Sam: Fourteen thousand stars on a Slack clone that runs on Nostr — with Jack Dorsey's name on it. [dry] Yeah, nothing suspicious about that timing.
Kai: [excited] This is Kai, and I have been up since FIVE cloning this repo—
Sam: And this is Sam, who has not been up since five, thank you.
Kai: It's July 30th, 2026, and we've got three open-source stories that are secretly all the same story.
Sam: [beat] Are they, though? Okay. Let's find out.
Kai: First up — Block just open-sourced Buzz, a Nostr-based rival to Slack and GitHub, and it's rocketing up Trending.
Sam: Then PyPI slams the door on uploads to old releases — no more sneaking malware into a two-year-old version everybody trusts.
Kai: And a brutal new study says six million GitHub stars are basically fake.
Sam: [dry] Which is exactly why I keep asking if your fourteen thousand are real, Kai.
Kai: So Block — Jack Dorsey's company — dropped Buzz. Self-hostable, chat channels, Git integration, search, automation, all built for human-AI teams.
Sam: So it's Slack and GitHub in a trench coat, riding on Nostr. Why Nostr?
Kai: Because it's decentralized! No central server owning your team's data. Your identity's a keypair, not an email some corporation controls.
Sam: [skeptical] Okay, so who runs the relays all that traffic flows through? Decentralized usually just means the middleman moved.
Kai: You self-host! That's the whole pitch, Sam. And the repo — block slash buzz — is already at fourteen-point-four K stars—
Sam: On day one. A founder with millions of followers tweets a link, and boom — fourteen thousand. That's not momentum, that's a fanbase.
Kai: Or it's a genuinely cool project people actually want? Radical concept.
Sam: Both can be true. But celebrity spikes look identical to bot spikes on the graph — that's my whole point.
Kai: [beat] Fine, that's... annoyingly fair. But the code's real, it's actually open, it's actually self-hostable.
Sam: And that part I respect. Open and self-hostable beats another closed silo. I just won't treat a star count as a security review.
Kai: So for you at home — if you're an early adopter, spin it up in a sandbox, kick the tires, but—
Sam: But don't migrate your company chat to a two-day-old platform. Wait for the audits. Let someone else be the beta.
Kai: [laughs] "Let someone else be the beta" should be on your tombstone.
Sam: It'll be a self-hosted tombstone. Next up — PyPI is now blocking new file uploads to any release older than fourteen days.
Kai: Wait, so I can't add a wheel to an old version anymore?
Sam: Right. And that's good, because it was a real attack vector. People were sneaking malicious wheels onto long-trusted, ancient releases.
Kai: Ohh — so version 1.2's been sitting there safe for two years, everyone trusts it, and then someone quietly bolts a poisoned file onto it.
Sam: Exactly. Package poisoning. You pin to an "old, stable" version thinking it's frozen — and it was never frozen at all.
Kai: Okay THAT is genuinely scary, and I hate how simple it is.
Sam: Simple attacks are the ones that work. And it's part of a broader supply-chain hardening push across GitHub and PyPI.
Kai: Hot take — every registry should've done this years ago. npm, are you listening?
Sam: [dry] I mean, yeah. Fourteen days is a fair trade-off. Legit maintainers fix a bad release fast; attackers going after old trust get locked out.
Kai: Is there a downside? Feels like there's always a downside with you.
Sam: A little friction if you genuinely need to patch an old line — but you'd cut a new release for that anyway. Net win.
Kai: So for you — your pinned dependencies just got a little more trustworthy overnight, for free.
Sam: And still — pin by hash, not just version. Belt and suspenders. This closes a door, it doesn't build a fortress.
Kai: Last one — and Sam, this is basically your religion — a new ICSE 2026 paper found roughly six MILLION suspected fake stars on GitHub.
Sam: [vindicated] Six million. Now read back this morning's cold open, Kai.
Kai: [groans] I know, I know. You're gonna bring up my Buzz stars, aren't you.
Sam: I would never. [beat] ...The paper ties inflated momentum straight to popularity gaming, spam, and malware.
Kai: So people buy stars to look legit, then use that fake legitimacy to push malware. That's the pipeline.
Sam: That's the pipeline. Ten thousand stars feels safe, so you skip the review. The stars are the social engineering.
Kai: Okay but — devil's advocate — not every spike is fake. Sometimes a thing genuinely blows up.
Sam: Sure. The tell is the shape. Real growth is messy over time; bought stars show up as a vertical wall from brand-new accounts.
Kai: [quietly] ...like a founder tweet driving fourteen thousand in a day.
Sam: [laughs] I didn't say it. You said it. Difference is, Buzz has real code behind it — that's what you actually check.
Kai: So for you — don't judge a repo by its star count. Look at the commits, the issues, the real contributors, the actual code.
Sam: And if the stars showed up overnight from accounts created last Tuesday? Guilty until proven safe.
Kai: So today: Block open-sourced Buzz, a Nostr Slack-slash-GitHub rival that's genuinely cool and genuinely unproven.
Sam: PyPI locked uploads to releases older than fourteen days, killing a sneaky package-poisoning trick.
Kai: And six million GitHub stars are apparently vapor, which retroactively makes Sam insufferable.
Sam: Vindicated. Not insufferable. There's a difference.
Kai: Before we go — I did the math. If those six million fake stars were one repo, it'd out-rank almost anything real on GitHub.
Sam: [dry] A phantom project made entirely of lies, topping the charts. Honestly, the most honest thing on Trending.
Kai: [laughs] Someone star that. Ironically. I mean it — ironically.
Kai: That's the show! Go clone something responsibly, and we'll see you tomorrow.
Sam: And Kai — check the shape of those stars before you get attached. This is Sam, letting someone else be the beta.
This show is made with AI: the hosts’ voices are synthetic and the scripts are AI-assisted. Every story links to its original source.