Hiring only senior engineers is killing companies (News)

0:29What up nerds? Human umpires aren't going anywhere anytime soon, but the writing is on the wall. This makes me sad. Sure, robots will make a higher percentage of crack calls, but they'll also be able to throw harder, hit further, and run faster someday. And that doesn't mean I want to watch them compete. Oh well, let's get into this week's news. Hiring only senior engineers is killing companies. In the last three months, Andrew Churchill interviewed 134 engineers. His main takeaway? There is a huge pool of exceptional junior engineers that most companies won't even consider. In this post, Andrew outlines why he loves working with juniors.

1:10Fresh energy, unshackled by prior experience, loyalty, and more. How to hire the right juniors? Filter for mindset, home assignments, tests with and without AI, etc. And how to make it work after the hire. Invest in mentoring, be patient, measure right, etc. His call to action, quote, investing your time in passionate junior developers will pay off in the long run. The question is whether you'll start now or wait until everyone else figures it out. Introducing Chrome DevTools MCP. Now in public preview, Chrome's DevTools now connects AI agents like Cursor, CloudCode, and Gemini CLI to its automation and debugging capabilities.

1:51The end result? Quote, your AI helper can not only write code, but actually run it in a real browser, inspect what's happening, and even fix issues based on real feedback from the page. End quote. Chrome DevTools MCP acts as a bridge between an AI model and a real Chrome browser instance, which means that your model can now open pages, click buttons, read the DOM slash CSS, capture performance metrics, read console logs, and much more. All autonomously as if a human developer were using Chrome DevTools. GitHub's plan for a more secure NPM supply chain. NPM has been getting hammered by attackers recently.

2:31So much so that I've struggled to track and contextualize all the events, so we're having our friend Farasabuka DJ from Socket Security on the show Friday to help make sense of it all. GitHub, as the owners and hosts of NPM, are at the center of the platform. Here's what they're doing about it. Quote, to address token abuse and self-replicating malware, we will be changing authentication and publishing options in the near future to only include one local publishing with required two-factor auth. Two, granular tokens, which will have a limited lifetime of seven days. And three, trusted publishing.

3:08Links to the details of all three of those things are in the show notes. In addition to these changes, GitHub provides a list of actions that NPM maintainers can take today to strengthen their package security. It's now time for sponsored news. Changelog News Classifieds. We're playing with the idea of adding a classifieds section to Changelog News. It would have a max five listings per issue that appear both in the newsletter and in the audio. They'd be super brief, headlines only, and link to a URL of your choice. If you'd like to put your startup, passion project, big idea, event, whatever, in front of changelog's classy, tasteful audience of hackers, fill out the form that's linked up in this week's newsletter.

3:51Generate a timeline of your day automatically. Quote, Dayflow is a native macOS app that records your screen at one frame per second, analyzes it every 15 minutes with AI, and generates a timeline of your activities with summaries. End quote. Dayflow's creator, Jerry Liu, built it because he realized that his calendar isn't the source of truth of how he actually spends his time. His screen is. Quote, I wanted a calm, trustworthy timeline that let me see my workday without turning into yet another dashboard I had to maintain. End quote. Thankfully, Jerry had privacy and data ownership in mind from the very start, so it gives you total control.

4:31Quote, it's MIT licensed and fully open source because anything that watches your screen all day should be completely transparent about what it does with that info. The app should feel like a quiet assistant, respectful of your attention, honest about what it captures, and easy to shut off. End quote. All that said, I'm kind of afraid to run this app not because of the data concerns, but because of what it might reveal about myself, of which I'm now blissfully unaware. What is good taste in software engineering? I've written often about taste as a large differentiator between man and machine, but because of its subjective nature, taste isn't the easiest thing to nail down.

5:09That is especially true in the context of software engineering, but Sean Godecki gave it a try. Quote, here are some indicators of software taste. One, what kind of code looks good to you? What kind of code looks ugly? Two, which design decisions you feel really good about and which ones are just okay? Three, which software problems really bother you to the point where you're worrying about them outside of work? Which problems can you just brush off? I think taste is the ability to adopt the set of engineering values that fit your current project, end quote. Sean goes on to explain why taste is different from skill, what engineering taste actually is, and why it's too easy, especially for immature engineers, to know what you like, but to mistake that for a principled engineering position.

5:55That's the news for now, but go and subscribe to the Change Log newsletter for the full scoop of links worth clicking on, such as how Ruby went off the rails, Super Mario Bros. Remastered, and hyperrealist data centers and Potemkin McRibs. Get in on the newsletter at changelog.news. We have some awesome episodes coming up this week. Charlie Marsh from Astral talking UV and rough on Wednesday. And Feras from Socket on those NPM attacks on Friday. Have a great week. Like, subscribe, and five-star review us if you dig the show. And I'll talk to you again real soon.