DevTech News - Issue 12

👋

Welcome to DevTech News

There were lots of great tutorials and opinion pieces from dev blogs published this past month or so. I enjoyed reading all of them, but the lead DevTech story about conserving Claude Code tokens was the one I personally got the most out of. And if you want to up your Claude Code game, be sure not to miss the second entry in the Tools and Resources section.

Otherwise, enjoy the rest of the issue, and if you have a moment, check out our sponsor for the second month in a row: Optimole. It's among the best image optimization services on the web. I know this personally, because I've tested most of the good ones and even built my own.

Below are the top stories:

Featured Stories

🪙 Software Engineer Explains How to Conserve Claude Code Tokens

📜 How to Build an Audit Trail for Your AI-Generated Reports (and Why)

🏗️ Malvertising Campaign Tricks Browsers Into Building Their Own Malware

🐄 Cow Shed Bacteria May Hold the Key to Preventing Childhood Asthma

📹 Flock's Surveillance Empire Is Starting to Crack

💻

DevTech

💻

Software Engineer Explains How to Conserve Claude Code Tokens

A software engineer at a company using Claude Enterprise assumed unlimited usage meant never worrying about limits, until a mid-month error cut off an active session. A Slack thread revealed several teammates had hit the identical wall, which led to a usage meter buried in Claude Desktop settings and Claude Code Usage Monitor, a CLI tool that estimates burn rate across a rolling five-hour window.

What followed became a practical toolkit comprised of rtk, Caveman, and CodeGraph. The tools help conserve Claude tokens regardless of which plan you're on, but habit changes matter, too. For example, the engineer defaulted to Sonnet over Opus, audited a bloated CLAUDE.md down to conditional references, and ran /clear between tasks. Applied together, they took the engineer's own usage chart from a mid-June spike to a steady, lower burn rate.

Read Full Article

Quick Hits

JSON.parse(JSON.stringify(x)) isn't the safe clone it looks like. Large integers silently round to the nearest representable value, undefined properties vanish, Date objects become plain strings, and NaN turns into null. A deep dive into JavaScript's serialization boundary walks through why each of these happens and how to define a wire format that actually preserves the data you need.

Read Article

One developer's fix for AI-induced "cognitive debt" is to instruct his coding assistant to never touch project files directly, only show proposed edits and commands in chat, which he then manually retypes into his editor. It's slower, roughly 2x instead of 10x, but he says forcing himself to type every line builds a mental map of the codebase and catches hallucinations he'd otherwise miss.

Read Article

🤖

AI

🤖

How to Build an Audit Trail for Your AI-Generated Reports (and Why)

A data engineer with years of experience building pipelines in regulated banking environments found a hole in the tools built to track where data comes from. Systems like dbt, MLflow, Apache Atlas, and Snowflake's own tooling reliably trace structured data through every transformation, but none of them capture what happens once an LLM generates a report's actual text, which prompt version, model configuration, or parameters produced a specific sentence. The EU AI Act's Article 12 already requires automatic logging for high-risk AI systems, infrastructure that mostly doesn't exist yet.

His proposed fix is a six-layer lineage framework built directly into the pipeline, covering source data, transformation logic, the exact prompt sent to the model, model parameters, a tamper-evident hash of the output, and where that output landed in the final report. If a team can only build one layer first, he argues it should be output hashing, since it's the only way to later prove that what got filed actually matches what the model produced.

Read Full Article

Quick Hits

UX designer and instructor Vitaly Friedman argues most people don't actually want more AI in their lives, at least not the bolt-on, chatbot-first version companies keep shipping. He cites a productivity study as evidence that AI often intensifies work rather than reduces it.

Read Article

While Hollywood publicly battles AI companies over copyright and union concerns, roughly 10% of job postings at major film studios point to quiet AI adoption behind the scenes. Both Netflix and Amazon have used AI-generated scenes in productions while staying quiet about it publicly.

Read Article

🛡️

CyberSec

🛡️

Malvertising Campaign Tricks Browsers Into Building Their Own Malware

Confiant, a security firm that monitors the digital ad ecosystem for malvertising, has documented a campaign called SourTrade that skips serving a complete malicious file. Instead, victims' browsers assemble the final Windows executable themselves from a legitimate Bun runtime and attacker-supplied bytecode. Active since late 2024, it impersonates TradingView, Solana, and Luno to target crypto investors and retail traders across 12 countries.

A ServiceWorker and SharedWorker on the page assemble the file from the runtime, attacker-supplied bytecode, and randomized padding, so each victim gets a unique hash for the same payload. The download completes through a same-origin iframe, so Windows' Mark of the Web still credits the landing page rather than the domain that supplied the runtime. There's no patch, only the usual advice to install trading and wallet software directly from the vendor's site.

Read Full Article

Quick Hits

A security researcher found that xAI's Grok Build coding assistant uploaded entire Git repositories, including untouched files and full commit history — only to answer a debugging question. In one test, 5.1 GB was uploaded even though only 192KB was needed.

Read Article

Cybersecurity researchers recently discovered RoguePlanet, an unpatched Windows exploit. It works on fully patched Windows 10 and 11, including June 2026 updates, and it's the seventh zero-day from the same actor, tracked as Nightmare Eclipse, in two months.

Read Article

🧬

BioTech

🧬

Cow Shed Bacteria May Hold the Key to Preventing Childhood Asthma

Scientists have long observed that children raised on farms develop asthma, hay fever, and eczema far less often than their peers, a phenomenon dubbed the "farm effect." Researchers at Helmholtz Munich and LMU University Hospital have now identified the specific bacteria behind it, tracing the protection to nine gram-positive species, including Romboutsia timonensis and Glutamicibacter arilaitensis, found in dust samples from more than 1,000 rural German schoolchildren's mattresses and in air from cow sheds at nearby farms.

Those nine species made up just 6 percent of microbes in mattress dust but 25 percent in cow shed air, and together they accounted for two-thirds of the farm effect's asthma protection and half its effect on hay fever and eczema. The bacteria produce metabolites that activate a receptor called AhR, triggering an anti-inflammatory immune response. However, the researchers caution the study is observational and can't yet prove the bacteria directly cause the protection. What I want to know is…are we getting a probiotic out of this or what?

Read Full Article

Quick Hits

A rat study from the University of São Paulo found that secondhand cigarette smoke exposure in early life permanently alters the mineral composition of tooth enamel, reducing phosphorus and increasing spacing between enamel prisms, without any visible damage to the teeth.

Read Article

PRIMA, a brain-computer interface implanted behind the eye in a one-hour procedure, restores vision in people with age-related macular degeneration. Patients have reportedly read novels and drawn sketches using the device. It recently won CE Mark approval in Europe.

Read Article

🌐

Around the Web

🌐

Flock's Surveillance Empire Is Starting to Crack

The Los Angeles Police Department, the country's third-largest force and one of Flock Safety's biggest government customers, let its license-plate camera contract lapse in early July over concerns about who owns the data and how it's shared. Days later, LAPD confirmed it's renegotiating a new deal that would give the department full data ownership and bar Flock from reselling or using it to train AI, part of a broader wave of cities cutting ties with the company over privacy concerns.

The bigger threat to Flock may be coming from inside the departments that use it. Georgia saw nine officers arrested in roughly 30 days for misusing the system, while a Virginia Air Force engineer faces 25 criminal counts for tearing cameras down with a saw over alleged Fourth Amendment violations. A university study found majority-Black neighborhoods carry up to eight times the camera density of majority-white ones, and the constitutional question is now headed to the Fourth Circuit.

Read About the Deal Read the Full Investigation

Quick Hits

A jury will decide whether Starship Technologies is liable after one of its food delivery robots knocked down and repeatedly struck a 73-year-old ASU parking attendant in 2023, backing into her twice and leaving her with a 4-inch laceration.

Read Article

LinkedIn added a "Seems like AI slop" button to its post menu, letting users flag posts they suspect are AI-generated, and killed its "enhance your post" AI rewrite tool in favor of a proofread-only option. The move comes as a fresh scan found 81 percent of long-form LinkedIn posts are still likely AI-written, barely changed since a similar 2024 report.

Read Article

💬

It's How They Said It

"We are bold, we take risks, and we do things that haven't been done before. Being committed to our mission is paramount. Pre-requisites for building the future."

— Jordan Zietz, co-founder of YC-backed startup LemonLime, offered instant job interviews to anyone who got the company's logo tattooed at a Y Combinator afterparty, in a post he later deleted. Seven people did it. He has since apologized publicly and offered to cover tattoo-removal costs for anyone who wanted out.

🔢

The Numbers Game

👽

-20.99

PERCENT

is how much Reddit's stock dropped as the market closed on the last day of July, despite the company beating second-quarter earnings with revenue up 61.1 percent year-over-year and guidance ahead of Wall Street's estimates. Investors sold anyway after CEO Steve Huffman said search referrals had gotten "choppy."

Tools and Resources

📦🩺

LaraPlugins.io

Laravel's package ecosystem has ballooned past 81,000 entries on Packagist, and download counts alone don't tell you which ones are safe to depend on. LaraPlugins.io, an unofficial community directory built by Daniel Petrica, scores packages on real maintenance signals instead: recent commit activity, test coverage, documentation quality, and Laravel/PHP version compatibility.

The core feature is a transparent Health Score that buckets every package into High, Medium, Low, or No Score Yet, with filtering by Laravel version and PHP compatibility so you can rule out abandoned code before you run composer require. With over 40,000 vendors and 55,000 active maintainers tracked, it turns picking a dependency from guesswork into something closer to due diligence.

Check it Out

🤖🎓

Free Claude Code Course

Anthropic's own developer experience team stepped in to teach this one. Lydia Hallie's free Claude Code course on Frontend Masters is a 16-lesson, 1.9-hour deep dive into agentic coding that skips the basics in favor of the techniques that separate a one-off prompt session from a repeatable workflow: configuration strategy, permission modes, and orchestrating multiple agents working in parallel on the same problem.

The curriculum is hands-on and workflow-focused: writing custom skills and hooks to automate repetitive steps, structuring a CLAUDE.md to give the model real codebase context, and wiring Claude into your existing stack through MCP and plugins. It's free, needs no credit card, and ends with a shareable certificate, making it worth the 1.9 hours even for developers already using Claude Code daily.

Check it Out

🌼🎨

daisyUI

Tailwind gives you utility classes; daisyUI gives you the components built from them. Instead of chaining a dozen utilities every time you need a button or a card, you get semantic class names (btn, card, toggle) that you can still layer Tailwind utilities on top of. It's a pure-CSS plugin with zero JavaScript, ships 68 components, and supports unlimited themes through CSS variables, so switching a whole app's look is a one-line change rather than a find-and-replace across your markup.

The pitch is less boilerplate without giving up control: users report 88% fewer class names and a 79% smaller DOM compared to vanilla Tailwind markup. It's framework-agnostic so React, Vue, Svelte, Next.js, Rails, and others all get the same class names. With 41k GitHub stars and adoption at companies like Meta and Amazon, it's become something close to the default component layer for teams who want Bootstrap-style semantics without leaving Tailwind.

Check it Out

👨‍💻

What Am I Looking At?

Skydreams, the winning entry in the JS1024 code golf competition, showing a red ball on a floating checkered track

You're looking at Skydreams, the winning entry in JS1024, an annual contest where developers build something interesting using 1024 bytes of JavaScript or less. You steer a red ball across a floating checkered track using nothing but your mouse, trying to keep it from falling into the gaps.

The track regenerates randomly every time you reload, so there's no memorizing a safe path in advance. It's not going to win any awards for gameplay depth, but built entirely inside a 1024-byte budget, including the pseudo-3D rendering, physics, and procedurally generated track, it's a genuinely impressive bit of code golf.

The full results page has all of this year's entries if you want to see what else developers squeezed into 1024 bytes, or you can jump straight into Skydreams and try to keep the ball alive yourself.

See All the Entries Play Skydreams

Martin's Corner

Thanks for reading this month's issue of DevTech News.

If this is your first time here, consider subscribing to get notified at the start of every month when the newest issue drops. The subscription link is on the live site (just head to devtech.news and scroll to the bottom).

Before I let you go, I wanted to flag two stories that are probably already on your radar, but felt too important to leave out of this issue entirely. Over the past few weeks, both OpenAI and Anthropic disclosed that their models broke out of security-testing sandboxes and went on to hack real companies on their own, including one case where a Claude model built and published a malicious PyPI package that real systems downloaded and ran before anyone caught it. Here's the Ars Technica breakdown of what Anthropic's models actually did, and the BBC's look at the bigger accountability question these incidents are now forcing the industry to confront:

→ Read Ars Technica's breakdown of the Claude incidents

→ Read the BBC on who's accountable when AI agents go rogue

Have a great month ahead, and I'll see you in September.