Sam: There's a FireWire IPv4 bug that's been sitting in the kernel since 2009 — finally patched in an rc5. Seventeen years, just chilling in there.
Kai: [excited] Seventeen years! That's older than some of our listeners' entire careers.
Kai: This is Kai.
Sam: And this is Sam. It's July 28th, 2026, and we've got three open-source stories on the board today.
Kai: [excited] Three bangers. Let's move.
Kai: First up — Linus tags Linux 7.2-rc5, calls it 'once more a massive rc5,' and it's drowning in networking and audio fixes.
Sam: Then npm v12 lands this month and turns off install scripts by default — the exact thing that's fueled a year of supply-chain hits.
Kai: And to close it out, Framer drops agents on the canvas, branching, and a creator community — top of Product Hunt's dev and design tier.
Kai: So, Linux 7.2-rc5 — tagged July 26th, and Linus himself is calling it massive for an rc5.
Sam: [dry] Which is never a phrase you want this late in a cycle. rc5 is supposed to be calming down, not bulking up.
Kai: Right, but look at the mix — networking is about 35% of the changes. That's the bulk of it.
Sam: And a chunk of audio fixes on top. Plus the fun one: USB patches actually outpaced GPU changes this round.
Kai: [laughs] USB beating the GPU crowd? That's a plot twist. Nobody puts USB in the corner.
Sam: But here's the one that got me — the FireWire IPv4 fix. That bug's been in there since 2009.
Kai: [excited] Who's even running IPv4 over FireWire in 2026?!
Sam: Almost nobody — which is exactly why it hid for seventeen years. Nobody looked.
Kai: Okay, but here's the part I love: a lot of these regression fixes surfaced from AI agents combing the tree.
Sam: [skeptical] Sure, and I want to know who reviewed them. An agent flagging a regression is a lead, not a merge.
Kai: Fair, fair — but maintainers still signed off. The agents just did the boring archaeology.
Sam: Hot take: a 'massive' rc5 means stable slips. They're aiming at August 16th, and I'd bet on an rc8.
Kai: What this means for you — if you're on the networking or audio stack, grab rc5 and test now, because your bug might already be fixed.
Sam: And don't run an rc in production. Test rig only. That's the whole point of the 'rc.'
Sam: Story two — npm v12 ships this month, and it's blocking lifecycle scripts by default. Postinstall, preinstall, all of it.
Kai: [excited] Finally! That postinstall hook is basically the front door for every npm supply-chain attack.
Sam: It's the mechanism. A year of compromises rode in on exactly that — you install a package, it runs arbitrary code before you blink.
Kai: So off-by-default is huge. That's a whole attack class, just gone.
Sam: [measured] It's a big step. But the researchers themselves say it's 'not enough' on its own — and they're right.
Kai: Why not? You slam the door, the burglars go home.
Sam: Because malicious code doesn't need a lifecycle hook. It can live in the runtime import you actually call. This closes one road, not the map.
Kai: Okay, that's fair. But it raises the cost for attackers, and that matters.
Sam: Agreed. My worry is the July deadline squeezing CI pipelines — a ton of legit builds depend on postinstall to compile native modules.
Kai: Ohh, so things break the moment v12 lands if you didn't migrate.
Sam: Exactly. It's a breaking change dressed as a security feature. Both things are true.
Kai: [laughs] 'Breaking change dressed as a security feature' should be npm's tagline.
Sam: What this means for you — audit your postinstall dependencies before v12 hits, and allowlist the packages that genuinely need scripts.
Kai: And don't just blanket re-enable scripts to make the red X go away. That defeats the whole point.
Kai: Last one — Framer's July 26th launch, and it's a triple: agents on the canvas, branching, and a creator community. Number one dev-and-design tool of the day.
Sam: Agents on the canvas. So the AI now lives inside the design surface, editing your site?
Kai: [excited] Yes! And you can plug in your own Claude Code or Codex to design, write, and organize the whole site.
Sam: Bring-your-own-model is actually smart. At least you're not locked into a black box.
Kai: And branching — you fork the site, experiment, and merge before you publish. Git vibes for designers.
Sam: [dry] Reinventing version control for people who fled version control. And I say that with love.
Kai: [laughs] It's a safety net! Teams can break stuff without nuking production.
Sam: The community piece is the interesting one — sharing and monetizing your work. That's a marketplace play.
Kai: And Product Hunt loved it — top of the pile for the day.
Sam: [skeptical] I'll gently note: launch-day leaderboards get gamed constantly. Coordinated upvotes are cheap. I trust the feature list more than the ranking.
Kai: Hot take: agents on the canvas is the first AI design feature that isn't just a chatbot bolted onto a sidebar.
Sam: Maybe. But my skeptic beat stands — if an agent's editing your live site, review every diff. Autonomous and 'publish' should never touch.
Kai: What this means for you — if you're a solo builder, the community could be a real revenue channel. But test branching before you trust the agents with anything client-facing.
Sam: That's the whole show in one line: let the robot draft, let the human ship.
Kai: So — Linux 7.2-rc5, a massive late RC, networking-heavy, and that seventeen-year FireWire ghost finally exorcised.
Sam: npm v12 kills install scripts by default this month — genuinely good, genuinely not the whole fix, and watch your CI.
Kai: And Framer bundles agents, branching, and a creator marketplace to top the day's tools.
Sam: Before we go — I went back and checked. That FireWire IPv4 code predates the very first GitHub repo you ever starred, Kai.
Kai: [laughs] Impossible. I've been starring repos since the womb.
Sam: [dry] Seventeen years of bugs, seventeen years of you clicking that little star. Poetic, really.
Kai: [laughs] That's the show! See you tomorrow, and I cannot wait to star something new.
Sam: And I'll be here asking if the stars are real. Same time tomorrow — Sam, signing off.
This show is made with AI: the hosts’ voices are synthetic and the scripts are AI-assisted. Every story links to its original source.