🤝Fractional CTO/CISO @fractalboxdev Building secure, private and compliant-by-design solutions for agents

Base in Singapore, from HK
Joined July 2022
Only AI can keep up with AI. That's what will guide the entire security model of the next decade.
445
665
54
4,032
909,860
Replying to @trq212
This post-processing workflow is incredibly inspiring. I'm wondering how you use Claude to direct product demos—like having it go through user flows like typing in the terminal or clicking on Mac apps—and then stitch the screencasts together with zoom-in effects and overlays?
76
debuggingfuture retweeted
This is the actual bottleneck. The models are smart enough already. What is missing is the company-specific context locked in senior people heads. Whoever cracks knowledge extraction at the company level unlocks the rest. As you work on this, please consider using GBrain as your OSS retrieval layer xitter.cf/t_blom/status/20608063…
Imagine replacing 90% of your employees with a team of geniuses who have no idea how your company operates. Total chaos. Nothing works. That’s what AI feels like today. The missing piece is extracting all the domain knowledge from people’s heads and providing that as structured context to the models.
259
134
89
2,490
568,302
debuggingfuture retweeted
Shopify CEO Tobi Lutke explains Goodhart’s law and why he doesn’t like KPIs or OKRs “Goodhart’s law is real. The moment a metric becomes a goal, it’s no longer a useful metric… No metric by itself is a complete heuristic for a complex business. There’s a million different tensions in a company, and you can’t keep all of them in harmony by optimizing for one thing.” For this reason, Shopify doesn’t use KPIs or OKRs. But as Tobi explains, this doesn’t mean they don’t value data and metrics. “We are extremely data informed. We have invested enormous amounts of money and time into systems that give us basically everything at our fingertips… But what Shopify attempts to do is just not over-fit for what’s quantifiable.” People love optimizing for highly-quantifiable things because there’s immediate gratification that comes from seeing a number go up. But Tobi thinks that the most important aspects of a product are rarely quantifiable: “The overlap of the most valuable things you can do with a product and the things that happen to be fully quantifiable are like maybe 20%. Which leaves 80% of a value space unaddressable by the people who only look at quantifiable things.” He continues: “Shopify is comfortable with unquantifiable things like taste, quality, passion, love, hate… The sort of deep satisfaction that a craftsperson feels when they’ve done a job well is actually a better proxy if you allow it to be.” They then have robust analytics systems that tell the company if something’s wrong or a new rollout breaks something. “We think about it as a cockpit for a pilot. The decisions are still made by pilots, and we think this leads to better results… I think there needs to be more acceptance in business of unquantifiable things… And then metrics take a support function.” Source: @lennysan (Feb 2025)
57
254
83
2,711
693,309
Many case 3d animations really helps understanding how things are linked together from different perspectives
1
28
It's pretty insane how AI has been transforming the way I study Math. On top of @karpathy 's wiki idea, I can immediate generate visualization and generate @leanprover programmable proofs to keep myself engaged and really ponder the concepts
2
10
126
Echoing this. My 'aha' moment with Al is internalizing open-source libraries to make them faster and safer. Lately I'm exploring @leanprover with Claude Code, utilizing it both for formal verification and as the most concise spec for agents (maths) xitter.cf/karpathy/status/202347…
I think it must be a very interesting time to be in programming languages and formal methods because LLMs change the whole constraints landscape of software completely. Hints of this can already be seen, e.g. in the rising momentum behind porting C to Rust or the growing interest in upgrading legacy code bases in COBOL or etc. In particular, LLMs are *especially* good at translation compared to de-novo generation because 1) the original code base acts as a kind of highly detailed prompt, and 2) as a reference to write concrete tests with respect to. That said, even Rust is nowhere near optimal for LLMs as a target language. What kind of language is optimal? What concessions (if any) are still carved out for humans? Incredibly interesting new questions and opportunities. It feels likely that we'll end up re-writing large fractions of all software ever written many times over.
6
163
debuggingfuture retweeted
Thanks to good people at @AnthropicAI we now have an official MCP for Excalidraw! Take it for a spin on @claudeai (search for Excalidraw in Connectors, or use in Claude Code and elsewhere). More to come. ✌
We are moving quickly. Thanks to Anton and the folks at @excalidraw , this is now the official Excalidraw MCP server. From weekend project to official server in less than a week.
188
522
215
6,277
801,231
With AI, Working code is a low bar. Secure by Design. Elegant by Design.
Replying to @jasoncrawford
> We built a browser with GPT-5.2 in Cursor. It ran uninterrupted for one week. It’s 3M+ lines of code across thousands of files. I would actually be more impressed if it had 3000 lines of code, and came with a Lean proof that its sandboxing is bug-free :D I think now that code in general (for non-frontier use cases) is on its way to being too cheap to meter, the next challenge is pushing everything up to the top tier of security.
3
94
Software Engineering is unusual in that it works with deterministic machines. Maybe LLMs mark the point where we join our engineering peers in a world on non-determinism." martinfowler.com/articles/20…
81
@martinfowler wrote "Other forms of engineering have to take into account the variability of the world. A structural engineer builds in tolerance for all the factors she can’t measure... "
1
2
90
AI didnt just make us architect, it also calls for better engineer. Peter Rice, the legendary structural engineer behind Centre Pompidou, once said: The engineer is the objective inventor and the architect the creative input.
1
1
3
137
Really refreshing to see how sync engine Jazz handles decentralized permission in CRDT. With crypto signature, the chain of edits is verifiable like a blockchain. Check against the whitelist of who can read/write the values. (another example of crypto more useful outside CT)
My talk from @sync_conf 2025 is ready! Check it out to learn how: 1) CRDTs + cryptographic permissions work 2) @jazz_tools is now a general-purpose database 3) our unique Jazz Cloud infra compares to - traditional stacks - other sync engines - Durable Objects
3
16
1,798
Replying to @Wise
@Wise has the worst customer support ever and best @Reddit censorship
1
1
72
There is no way @claudeai talk about NEA photocathodes when asked to build a landing page, unless it is leaking response of other users's private query
1
90
with $NET now it is actually possible for @Cloudflare to pay out for damages for each 5xx on them
1
118
The more I realize AI can do my job, the more I feel I should focus on what humans are good at. If I'm not getting enough sleep, I'm definitely doing something terribly wrong
1
3
113
Fund in my Coinbase is still locked with random API error. The non-existent CS motivates me to self-custodial, but wait, I can't
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
1
2
84
Today developers are shaping agents with skills shared on Github. Very soon it the COO office will be interviewing, onboarding, assigning, reviewing and laiding off agents like the HR today
1
63