Malware Spread by VS Code Marketplace & Auto-update, Cursor's VS Code Workplace Security Misstep & More

This morning, we did a three hour live stream (Memory Day Weekend Marathon).

Here’s a breakdown of what we covered:

• Cursor’s workspace-trust default. Cursor ships with `workspace trust` disabled by default, which is a misstep worth being aware of. There’s a one-toggle fix Goju walks through on-stream.

• The GitHub 3,800-repo breach aftermath. A continuation of the 5/21 deep dive. Additional technical context on the TanStack → NX → GitHub daisy chain that Goju thinks is worth adding to the public conversation, plus where his read differs from the published write-ups.

• C++, Python, and the OO question. Goju’s evolving view on object-oriented programming, why static polymorphism (C++ templates) still has real advantages for serious systems, why Python is the right starter language but not necessarily the right destination. Includes the magic-number anti-pattern story and the bound-name discipline that prevents week-long refactors.

• A shorter opener on AI coding for real systems. Can someone without a programming background iteratively build a production-quality system with Claude Code / Cursor / Codex, or does it get harder once the codebase grows? Honest take from daily use.

• GTT’s multi-platform direction. Why Goju is broadening GTT beyond YouTube toward IG, TikTok, Substack, X, and direct platforms. Includes a distribution question Goju has been thinking about (whether the Gemini Nano commentary is affecting reach), and why algorithmic dependency is the single creator-business risk most worth planning around.

• Continue the auto-update discipline from the 5/21 episode — staggered updates, the NPM 30-day delay rule for production dependencies

• Cursor: turn `workspace_trust` ON manually, audit recently-installed extensions

• Magic-number discipline: bind every literal to a named constant, even when it looks like “obviously just an 8”

• Be deliberate about granting AI agents OAuth/MCP access to repos and payment systems

• Multi-platform creator strategy: don’t assume any single platform will keep prioritizing your reach forever
  

Topics covered:

• Can non-coders ship production software with Claude Code? Honest take

• The *magic-number anti-pattern* + bound-name discipline (real refactoring lesson)

• *OO growth mindset* — why your view of OO should evolve as you ship

• *Static vs dynamic polymorphism* — C++ templates vs Python duck typing for serious systems

• Why *C++ still has a place* + why *Python is still the right starter*

• *Intellectual honesty matters more than being right* — Goju’s recurring principle

• *Cursor IDE’s `workspace trust` default* — a misstep worth being aware of, with a practical fix

• *GitHub 3,800-repo leak* — additional context Goju thinks is worth adding to the public conversation

• TeamPCP daisy chain recap (TanStack → NX → GitHub) for newer viewers

• *YouTube distribution question* + the Gemini Nano commentary angle

• *GTT’s multi-platform direction* — IG, TikTok, Substack, X, direct platforms

• Memorial Day marathon-stream format experiment

• Real-time Discord channel routing + audience interplay

• Sleep-pattern reflection (Goju on 4–5h since founding Merly)

• Long-form Q&A on language progression, Kunle Olukotun anecdote, teaching philosophy

• Closing community CTA + Discord drop
  

If you’d like to dive into the full 3-hour live stream, here’s the link:

Hope you’re all having a safe and wonderful long-weekend!

Goju