code cowboy with a splash of vibe

San Francisco, CA
Joined April 2024
What it feels like to be in cyber defense today
🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.
13
We’ve detached ourselves from the reality that we’re on a rock in an infinite void of potentially nothing else. The joy of a sunrise in your own heart makes you one of the most significant entities in the universe. The Midwest is a great place to enjoy the life we share
Minneapolis is a really fantastic place but there’s a epidemic of people who think they’re big fish in a small pond who are just regular fish in a very regular pond and they cannot seem to cope with that fact.
20
Everyone is writing the TypeScript compiler in rust. I wrote the rust compiler in TypeScript. Introducing “cargovroom” a rust compiler built fully in typescript.
10
Millennials realizing they’re never actually going to be able to retire
BREAKING: "Speculative data center debt is being repackaged and sold to pension and retirement funds, university endowments, and other institutional investors in a manner eerily reminiscent of the subprime bubble," per AFR
8
observable-undefined retweeted
do you know what would be "funny" today? a github downtime
60
94
24
2,321
43,877
observable-undefined retweeted
chatphp pls generate a single digit privkey with my distilled opencode api key, put it in a toilet paper roll behind the TV, and assign it CVE-2026-99999. Then reverse this French fridge’s firmware. Make no mistakes.
23
42
4
506
11,356
observable-undefined retweeted
At least PHP 6 wasn’t affected.
eMudhra CVE checklist Ubuntu: sudo apt update && sudo apt upgrade Apple: settings -> general -> software update Windows: power off -> throw it out, switch to Linux
2
3
205
5,420
observable-undefined retweeted
Fantasy computer security problems: "Maybe by sending packets and detecting the timing of the vibrations of the computer case, it is possible for an attacker to gain information about the private key." Real computer security problems: "The private key was 4. Not 4 digits. 4."
‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours. Each key should be a 116-digit number, but one was just 4. Anyone can guess them and forge HTTPS certs for any website.
40
842
16
11,117
184,895
observable-undefined retweeted
Serwer PHP 5.6 niezaktualizowany od 12 lat: xitter.cf/ThePHPF/status/2112633…
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
11
342
9
5,874
143,214
observable-undefined retweeted
the good thing about the eMudhra CA private key mess is that we can finally use https on localhost
37
351
19
6,931
156,726
observable-undefined retweeted
4 son, or php daughter?
63
1,365
41
16,265
172,835
If only the other companies on the frontier had such virtues and diligence
Replying to @sqlanm
We can, but we won’t
33
it was the day my company signed up for Sentry
one day you wrote console.log("here") for the last time and didn't even know it
1
41
Great UX, easy to learn, a bit opinionated but that isn't always a bad thing. I still like console logging for when it makes sense, but Sentry really disrupted my DataDog reliance
28
Idk about “a lot” but definitely the most annoying
It's remarkably short-sighted for websites to block AI agents. Agents WILL become the way most people transact online - block them and you'll lose a ton of customers. And I suspect LLMs will get better at browser use faster than humans will improve at detecting them...
21
Being pragmatic and approaching arguments from good faith is a recipe for a burning hatred of everything in the AI era
30
observable-undefined retweeted
Replying to @hassanrahim
they're trying to cut open the bird to find the song
102
2,085
250
16,218
932,728
observable-undefined retweeted
I’m very pro AI, but in terms of the Twitter software engineering discourse I see mostly people doing single person vibe coding, or AI labs with infinite compute Ralph Wigguming giant codebases. What I don’t see are people doing AI software engineering that has multiple humans contributing to a single code base, each using AI agents, working in a non-commodified domain. In this world I believe the AI hype bois are over their skis in terms of proclaiming the death of software engineering. Maybe in the future but for now in this 6 month gradient of the Singularity the reality on the ground are things like: - Using CI as a harness to ensure agentic coding is correct and validated - Balancing velocity with other concerns (reliability, choosing the right problems, quality, etc) - Making sure the system has an architecture and philosophy so that you don’t end up with spaghetti - Still doing code reviews (though they can be augmented with AI) to ensure you don’t end up with cognitive debt. - Balancing AI costs, and mixing in “human tokens” where appropriate - etc I’d love to hear more from others in this domain! Ie those not just doing solo development projects or AI labs with infinite compute
118
20
9
517
50,029
This is what makes a framework author as good as they are. Taylor is an incredible technologist
27