This week I’m joined by Peer Richelsen, co-founder of Cal.com. What if the majority of open source repositories are already compromised and we just don’t know it yet? That’s the theory Peer brings to the table this week. We dig into how AI has flattened the knowledge graph to the point that a 16-year-old can vibe hack a power station just as easily as their mom can vibe code an iOS app, why the reporting culture that has kept open source safe all these years is collapsing under AI generated noise, Cal.com’s move to fork its own codebase and take the sensitive parts private, and the eye opening reality that shipping “$1 of AI tokens for pennies on the dollar” is now a common startup business model.

Sam Lambert is back after 4 years and he does not hold back! We cover $5 PlanetScale Postgres, the Neki “do-over” of Vitess, agents shipping schema changes through deploy requests, rolling back a 500TB table in seconds, and the very real question of whether to open source any of it. Plus: why he thinks the sleeping, lazy giants should be broken up.

Haroon Meer is back! Haroon is the Founder of Thinkst, the ~50-person bootstrapped company behind Canary and Canarytokens — honeypots and tripwires you sprinkle inside your network and forget about until an attacker touches one. We talk about the AWS API key token attackers just can’t resist trying, the real credit card token backed by an actual bank partnership, Breadcrumbs (their brand-new feature that leads intruders straight to your canaries), a live demo where a hardware Canary becomes a Synology NAS in one click, and how a company with zero outbound sales and no price increase in ten years quietly passed $22.5 million in ARR.

This week I’m talking with Max Stoiber, currently working on ChatGPT’s plugin directory and app platform at OpenAI. We discuss the hundreds of open source projects nobody remembers alongside the big ones like react-boilerplate and styled-components, how Spectrum became part of GitHub and eventually helped shape GitHub Discussions, the founder growth that came from building Stellate, the GraphQL cache that turned into a dual acquisition by Shopify and The Guild, and why ChatGPT apps feel like a new surface for software.

This week I’m talking with Matt Carey about Code Mode and how most of us have been thinking about MCP all wrong. Matt works on the Agents SDK and MCP at Cloudflare — we discuss how server-side Code Mode lets one MCP server expose all ~2,500 Cloudflare API endpoints in about 1,000 tokens of context, the dynamic Worker loader that runs model-written code safely in a V8 isolate, Matt’s own workflow with Claude, where memory fits into the future of agents, and his Zaggy git wrapper that keeps agents from force-pushing his repos.

Today on the show I’m talking with Amelia Wattenberger — designer, data-viz veteran, ex-GitHub Next, and now designing Intent at Augment Code. What if the last 30% of any software project is about to become the hardest part you’ve ever done? That’s the argument Amelia is making today. We discuss the identity crisis developers are having as agents take over the keyboard, the epic redesign of developer tooling in this agent-first world, the arc from autocomplete to chat to CLI back to UI, why Intent treats a workspace as their core primitive not a chat thread, the tradeoffs between one-worktree-per-agent vs. one-worktree-per-task, and why she thinks prototyping just got easier but finishing got harder.

Adam talks with Tailscale co-founder and Chief Strategy Officer David Carney about where Tailscale is headed next: TSIDP, TSNet, multiple tailnets, and Aperture. They get into clickless auth (via TSIDP), TSNet apps, multiple tailnets for isolation and control, and Aperture, Tailscale’s private AI gateway for API key management, observability, and agent security.

Burke Holland works on GitHub Copilot by day and codes with his AI agents always. Early January, Burke posted about how Opus 4.5 changed everything. We were all still buzzing from the holiday-season 2x usage bump Claude gave us, and Opus 4.5 felt like a genuine step function in capability. Burke and I get into all the details. Opus 4.5 may have started the fire, but GPT-5.3 Codex is certainly living up to the hype.

Steve Ruiz joins us for a deep-dive on tldraw (a very good free whiteboard) and the business he’s built selling SDKs that help others build very good whiteboards (and more) with tldraw’s high-performance web canvas.

Along the way, we discuss the excitement/fear we share about keeping our agents busy, how SDK and infra companies are affected differently by agentic software than SaaS companies, how Steve is approaching the coming era of internal tooling, what will happen when we equip LLMs with an infinite canvas, and more.

Paul Dix joins us to discuss the InfluxDB co-founder’s journey adapting to an agentic world. Paul sent his AI coding agents on various real-world side quests and shares all his findings: what’s going to prod, what’s not, and why he’s (at least for a bit) back to coding by hand.

Update: He’s back to letting the AIs write code, but with a lot more oversight. For now…

In May of 2025, Docker launched Hardened Images, a secure, minimal, production-ready set of images. In December, they made DHI freely available and open source to everyone who builds software. On this episode, we’re joined by Tushar Jain, EVP of Engineering at Docker to learn all about it.

As the creator and long-time maintainer of ESLint, Nicholas Zakas is well-positioned to criticize GitHub’s recent response to npm’s insecurity. He found the response insufficient, and has other ideas on how GitHub could secure npm better. On this episode, Nicholas details these ideas, paints a bleak picture of npm alternatives like JSR, and shares our frustration that such a critical piece of internet infrastructure feels neglected.

Damien Tanner (founder of Pusher, now building Layercode) is back for a reunion 17 years in the making. Damien officially returns to The Changelog to discuss the seismic shift happening in software development. From the first sponsor of the podcast to frontline builder in the AI agent era, Damien shares his insights on why SaaS is dying, why code review is a bottleneck (and non-existent for some), and how small teams can now build giant things.

We’re joined by Sid Sijbrandij, founder of GitLab who led the all-in-one coding platform all the way to IPO. In late 2022, Sid discovered that he had bone cancer. That started a journey he’s been on ever since… a journey that he shares with us in great detail. Along the way, Sid continued founding companies including Kilo Code, an all-in-one agentic engineering platform, which he also tells us all about.

Ajay Kulkarni from Tiger Data (Co-founder/CEO) is on the pod this week with Adam. He asked him to get vulnerable and trace his path to becoming a CEO. They dig into the themes that have shaped his career, and explore how founder values end up forming company culture (whether you intend them to or not). From his enterprise days to building Timescale (and the rename to Tiger Data), we cover the whole journey — even the haters, because haters gonna hate. Here’s where it gets really interesting: Agents in the database! Not the hype. The real thing baby. They get into how fast you can go from idea to shipped these days, what it actually means to talk to your database, and the whole API/CLI/MCP/Skills movement.

We’re joined by Zipline cofounder / CTO, Keenan Wyrobek. Zipline is on a mission to build the world’s first logistics system that serves all people equally via their fleet of autonomous drones that started in Africa delivering medical supplies and can now deliver packages (up to 8 lbs) directly to your door. They’ve solved a lot of gnarly technical and regulatory challenges along the way. We go deep with Keenan. We hope you’ll find this one fascinating.

Amazon CTO, Werner Vogels, stops by to help us explore his tech predictions for 2026 and beyond. Will companionship be redefined by consumer robots? Will quantum-safe become the only safe worth talking about? Is this the dawn of the renaissance developer? We’re infinitely curious why Werner came to this particular set of conclusions. Are you?

Let’s hear how Wikipedia actually works from long-time Wikipedian, Bill Beutler! Bill has been heavily involved with this “8th wonder of the modern world” for two decades and even built a career on it, founding Beutler Ink –a digital agency known for its pioneering work in Wikipedia public relations.

We discuss: the official (and not so official) rules, the editor cabal (which isn’t one), the business model (which really isn’t one), how an edit sticks (or not), how AI chatbots threaten the future of the site (or don’t), and a whole lot more.

Spencer Chang caught our attention with the alive internet theory website, but he creates all kinds of computery things to bring people together around play, connection, and creation. Spencer’s experiments with computing-infused objects inspired him to create an entire line of internet sculptures and real-world computing shrines that will hopefully inspire all of us to keep the internet alive and flourishing for years to come.

Prolific software blogger, Sean Goedecke, joins us to discuss why he believes software engineers need to be involved in the politics of their organization, how to avoid worry driven development, what is “good taste” in software engineering, where agentic coding will take our industry, why getting the main thing right is so important, and how to get your blog to the top of Hacker News.

Andrew Nesbitt builds tools and open datasets to support, sustain, and secure critical digital infrastructure. He’s been exploring the world of open source metadata for over a decade. First with libraries.io and now with ecosyste.ms, which tracks over 12 million packages, 287 million repos, 24.5 billion dependencies, and 1.9 million maintainers.

What has Andrew learned from all this, who is using this open dataset, and how does he hope others can build on top of it all? Tune in to find out.

Adam Jacob joins us to discuss how agentic systems for building and managing infrastructure have fundamentally altered how he thinks about everything, including the last six years of his life. Along the way, he opines on the recent AWS outage, debates whether we’re in an AI-induced bubble, quells any concerns of AGI and a robot uprising, eats some humble pie, and more.

Ellie Huxtable’s magical shell tool, Atuin, won developers’ hearts by syncing, searching, and backing up our shell history with ease. Now Ellie is tackling the desktop with a GUI built to help teams make their workflows repeatable, shareable, and reliable.

We’re joined by Deepak Singh from the Kiro team. Kiro is AWS’s attempt at building an AI coding environment to take you from prototype to production. It does that by bringing structure to your agentic workflow with spec-driven development. Their aim: the flow of AI coding, leveled up with mature engineering practices.

Our friends at Cult.Repo launch their epic Vite documentary on October 9th, 2025! To celebrate, Jerod sat down with Evan You to discuss Vite’s adoption story, why he raised money to start VoidZero, how developer documentaries get made, open source sustainability, and more.

Charlie Marsh built Ruff (an extremely fast Python linter written in Rust) and uv (an extremely fast Python package manager written in Rust) because he believes great tools can have an outsized impact. He believes it so much, in fact, that he started an entire company that builds next-gen Python tooling.

On this episode, Charlie joins us to tell us all about it: why Python, why Rust, how they make everything so fast, how they’re starting to make money, what other products he’s dreaming up, and more.

Voices of Oxide on the pod! Cliff Biffle (engineer), Dave Pacheco (engineer), and Ben Leonard (designer) are on the show today. Jerod and I were invited to Oxide’s annual internal conference called OxCon to meet the people and to hear the stories of what makes Oxide a truly special place to work right now.

Cliff Biffle is working on all Hubris and firmware. Cliff says “There’s a lot that happens before the ‘main CPU’ can even power on.” Dave Pacheco is leading the efforts on Oxide’s “Update” system. And Ben Leonard in charge of all things brand and design at Oxide.

Everything is changing. Adam is joined by his good friend Beyang Liu from Sourcegraph — this time, talking about Amp (ampcode.com). Amp is one of the many, and one of Adam’s favorite agentic coding tools to use. What makes it different is how they’ve engineered to it to maximize what’s possible with today’s frontier models. Autonomous reasoning, access to the oracle, comprehensive code editing, and complex task execution. That’s nearly verbatim from their homepage, but it’s also exactly what Adam has experienced. They talk through all things agents, how Adam might have been holding Amp wrong, and they even talked through Adam’s idea called “Agent Flow”. If you’re babysitting agents, this episode is for you.

Jim Remsik has lived on the bleeding edge (but also the heart’s center) of the Ruby world for decades. This fall, he’s organizing six (yes, SIX) XO Ruby confs all around the United States.

On this episode, Jim joins us to reminisce about the early days of Ruby and Rails, share what he’s learned from so many years of organizing events, and invite all of us to join him on his upcoming 7500 mile road trip.

Our friends at Cult.Repo launched their epic Python documentary on August 28th, 2025! To celebrate, we sat down with Travis Oliphant –creator of NumPy, SciPy, and more– to get his perspective on how Python took over the software world.

Stick around for the twist ending! We set aside Python and dissect Travis’ big idea to make open source projects financially sustainable through direct investment.