alias (@loadingalias) header
alias (@loadingalias) profile picture

Founder @ alias-research | cargo-rail | rscrypto | privacy advocate | Member @ Zed Guild 🦀

USA
Joined May 2023
Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)Photo by alias (@loadingalias)
May the bridges we burn light the way.
4
38
20,099
I really dislike TLA+ and TLC. When can we use Verus + Stateright + Kani with Lean for the math? Does Bend2 somehow collapse all of this into Bend2? @VictorTaelin, help me understand?
51
The scale of the danger North Korea poses to crypto has become impossible to ignore. This is the story of the investigators exposing North Korean operatives working inside the industry. You think you know who your developer is. But do you? 🎬 Introducing THE DEVELOPER.
24
103
31
670
97,766
So many of you need to read this.
Next question: why are you still using branches? We talked about PRs. I don't think they make sense anymore, if you rethink them from first principles. Yes, if you only use them to trigger CI, then sure, go ahead. That's a fat commit, not a PR. But for mandatory code review? Knowledge sharing? C'mon. But some of you said: "we use PRs because we use branches! I love to keep my stuff on branches." And I'm here to tell you: you don't need branches! You can just push to main. It's called trunk-based development and the idea behind it is true continuous integration: you continuously integrate your changes with the trunk, the main branch. It's been around for a while, it works. Just yesterday I talked with someone who said they've used it in an org with 400 engineers, without any issues. Ruby, the project, uses trunk-based development. The main idea is that you want to avoid long-lived branches. They're bad, because branches can diverge and merging can turn into a thing. And you don't want routine operations to become a thing. Even when I worked in teams that used PRs and branches, I considered it a smell when a branch lived for longer than a day or two. But when I shared this with others, I'd often get something back like this: "Well, good for you, but no. MY thing, what I'm working on, that can't be done on main. It needs to be on a branch! It has a database migration, it changes the underlying shape, the architecture, it refactors this and changes that. It can't go on main yet! I need to merge it all at the end." And then I'd say: "Nah, I can merge nearly anything continuously in small commits to main. You split things up. Add the column first, merge that, deploy it, now it's out, works, safe. Add the helpers first, merge them, get them out. Want to migrate from legacy pattern A to new pattern B? Don't do it all at once. Add the dependency, then migrate A to B, one by one, safe." If it can be merged in a large change, I bet it can be done in small increments that you merge to main. Yes, there are exceptions, but it's 0.5% of cases, not 50%. But there was a real problem with this approach: it was hard! There's a lot of "meta programming" you have to do: make sure this small first change compiles and runs and the tests work, merge it, get it out, monitor it; then do the next small piece, make sure that works and get it out; then maybe push some still-unused dead code, add a feature flag, add a config variable; or keep both configurations working at the same time, etc. That meant sometimes it was just easier to do it in a big fat branch. But big fat branches are risky! A system that continuously flows is safer than a system that starts and stops in spurts. But -- you guessed it -- here's the good news: Now, with agents, all of these chores are no chores at all! Agents are great at adding feature flags, they're great at splitting up code, they're great at keeping track of three changes and merging them one by one and watching them roll out. They're great at keeping two configurations working for a day. They're great at migrating one by one. In other words: it's now 10x easier to just work on main and make sure everything is continuously integrated and working. It's now easy to make sure the system constantly flows. And look, ... I'm not here to convince you to switch to trunk-based development. Just a ruse to get you to read this. (But also, hey: try it! Pushing to main is amazing.) I'm here to make you RETHINK how you develop software. Don't just use agents to replace your typing. Use agents as the magic code-writing machines they are. Everything that was hard about software development because it involved writing code -- even the meta programming -- has become easier. You can now reach for the stars! But you need to look up.
1
47
Any new product or company should be using PQE end to end.
33
Holy shit. We’re watching a movie play out in real-time; Binance is getting absolutely hammered. This is unbelievable.
42
$2.3B get hacked in Binance hack Tether and Circle freeze like 85% of it before it can be taken. Two things: A) The bar is disturbingly low if this is even possible. This shouldn’t technically even be possible. B) Crypto is so far from decentralized and valid as an alternative outside of Bitcoin. The Bitcoiners were right all along.
56
What are you all using to give your agents power - cpu, ram, NVMe, etc? Are we still using dedicated servers? I can’t fight these new systems over io-uring perms or kernel access. I need actual access. What’s the best choice here?
30
AWWWWOOOOOOOGAAAAAAA 9.8 severity use-after-free vulnerability in the kernel’s IPv4 TCP stack just landed Time to patch! ubuntu.com/security/CVE-2026…
97
243
99
2,899
415,218
alias retweeted
ScopeDB Cloud 今天正式开放 Public Preview 🥵 更多的我就不说了,欢迎点击首评链接免费注册使用,据反馈体验非常丝滑 🐶;或者直接点进博客看看详情,也可以参考昨天发布的 Raft 用户案例看看真实场景。 接下来几天我会 Demo 一些常见需求在 ScopeDB 上的解决方式,Stay Tuned :D
ScopeDB Cloud is now in Public Preview. Serverless event analytics across your systems, without fragile ETL or idle compute: - Schema on the fly for evolving JSON - ScopeQL pipelined queries for humans & agents - Elastic compute on object storage Links below 👇
3
8
1
38
2,783
I know the numbers in Anthropic’s S1 are exciting, but this could seriously backfire. They must have some kind of “too big to fail” ideas because if the cost of AI comes down (highly likely) to the consumer or a competitor ships a major improvement the can’t reach… they’re fucked. I mean, if Google, Microsoft, Amazon, or XAI ship a model that cheap enough and dominate… Anthropic is going to bleed. The major investors, all the same people, will eat them alive.
1
82
We (actually) KILLED Palantir this time!!! New updates, better ontology generation, cloud service, and smarter agents! You can deploy it locally here: github.com/HelixDB/helix-fou… or use the cloud: foundry.helix-db.com
30
42
5
473
45,111
The way we develop has to evolve. I’m so tired of following these legacy standards or systems when none of it applies to our actual experience anymore. Software is in a super cool place. We can basically start over and learn from our mistakes. We can develop three iterations at once and toss the failures.
43
USearch v3 is ready for a design-partner preview! 3 years ago, I released USearch v2. It became my first widely deployed piece of software. It grew to over 4’000 GitHub stars, a number unimaginable to me back then. Together with my complementary projects, that’s 17’000 stars today. The open-source infrastructure behemoths shipping these libraries by default, like ClickHouse & ScyllaDB, collectively account for over 550’000 stars. Almost 800’000 including opt-in integrations 🤯 Thank you to everyone who shipped, starred, or argued with this code! I know I can be slow to respond, and I appreciate your patience. With help from AI agents, compute from neocloud partners and a lot of user feedback, USearch v3 finally has a release candidate. Only 1’000 days of work later 🫠 USearch v3 stays open-source, Apache 2.0, free for everyone, from open-source giants to neolabs, hyperscalers, government agencies, & even mobile publishers! Still, I’ve seen many times how paying for an integrated software experience can work better and cost less than getting the software for free — and be in everyone’s best interest. So I want to take a page from ClickHouse and Databricks, two organizations that reshaped commercial analytics infrastructure over the past decade by building businesses around open-source foundations. I want to do the same for Search: keep the infrastructure open and productize the experience around it. Before putting a major breaking release on “main” branch and launching an integrated offering around it, I want to make the transition as smooth as possible for my users. So I’m inviting a few design partners to join me in final benchmarking and help shape the UX and C ABI before the public release. Your workloads should have a say in what ships. I have no doubt USearch v3 will be a “scale unlocker” for many organizations reliant on Search. With a little creativity and collaboration, it can become a “capability unlocker” as well. If you’re working at a frontier intelligence lab, in autonomous driving, or in life sciences, and managing 100+ TB of data, DM me with a brief description of your workload. I’d love to collaborate!
10
7
2
47
5,780
alias retweeted
I spent some time off reading some papers and thought that I could improve upon what was previously the world's fastest CRDT Introducing eg-strider: a set of improvements on top of Eg-walker that result in significantly better performance on every measurable axis jzhao.xyz/posts/eg-strider github.com/jackyzha0/eg-stri… (now featuring exclusive twitter language balls benchmark visualizations)
15
24
5
288
13,841
alias retweeted
v1 ci is half the price of blacksmith lol
2
1
23
1,389
Vector has redeveloped its IEEE 11073 SDC stack in Rust, for medical device networking. 🦀 SDC, Service-oriented Device Connectivity, is a family of standards within IEEE 11073. It lets point-of-care medical devices from different vendors discover each other, exchange measurements, states and alarms, and expose their functions as standardized services. Vector unveiled what it calls the first Rust-based SDC stack at its Medical Engineering Symposium on October 15. It is expected to be available in the first quarter of 2027. Why Rust, as Vector puts it: → Memory and type safety help prevent common memory-handling errors during development → That can reduce certain causes of runtime errors and memory-related security vulnerabilities → For safety-critical devices, it is described as a solid foundation for reliability and cybersecurity requirements On integration: → The stack can be used from C and C++ applications through a foreign function interface → Manufacturers do not need to port existing application software to Rust → The architecture is designed to work across different hardware and operating systems On performance, Vector claims significantly better results, credited to optimized XML message processing and more efficient management of the device data structure. No numbers were given. A few things worth noting: → Vector's press release does not mention any certification or regulatory approval. One trade-press headline says the stack "qualifies for medical devices", but its text does not name a qualification either → The stack is not released yet → All claims are the vendor's own. No benchmarks, customers or toolchain details were given Still, a notable signal: a long-established automotive and medical tooling vendor is choosing Rust for a protocol stack intended to run inside medical devices. 🔗 vector.com/en/company/press/… #RustLang #MedTech #Embedded #Safety
1
8
464
alias retweeted
How to find ALL PHP bugs: 1. Compile code (e.g. to RISC-V, x86, LLVM IR) 2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it! 3. Find a LOT of bugs Super proud of our work. A big step towards finding ALL memory safety bugs
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…
24
61
5
1,190
55,842
The most vulnerable companies in software today are those selling pure convenience. If you ship an abstraction on top of AWS, Azure, GCP, or an OSS database... you are vulnerable. You should be actively deploying capital to get off the hyperscaler needle (be brave) and funding research to ship a genuinely novel product. I'd go as far as saying you're already seeing it on the books. AI is going to remove the willingness to pay for that abstraction.
2
5
204
I see it. I can see it. The vision is there. - Data Infra via the plane - Dev Infra via the ADE - Compute/Hardware Infra via campuses - Manufacturing via grit/determination - SMR Power via lobbying/determination
1
97
I don’t really believe in coincidence when it hits over and over and over. There is something going on with these vulnerabilities. I’m starting to feel like it’s not the thing we should be worried about, but rather a distraction to the thing we should be worried about.
1
110