)

Benjamin Lannon — Sat, 27 Jun 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I consumed

The RAM shortages really hit hard this week across consumer electronics. That included:

The Steam Machine that was fully revealed at $1049 for the 512GB model.
The 3rd price increase for Xbox Series X which now goes up to $800 (compared to when it was $500 when it launched 6 years ago).
A bunch of Apple devices including Macs, iPads, and others.

and it seems we have still not hit the hump of things starting to balance out, so it is likely to be years before things start cooling down sadly. At least in a positive light, none of my main devices are reaching end of life, so what this is likely to look like for me is just longer lifecycles between me upgrading.

Weeknotes #85 (June 20, 2026)

Benjamin Lannon — Sat, 20 Jun 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I worked on

I've been thinking about some various projects to speed up my deployment workflow as the speed to go from idea to app has rapidly sped up via coding agents, but the flow of a dev server to a deployed container accessible on my tailscale network still has some tedious work. The flow is almost the same for most apps I am working on so why not reduce the friction of deploying.

Things I consumed

I've been continuing to read the Undead Unluck manga. I originally watched the first season of the anime and wanted to progress with the story as there is no confirmed date for a continuation of the anime.
Rumors are that this upcoming week is going to be the official reveal of pricing of the Steam Machine and Steam Frame devices from Valve. Due to the ram and storage shortages, they are very likely to be higher than what consumers were originally expecting, but I feel they both serve two interesting markets: The Steam Machine for people who want to have PC-level gaming with the ease of use of a console, and personally speaking, the Steam Frame being a VR headset that isn't made by Meta.

Weeknotes #84 (June 13, 2026)

Benjamin Lannon — Sat, 13 Jun 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I worked on

I went ahead and finally set the Min Release Age setting for NPM which blocks installing new packages / versions that are under a day old (or whatever set of hours / days you wish). This will reduce the attack vector of a lot of supply chain attacks given most are found within a few hours and subsequently yanked from npm.

Things I consumed

WWDC 2026 was this past week and the main highlight was the new LLM powered Siri. Personally I was whelmed given it does finally work, but this is what was previewed 2 years ago and finally is landing this fall. I have tried it on my macbook air, but I feel we won't feel the full power of it until app developers integrate with it come this fall.
Claude Fable 5 was a model that was released this week that was at the knowledge level of Anthropic's Mythos model, but with security guardrails to prevent dangerous use of it. That said as of Friday night, the US Government requested it be blocked by any foriegn nationals and due to such, it is no longer available for anyone to use.

Weeknotes #83 (June 06, 2026)

Benjamin Lannon — Sat, 06 Jun 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I consumed

The solution might be cancelling my AI subscription is an article that hits at the danger of just cause AI can build anything you want, you still have to put in the effort of making things that you wish to keep around and is actually valuable.
The divide of people who see the pros vs cons of AI coding continues, the maintainer of the jqwik java testing tool threw in what ends up as malware of trying to hijack a coding agent like claude code or codex, have it erase code, and then erase proof it did such. Andrew Nesbitt summarized the situation here: Protestware for coding agents
RTX Spark is Nvidia entering the consumer laptop and PC space with a chip originally found on their $4000 DGX Spark PCs. Windows on ARM has been tried over and over again without success yet, so I am skeptical, and especially given that this machine is going to start with 128GB of RAM in a time where memory is constrained feels like this is going to be at the top of the line of premium devices. That said, companies like Dell luckily are also looking at the other end of the market with their new $600 XPS 13 to compete with Apple's Macbook Neo.

Weeknotes #82 (May 30, 2026)

Benjamin Lannon — Sat, 30 May 2026 00:00:00 +0000

Things I found, read, did, and produced this past week.

Things I worked on

I wrote a new entry on how I use AI as of May 2026 to see how things have changed over the past few months.
I vibe coded a simple CLI to view all variables and secrets from GitHub Actions in the case that my account was exposed somehow, secrets that may not be used anymore could be cleaned up.

Things I consumed

I finally took the dive and installed Immich on my local network as an alternative to Google Photos without any of the Generative AI features they've been progressively adding over time.
On Rendering Diffs was a post by the diffs.com team going over the complexity of rendering diffs and how they solved this issue as at a certain scale, the diff viewer in GitHub currently just doesn't work as you intend it to.
Found a fun YouTube video of a dev's Witch Hat Atelier Spell Simulator.

How I use AI in May 2026

Benjamin Lannon — Sun, 24 May 2026 00:00:00 +0000

5 months later after my previous post like this, I wanted to write another post seeing what my outlook is on AI.

How I use

Model: GPT-5.5, $20 OpenAI plan, stil don't hit limits. I previously used the paid Claude sub, but I've jumped back to GPT models specifically cause of the next point.
Harness: Codex App. When I saw the workflow of project categorized sidebar, I knew that was the UX I wanted, and the application works reasonably well. For small sessions I also may just use the Codex CLI.
Still fairly hands on and reading the majority of the code and the output of sessions with these coding agents.
Still not really using AI in apps that have AI features (Browsers, web apps, etc) outside apps specifically for AI. Also still not using AI for creative work (art, video) as well as writing.
I Removed sandboxes due to environment issues, where a agent tries to do something but the container does not have the command installed and I don't really like keep on rebuilding such.That said, I am still not using --yolo / --dangerously-skip-permissions modes. I still don't know how to protect against bad commands.

Apps I've built with AI

Weeknotes Collector mainly for initial UI, but backend is mainly handcoded.
TCG Tracker coded primarially with Claude Code and Codex. Claude handled some niche things (Tanstack, Convex) quite well. Very minimal AGENTS.md.

General Thoughts

Pricing is changing in some places (GitHub Copilot prices changing in June 2026, Anthropic switching to API pricing for programatic use, 3x higher API price for Gemini 3.5 Flash), but I am still using a subscription for my primary usage. Also, almost all of the providers now have a middle $100 a month tier the base $20 and max $200.
I use minimal amount of skills, have not used any MCP servers, and minimal AGENTS.md that I don't use too much of these unless I see the agents flailing over and over again.
- Of note, hand writing a few sentences in AGENTS.md seems to work well compared to having the model generate a long AI generated AGENTS.md file.