Sam: Some of your colleagues are living in 2030. Others are stuck in 1990. [dry] And you're all on the same team.
Kai: [upbeat] I'm Kai.
Sam: And I'm Sam. It's Monday, October 12th, 2026, and you're listening to Trending Repos.
Kai: We've got three big stories for you today from the world of open source and dev tools.
Kai: Andrej Karpathy is warning that the gap between what people think AI can do and what it actually can do is becoming a chasm.
Sam: We're also talking about why browser fingerprints are the new cookies. And yes, it's as creepy as it sounds.
Kai: And we're asking: are passkeys a gilded trap designed to lock you into one ecosystem forever?
Sam: Let's get into it.
Kai: So, let's start with that cold open. A tweet from AI heavyweight Andrej Karpathy is blowing up right now, with over 400 points and nearly 600 comments.
Kai: He's arguing that the divide in how people use LLMs is getting weirdly wide. Some devs are using them in ways that feel like science fiction...
Sam: ...while others haven't moved beyond a simple prompt and response. That's the 1990 vs. 2030 gap we opened with. It's not just a skills gap, it's a total reality gap.
Kai: [excited] Exactly. Karpathy says some people are building entire autonomous agents that run for hours on complex tasks. It's a completely different paradigm.
Sam: And what does that mean for a team? If your lead engineer is building Skynet and your junior dev thinks ChatGPT is just for writing emails, you have a massive, massive problem.
Kai: It's a huge opportunity, though! The people who get it are achieving insane productivity multipliers.
Sam: It's a huge risk. It creates a shadow IT system where one person's 'productivity multiplier' is another person's undocumented, un-auditable, and totally insecure black box. What happens when that person leaves?
Kai: Fair point. But the genie is out of the bottle. You can't stop it. The comments are full of people saying 'this is the most important trend in tech right now.'
Sam: Sure, but this means we all need to have a serious conversation about standards and practices. It's not about stopping progress, it's about not flying blind.
Kai: So the takeaway here is to figure out who on your team is living in 2030 and learn from them, fast. You don't want to get left behind in 1990.
Sam: Alright, next up: speaking of things you can't easily see... a post on `royfish.dev` is making the rounds, declaring that 'Fingerprints are the new cookies.'
Sam: Browser fingerprinting is a technique to create a unique identifier for you, without storing any data on your machine. No cookies, no local storage, nothing you can easily clear.
Kai: Wait—so how does it work? It sounds like magic.
Sam: It's not magic, it's just a grim combination of data points. Your browser leaks a ton of information: user agent, screen resolution, color depth, timezone, installed fonts, browser plugins... the list goes on.
Kai: And each of those is just a tiny piece of a puzzle. But you combine enough, and the result is statistically unique. [beat] Okay, what can you actually build with this?
Kai: Well, the article lays out how. You'd write a JavaScript function to grab all these properties—`navigator.userAgent`, `screen.width`, `screen.height`, `navigator.plugins`—and then smash them all into one giant string.
Sam: Let me guess, you hash it.
Kai: You hash it. And just like that, you have a persistent, unique ID for that browser. No cookies needed. You can track users across sessions, across sites... it's incredibly powerful.
Sam: [sarcastic] Powerful is one word for it. It's a privacy nightmare. The whole point of cookie banners and privacy laws was to give users control, and this side-steps all of it. This is why we can't have nice things.
Kai: But from a pure engineering perspective, it's a clever solution to the problem of statelessness. I'm not saying it's ethical, but it's clever.
Sam: So is a virus. Doesn't mean you should build one. The takeaway here is to be aware this is happening. Tools like the Tor Browser were built to combat exactly this kind of tracking by standardizing these properties.
Sam: Our last story today is about something meant to improve security that might be its own kind of problem. A Substack post titled 'Passkeys are a trap' is getting a ton of attention.
Kai: Oh, I've been loving passkeys! No more passwords, just use my face or my fingerprint. What's not to love?
Sam: What's not to love is the vendor lock-in. The post argues that, in practice, passkeys aren't an open standard. They're a tool for Apple, Google, and Microsoft to lock you into their ecosystems.
Kai: How so? I thought the whole point was that they were based on the FIDO standard, which is interoperable.
Sam: The standard is, but the implementation isn't. When you create a passkey on your iPhone, where does it live? In your iCloud Keychain. How do you get it out? [beat] You don't.
Kai: But it syncs to my Mac and my iPad... so it's portable within the Apple ecosystem.
Sam: Exactly. Within the Apple ecosystem. What happens when you want to switch to Android and Windows? You can't export your passkeys. You have to go to every single website and create a new one with your new provider—Google, in that case.
Kai: Oh. That's... [sighs] that's bad. So I'm not just choosing a phone, I'm choosing my identity provider for the rest of my digital life?
Sam: That's the trap. It's a gilded cage. It's convenient right up until the moment you want to leave. Unlike a password manager like 1Password or Bitwarden, where you can export your entire vault and move it anywhere.
Kai: So the advice is... what? Don't use passkeys?
Sam: The post suggests using third-party authenticators, like a YubiKey or a password manager that supports passkeys, rather than tying them directly to your OS vendor. Keep your identity portable.
Kai: Wow. Okay, that's a lot to take in. Let's do a quick recap.
Sam: Alright. We started with the growing reality gap in AI use, which is creating massive opportunities and risks on dev teams.
Kai: Then there's browser fingerprinting, a powerful and creepy way to track users without cookies.
Sam: And we wrapped with passkeys, which offer amazing convenience but might just be a gilded cage to lock you into one ecosystem.
Kai: Before we go, one fun thing. Have you ever run `apt install libaa-bin` and then typed `aafire` in your terminal?
Sam: [laughs] Oh, the ASCII art fire. Or my personal favorite, `ASCIIQuarium`. An entire aquarium simulation running in your terminal.
Kai: Exactly! Just a reminder that open-source can also just be for fun. Go check out `ASCIIQuarium`. It's a classic for a reason.
Kai: And that's our show! Thanks for listening to Trending Repos.
Sam: We'll be back tomorrow with more. Until then, ask yourself: are you living in 1990, or 2030?
This show is made with AI: the hosts’ voices are synthetic and the scripts are AI-assisted. Every story links to its original source.