Bhavya Chawla @beeseedev

@shensi so basically @langfuse + @PortkeyAI ?

if only someone at google had written a paper about a million scale CP leaning permission management with sub-second guarantees. Cries in zookies

> found a $10 bill > took 5 seconds to pick it up >$63m annualized ARR

Today, every sync between remotes, whether it runs on your laptop, a CI runner, or a remote server — creates a local git checkout somewhere. That's disk, state, something to provision and something to corrupt. git-sync eliminates that. It pipes deltas directly between remotes. The process that runs it never materializes a checkout. Not on disk. Not anywhere. Seems like one pinpoint thing. But at scale, it unlocks everything. No local copy means the sync process is truly stateless. Stateless means ephemeral compute, no EBS attached. Which means your sandbox environments — spin up, run agents, test, destroy — don't need anyone maintaining a persistent clone in between. You get the latest state, you work with it, and if you get a fruit out of it, decide what to do with the artifact. PR it back, ship it, throw it away. Per my POV: This was existential for Entire. They need code from your remotes streamed continuously to function at all. The fix wasn't a grand architecture. It was one precise elimination — no materialized checkout, anywhere, ever. And they open-sourced it. 🫡

Thomas Dohmke @ashtom

a month ago

Suddenly feeling the urge to copy your repo somewhere new? @EntireHQ is open sourcing our latest project today: git-sync. Most git migration tools assume you’ll make a local mirror clone, fetch everything down, then push it back up somewhere else. Instead, git-sync mirrors refs

31 93 895 211K 745

@aidaniil not a lab, barely a retriever

Give a man a fish and you feed him for a day. Give a man an AbstractAbstractFishFactory and you feed him for a lifetime.

The mental model shift: WAL isn't "write it down in case we crash." It's "write it down because every copy of this database — recovering, replicating, or running — needs to converge on the exact same page state." And Postgres is surgical about what it logs: → Structural changes (pointer redirects) → logged, because they can't be rederived → Mechanical changes (byte sliding) → not logged, because they can be deterministically reproduced from the structural changes Log the what. Let the replay figure out the how. /fin

"But wait — you said defragmentation ISN'T logged. So how does the standby get the right physical layout?" Here's the clever trick: Postgres uses a single WAL record called XLOG_HEAP2_CLEAN that logs: • Which line pointers were pruned/redirected • The new free-space boundaries of the page When this record is replayed (on crash recovery OR on a replica), the replay function calls PageRepairFragmentation — the exact same defrag function the primary used. So the byte-sliding isn't logged because it doesn't need to be. The WAL record carries enough info to reproduce the byte-sliding deterministically. Log the intent. Replay the mechanics. Pages end up bit-for-bit identical.

TIL: PostgreSQL's WAL isn't just a crash recovery journal — replication is a first-class intent too. I went down a rabbit hole reading about HOT updates, pruning, and defragmentation in Postgres and came out with a much deeper appreciation for why certain operations get logged and others don't. A thread 🧵 #PostgreSQL

If your company generates any revenue from software, this should be baseline: → Private artifact registry (no direct public npm/PyPI pulls) → Admission gates: package age, author history, download count thresholds → New transitive dep = approval workflow, not silent install → Vuln feed subscriptions with auto-quarantine from internal registry Having owned SOC2 and ISO audits, the dirty secret is that compliance vendors are extremely subjective here. One auditor asks "do you have a process?" and moves on. Another wants artifacts. Neither defines what good actually looks like. This isn't a practices problem. It's a standards problem.

Gergely Orosz @GergelyOrosz

2 months ago

Supply chain attacks are becoming more frequent, and far more serious. What are sensible practices to protect against these when using Node or Python packages? I assume pinning versions is the bare minimum; for those with security teams / tools: why else do you do / can you do?

114 49 644 114K 290

The entire AI coding agent ecosystem runs on npm. Claude Code. OpenClaw. All of them — auto-updating, shell access, full filesystem. axios just shipped a RAT as a transitive dependency to 100M weekly installs. When your AI agent runs npm install and then has execSync privileges, the attacker doesn't need a zero-day. They already have a willing executor. Tracing the impact? Good luck. Nuke and rotate everything. #ClaudeCode #OpenClaw #AIAgents #npm

Feross @feross

2 months ago

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios

541 4K 16K 12.4M 7K

It's 2026 and #microslop is still too busy gargling their own corporate diarrhea to let you install a fucking Python package from GitHub Packages. Vibe code the damn thing.

@GroqInc... y'all are technically family now right? @nvidia just dropped Nemotron 3 Super — this thing is topping benchmarks everywhere. When's it showing up on Groq? Nemotron at Groq speed would be absolutely unhinged.

Pick any season of shark tank, there's always that one pitch for an automated food cooking machine. well, we've basically achieved that for coding. Now imagine buying one, opening a restaurant, and yelling "look how many plates we send out!" ...while nobody's checking if the food slaps DORA metrics (the gold standard for eng teams) were built for a world where humans were the bottleneck. AI broke that assumption. deploying fast is table stakes now — everyone deploys fast. what we actually need to measure: → did the feature move the needle for users? → is AI code creating silent tech debt? → are reviewers actually reviewing or just vibing & approving? → how fast do we go from "customer has a problem" to "customer's problem is solved"? speed is cheap now. judgment is the scarce resource.

Gergely Orosz @GergelyOrosz

3 months ago

When it comes to AI agents / AI tooling + coding, I hear an awful lot of talk about: Efficiency Iteration speed / PR output rate / lines of codes produced I hear zero mentions about: Quality Customer obsession This will bite back, and it probably already is...

101 65 885 122K 137

The AWS account quota thing seems basically like a tripwire signal. Sure it protects you from billing surprises. But say if you're someone suddenly spinning up GPU instances that's basically a flag for them, and probably feeds straight into their sales pipeline with a solution architect knocking on your door. GPU instances are blocked by default. Makes sense given the demand crunch. But lifting the quota demands pitching your entire use case to their sales team!! - pretty much harvesting demand signals and route promising workloads to sales.

dax @thdxr

3 months ago

it took us several days to get our new AWS accounts properly provisioned with the right capacity limits to deploy our stuff it's crazy how things have regressed here

79 10 1K 94K 62

Been using since over an year now to build chat workflows and nothing really beats it. Super handful if your agentic flows got too many hops or handoffs - bunch of those "classification" or "orchestration" path decisions compound so latency is key. As for maverick consistency and structured output has been a real pain, honestly Llama 3.3, GPT OSS and Kimi have been much more reliable. Wondering why they never promoted the Llama 4 models to production tier.