Hi and welcome back to “Trust the Process”. The weekly newsletter where I share my own progress over the week and interesting links I found along the way.

I’m writing this issue on Friday already, because when you’re reading this, chances are that I’m currently running the Lausanne Marathon. It’s my second time running it, so I already kinda know what I signed up for. I’m still nervous about Sunday nonetheless. Wish me luck in reaching my goal of running a sub-4-hour marathon. I will report back next week on how it went.

The marathon was not the only thing I was nervous about, though, as you will see.

Process

Because it was such a short week, not much happened on the Morgenblau side. The only small changes targeted the Sources page (you can now finally edit your sources in the app and don’t have to use PDSls anymore), the universal subscribe feature from last week (small bugfixes) and setting up a new monorepo structure. I should really get started with building a proper landing page for Morgenblau, and the monorepo was a first step that hopefully gives me the push to actually start next week. We’ll see.

If you took a look at my website during the week, you saw: nothing. Well, at least on the surface. Under the hood, it’s all new. Or old? I don’t know.

After a short stint with Hugo, my website is back on Astro now (like the first version in 2024 was). The move was surprisingly smooth: Opus 5.5 handled it with essentially one prompt and without a single issue, and even wrote visual regression tests that showed nothing broke. I have to keep reminding myself that even a couple of months ago, that would have been almost impossible to do. Now, I take such a 1:1 migration of a more or less static website from one web framework to another for granted.

The move fixed a few small annoyances that accumulated over the last couple of weeks and brought some improvements with it:

It’s hosted on Cloudflare now and not self-hosted via Dokploy anymore. There were regular small hiccups that I would rather not have to think about when it comes to my personal website. I want to build cool stuff and write about it, not worry too much about my infrastructure. Turns out, that’s also a good idea from a security perspective, as this week showed (more on that below).

This new setup also allows my website to be an account on the Fediverse. Go search for @[email protected] on your Mastodon instance and you should be able to follow it. Not much to see yet, but the next regular post I publish to my personal website should show up there. All of this is implemented with the wonderful Fedify package.

Astro also allows me to still have a static site (redeployed every 2 hours) with some dynamic elements (server islands). Right now, I have two of them:

• My last played song in the header/mobile menu, fetched via Last.fm. Previously, this would only update with every site build, now it updates with every reload.
• Comments under my posts, fetched from Bluesky and, from the next post onward, from Mastodon as well. Gives my blog posts a bit more life :)

Newsletter issues like this one now also show up under /posts, so that all my content can be found in one place.

I also created my own little CMS for managing all the Markdown files for my personal website without having to open a code editor. It’s called CMSimple (creative name, I know) and it’s, surprise, a very simple CMS:

I originally started to build it for my Hugo website, but I never really used it because it still had a few nasty bugs. With the port to Astro, I finally fixed them, so the CMS is now actually usable.

The functionality is pretty limited, but it does exactly what I need for my workflow:

• Push and pull to/from the remote repo
• Preview posts (with a dev server running under the hood) with the click of a button
• Automatically resize and compress images

I used to use an app called Darkmatter for this on the first version of the website, but some things never really worked for me (e.g. the preview, because my posts don’t live under /posts/post-slug but have top-level slugs). It’s really cool that you can now just build your ideal version of such a tool pretty easily, tailored to your exact needs. The beauty of building personal software.

At work, the busiest day of the week was my day off. At least it felt like it.

If you haven’t heard about it yet (who are you? I’m almost envious), the internet was basically in flames for half of the week because security vulnerabilities, pretty bad ones, were popping up left and right:

• Certificates that are supposed to protect web traffic turned out to be so insecure that they had to be immediately revoked (the private key of one was just the number 4, WTF?)
• A PHP vulnerability with 9.2 severity on the CVSS 4.0 scale that had been in the code for more than a decade leaked before a patch was available, which made everyone freak out
• Node.js had a pretty bad vulnerability as well
• Environment variables on Railway were compromised
• GitLab had a 12-year-old high-risk vulnerability too

Billow, the app we’re building at Trueform, is built with Laravel, which uses PHP under the hood. Naturally, I was very nervous when I read about the PHP vulnerability. Nobody seemed to know what to do and horror scenarios were circulating everywhere.

We took a couple of precautions during the day, but luckily, two providers we rely on for Billow handled the situation very professionally:

• Cloudflare deployed firewall rules as soon as they could to protect their customers. Billow sits behind a Cloudflare firewall, so that was already good to hear (and also reassured me that moving my personal website to them was probably not too bad an idea).
• Laravel Cloud had really good communication during the day, and at 14:00 UTC, when the patch was available, they immediately (and without a redeploy from our side) upgraded Billow to the patched PHP version.

It was emotionally very stressful but still interesting to live through such a day and see everything unfolding in real time. I’m just glad that everything went smoothly for us (I did a deep dive into our logs on Thursday and there were no anomalies) and that I’m not a cybersecurity expert who has to do this stuff every day. But I suppose we all have to become better at cybersecurity anyways, because frontier LLMs seem to find more critical software vulnerabilities every day. We just have to be faster at patching them than the bad guys are at exploiting them.

Finds

Cool things I discovered this week:

• What COROS Data Revealed About the 2026 London Marathon: Very interesting to read this in the week of my marathon. I’m also training with a COROS watch, and if I run like an average COROS athlete, I will run my sub-4-hour marathon ;)
• Pele · Mermaid diagrams as themeable SVG: A zero-dependency alternative to Mermaid with a few additional perks. Made by kepano, the CEO of Obsidian.
• Redesigning source control at Anthropic: Modern problems require modern solutions. This is the second custom source control system from an AI lab I’ve heard of, after the one from Cursor/xAI.
• celld: Durable Objects, self-hosted: With my move to Cloudflare, I read a bit more about their primitives like Durable Objects. And I found this self-hostable version (whose creator now also works for Cloudflare).
• The Test That Only Failed in the Summer - Henrique Dias: Who doesn’t love a good old “timezones are weird” post? If you haven’t seen it yet, I also recommend watching Tom Scott’s phenomenal video on the topic.
• Owls in Towels: The best website you’ll visit this week.
• Scrawl — Show an agent the problem.: Another interesting approach to the “I need to communicate feedback to my agent in a more efficient way”-problem. I tried it out alongside my own tool Kai during the week.
• Building a transcript-based video editor: Another great example of creating personal software tailored to your needs.
• How to install an app on your Commodore 64 - Anil Dash: People used to install programs by just typing them into their computer from a magazine? For me as a member of Gen Z, that was a really interesting read.
• Digital hygiene: This week feels like a good time to re-share this post by Andrej Karpathy. If you still don’t use a password manager, set one up ASAP!
• Caring in the age of AI: The best tech talk I’ve seen in a while. “You have to eat your customer’s pain”. And a good argument for having more “vertical ambition”, not vibe-coding 30 different sloppy products.

From the blog

I didn’t publish any posts since the last issue.

That’s it for this issue. Thanks for sticking around! If you have any questions, feedback, or just want to say hi, reply to this email and it will land straight in my inbox.

Until the next one,
Dominik