Daniel Fernández

Daniel Fernández

@danfenz.dev

Software engineer. Author of @thymeleaf.org, Unbescape, Attoparser and the Arxila family of OSS projects. 🏡 Galicia, Spain, European Union.

97 followers72 following70 posts

Daniel Fernández
@danfenz.dev

Back in April, it was taking GitHub approx 3 business days to review security advisories and assign CVE IDs. Five months later, it is now taking them 5 WEEKS. That's the new AI-powered, AI-harassed Open Source world. github.com/orgs/communi...

github.comExcessive CVE Assignment Backlog and Delay in GHSA Process · community · Discussion #207039🏷️ Discussion Type Product Feedback 💬 Feature/Topic Area Other Discussion Details Although it is well documented by GitHub themselves in their security blog here, I need to provide feedback on how ...
Daniel Fernández
@danfenz.dev

@libro.fm I understand why you may need to do this for a small set of books. But I worry to see such set growing (+3 books in my wishlist), and your "à la carte" prices for these books are quite higher than those in Audible — in some cases, even titles included "for free" in Audible's subscription 😔

Daniel Fernández
@danfenz.dev

The advent of the LLM-driven security auditor not only causes a flood of questionable reports on open source projects, but interestingly also causes some of these reports to report exactly the same with few days difference.

Daniel Fernández
@danfenz.dev

There is a kind of user that doesn't read the docs, opens tickets because they try programming using the force and fail and that, when you point out their error to them, just open a new ticket blaming your docs for not being good enough. You simply have to admire their determination in life.

Daniel Fernández
@danfenz.dev

I believe Patrick Wyman is one of the best communicators of popular history out there today. Whatever he has written in this book, if it is half as good as his podcasts, is going to be terrific.

Patrick Wyman@patrickwyman.bsky.social

Today's the big day, friends - my new book, Lost Worlds: The Rise and Fall of Human Societies from the Ice Age to the Bronze Age, is available for preorder! Smash that link and purchase from your retailer of choice, if that's the kind of thing you're into. www.harpercollins.com/products/los...

harpercollins.comLost WorldsThe creator of the hit podcast Tides of History offers a new look at humanity’s deep past, showing us how our world was built not by inevitability, but by t...
Daniel Fernández
@danfenz.dev

Everyone today: "Your password must be 18 characters long, contain upper case, lower case, two numbers 0-9, a punctuation mark, a musical note and a fifteenth century kanji letter." Meanwhile banks: "Maximum 8 characters, only A to Z upper case allowed."

Daniel Fernández
@danfenz.dev

Reorganizing development work stints in order to make the best use of the available AI credits before they top up the following month. The trend that no one saw coming.

Daniel Fernández
@danfenz.dev

So apparently, if you are a huge software vendor and charge big money for support and consulting, you can sell rubbish software and ignore standards and specs, and then expect that your customers will force their OTHER vendors to adapt to your garbage because that will be much cheaper for them.

Daniel Fernández
@danfenz.dev

I've just asked 3 AIs about the way to obtain, using the "uv" command, which is the version of the python runtime that is being used for the active virtual environment. I know I can use "python --version", but I was curious to see whether I could do everything with "uv".

View full thread
Daniel Fernández
@danfenz.dev

I explained that point at the chat, and then came the first thing similar to a "good" answer: use "uv python find", which will output the path of the python runtime, then pipe it to "xargs -L 1 -I {} {} -V" to execute it and extract the version ("-V").

Daniel Fernández
@danfenz.dev

I've just asked 3 AIs about the way to obtain, using the "uv" command, which is the version of the python runtime that is being used for the active virtual environment. I know I can use "python --version", but I was curious to see whether I could do everything with "uv".

View full thread
Daniel Fernández
@danfenz.dev

So I explained that 0.8.17 was the latest version, released 5 days ago, and its response was that in such a case I should just use "python --version" without uv (OK, that's true, but I wanted a "uv" option). And again that "uv python list" would indicate the current one in the list (nope, nope).

Daniel Fernández
@danfenz.dev

3. So I asked Gemini (2.5 Flash), and this one told me that "uv python" without any arguments would give me the path of the python executable being used in the virtualenv. Which was incorrect again, as this only outputs the list of arguments that can be passed to it.

Daniel Fernández
@danfenz.dev

I've just asked 3 AIs about the way to obtain, using the "uv" command, which is the version of the python runtime that is being used for the active virtual environment. I know I can use "python --version", but I was curious to see whether I could do everything with "uv".

View full thread
Daniel Fernández
@danfenz.dev

2. So I asked Claude (Sonnet 4), and again it told me that I should use "uv python --version" (nope) and also that "uv python list" would give me a list of the installed python versions, indicating the currently active one (also nope on this last point).

Daniel Fernández
@danfenz.dev

I told it that "uv python --version" did not exist, and that I was using uv 0.8.17… and its response clarified that, in fact, the "uv python" subcommand had appeared in uv version 0.9.0, so I needed to upgrade 😕

Daniel Fernández
@danfenz.dev

I've just asked 3 AIs about the way to obtain, using the "uv" command, which is the version of the python runtime that is being used for the active virtual environment. I know I can use "python --version", but I was curious to see whether I could do everything with "uv".

View full thread
Daniel Fernández
@danfenz.dev

I reiterated that I used version 0.8.17, which is newer than 0.1.0 and, as a response, I obtained a lengthy explanation about how, contrary to what it seemed, 0.1.0 was in fact a newer version than 0.8.17 because the uv project had been rebooted after 0.8.0, back to 0.1.0 🤨

Daniel Fernández
@danfenz.dev

Interestingly, this explanation included a literal quote from the release notes explaining the reboot, and a link to such release notes where apparently I could verify that point myself. None of that was real. Version 0.8.17 was released five days ago.

Daniel Fernández
@danfenz.dev

I've just asked 3 AIs about the way to obtain, using the "uv" command, which is the version of the python runtime that is being used for the active virtual environment. I know I can use "python --version", but I was curious to see whether I could do everything with "uv".

Daniel Fernández
@danfenz.dev

1. Github Copilot (GPT-4.1) told me it was "uv python --version". I told it that a "--version" option didn't exist for "uv python", and that I was using uv version 0.8.17. Its response was that this "--version" option appeared in 0.1.0, so I needed to upgrade to that version 🤷

Daniel Fernández
@danfenz.dev

SQL was dead. Then Hadoop got the hype, and we put a SQL layer on top to improve it. Then noSQL got the hype, and we put a SQL layer on top to improve it. Then the Data Lake got the hype, and we put a SQL layer on top to improve it. I can't wait to see what SQL looks like on top of AI agents.

Daniel Fernández
@danfenz.dev

I keep moving my old "small" OSS projects to a new namespace, and so "op4j" (a fluent API for Java similar to today's streams, that I developed back in 2010) now has a new home. Though in this case I have not modernized the code because the project was deprecated by JDK8. github.com/arxila/op4j

github.comGitHub - arxila/op4j: A Java library aimed at improving the quality, semantics, cleanness and readability of Java code, especially auxiliary code like data conversion, structure iteration, filtering, ...A Java library aimed at improving the quality, semantics, cleanness and readability of Java code, especially auxiliary code like data conversion, structure iteration, filtering, mapping, etc. - arx...
Daniel Fernández
@danfenz.dev

This touches on two critical points most people miss: First that most OSS, even popular projects, get no relevant external contributions ever. Second that maintainers get NOTHING out of their effort besides a fancy line in their CVs that most companies ignore. OSS is 95% fueled by mere dev pride.

The New Stack@thenewstack.io

Despite running the world’s software economy, open source projects like curl lack backing. @AlexWilliams.bsky.social explains @daniel.haxx.se’s call for companies to finally step up and support what they rely on.

thenewstack.ioThe World Runs 20 Billion Instances of Curl. Where's the Support?Curl is just one projects that make up the $8.8 trillion open source industry. In a keynote at Open Source Summit, curl creator Daniel Stenberg asks why help is so scarce.
Daniel Fernández
@danfenz.dev

Even the smallest piece of software you want to try is now distributed as a 12-container docker-compose deployment or kubernetes cluster. Everything is so slow. It's incredible how good we are at making our new shiny supercomputers turn uncomfortable and cumbersome at every step of the tech cycle.

Daniel Fernández reposted

Siva
@sivalabs.in

Oooh...what are these shiny new lock icons 🤔 That's right... Spring Modulith support landed in @intellijidea.com 2025.2. You don't have to run the test to know whether you are violating any module boundaries. IntelliJ IDEA tells you as you code 🔥

IntelliJ IDEA, a JetBrains IDE@intellijidea.com

🎉 IntelliJ IDEA 2025.2 is out! It brings powerful updates to help you stay productive, write better code, and adopt the latest tech with confidence. Discover what’s new: www.jetbrains.com/idea/whatsnew/

Daniel Fernández
@danfenz.dev

I will happily admit Python shines in some scenarios, but whenever I find myself switching Java for Python for software development, it's quite a lot like trading a fully-equipped restaurant kitchen for a hotel room kettle.