The Week Three Developer Tools Changed Owner and Nobody Agreed What That Meant

Three pieces of developer infrastructure changed owner in four days, an operating system shipped its first release in two years and immediately started an argument about something else, and a repository that did not exist three weeks ago is now gaining stars faster than most projects gain them in a year.

This is our first roundup, so it is also a note on what we are actually doing here. We publish two to four pieces a week, we test what we can test, and we say when we have not. Here is the week.

The big story: three acquisitions, one calm thread

Between 26 and 29 August, AWS acquired DuckLabs, Nvidia agreed to buy Hugging Face for around 13 billion dollars, and OpenAI cut Cursor off from its models after SpaceX acquired it. Three Hacker News threads, 3,908 points, 1,745 comments.

What made it worth writing up was not the deals. It was that only one community relaxed. The DuckDB thread turned around the moment a reader pointed out that AWS bought the company and not the code, because a nonprofit foundation holds the intellectual property. The Hugging Face and Cursor threads had no equivalent structure to point at and stayed anxious.

Amazon has the worst reputation of the three buyers among the people commenting, and produced the calmest thread. That is the finding: reputation predicted almost nothing, and governance structure predicted almost everything.

Full piece: Three Developer Tools Got Acquired in Four Days and Only One Community Relaxed.

DeepSeek Harness, and why we went looking for a catch

A repository created on 13 August is at 205,238 stars. We did not believe it, so we spent an afternoon trying to break the number.

Three things looked wrong: zero open issues, only 891 watchers against 205,000 stars, and 14,460 commits on a repo that was eighteen days old. All three have dull explanations. Issues are disabled in favour of Discussions. The watcher ratio is what trending looks like. And the oldest commit is dated 10 June, so the project ran privately for two months before going public.

The part we did not expect: eight of the twenty-five fastest-growing repositories created this month are DeepSeek Harness ecosystem projects, and seven of them are not DeepSeek's. Two separate groups shipped competing desktop clients. Somebody's curated plugin list has 13,764 stars on its own.

Full piece: DeepSeek Harness Hit 205K Stars in 18 Days and We Went Looking for the Catch.

Haiku shipped, and the thread was about something else

Haiku R1/beta6 landed on 26 August, two years after the last beta, with over 530 resolved tickets and one new developer gaining commit access. The performance work is real: git status on a 160,000-file repository went from about 15 seconds to 2.5 on a hot cache.

Almost none of the 85 comments were about that. The thread relitigated Haiku's July decision to ban AI and LLM contributions outright, and the release notes turned out to be evidence for both sides of that argument at once.

Full piece: Haiku Shipped Its First Beta in Two Years and the Thread Turned Into a Fight About AI.

Also shipped

Apple introduced the M6 and M5 Ultra. 1,310 points and 1,296 comments, which is a near one-to-one ratio and the signature of a thread where people are arguing rather than nodding. Worth reading the comments more than the announcement.

Nitter and XCancel received cease and desist notices. 1,205 points against 1,346 comments, the highest comment-to-point ratio of anything this week. The front ends that let people read X without an account are the ones under pressure, which matters to anyone whose tooling scrapes public posts.

GLM-5.3-Flash shipped. 1,129 points, 575 comments. Another open-weight release landing in a week already dominated by questions about who controls model distribution.

Cloudflare saved 100 terabytes of memory optimising the 1.1.1.1 DNS cache. 919 points, and one of the few genuinely technical write-ups in the top ten this week rather than an acquisition or a policy fight.

MS Paint and Photos were found to invisibly watermark locally generated output. 860 points, 436 comments. The word doing the work in that headline is locally.

A CEO fired developers to make room for AI, and the developers open sourced their work. 1,027 points, 714 comments. Make of it what you will.

Repos that moved

We snapshot the twenty-five fastest-growing new repositories on GitHub and record star counts over time, which means we can report velocity rather than just size. These are stars per day since each repository was created.

Two things stand out. watermarks-remover, a tool that strips AI watermarks from content, is at 19,536 stars in 19 days, in the same week that Microsoft was found watermarking locally generated images. Those two facts are almost certainly related.

And sapientinc/PRAXIST, an autonomous research system, went from nothing to 4,809 stars in three days. That is the one we will be watching next week, because three days is too early to tell whether it is substance or momentum.

From the Watercooler

The sharpest comment of the week came from u/afpx in the Nvidia thread, asking the question the rest of the discussion mostly avoided:

Both HF and OR, from a technological standpoint, don't appear to have much IP that cannot be easily replicated. I wonder how much it's worth to Nvidia just to obtain a list of who's downloading which models and for what purpose.

File hosting for model weights is not defensible technology. Knowing which organisations pull which models, at what scale, and trending in which direction, is a GPU demand forecast that no competitor can buy at any price. If that is the asset, then the entire argument about whether Nvidia will degrade the platform is beside the point, because a degraded platform produces worse data.

Deep dive: we tried to break our own database

The thing we spent most actual time on this week was not a story. We were verifying row level security on a Supabase project and found a failure mode that looks exactly like success.

A blocked anonymous UPDATE returns 204 No Content. Not 401, not 403. In most APIs 204 means the operation worked. Here it means RLS filtered the query down to zero rows, the update ran against nothing, and the database correctly reported success at doing nothing.

If you are checking status codes to confirm your policies work, you will read that as a hole in your security and go looking for a bug that does not exist. Or worse, you will read a genuine hole as safe, because a permitted write that matches no rows returns the same 204.

The fix is one header. Sending Prefer: return=representation makes PostgREST return the affected rows, so an empty [] is unambiguous where a status code is not.

We also confirmed the thing everyone knows and nobody checks: a table created without RLS is world-readable and world-writable through the REST API. We created one, read every row with the anon key, and successfully inserted a row as an anonymous user. It takes about four seconds.

Verifying RLS through your own app in a private window is not a test. It is a demonstration.

Full procedure, including the script we now run before every deploy: Your Supabase RLS Policy Might Be Fine and You Have No Way of Knowing.

The other fight: Nitter, and reading things without an account

We nearly left this out and were wrong to consider it. The cease and desist notices sent to Nitter and XCancel pulled 1,205 points and 1,279 comments, the highest comment-to-point ratio of anything this week, and it is the story with the most direct consequence for how developers work.

Nitter and XCancel are front ends that let you read X without an account. They are also, quietly, how a lot of tooling reads public posts: link previews, archival scripts, research pipelines, and every bot that quotes a thread. Removing them does not just inconvenience readers.

u/afavour put the reader's version plainly:

Even if you put all the political arguments aside it sucks when a site requires you to log in before you can read content on it. For me that'll mean I just don't read content on there any more.

The more interesting comment came from u/delegate, who drew 17 replies asking why platforms get to control the distribution of content their users wrote. It is not a new question, but it lands differently in a week when three other companies just bought the infrastructure other people build on.

There is a practical note buried in this for anyone maintaining a tool. If your project resolves X links for previews or citations, that path is closing, and the failure will look like intermittent timeouts rather than a clean error. Worth checking before it becomes a support ticket.

The one thing the thread did not resolve, and the reason we are watching it: nobody could point to a replacement that is not itself one login policy away from the same problem. u/S0y listed Mastodon, Bluesky and Threads, and the replies noted that only one of those is structurally different rather than just differently owned.

What we skipped, and why

The Visual Studio 2026 August update. It shipped thinking-effort controls and built-in agent skills, which is genuinely relevant to how people are working. We skipped it because we could not find a substantial community thread to read against the changelog, and a rewritten changelog is not worth your time or ours.

The wider open source AI contribution ban wave. GCC, NetBSD, QEMU and OpenJDK have all landed restrictive policies this year, and there is a public repository cataloguing them. It is a real trend and we will come back to it. We skipped it this week because we had just covered the Haiku version and running the same argument twice in one week is how a site starts repeating itself.

Xiaomi's new CPU matching Apple cores on single-thread. 1,003 points and 736 comments, so clearly people cared. We skipped it because we have no way to verify silicon benchmarks ourselves, and passing along someone else's numbers with our name on top is exactly the thing we said we would not do.

Next week

We are watching whether the DeepSeek Harness ecosystem keeps compounding or flattens out, which the star tracking will show us rather than requiring a guess. We want to see whether Nvidia says anything binding about Hugging Face's open model hosting. And PRAXIST needs another week before anyone can say whether it is real.

If you have something we should be looking at, the contact page works. That is what just shipped.