I'm somebody who's written rather extensively on generative AI ethics, and I feel there is a lot that is unethical about the current corporate climate and culture surrounding the technology. And when I write about LLMs and chatbots, I'm careful not to make judgments about the people using the end products—I don't think you're a bad person if you use ChatGPT or Claude, or whatever. What I'm discussing today is different. There is no room for debate or argument, here—only hard, absolute lines in the sand. Much of the world has become far too complacent and complicit with people (and their companies) who proclaim and hold far-right, fascist ideology. These are not image boards residing in the fringe corners of an anonymous Internet made up of people who have slipped through the cracks. No, these are wealthy people in power who are blatant and shameless in their support for those who continuously beat the drum of bigotry, xenophobia, transphobia, and cynical accelerationist hatred. Open source technology has become a culture safe for this rhetoric and ideology, with millions of dollars being invested to continue this status quo. You need to be made aware of this, and then you need to be vocal and take action. ## DHH David Heinemeier Hansson is the most well-known figurehead here. He is the creator of Ruby on Rails, CTO of 37signals, and a Shopify board member. In September 2025, DHH published "As I remember London", mourning that London is "no longer full of native Brits"—a claim that redefines "native Brit" to mean "white." Developer Jake Lazaroff details how DHH describes a Tommy Robinson march as "heartwarming," where speakers called for "remigration" (a euphemism for the ethnic cleansing of non-white residents) and one speaker demanded that countries "ban halal," "ban mosques," and "ban temples." DHH invokes abuse scandals to bolster his white-nationalist rhetoric, framing non-white men as predators of "British girls," while UK data shows no such racial skew. LibreNews reaches the same conclusion. Developer Joel Drapper wrote how Ruby Central had lost a $250,000-a-year sponsorship from Sidekiq after giving DHH a speaking slot at RailsConf a few weeks later, leaving the nonprofit financially dependent on Shopify (where DHH sits on the board); Shopify then pushed Ruby Central to consolidate control rather than lose its funding. The Register and Heise both covered the fallout. But none of this has cost DHH money—if anything, he's only gained. A few weeks ago, DHH announced the Omacom Foundation to bankroll his Linux distribution, Omarchy, which is nothing more than a few vibecoded scripts on top of Arch Linux. There are twelve "Founding Patrons" pledging a million dollars apiece: * Tobi Lütke, CEO of Shopify * Patrick Collison, CEO of Stripe * Michael Dell, Chairman and CEO of Dell Technologies * Jack Dorsey, Block Head and Chairman of Block * Matthew Prince, CEO of Cloudflare * Brendan Iribe, Cofounder of Sesame and Oculus * Jason Fried, CEO of 37signals * Drew Houston, cofounder and co-CEO of Dropbox * Peter Steinberger, creator of OpenClaw * Brian Armstrong, CEO of Coinbase * Yunjie Dai, cofounder of TapTap * DHH himself. And these corporations are each contributing $100,000 a year for three years: * 1Password * 37signals A dozen of the most powerful executives in tech looked at a man who wrote that a British march calling for the deportation of non-white citizens was "heartwarming," and decided he was the person they wanted to hand a multimillion-dollar foundation to. I should also mention that the same infrastructure companies bankrolling Omarchy and Ladybird are also the backbone of the ongoing violence of U.S. deportations. This includes Amazon's AWS contracts powering ICE, Palantir building ICE's case-management system, and the use of Salesforce's tools. ## "Apolitical" Andreas Kling, founder of the Ladybird browser project (itself an Omacom-adjacent beneficiary, sponsored by Cloudflare, FUTO, Shopify, 37signals, Proton, and JetBrains), built his project's identity around refusing a documentation patch that would have made SerenityOS's manuals gender-neutral, on the grounds that gender-neutral language was "personal politics" that didn't belong in a technical project. Blogger Kate Vibber wrote how that became Ladybird's official contributing guidelines, which now bar "discussions on societal politics" outright—a policy treating the mere existence of trans contributors as more "political" than excluding them. In 2026, Kling posted in support of Charlie Kirk after Kirk's assassination and, per discussion on Lobsters, bristled at being called a fascist for it—a reaction hard to square with "apolitical," since Kirk was a movement figure who, per his own Wikipedia entry, promoted the "white genocide" conspiracy theory and criticized the Civil Rights Act. Vaxry, the developer behind the Hyprland Wayland compositor (another Omacom-funded project), was banned in 2024 by Freedesktop.org's Code of Conduct team over a pattern of the Hyprland Discord enabling harassment of trans community members, including an incident where moderators changed a trans user's display name to strip their pronouns. Vaxry's own public response framed the ban as ideological overreach by "social justice warriors," while the Freedesktop side, recounted at LibreNews, describes over a year of private attempts to get him to address the toxicity before going public. Hyprland's contributing guidelines now ban "political" speech too. Enrico "metux" Weigelt forked the deprecated Xorg server into Xlibre as a rebellion against a "RedHat DEI" conspiracy he believes exists. The founding document of the project was a rant about big-tech diversity initiatives, and its code of conduct is a text file that just says "404." FUTO is a funder of Immich and is run by Eron Wolf, a friend and platformer of Curtis Yarvin, the "dark enlightenment" writer whose ideas about dismantling democracy have now found purchase in the current U.S. administration. Brendan Eich, Mozilla's co-founder and now Brave's CEO, used Brave's infrastructure to give payments to Kiwi Farms, a forum whose harassment campaigns have been linked to multiple suicides. We witness the same pattern over and over. A tech project is declared "apolitical," and defines any accommodation of marginalized contributors as a political act, and keeps the actual politics of the maintainers—nostalgia for ethnically white homogeneous cities and hostility to gender-neutral pronouns—off the table entirely. Because that's just, you know, how they feel. "Apolitical" has never meant a lack of politics. It's meant politics that current power doesn't have to defend. ## The Throughline We have been watching the fragile fury of white masculinity and hate metastasize and fester over the years, from Gamergate's harassment campaigns through years of anti-SJW cringe compilation content mills, the marking of Antifa as the enemy, the tantrum-throwing #AllLivesMatter movement, and the manufactured panic over DEI and "wokeism." You are not living in the neoliberal-Obama era where basic compassion and empathy are the default anymore. And you haven't been for a long time. Despite their cries about censorship and deplatforming, and despite their persecution fetish, these people are not on the fringe. They have board seats and sponsorships and multimillion-dollar foundations. It is no coincidence this is occuring as companies and brands return to X, as the United States votes at a Midterm election being interfered with by a sitting president, as conservatives normalize the far-right in Europe politics and culture. If you want a more thorough and longer list of people, companies, and products, then I recommend reading up on Devine Lu Linvega's Fashware list on Sourcehut, as well as Drew DeVault's list of Weird Little Guys. You may be in a position where the specific harms and rhetoric being spewed are not aimed at you, and you may have been coaxed into viewing what I'm saying here as overreaction, or as a rabid, self-righteous screed. Millions of dollars have been spent to ensure this, and it could not be further from the truth. We cannot afford to continue to shrug off the presence of these people and their projects in open source. A united stand must be taken. **Speak up on this**. Boycott aggressively. Let people know you don't support Cloudflare, Shopify, 37signals, Dell, 1Password, Framework, Block, Coinbase, Dropbox, TapTap, and any other company enabling the spread of dangerous and harmful political ideologies that will continue to result in further violence and death. And let people know the harm these companies are actively doing. We cannot allow this to continue; we must be far more proactive and assertive in our fight against the normalization of fascism and the far right. We must be willing to sacrifice ease and convenience, and we must be willing to sever all connections with these entities. It is our only way forward.

Matthew Butterick

On March 19, 2026, trivy — a widely used open source vulnerability scanner maintained by Aqua Security — experienced a second security incident. Three weeks after the hackerbot-claw incident on February 28 that resulted in a repository takeover, a new compromised release (v0.69.4) was published to the trivy repository. The original incident disclosure discussion (#10265) was also deleted during this period, and version tags on the aquasecurity/setup-trivy GitHub Action were removed. Trivy maintainers deleted the v0.69.4 tag and Homebrew downgraded to v0.69.3. The following is a factual account of what we observed through public GitHub data.

AI inference emerges as a critical factor in tech compensation, impacting engineer productivity and Silicon Valley hiring dynamics.

Immer am ersten Sonntag im Monat #DIDit #DUTgemacht

Last spring I wrote a blog post about our ongoing work in the background to gradually simplify the curl source code over time. This is a follow-up: a status update of what we have done since then and what comes next. In May 2025 I had just managed to get the worst function in curl down to complexity 100, and the average score of all curl production source code (179,000 lines of code) was at 20.8. We had 15 functions still scoring over 70. Almost ten months later we have reduced the most complex function in curl from 100 to 59. Meaning that we have simplified a vast number of functions. Done by splitting them up into smaller pieces and by refactoring logic. Reviewed by humans, verified by lots of test cases, checked by analyzers and fuzzers, The current 171,000 lines of code now has an average complexity of 15.9. ## Complexity The complexity score in this case is just the cold and raw metric reported by the pmccabe tool. I decided to use that as the absolute truth, even if of course a human could at times debate and argue about its claims. It makes it easier to just obey to the tool, and it is quite frankly doing a decent job at this so it’s not a problem. ## How to simplify In almost all cases the main problem with complex functions is that they do a lot of things in a single function – too many – where the functionality performed could or should rather be split into several smaller sub functions. In almost every case it is also immediately obvious that when splitting a function into two, three or more sub functions which smaller and more specific scopes, the code gets easier to understand and each smaller function is subsequently easier to debug and improve. ## Development I don’t know how far we can take the simplification and what the ideal average complexity score of a the curl code base might be. At some point it becomes counter-effective and making functions even smaller then just makes it harder to follow code flows and absorbing the proper context into your head. ## Graphs To illustrate our simplification journey, I decided to render graphs with a date axle starting at 2022-01-01 and ending today. Slightly over four years, representing a little under 10,000 git commits. First, a look a the complexity of the _worst_ scored function in curl production code over the last four years. Comparing with P90 and P99. The most complex function in curl over time Identifying the worst function might not say too much about the code in general, so another check is to see how _the average complexity_ has changed. This is calculated like this: * All functions get a complexity score by pmccabe * Each function has a number of lines For all functions, add its function-score x function-length to a total complexity score, and in the end, divide that total complexity score on total number of lines used for all functions. Also do the same for a median score. Average and median complexity per source code line in curl, over time. When 2022 started, the average was about 46 and as can be seen, it has been dwindling ever since, with a few steep drops when we have merged dedicated improvement work. One way to complete the average and median lines to offer us a better picture of the state, is to check how large portions of the code that is still how complex. How big portion of the curl source code is how complex This reveals that the most complex _quarter_ of the code in 2022 has since been simplified. Back then 25% of the code scored above 60, and now all of the code is below 60. It also shows that during 2025 we managed to clean up all the dark functions, meaning the end of 100+ complexity functions. Never to return, as the plan is at least. ## Does it matter? We don’t really know. We believe less complex code is generally good for security and code readability, but I it is probably still too early for us to be able to actually _measure_ any particular positive outcome of this work (apart from fancy graphs). Also, there are many more ways to judge code than by this complexity score alone. Like having sensible APIs both internal and external and making sure that they are properly and correctly documented etc. The fact that they all interact together and they all keep changing, makes it really hard to isolate a single factor like complexity and say that changing this alone is what makes an impact. Additionally: maybe just the refactor itself and the attention to the functions when doing so either fix problems or introduce new problems, that is then not actually because of the change of complexity but just the mere result of eyes giving attention on that code and changing it right then. Maybe we just need to allow several more years to pass before any change from this can be measured?

New tool helps open source projects manage the scourge of AI slop.