Fetching from the wire…
01
02
03
04
05
06
07
08
Infra2026-06-18 · source-backed
His conclusion is DuckDB matches or beats SQLite's safety for untrusted queries, but only with enable_external_access=false, lock_configuration=true, and a watchdog thread, since DuckDB lacks SQLite's opcode-based query timeouts. He ships a safe_duckdb.py helper and a Datasette prototype. Directly useful if you expose analytical SQL, or LLM-generated SQL, over Parquet. (Simon Willison)
Each link below shares sources, entities, or timing with this story.
Willison launched datasette-apps (0.1a2) on June 18, hosting self-contained HTML+JS apps in a sandboxed iframe that run SQL against your data, read-only by default. He frames it as "Claude Artifacts reimagined for Datasette," artifacts backed by a JSON API to a relational data...
Prompted by Julia Evans admitting on July 17 that she still can't read query plans, Willison had Fable build a tool that runs arbitrary SQL against a SQLite database and renders both EXPLAIN QUERY PLAN and the lower-level EXPLAIN bytecode with per-line plain-English annotation...
Simon Willison shipped the fix August 6 and back-ported to 0.65.3: instances serving both public and private tables from one database let public-table users inject SQL and gain read access to private tables, defeating the permission system even with execute-sql disabled. Willi...
Simon Willison shipped 1.0a35 on June 23 with in-browser "Create table" and "Alter table" interfaces backed by stable JSON schema APIs, plus template context promoted to a stable public API. It pushes Datasette from read-only publishing toward an editable, scriptable database...
On June 24, Willison converted the mdn/browser-compat-data repo into a SQLite database served over a GitHub CDN with open CORS headers, queryable directly in Datasette Lite (simonwillison.net). It's a small pattern with big reach: ship a static SQLite file with open CORS and y...
Simon Willison shipped an alpha that turns an interactive-upload plugin into something programmable, with a formal API for uploading and atomically swapping databases on a running hosted Datasette (Simon Willison). "Rebuild the DB elsewhere, then hot-replace it" stops being a...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.