I'm somebody who's written rather extensively on generative AI ethics, and I feel there is a lot that is unethical about the current corporate climate and culture surrounding the technology. And when I write about LLMs and chatbots, I'm careful not to make judgments about the people using the end products—I don't think you're a bad person if you use ChatGPT or Claude, or whatever. What I'm discussing today is different. There is no room for debate or argument, here—only hard, absolute lines in the sand. Much of the world has become far too complacent and complicit with people (and their companies) who proclaim and hold far-right, fascist ideology. These are not image boards residing in the fringe corners of an anonymous Internet made up of people who have slipped through the cracks. No, these are wealthy people in power who are blatant and shameless in their support for those who continuously beat the drum of bigotry, xenophobia, transphobia, and cynical accelerationist hatred. Open source technology has become a culture safe for this rhetoric and ideology, with millions of dollars being invested to continue this status quo. You need to be made aware of this, and then you need to be vocal and take action. ## DHH David Heinemeier Hansson is the most well-known figurehead here. He is the creator of Ruby on Rails, CTO of 37signals, and a Shopify board member. In September 2025, DHH published "As I remember London", mourning that London is "no longer full of native Brits"—a claim that redefines "native Brit" to mean "white." Developer Jake Lazaroff details how DHH describes a Tommy Robinson march as "heartwarming," where speakers called for "remigration" (a euphemism for the ethnic cleansing of non-white residents) and one speaker demanded that countries "ban halal," "ban mosques," and "ban temples." DHH invokes abuse scandals to bolster his white-nationalist rhetoric, framing non-white men as predators of "British girls," while UK data shows no such racial skew. LibreNews reaches the same conclusion. Developer Joel Drapper wrote how Ruby Central had lost a $250,000-a-year sponsorship from Sidekiq after giving DHH a speaking slot at RailsConf a few weeks later, leaving the nonprofit financially dependent on Shopify (where DHH sits on the board); Shopify then pushed Ruby Central to consolidate control rather than lose its funding. The Register and Heise both covered the fallout. But none of this has cost DHH money—if anything, he's only gained. A few weeks ago, DHH announced the Omacom Foundation to bankroll his Linux distribution, Omarchy, which is nothing more than a few vibecoded scripts on top of Arch Linux. There are twelve "Founding Patrons" pledging a million dollars apiece: * Tobi Lütke, CEO of Shopify * Patrick Collison, CEO of Stripe * Michael Dell, Chairman and CEO of Dell Technologies * Jack Dorsey, Block Head and Chairman of Block * Matthew Prince, CEO of Cloudflare * Brendan Iribe, Cofounder of Sesame and Oculus * Jason Fried, CEO of 37signals * Drew Houston, cofounder and co-CEO of Dropbox * Peter Steinberger, creator of OpenClaw * Brian Armstrong, CEO of Coinbase * Yunjie Dai, cofounder of TapTap * DHH himself. And these corporations are each contributing $100,000 a year for three years: * 1Password * 37signals A dozen of the most powerful executives in tech looked at a man who wrote that a British march calling for the deportation of non-white citizens was "heartwarming," and decided he was the person they wanted to hand a multimillion-dollar foundation to. I should also mention that the same infrastructure companies bankrolling Omarchy and Ladybird are also the backbone of the ongoing violence of U.S. deportations. This includes Amazon's AWS contracts powering ICE, Palantir building ICE's case-management system, and the use of Salesforce's tools. ## "Apolitical" Andreas Kling, founder of the Ladybird browser project (itself an Omacom-adjacent beneficiary, sponsored by Cloudflare, FUTO, Shopify, 37signals, Proton, and JetBrains), built his project's identity around refusing a documentation patch that would have made SerenityOS's manuals gender-neutral, on the grounds that gender-neutral language was "personal politics" that didn't belong in a technical project. Blogger Kate Vibber wrote how that became Ladybird's official contributing guidelines, which now bar "discussions on societal politics" outright—a policy treating the mere existence of trans contributors as more "political" than excluding them. In 2026, Kling posted in support of Charlie Kirk after Kirk's assassination and, per discussion on Lobsters, bristled at being called a fascist for it—a reaction hard to square with "apolitical," since Kirk was a movement figure who, per his own Wikipedia entry, promoted the "white genocide" conspiracy theory and criticized the Civil Rights Act. Vaxry, the developer behind the Hyprland Wayland compositor (another Omacom-funded project), was banned in 2024 by Freedesktop.org's Code of Conduct team over a pattern of the Hyprland Discord enabling harassment of trans community members, including an incident where moderators changed a trans user's display name to strip their pronouns. Vaxry's own public response framed the ban as ideological overreach by "social justice warriors," while the Freedesktop side, recounted at LibreNews, describes over a year of private attempts to get him to address the toxicity before going public. Hyprland's contributing guidelines now ban "political" speech too. Enrico "metux" Weigelt forked the deprecated Xorg server into Xlibre as a rebellion against a "RedHat DEI" conspiracy he believes exists. The founding document of the project was a rant about big-tech diversity initiatives, and its code of conduct is a text file that just says "404." FUTO is a funder of Immich and is run by Eron Wolf, a friend and platformer of Curtis Yarvin, the "dark enlightenment" writer whose ideas about dismantling democracy have now found purchase in the current U.S. administration. Brendan Eich, Mozilla's co-founder and now Brave's CEO, used Brave's infrastructure to give payments to Kiwi Farms, a forum whose harassment campaigns have been linked to multiple suicides. We witness the same pattern over and over. A tech project is declared "apolitical," and defines any accommodation of marginalized contributors as a political act, and keeps the actual politics of the maintainers—nostalgia for ethnically white homogeneous cities and hostility to gender-neutral pronouns—off the table entirely. Because that's just, you know, how they feel. "Apolitical" has never meant a lack of politics. It's meant politics that current power doesn't have to defend. ## The Throughline We have been watching the fragile fury of white masculinity and hate metastasize and fester over the years, from Gamergate's harassment campaigns through years of anti-SJW cringe compilation content mills, the marking of Antifa as the enemy, the tantrum-throwing #AllLivesMatter movement, and the manufactured panic over DEI and "wokeism." You are not living in the neoliberal-Obama era where basic compassion and empathy are the default anymore. And you haven't been for a long time. Despite their cries about censorship and deplatforming, and despite their persecution fetish, these people are not on the fringe. They have board seats and sponsorships and multimillion-dollar foundations. It is no coincidence this is occuring as companies and brands return to X, as the United States votes at a Midterm election being interfered with by a sitting president, as conservatives normalize the far-right in Europe politics and culture. If you want a more thorough and longer list of people, companies, and products, then I recommend reading up on Devine Lu Linvega's Fashware list on Sourcehut, as well as Drew DeVault's list of Weird Little Guys. You may be in a position where the specific harms and rhetoric being spewed are not aimed at you, and you may have been coaxed into viewing what I'm saying here as overreaction, or as a rabid, self-righteous screed. Millions of dollars have been spent to ensure this, and it could not be further from the truth. We cannot afford to continue to shrug off the presence of these people and their projects in open source. A united stand must be taken. **Speak up on this**. Boycott aggressively. Let people know you don't support Cloudflare, Shopify, 37signals, Dell, 1Password, Framework, Block, Coinbase, Dropbox, TapTap, and any other company enabling the spread of dangerous and harmful political ideologies that will continue to result in further violence and death. And let people know the harm these companies are actively doing. We cannot allow this to continue; we must be far more proactive and assertive in our fight against the normalization of fascism and the far right. We must be willing to sacrifice ease and convenience, and we must be willing to sever all connections with these entities. It is our only way forward.

Attached: 1 image AI bozo got really mad we banned him and suddenly we're down for 12+ hours due to a DDoS attack. You do the math, I guess https://tcrf.net

One of the established power features of the curl command line tool is its support for “globbing”. It is a built-in way to specify ranges and sets in different ways and have curl iterate over them to simplify repeated transfers. For example, you can easily download three images from the same host without having to repeat the almost same URL three times: curl -O "https://img.example/{flower,house,garden}.jpg" Or if you have them in a numbered range, you can get a thousand images in a single tiny command line: curl -O "https://img.example/photo[1-1000].jpg" And they can be combined in crazy ways: curl -O "https://example.{org,com}/{apples,mugs,coins}/img[1-1000].jpg" curl allows globs used in a single URL to create up to 263 permutations – which, if you can do one million transfers per second, would take 292 thousand years to complete. (As an added bonus you can of course also add `-Z` to the command line to make curl transfer all those images in parallel rather than serially.) ## Saving them To help users save files when using globbing, curl provides a way to reference the globbed components using `#[number]` when setting the target filename. The number then references the specific glob, where the first is 1, the second 2 etc. Saving the one thousand images using different filenames locally than they use remotely: curl "https://img.example/photo[1-1000].jpg" -o "local-#1.jpeg" This allows a compact command line to also offer flexibility. ## News coming in 8.21.0 All functionality mentioned above has existed in curl for years; decades even. It just so happened that one day when working with curl I fell over a use case that I could not solve with the existing command line functionality. I wanted to do a globbed upload to a HTTP server and then save all the separate responses into their own dedicated files, preferably with names based on the glob. I will admit that I at first had a hard time to accept the fact that we actually could not do this already, but that was then rather quickly instead turned into: how should I add support for this in the smoothest and most convenient way? Using what syntax? The road to fixing it for uploads took a little detour. ## Name instead of index Starting in 8.21.0, curl can assign a name to each glob and then reference that glob by name instead of using just a glob index number. This allows command lines to get ever so slightly more readable I think. The image range example from above, but instead using named globs: curl "https://img.example/photo[<number>1-1000].jpg" -o "local-#<number>.jpeg" Or a version with three separate globs where they all are used in the output file name: curl "https://example.{<tld>org,com}/{<object>apples,mugs,coins}/img[<index>1-1000].jpg" -o "file-#<index-#<tld>-#<object>" Slick, right? ## Uploads Back to the globbed upload challenge: curl -T "{one,two,three}.jpg" https://ul.example/ … but with the responses saved in separate files instead of sent to stdout. Use named globs: curl -T "{<counter>one,two,three}.jpg" https://ul.example/ -o "save-#<counter>" The only way to refer to an upload glob is to set a name and refer to that name. There are no indexed references for uploads, only for URL globs. ## Mixing URL globs and uploads globs It is in fact possible to also use a mix of upload globs and URL globs in the same command line if you want to upload multiple files to multiple destinations. They set the names in the same namespace and you refer to the names the same way, independently of source. This feels more like a thing to show off in a blog post like this rather than something people will actually find good use for: Upload three files to three sites, save all nine response in separate files: curl -T "{<counter>one,two,three}.jpg" https://{<host>ul1,ul2,ul3}.example/ -o "save-#<counter>-#<host>"

The SMB protocol has weak security and is rarely used these days

Using git as a database is a seductive idea. You get version history for free. Pull requests give you a review workflow. It’s distributed by design. GitHub will host it for free. Everyone already knows how to use it. Package managers keep falling for this. And it keeps not working out. ## Cargo The crates.io index started as a git repository. Every Cargo client cloned it. This worked fine when the registry was small, but the index kept growing. Users would see progress bars like “Resolving deltas: 74.01%, (64415/95919)” hanging for ages, the visible symptom of Cargo’s libgit2 library grinding through delta resolution on a repository with thousands of historic commits. The problem was worst in CI. Stateless environments would download the full index, use a tiny fraction of it, and throw it away. Every build, every time. RFC 2789 introduced a sparse HTTP protocol. Instead of cloning the whole index, Cargo now fetches files directly over HTTPS, downloading only the metadata for dependencies your project actually uses. (This is the “full index replication vs on-demand queries” tradeoff in action.) By April 2025, 99% of crates.io requests came from Cargo versions where sparse is the default. The git index still exists, still growing by thousands of commits per day, but most users never touch it. ## Homebrew GitHub explicitly asked Homebrew to stop using shallow clones. Updating them was “an extremely expensive operation” due to the tree layout and traffic of homebrew-core and homebrew-cask. Users were downloading 331MB just to unshallow homebrew-core. The .git folder approached 1GB on some machines. Every `brew update` meant waiting for git to grind through delta resolution. Homebrew 4.0.0 in February 2023 switched to JSON downloads for tap updates. The reasoning was blunt: “they are expensive to git fetch and git clone and GitHub would rather we didn’t do that… they are slow to git fetch and git clone and this provides a bad experience to end users.” Auto-updates now run every 24 hours instead of every 5 minutes, and they’re much faster because there’s no git fetch involved. ## CocoaPods CocoaPods is the package manager for iOS and macOS development. It hit the limits hard. The Specs repo grew to hundreds of thousands of podspecs across a deeply nested directory structure. Cloning took minutes. Updating took minutes. CI time vanished into git operations. GitHub imposed CPU rate limits. The culprit was shallow clones, which force GitHub’s servers to compute which objects the client already has. The team tried various band-aids: stopping auto-fetch on `pod install`, converting shallow clones to full clones, sharding the repository. The CocoaPods blog captured it well: “Git was invented at a time when ‘slow network’ and ‘no backups’ were legitimate design concerns. Running endless builds as part of continuous integration wasn’t commonplace.” CocoaPods 1.8 gave up on git entirely for most users. A CDN became the default, serving podspec files directly over HTTP. The migration saved users about a gigabyte of disk space and made `pod install` nearly instant for new setups. ## Go modules Grab’s engineering team went from 18 minutes for `go get` to 12 seconds after deploying a module proxy. That’s not a typo. Eighteen minutes down to twelve seconds. The problem was that `go get` needed to fetch each dependency’s source code just to read its go.mod file and resolve transitive dependencies. Cloning entire repositories to get a single file. Go had security concerns too. The original design wanted to remove version control tools entirely because “these fragment the ecosystem: packages developed using Bazaar or Fossil, for example, are effectively unavailable to users who cannot or choose not to install these tools.” Beyond fragmentation, the Go team worried about security bugs in version control systems becoming security bugs in `go get`. You’re not just importing code; you’re importing the attack surface of every VCS tool on the developer’s machine. GOPROXY became the default in Go 1.13. The proxy serves source archives and go.mod files independently over HTTP. Go also introduced a checksum database (sumdb) that records cryptographic hashes of module contents. This protects against force pushes silently changing tagged releases, and ensures modules remain available even if the original repository is deleted. ## Beyond package managers The same pattern shows up wherever developers try to use git as a database. Git-based wikis like Gollum (used by GitHub and GitLab) become “somewhat too slow to be usable” at scale. Browsing directory structure takes seconds per click. Loading pages takes longer. GitLab plans to move away from Gollum entirely. Git-based CMS platforms like Decap hit GitHub’s API rate limits. A Decap project on GitHub scales to about 10,000 entries if you have a lot of collection relations. A new user with an empty cache makes a request per entry to populate it, burning through the 5,000 request limit quickly. If your site has lots of content or updates frequently, use a database instead. Even GitOps tools that embrace git as a source of truth have to work around its limitations. ArgoCD’s repo server can run out of disk space cloning repositories. A single commit invalidates the cache for all applications in that repo. Large monorepos need special scaling considerations. ## The pattern The hosting problems are symptoms. The underlying issue is that git inherits filesystem limitations, and filesystems make terrible databases. **Directory limits.** Directories with too many files become slow. CocoaPods had 16,000 pod directories in a single Specs folder, requiring huge tree objects and expensive computation. Their fix was hash-based sharding: split directories by the first few characters of a hashed name, so no single directory has too many entries. Git itself does this internally with its objects folder, splitting into 256 subdirectories. You’re reinventing B-trees, badly. **Case sensitivity.** Git is case-sensitive, but macOS and Windows filesystems typically aren’t. Check out a repo containing both `File.txt` and `file.txt` on Windows, and the second overwrites the first. Azure DevOps had to add server-side enforcement to block pushes with case-conflicting paths. **Path length limits.** Windows restricts paths to 260 characters, a constraint dating back to DOS. Git supports longer paths, but Git for Windows inherits the OS limitation. This is painful with deeply nested node_modules directories, where `git status` fails with “Filename too long” errors. **Missing database features.** Databases have CHECK constraints and UNIQUE constraints; git has nothing, so every package manager builds its own validation layer. Databases have locking; git doesn’t. Databases have indexes for queries like “all packages depending on X”; with git you either traverse every file or build your own index. Databases have migrations for schema changes; git has “rewrite history and force everyone to re-clone.” The progression is predictable. Start with a flat directory of files. Hit filesystem limits. Implement sharding. Hit cross-platform issues. Build server-side enforcement. Build custom indexes. Eventually give up and use HTTP or an actual database. You’ve built a worse version of what databases already provide, spread across git hooks, CI pipelines, and bespoke tooling. None of this means git is bad. Git excels at what it was designed for: distributed collaboration on source code, with branching, merging, and offline work. The problem is using it for something else entirely. Package registries need fast point queries for metadata. Git gives you a full-document sync protocol when you need a key-value lookup. If you’re building a package manager and git-as-index seems appealing, look at Cargo, Homebrew, CocoaPods, Go. They all had to build workarounds as they grew, causing pain for users and maintainers. The pull request workflow is nice. The version history is nice. You will hit the same walls they did.