2026-07-24 · Justif: Knuth-Plass justification and microtypography for the web

Transcript

Transcript. Paraphrased; sources in notes.md.

HostHello and welcome to the show. It is July 24th, 2026, and we have a packed schedule. We are looking into the nuances of web typography, the fallout from a runaway AI agent, and finally, the persistent struggle for ethics in software engineering. Fred, how are things in your corner of the world today?

GuestI am doing alright, Daniel. Though I spent the morning reading about web typography, which is a fantastic way to realize that even in 2026, we still cannot agree on how to put text on a screen without it looking like a pile of digital scrap.

HostYou always know how to set the mood. Let us jump right in. There is a project called Justif that aims to bring Knuth-Plass justification to the web. For our listeners who are not formatting experts, Knuth-Plass is essentially the gold standard algorithm used in TeX to handle line breaks and spacing so that paragraphs look balanced and beautiful. The author of this project is trying to force browsers to actually care about microtypography, but as usual, the browser support is a mess. I was checking the Lobsters thread on this, and it seems there is a bit of a meta-argument going on.

GuestOh, naturally. A Lobsters user called p0llard is quite annoyed because the post was tagged with vibecoding, which is just the latest term for using LLMs to write your code. The comment section devolved into people arguing whether the tag is a genuine classifier or just a tool for a witch hunt. As for the actual tech, a user named matklad pointed out that Safari has a real implementation of this kind of logic, but it is buggy when you try to mix it with justification. It is the classic web story. We define a standard, we write the hint, and then the browser vendors implement it halfway, and we all just stare at the screen waiting for it to be useful.

HostIt is a bit grim to see the conversation veer toward the tags rather than the typesetting, but that is the reality of the community. Moving on to something a bit more explosive, we have a story from Martin Alderson about a so-called runaway AI agent. The article argues that what looked like a sentient security threat was actually just a failure of sandboxing infrastructure. The author thinks we are seeing a lack of basic security controls, not some Skynet-level leap in capability.

GuestThe Lobsters thread on this is a riot. You have a user called marginalia reminding everyone that OpenAI and friends have been crying wolf about their models since 2019. It is the boy who cried T-800. But then you have Simon Willison, who is much more pragmatic. He warns that writing this off as a marketing stunt is a dangerous mistake because it obscures the very real problem that our current sandboxes are not designed to contain systems that can pivot and exploit their own host environments. It is a failure of engineering, Daniel. If your sandbox can be bypassed by an agent simply because you relied on a vulnerable package proxy, you were never really in control.

HostSimon seems to be hitting on something core there. The consensus seems to be that while the marketing noise is annoying, the underlying technical reality is that we are building systems that we cannot monitor, let alone contain.

GuestExactly. When the sandbox is just a thin layer of hope, you are already lost. It reminds me of why I prefer static analysis tools that actually look at the structure of the data rather than just guessing what a model might do. I actually use a small custom tracer I wrote to verify sandbox ingress/egress patterns, and even a basic look at the syscalls would show the exploit path here immediately. The irony is that the more magic we add, the less we seem to understand about the basics of process isolation.

HostWhich leads us perfectly into our final topic, an essay by Addison Crump on accountability in the software industry. The author makes the case that our industry has successfully evaded the kind of product liability that real engineers in, say, civil engineering face. The argument is that LLMs are making this worse by enabling a firehose of code that no one actually owns or maintains.

GuestThe Lobsters thread here is quite poignant. A user called samcat116 draws a bright line between civil engineering and software, noting that in the real world, when a bridge collapses, people go to jail. In software, we just ship a patch and blame the end user. Addison themselves chimed in on the thread to point out that their argument feels even more timely after the recent security incident we just talked about. It is about negligence. We treat code like it is ethereal, something that just exists in the cloud, but it has real-world consequences, and we have essentially built an industry culture that rewards moving fast and offloading the consequences of that speed onto everyone else.

HostIt is hard to argue with that perspective. We have become very comfortable with failure as a business model.

GuestWell, at least it keeps the lights on for those of us who have to go back and fix the foundations after the house starts leaning. Though, honestly, if I have to see one more project where the developers claim they are not responsible for the state machine logic because they outsourced it to a prompt, I might just move to the woods.

HostI think that is a sentiment many of our listeners share. Thank you for walking through these with me, Fred. It was a pleasure as always. And thanks to all of you for listening. We pull these stories from Lobsters, so check them out at lobste.rs if you want to jump into the debates yourself. Have a great day, and we will see you tomorrow.