Yeah, it's also not a straightforward equation: getting updates immediately may mean you avoid an attack, as well as getting the newest features and fixes.

That said, "cooldowns" are hardly new -- lots of people used to delay windows/macs/android updates until they were sure they were stable.

Dependency cooldowns turn you into a free-rider Against dependency cooldowns as a response to supply chain attacks

As someone who has suggested using cooldowns to mitigate some attacks, I did enjoy this article arguing they are a poor solution and moral problem: calpaterson.com/deps.html

Cal suggests using upload queues instead, which I would agree with.

This is tragically beautiful.

How I run multiple $10K MRR companies on a $20/month tech stack

"[the AWS] control panel is a labyrinth designed to extract billing upgrades".

Love this article on running lean (including LLMs) by Steve Hanov stevehanov.ca/blog/how-i-r...

@lizrice.com you might want to check this out if you haven't already...

For anyone that hasn't seen it yet, the For You feed is a better replacement for the default feeds.

bsky.app/profile/did:...

Parenting milestone achieved: woke up and nearly screamed because the 3 year old had silently come into our room and was standing next to my head quietly staring at me

E.g. bsky.app/profile/imki...

I think that's their April Fool buddy tamagotchi thing, right?

Lol, I'd actually quite like if that was real 😅

🔥 @rkatz.xyz taking no prisoners today lol

Solar is not less than revolution in Pakistan. Almost every home and factory has solar installed on their roofs. More affluent houses have almost gone off grid; others are selling back to grid and others who can't afford has their own small scale 12V solar panels to run fans in the scorching summer of Pakistan to save electricity bills. It is all done by people independently without much support from the government as ROI (if you are using full potential of your installed capacity, it can be as low as 1 year and afterwords it will be free) is much better on solar than paying the grid. I myself has got one my roof, 6KW with 5Kwh battery backup costing me 700K roughly 2500$. Now, I can use AC without thinking of electricity bills and the most importantly I do not have to face inconvenience of grid being not available in some cases for 24 hours. Now Pakistan is facing energy crises not because it does not have enough, because it has too much as people are generating their own and due to nature of the contracts with electricity producing companies' government has to pay them according to their installed capacity not by generated. According to a government report in 2021, 116,816Gwh was consumed commercially and in 2024 it stands at 111,110Gwh and in 25 and 26 in would be even lower. Isn't it insane?

thought this comment on hacker news about the energy race was interesting

New #GOTOpodcast 👇
@adrianmouat.com & @charleshumble.bsky.social on the real state of container security.

• Why containers are hard to secure
• Why scanners don’t solve the problem
• What’s changing now
• The practices that work
• Lessons from real incidents


🎧 gotopia.tech/podcast

#GOTOpodcast:
@hollycummins.com, @abangser.bsky.social & @adrianmouat.com discuss

• Why security often frustrates developers
• Why security fails when added late
• How platform engineering can help
• The next big risk area

🎧 Listen in: gotopia.tech/podcast

Mildly impressed I managed to describe the Swiss cheese model without a picture!

Thanks for the mention!

CloudNative.Now - February 2026 Welcome to the February edition of CloudNative.Now - a monthly newsletter that covers all that has been happening in the cloud native world

This months newsletter is now out! 🎉

✨ February 2026 ✨

https://cloudnative.now/2026-february/

Yes, this is great! Well done @charleshumble.bsky.social

Nobody knows what programming will look like in two years Kent Beck doesn't know what programming will look like in two years, and he's been thinking about this longer than most of us.

Excellent article from @charleshumble.bsky.social, a must-read for all developers

leaddev.com/ai/nobody-kn...

I regularly see people wondering how it's possible that there are so many musicians and writers and film makers and artists from a tiny nation like Iceland.

And the answer is really simple: State funding for art education and artists. I literally get a salary from the government to write books.

The podcast has been going for a few seasons now and is well worth a listen; this episode starts with a tale of (nearly) exploding boilers...

Kubernetes Bytes Kubernetes Bytes is a podcast bringing you the latest from the world of cloud native data management. Hosts Ryan Wallner and Bhavin Shah come to you from Boston, Massachusetts with experienced…

I spoke with Bhavin Shah a few weeks back for the Kubernetes Bytes podcast.

We covered a bunch of topics including CVEs, the different vulnerability databases, and how platform engineers can use Chainguard images to protect against CVEs.

www.kubernetesbytes.com

How I learned to stop worrying and love the latest tag The latest tag isn’t unsafe by default — pin images to digests for reproducible, secure updates while staying current with automated workflows.

More info in this blog post www.chainguard.dev/unchained/ho...

My hot take on why the "latest" tag is sometimes the best tag to use!

#containers
#kubernetes
#devops

The team at GOTO have done a great job of collating links to the various subjects we talk about which are fantastic resources for anyone that wants to dive deeper.

State of the Art of Container Security • Adrian Mouat & Charles Humble • GOTO 2026 This interview was recorded for GOTO State of the Art in November 2025. #GOTOcon #GOTO https://gotopia.tech Read the full transcription of this interview…

I spoke with @charleshumble.bsky.social a few weeks back for @gotocon.com

We dived into a wide range of security and container topics, from why containers came about and how vulnerability scanners work, to SBOMs and the evolution of Distroless into @chainguard.dev images

youtu.be/9NUOiL48hbo?...

Security vs DevEx? False choice.

@abangser.bsky.social, Adrian Mouat & @hollycummins.com explore how teams can build systems that are both secure and great to work on. youtu.be/EGSMP2UodKM?...

i'm torn on this. on one hand: yes, i feel this. i'm doing coding side projects again and i haven't done that for a decade.

on another hand, the kind of burnout i get from overusing claude is unlike anything before. i'm learning to find a balance

It's from an article on the productivity of "great hackers". I guess "great hackers" will still exist, but the skills they need and use will have to evolve.

www.paulgraham.com/gh.html