GoKawiil
Tech News
An unnamed Fortune 500 solutions integrator's CTO argues that companies rolling out AI tools are repeating the same organizational mistakes seen during the early DevOps movement nearly twenty years ago. The CTO frames this as a pattern of learning through costly trial and error rather than applying lessons already known from that earlier shift.
Developer bealesh released neckbeard, a plugin for AI coding agents like Claude Code that analyzes an application's repository and generates reviewable cloud infrastructure plans with monthly cost estimates. It supports AWS, GCP, and Azure deployments via GitHub Actions or GitLab CI, using a bundled catalog of tested OpenTofu modules, and includes commands such as /neckbeard:analyze, /neckbeard:estimate, and /neckbeard:sync. The tool pairs AI-driven analysis with deterministic planning and validation code so the agent explains infrastructure rather than inventing it.
Developer Iain Cambridge argues that Go's practice of importing packages by their git-hosting URL (e.g. github.com/user/repo) ties codebases to a specific provider like GitHub. He describes a company that ended up paying for GitLab, GitHub, and Azure DevOps simultaneously because switching import paths was too costly, and says he built a tool called Boneclone to replicate code across multiple git hosts. His proposed fix is to use a custom domain (e.g. go.iain.rocks/boneclone) that redirects to the actual host, so the underlying provider can be changed without altering import paths.
Aikido Security published research showing that GitLab's per-user incoming email address, meant to let users create project issues via email, contains a non-expiring token that functions as an authentication and authorization credential. Because GitLab treats any message sent to that address as coming from its owner, exposure of the address alone can let an attacker create issues, submit merge requests, or send patch files across an organization's public and private projects without needing account credentials.