Rust

The first public versions of rustquty shipped with a nice idea: local-first quality gates for Rust projects. Run one command. Collect metrics. Compare against a baseline or absolute thresholds. Fail if quality regressed. That model still feels right to me. But this week I hit the part every tool author eventually hits: the moment where the tool says something so obviously wrong that you stop trusting the entire report. For rustquty, that happened in two collectors: duplicates and loc. ...

I was in the middle of a refactor in animedb, one of my Rust projects. Ran cargo fmt --check, ran cargo clippy, ran cargo test. All green. Pushed the PR. A few days later, looking at the diff, I noticed one function had ballooned to over 100 lines. Another had 8 levels of nesting. Nobody commented. CI passed. Because CI doesn’t look at that. I’d seen this happen before. Quality doesn’t disappear overnight. It degrades slowly, one function at a time, until one day you look at a module and think “how did this turn into such a mess?” ...

It was 2 AM. I was digging through my local anime folder trying to figure out why my media server hadn’t picked up a new episode. I opened the SQLite database file out of curiosity — just to see what was in there. I could read it. All of it. Every title. Every rating. Every entry in my watch history. Plain UTF-8 text, sitting unprotected on my disk. I closed the terminal and stared at the ceiling for a while. ...

Recently, I watched a Veritasium video called “The Internet Was Weeks Away From Disaster and No One Knew.” It dives deep into the history of the XZ Utils backdoor—a highly sophisticated, multi-year social engineering campaign that almost compromised OpenSSH and the entire open-source ecosystem. A malicious actor spent years gaining trust, slowly pushing malicious commits into a deeply buried compression library that everything else depends on. ...