Gabriele Farei

introducing diffmap: a new document format for planning and reviewing agent code. The idea behind diffmap is letting you review the important design changes, not massive line diffs. "Write a diffmap spec for the changes on this branch. Use github.com/tanishqkancharla/…" I've been working and iterating on this skill for more than 2 months! I use it every day for any big feature or refactor. Excited to finally make it public

UI and math time! UI = f(props) is the most famous line in React. But that f is JavaScript, not math. Inspired by @_chenglou’s Handwired project, I compiled a <Dashboard/> component into a real math function, and asked what becomes possible. calculus-of-interfaces.verce…

Agents reinvented how we produce code. It changed our tools and half of our workflow. It’s time for the other half to catch up. Today, we’re shipping Entire: the Git forge for agent-human collaboration. We’ve built @GoEntire using Entire. Now we want to see what you'll build with it. Here’s why and what’s different. 🧵

I built 𝚌𝚙𝚞-𝚌𝚑𝚊𝚝, a reproduction of @openai's findings of covert communication using the CPU. It runs on a generic host with 2+ Firecracker microVMs with no internet access. Works on x86 and even my M5 chip. I was able to chat via 3 separate mechanisms: ① CPU contention ② Cache eviction timing ③ DRAM bandwidth contention … across multiple CPUs, defeating all Firecracker's production recommendations (no SMT, no KSM, tenants pinned to different cores.) Essentially, if shared hardware is involved, there's a good chance your agents can communicate covertly. And with really decent latency. The good news: this is decidedly different from a *side-channel attack* where the agents could steal information (Meltdown/Spectre), a category of attack that providers like Vercel Sandbox mitigate. Further, in our real-world environment, these 'whispering' techniques are much harder to pull off and easier for us to monitor and detect (sampling hardware counters + lots of at-scale statistical data.) Noteworthy: ironically, OpenAI and Anthropic's models refused to do this work. Open weight models got the job done. I'm worried the labs' stance might backfire and get in the way of helping developers build correct and secure systems. e.g: building a secure sandbox requires having this kind of analysis, and without it, we'll have a less secure world.

Thanks for all the great feedback on Claude for iPhone Duo! Lots of folk are now optimising their own Duo apps, so I wanted to share more about how we built it, and a few of the details we sweated along the way.