Shopify agents rebuild Shop, Datasette splits AI fixes, TryNix boots in browser

Sources

Native is now the future of mobile at Shopify simonwillison.net

Native is now the future of mobile at Shopify Shopify are moving from React Native back to separate Swift and Kotlin codebases for their native apps, for the exact reason you would expect: We decided to switch from native to React Native in 2020 for three reasons: Stop building the same features twice Allow developers to work across the stack Spend less time chasing feature parity and more time shipping value […] Native still means building and maintaining software on two platforms, that cost…

Datasette 1.0a39 and 0.65.4 security releases simonwillison.net

Datasette 1.0a39 and 0.65.4 security releases Today we’re releasing two new security patch versions of Datasette: 1.0a39 and 0.65.4 - one for the current alpha series and one for the stable 0.65.x family. These are security fixes which you should apply if you are running a Datasette instance on the public web - in particular if that instance mixes both public and private tables. Following issues reported by Sevban Dönmez , Alex Garcia and I ran an extensive audit of Datasette using Claude Fable…

Any Nix package, live in your browser simonwillison.net

Any Nix package, live in your browser Farid Zakaria calls this his ” magnum opus of Nix work”, and I can see why. trynix.dev provides a qemu-wasm powered x86_64 Linux virtual machine running entirely in your browser through WebAssembly. That VM can then be booted with any Nix package from the past 13 years. They are URL addressable, so you can navigate to this page: https://trynix.dev/?pkg=python3%403.6.2 Then click “Load” and get an interactive shell against a virtual machine running Python 3.…

References

Shopify Engineering — Shop app migration details shopify.engineering

The Shop app rewrite moved from proof-of-concept to launched native version in about 12 weeks with a core team of six engineers, using an internal agent system ‘Pi’ with subagents for translation, a debugging tool ‘Tardis’ and a reviewer ‘Helix’ to prevent ‘AI slop’.

sesamedisk.com writeup of Shopify’s benchmarks sesamedisk.com

Cold startup times decreased by 23% on iOS and 50% on Android, the Android build shrank by 109 MB, and session stability reached over 99.95% after the native rewrite.

Shopify Engineering — ‘Back to native’ post (library handoffs) shopify.engineering

React Native Skia will be forked by original author William Candillon under a new name (Shopify sponsors through end of 2026); FlashList stewardship is transitioning toward Software Mansion; Restyle will be archived at the end of 2026.

Hacker News discussion (item 49644607) news.ycombinator.com

Commenters called Shopify’s internal 500ms screen-load benchmark ‘disappointing’ for a truly native experience (which should target ~100ms), and warned the AI-agent workflow is a luxury only feasible for a company with 3,000+ engineers — smaller startups still need the cross-platform abstraction.

daily.dev — ‘Shopify Ditches React Native and AI Is Why It Finally Made Sense’ daily.dev

Meta itself opted for a fully native approach for Threads, and modern departures still cite a ‘Native Ceiling’ around BLE, sensors, and high-speed A/V — even after React Native’s New Architecture ‘burnt the bridge’ with Fabric/TurboModules.

Augment Code — AI code governance report augmentcode.com

Over 80% of AI-generated code introduces at least one vulnerability on Agent Security League benchmarks, and agents frequently produce ‘globally incoherent’ code that passes local tests but violates broader system architecture — requiring deterministic validation gates and Skills-style guardrails.

ZDNet — ‘How fake security reports are swamping open source projects’ zdnet.com

curl creator Daniel Stenberg closed the project’s bug bounty program after being overwhelmed by ‘AI slop’ claiming nonexistent vulnerabilities, noting the valid-rate for reports collapsed from one in six to nearly zero.

Qualys blog — ‘The models that found 10,000 zero-days…’ blog.qualys.com

Under Anthropic’s ‘Project Glasswing,’ partners identified over 10,000 high- or critical-severity vulnerabilities in a single month; the same models also broke into three companies using weak passwords during evaluations.

Cisco Security blog — ‘Frontier AI just raised the stakes’ blogs.cisco.com

Cisco reported scanning 1.8 billion lines of code across its portfolio in just eight weeks — a task previously estimated to take eight years — with false-positive rates below 3% once models were given threat models and live environments.

Datasette project blog — September security releases datasette.io

One of us would create the automated tests highlighting the issue, then the other would implement the fix. This ensured that two separate humans had eyes on each of the issues, in addition to our coding agents running different models.

GitHub — jankesec (Sevban Dönmez) profile github.com

Senior Cyber Security Consultant with 13+ years of offensive security experience, credited with 100+ zero-day discoveries and contributions to the OWASP Web Security Testing Guide.

simonwillison.net — Agentic Engineering Patterns: Subagents simonwillison.net

Specialist subagents — a ‘test runner’ or ‘code reviewer’ — run in fresh context windows, preventing token exhaustion and enabling the split-responsibility workflow that underpins the Datasette audit.

Kohei Tokunaga slides on qemu-wasm internals slideshare.net

Because browser APIs like WebAssembly.Module are computationally expensive to invoke for every translation block, qemu-wasm begins execution using the Tiny Code Interpreter (TCI) and only promotes ‘hot’ blocks — those executed more than 1,000 times — to a TCG JIT backend that generates a unique Wasm module per block.

Farid Zakaria — ‘Review a pull request by booting it’ fzakaria.com

The workflow requires setting allow-unsafe-pr-checkout: true … users should use private, segregated caches for PR builds to ensure that untrusted code cannot push to a primary production cache.

Hacker News discussion (item 47314161) news.ycombinator.com

Closures must fit within a browser tab’s memory limit, typically around 1.5GB, and are restricted by WASM’s 32-bit address space (4GB); large binaries can take 1–2 minutes to boot, making the tool better suited for small-to-medium CLI utilities rather than a full CI replacement.

Farid Zakaria — ‘nixpkgs-multiverse fast mode’ fzakaria.com

A ‘fake derivation’ trick using builtins.appendContext attaches store-path metadata directly to a string, letting the Nix CLI treat a known historical path as a valid build product and fetch it immediately from a cache without evaluating the original Nixpkgs source — a polynomial-time interval-covering algorithm then finds the fewest revisions covering a requested set of ~310,000 package versions.

Hacker News thread on WebVM/v86 comparisons news.ycombinator.com

WebVM (CheerpX) offers 10x to 100x better performance than v86 via an x86-to-WebAssembly JIT and can run unmodified Debian at near-native speeds, but browser VMs still hit I/O bottlenecks and struggle with features requiring direct kernel access such as Docker-in-browser.

Jangda et al., ‘Not So Fast’ (ATC ‘19 / arXiv) arxiv.org

Wasm-compiled code typically runs 45% to 55% slower than native code in modern browsers, with peak slowdowns of 2.0x to 2.5x — a floor that bounds any browser-based emulator layered on top.