devtake.dev — #open-sourceArticles tagged open-source on devtake.dev.https://devtake.dev/en-usAn AI agent found 21 ways to attack FFmpeg, the codec library inside almost everythinghttps://devtake.dev/article/ffmpeg-21-zero-days/https://devtake.dev/article/ffmpeg-21-zero-days/DepthFirst's agent surfaced 21 FFmpeg zero-days for about $1,000. One 183-byte packet hits RCE. The deeper story is who pays the volunteers who fix them.Sat, 13 Jun 2026 13:00:00 GMTsecuritysecurityffmpegopen-sourcercevulnerabilityfuzzingluca-reinhardtRed Hat's npm namespace and Arch's AUR were both backdoored within two weeks of each otherhttps://devtake.dev/article/npm-registry-supply-chain-wave/https://devtake.dev/article/npm-registry-supply-chain-wave/A worm hijacked Red Hat's npm namespace, a rootkit spread through 1,500 Arch AUR packages, and a SOC 2-certified AI gateway shipped malware. Registries are under fire.Sat, 13 Jun 2026 12:45:00 GMTsecuritysecuritysupply-chainnpmopen-sourcemalwareluca-reinhardtCloudflare bought VoidZero, the team behind Vite. The tools stay MIT and vendor-neutral.https://devtake.dev/article/voidzero-joins-cloudflare/https://devtake.dev/article/voidzero-joins-cloudflare/Cloudflare acquired VoidZero, Evan You's company behind Vite, Vitest, Rolldown and Oxc. The tools stay MIT-licensed, and there's a $1M ecosystem fund.Mon, 08 Jun 2026 09:45:00 GMTopen-sourceopen-sourcedev-toolsjavascriptvitecloudflaresoren-vanekBeyond the engine: six open-source tools that shape how games get madehttps://devtake.dev/article/open-source-game-dev-tools-digest/https://devtake.dev/article/open-source-game-dev-tools-digest/Godot, Unity and Unreal get the headlines, but six open-source tools quietly do the art, levels, and dialogue work that real games ship on.Mon, 08 Jun 2026 08:15:00 GMTgaminggamingopen-sourcegame-devdev-toolsgodothiro-tanakaMicrosoft is shipping Linux's core commands on Windows, built in Rusthttps://devtake.dev/article/microsoft-coreutils-windows-rust/https://devtake.dev/article/microsoft-coreutils-windows-rust/Microsoft's Coreutils for Windows brings native ls, cp, and grep to Windows, built on the Rust uutils project. Here's what it is and why the Rust rewrite matters.Wed, 03 Jun 2026 12:45:00 GMTopen-sourceopen-sourcerustdev-toolsgithublinuxsoren-vanekSQLite won't accept AI-written code, but QEMU just opened the door to ithttps://devtake.dev/article/sqlite-refuses-agentic-code-qemu-opens-door/https://devtake.dev/article/sqlite-refuses-agentic-code-qemu-opens-door/Two of the most cautious C projects split on AI contributions in the same week. The real fight is over copyright provenance and who cleans up the slop.Fri, 29 May 2026 05:35:00 GMTopen-sourceopen-sourcesqliteqemuai-codingagentic-codingmaintainerslicensingllmsoren-vanekHacker News is obsessed with durable Postgres workflows and a game about clicking yeshttps://devtake.dev/article/dev-tools-trending-digest-may-2026/https://devtake.dev/article/dev-tools-trending-digest-may-2026/Six dev-tooling and AI posts that climbed Hacker News in late May 2026: durable execution on plain Postgres, LLM code smells, a permission-fatigue game, Rust 1.96, and more.Fri, 29 May 2026 05:05:00 GMTaidev-toolshackernewsllmrustpostgresai-agentsopen-sourcedieter-morelliMySQL just fixed a 20-year-old bug where cascade deletes silently skipped triggershttps://devtake.dev/article/mysql-bug-11472-fixed-20-years/https://devtake.dev/article/mysql-bug-11472-fixed-20-years/MySQL bug #11472 was filed in 2005: triggers never fired on foreign key cascade actions, silently breaking audit logs. MySQL 9.7 finally closes it via WL#17024.Wed, 27 May 2026 18:50:00 GMTopen-sourcemysqldatabasesopen-sourceoracledev-toolssqlmariadbsoren-vanekMicrosoft just open-sourced 86-DOS. Tim Paterson's 45-year-old listings are now on GitHub under MIT.https://devtake.dev/article/microsoft-dos-historical-source-open-sourced/https://devtake.dev/article/microsoft-dos-historical-source-open-sourced/Yufeng Gao and Rich Cini scanned Tim Paterson's 1981 assembler printouts. Microsoft pushed them to DOS-History/Paterson-Listings on April 28, the 45th anniversary.Mon, 25 May 2026 12:30:00 GMTopen-sourcemicrosoftms-dos86-dosopen-sourcecomputer-historygithubmit-licensetim-patersonsoren-vanekFlatpak's next sandboxing milestone bolts it to systemd. Alpine and Void users get the bill.https://devtake.dev/article/flatpak-systemd-dependency-shift/https://devtake.dev/article/flatpak-systemd-dependency-shift/Sebastian Wick and Adrian Vovk pitched systemd-appd at Linux App Summit on May 17. The cost of nested sandboxing is a hard systemd dependency in mainline Flatpak.Mon, 25 May 2026 11:30:00 GMTopen-sourceflatpaksystemdlinuxsandboxopen-sourcealpine-linuxvoid-linuxpipewiresoren-vanekyt-dlp's maintainer says Bun is now 'fully vibe-coded'. Support is officially deprecated.https://devtake.dev/article/yt-dlp-bun-support-deprecated/https://devtake.dev/article/yt-dlp-bun-support-deprecated/yt-dlp's maintainer bashonly says Bun's Rust rewrite 'has taken a turn towards being fully vibe-coded.' The supported window narrowed to four versions.Sat, 23 May 2026 09:30:00 GMTopen-sourceyt-dlpbunjavascriptruntimevibe-codingopen-sourcedev-toolssoren-vanekCloudflare taught wasm-bindgen to catch a Rust panic. Workers no longer poison the sandbox.https://devtake.dev/article/cloudflare-rust-workers-panic-recovery-wasm-bindgen/https://devtake.dev/article/cloudflare-rust-workers-panic-recovery-wasm-bindgen/Three Cloudflare engineers shipped panic and abort recovery into wasm-bindgen on April 22. A Rust Worker that panics now reinitialises on the next request.Wed, 20 May 2026 09:00:00 GMTopen-sourcerustcloudflarewasmwasm-bindgenwebassemblydev-toolsopen-sourcejavascriptsoren-vanekAtlassian laid off the engineer who built its edge. He published the blueprints.https://devtake.dev/article/atlassian-layoff-engineer-system-design-video/https://devtake.dev/article/atlassian-layoff-engineer-system-design-video/Vasilios Syrakis spent eight years building Atlassian's Envoy control plane. After the March cuts, he posted a 40-minute walkthrough that hit 1.1M views.Tue, 19 May 2026 10:30:00 GMTwebopen-sourcedev-toolsinfrastructureenvoyatlassianplatform-engineeringlayoffssystem-designnaomi-parkThe OrcaSlicer fork Bambu Lab killed has six mirrors. Jeff Geerling joined the boycott.https://devtake.dev/article/bambu-lab-community-fork-fulu-foundation/https://devtake.dev/article/bambu-lab-community-fork-fulu-foundation/FULU-Foundation/OrcaSlicer-bambulab hit 1,700 stars on May 12. Geerling won't recommend a Bambu printer again, and Louis Rossmann pledged $10,000 toward Jarczak's defense.Wed, 13 May 2026 10:15:00 GMThardwarebambu-laborcaslicer3d-printingopen-sourceagpljeff-geerlingvendor-lock-indmcahiro-tanaka120 million plugin downloads later, Obsidian moved off GitHub. Paid plugins are now allowed.https://devtake.dev/article/obsidian-plugin-marketplace-future/https://devtake.dev/article/obsidian-plugin-marketplace-future/Obsidian launched Obsidian Community on May 12. The new directory replaces the GitHub plugin queue with automated reviews, and paid plugins are in for the first time.Wed, 13 May 2026 09:30:00 GMTopen-sourceobsidianpluginsopen-sourcenote-takingkepanoautomated-reviewdev-toolspaid-pluginssoren-vanekRPCS3's maintainers will ban contributors who submit undisclosed AI pull requestshttps://devtake.dev/article/rpcs3-ai-slop-pull-requests-policy/https://devtake.dev/article/rpcs3-ai-slop-pull-requests-policy/The PS3 emulator project posted on X on May 10, citing 'AI slop' that has been clogging review. The hard line: ban-on-sight if you don't disclose.Mon, 11 May 2026 10:15:00 GMTopen-sourceopen-sourcerpcs3emulatorgithubai-codingai-slopplaystation-3contributorssoren-vanekJarred Sumner rewrote 960,000 lines of Bun from Zig to Rust in six days. He might throw it all away.https://devtake.dev/article/bun-rust-rewrite-zig-test-compatibility/https://devtake.dev/article/bun-rust-rewrite-zig-test-compatibility/Bun's creator used Claude to port the JavaScript runtime from Zig to Rust, hitting 99.8% test compatibility. He says there's a 'very high chance' it gets scrapped.Sun, 10 May 2026 09:45:00 GMTopen-sourcebunrustzigjavascriptruntimeanthropicopen-sourcedev-toolssoren-vanekValve open-sourced the Steam Controller's shell. Dbrand had a skin ready in 48 hours.https://devtake.dev/article/valve-steam-controller-cad-open-source/https://devtake.dev/article/valve-steam-controller-cad-open-source/Valve published STP and STL CAD files for the Steam Controller and Puck under CC BY-NC-SA 4.0 on GitLab. Anyone with a 3D printer can now mod it.Fri, 08 May 2026 09:30:00 GMTgamingvalvesteam-controlleropen-sourcecreative-commons3d-printingmoddinggaminghardwarehiro-tanakaBambu Lab killed an OrcaSlicer fork by lawyer letter. The fork was based on Bambu's own AGPL code.https://devtake.dev/article/bambu-lab-orcaslicer-legal-threat/https://devtake.dev/article/bambu-lab-orcaslicer-legal-threat/Pawel Jarczak pulled OrcaSlicer-bambulab off GitHub on May 1 after Bambu Lab's legal team accused him of impersonating Bambu Studio and bypassing authorization.Sun, 03 May 2026 13:00:00 GMThardwarebambu-laborcaslicer3d-printingopen-sourceagplagplv3dmcavendor-lock-inhiro-tanakaMicrosoft open-sourced the earliest known DOS code, transcribed from a stack of Tim Paterson's printouts.https://devtake.dev/article/microsoft-dos-source-code-open-sourced/https://devtake.dev/article/microsoft-dos-source-code-open-sourced/MIT-licensed at GitHub on April 28, the 86-DOS 1.00 kernel and PC-DOS development snapshots were OCR'd from 45-year-old assembler listings.Sun, 03 May 2026 12:45:00 GMTopen-sourcemicrosoftdos86-dosopen-sourceretrocomputingmit-licensegithubtim-patersonsoren-vanekAn unofficial Notepad++ port finally landed on Mac. Don Ho didn't write it.https://devtake.dev/article/notepad-plus-plus-mac-port/https://devtake.dev/article/notepad-plus-plus-mac-port/Andrey Letov shipped a native macOS Notepad++ port as a universal binary with the original Scintilla engine and a new Cocoa UI. It's GPL, free, and unaffiliated with Don Ho.Fri, 01 May 2026 10:30:00 GMTopen-sourceopen-sourcenotepad-plus-plusmaccode-editorsscintillacocoagpldev-toolssoren-vanekZed 1.0 ships its agentic editor. The Atom team's Rust rewrite finally has a stable label.https://devtake.dev/article/zed-1-0-rust-editor-launch/https://devtake.dev/article/zed-1-0-rust-editor-launch/Zed Industries shipped 1.0 on April 29 after five years of Rust and GPU work. Free forever for humans, with $10/month hosted AI and an open Agent Client Protocol.Thu, 30 Apr 2026 09:30:00 GMTopen-sourcezedrustdev-toolsagentic-codingopen-sourcecursorcode-editorsai-assistantsoren-vanekMitchell Hashimoto is pulling Ghostty off GitHub. The reason is daily outages.https://devtake.dev/article/ghostty-leaving-github-mitchell-hashimoto/https://devtake.dev/article/ghostty-leaving-github-mitchell-hashimoto/Ghostty's creator has tracked GitHub outages every workday for months. After 18 years on the platform, he's moving the project. A read-only mirror stays.Wed, 29 Apr 2026 09:25:00 GMTopen-sourceghosttygithubopen-sourcedev-toolsmitchell-hashimototerminalhashicorpsoren-vanekWarp's terminal is now open source. The cloud agent platform Oz is the actual product.https://devtake.dev/article/warp-terminal-open-source-agpl/https://devtake.dev/article/warp-terminal-open-source-agpl/Warp released its 36k-star Rust client on GitHub under AGPLv3 on April 28. OpenAI is the founding sponsor and Oz keeps the bills paid.Wed, 29 Apr 2026 09:15:00 GMTopen-sourcewarpopen-sourceopen-source-licensingagplterminalai-agentsopenaidev-toolssoren-vanekMinIO archived its repo on April 25. The community fork already has the admin console back.https://devtake.dev/article/minio-repository-archived/https://devtake.dev/article/minio-repository-archived/MinIO's GitHub repo went read-only with a 'NO LONGER MAINTAINED' banner pointing users at AIStor. Pigsty's Ruohang Feng forked it and restored the binaries.Sun, 26 Apr 2026 11:30:00 GMTopen-sourceminioopen-sources3object-storageagplforkself-hostedpigstysoren-vanekDeepSeek V4 lands: 1.6T-param open MoE, 1M-token context, and SWE-bench within 0.2 of Opus 4.6https://devtake.dev/article/deepseek-v4-release/https://devtake.dev/article/deepseek-v4-release/DeepSeek shipped V4-Pro and V4-Flash under MIT on April 24. V4-Pro hits 80.6% on SWE-bench Verified. V4-Flash is $0.14 in / $0.28 out.Fri, 24 Apr 2026 21:30:00 GMTaideepseekdeepseek-v4llmai-modelsopen-weightsmoebenchmarksopen-sourcedieter-morelliLinux 7.1 is yanking ham radio, ISDN, and ATM. The reason: AI bug-report spam.https://devtake.dev/article/linux-7-1-ham-radio-isdn-removal/https://devtake.dev/article/linux-7-1-ham-radio-isdn-removal/Jakub Kicinski's networking pull request removes 138,161 lines of decades-old code. Kernel maintainers say LLM-generated bug reports made the old subsystems un-maintainable.Fri, 24 Apr 2026 21:00:00 GMTopen-sourcelinuxlinux-kernellinux-7-1kernelai-securitynetworkingopen-sourcesecuritysoren-vanekInside GitHub's fake star economy: 6 million bought stars and how to spot themhttps://devtake.dev/article/github-fake-star-economy/https://devtake.dev/article/github-fake-star-economy/A Carnegie Mellon study counted 6 million suspected fake stars across 18,617 GitHub repos. Here's what the StarScout research actually found and how to read a star count now.Mon, 20 Apr 2026 16:00:00 GMTopen-sourcegithubfake-starsstarscoutopen-sourcesoftware-researchicse-2026supply-chainai-repossoren-vanekCloudflare open-sourced a lossless LLM compressor that shaves 22% off model weightshttps://devtake.dev/article/cloudflare-unweight-lossless-llm-compression/https://devtake.dev/article/cloudflare-unweight-lossless-llm-compression/Unweight is Cloudflare Research's new BF16 weight compressor. 22% smaller bundles, 13% smaller inference footprint, 30-40% throughput overhead, BSD license.Sun, 19 Apr 2026 12:00:00 GMTopen-sourcecloudflareunweightllmcompressionbf16huffmanh100open-sourcesoren-vanekQwen 3.6-35B-A3B: the open MoE beating Opus 4.7 on Simon Willison's laptophttps://devtake.dev/article/qwen-3-6-35b-a3b-beats-opus-on-laptop/https://devtake.dev/article/qwen-3-6-35b-a3b-beats-opus-on-laptop/Alibaba's Qwen 3.6-35B-A3B is a 35B-param mixture-of-experts with only 3B active. Apache 2.0, runs on consumer GPUs, and it's already winning real tasks.Fri, 17 Apr 2026 10:00:00 GMTaiqwenalibabaopen-sourcemoellmlocal-inferenceopen-weightsdieter-morelli