Pinned Tweet
First blog post in a longg time.
Felt important to re-orient around what it means to be a senior engineer in the era of agentic development and what still holds true: first principles thinking.
sunilsadasivan.com/writing/f…
Inspired by / response to @threepointone's recent post.
new post: the senior engineer death spiral
sunilpai.dev/posts/the-senio…
a friend just started a big job and asked for some advice. so I braindumped a monologue about a super common failure mode I see with engineers and posted it here, hope it helps whoever it can.
Sunil Sadasivan retweeted
We must face the reality that Tech's brand in America has taken a real hit, and it will take hard work to win back Americans' trust.
Sunil Sadasivan retweeted
One of the more exciting parts of this election - among many - is the return of a religious left.
Sunil Sadasivan retweeted
Let yourself have more fun. Even in the chaos, if that’s where you find yourself.
Sunil Sadasivan retweeted
SIXERS BEAT KNICKS 98-93 IN NBA CUP
TYRESE MAXEY DROPS 27 POINTS
ANFERNEE SIMONS WITH 21 AND LEBRON JAMES WITH 20
SIXERS START SEASON 5-1
PLAY THE SONG
Sunil Sadasivan retweeted
In third-party OSS vs first-party vibe-coded evaluation, the question will turn from "which has better code quality/security?" to "which has a smaller supply chain attack surface?", which is a very easy answer.
One potential outcome of the vulnpocalypse is that companies decide the cost (in risk, dollars, and engineering hours) of OSS dependencies is too high. Vulnerability management isn’t cheap or glamorous, and it’s unlikely that you need all of the attack surface you inherit with these packages. All of the small packages from the many transitive dependencies you inherit present supply chain risk that likely outweighs whatever value you’re getting from that few hundred lines of code.
The cost of the tokens to rewrite the fraction of that code you need, and maintaining it as 1p code, will eventually be lower than the continued cost of dependency management.
This will improve security, but would have negative consequences for the OSS ecosystem.
Sunil Sadasivan retweeted
This one maybe as bad or worse than the PHP ones. Get used to lots of patching.
Sunil Sadasivan retweeted
Why are people acting like it's @OpenAI/@AnthropicAI's fault that vulns are being fixed/disclosed? This is the result of decades of security debt from poor software engineering. The labs' models are not creating net-new security risk, the risk has always been there and we're finally able to uncover and fix it.
Kudos to @stripe for doing this.
We may need more API companies to detect and send these notices. IMO it's fair game for them break integrations to force app developer's hands to address.
Sunil Sadasivan retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.