Tamal Saha (@tsaha) header
Tamal Saha (@tsaha) profile picture
Joined January 2010
Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)Photo by Tamal Saha (@tsaha)
Tamal Saha retweeted
Talked to an older Chairman the other day, and something he talked about in building a business was the "tax" you pay before getting to break out success. "Everything in this system will try to keep you from winning, and you have to hang in long enough to win anyway."
15
14
3
269
12,748
Tamal Saha retweeted
Replying to @ibuildthecloud
but most developers
1
13
1,063
Tamal Saha retweeted
The time to be most ambitious is when you have nothing to lose or nothing left to gain.
458
3,663
163
31,771
752,400
Tamal Saha retweeted
It is my belief that many devs right now are not maximizing what they can do with automatic programming because they still look at the code. Doing it makes you the bottleneck. Your time is better invested in new ideas, QA, design, and asking yourself what is your goal.
271
255
130
2,712
506,227
Tamal Saha retweeted
🚨 Argo CD users have a serious problem. - Low-privilege users could read Kubernetes resources outside their app scope - ServerSideDiff=true made it worse - Plaintext Secrets could be exposed with zero redaction Affected: - 3.2 < v3.2.11 - 3.3 < v3.3.9 Fix: > Upgrade now > Disable ServerSideDiff=true > Tighten RBAC > Rotate Secrets if enabled This one is bad. github.com/argoproj/argo-cd/…
5
39
6
232
43,817
Tamal Saha retweeted
Starting June 1st, GitHub Copilot will move to a usage-based billing model as GitHub Copilot supports more agentic and advanced workflows. In early May, you'll see a preview bill experience, giving visibility into projected costs before the transition. 👉 Read more about the upcoming change: github.blog/news-insights/co…
523
910
1,058
2,879
3,777,922
Tamal Saha retweeted
TL;DR: pgBackRest is no longer being maintained. For details see github.com/pgbackrest/pgback…
9
23
6
48
11,524
Tamal Saha retweeted
When this news broke I really wanted to understand how the linux scheduler work. So I started to research. What I gathered so far: (of course I might be missing something) Unlike user code, the Linux kernel code isn’t usually preemptable. That is when a system call is executed or a page fault is triggered the kernel runs to completion hogging the cpu core it runs on. The current Linux 7 tip experimenting a different preemption model for kernel code, so other more critical tasks can be scheduled. With this default mode, Postgres experienced 50% dropped in performance in one test suite 96 cores, with 100GB shared buffers pool. The theory from the thread discussion is that the large buffer pool 100 GB with the default 4kb kernel vm page size, caused significant number of page faults. Page faults gets triggered to allocate physical memory on first access or on swap (I have a video detailing this). Page fault runs kernel code to do the allocation of the physical memory and update the page table data structure for the process. If page faults are being preempted, it keeps the user process code in spin lock waiting for access. Indeed Andreas, the postgres maintainer, was able to prove that even with stable Linux you could see the contention obtaining memory from shared buffers, its just not as obvious with 7.0 where kernel preemption is enabled Using huge pages significantly reduces page faults, improving the performance. My Page Faults The Backend Engineering Show youtu.be/AsFxaZJ1M0k Phoronix article phoronix.com/news/Linux-7.0-…
4
34
3
408
46,131
The open source project that wins is the one that's just keeps plugging away.
1
1
1
714
Tamal Saha retweeted
🚨 Breaking: Trivy Docker images are compromised. Tags 0.69.4, 0.69.5, and 0.69.6 contain infostealer IOCs. The latest images were pushed to Docker Hub without corresponding GitHub releases. `latest` currently points to a malicious image. Details: socket.dev/blog/trivy-docker…
27
1
71
9,416
Tamal Saha retweeted
🚨 Breaking: Trivy GitHub Actions supply chain attack – 75 out of 76 version tags compromised. If your CI/CD pipelines reference “aquasecurity/trivy-action” by version tag, you’re likely running malware right now. At Socket, we identified that an attacker force-pushed nearly every version tag in the official aquasecurity/trivy-action repository. That’s @​0.0.1 all the way through @​0.34.2. Over 10,000 GitHub workflow files reference this action. The malicious payload runs silently before the legitimate Trivy scan, so nothing looks broken. Meanwhile it’s: - Dumping runner process memory to extract secrets - Harvesting SSH keys - Exfiltrating AWS, GCP, and Azure credentials - Stealing Kubernetes service account tokens The only unaffected tag right now appears to be @​0.35.0. Socket independently detected this at 19:15 UTC and generated 182 threat feed entries tied to this campaign – all correctly classified as Backdoor, Infostealer, or Reconnaissance malware. This is the second Trivy compromise this month. Earlier in March, attackers injected code into the Aqua Trivy VS Code extension on OpenVSX to abuse local AI coding agents. The compromised tags are still active. Pin to @​0.35.0 or use a SHA reference until this is fully remediated. Full write-up: socket.dev/blog/trivy-under-…
15
115
27
372
238,589
Tamal Saha retweeted
🌟 Go 1.26.1 and 1.25.8 are released! 🔐 Security: Includes security fixes for the standard library (CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142). 🗣 Announcement: groups.google.com/g/golang-a… ⬇️ Download: go.dev/dl/#go1.26.1 #golang
10
117
12
629
80,097
"Gartner consulting down 12.8%. Forrester consulting down 16% in Q4, down 9% for the full year. Forrester is exiting strategy consulting entirely — bookings dropped over 50% in 2025."
7
7
2
78
39,630
Tamal Saha retweeted
The reason why RAM has become four times more expensive is that a huge amount of RAM that has not yet been produced was purchased with non-existent money to be installed in GPUs that also have not yet been produced, in order to place them in data centers that have not yet been built, powered by infrastructure that may never appear, to satisfy demand that does not actually exist and to obtain profit that is mathematically impossible.
1,052
20,336
1,055
138,289
4,222,750
Tamal Saha retweeted
Despite what people say, the majority are not really willing to do what it takes... That's your biggest advantage.
82
264
13
1,492
50,503
Tamal Saha retweeted
"Envy no one. For whatever you see, a price was paid." Absolute truth.
196
13,714
227
49,938
1,103,334
MongoBleed (CVE-2025-14847) is basically Heartbleed for MongoDB - unauthenticated memory disclosure - public POC, trivial to exploit - leaks creds, tokens, cloud keys straight from RAM - huge exposed surface on the internet Good writeups and technical details here: doublepulsar.com/merry-chris… ox.security/blog/attackers-c… blog.ecapuano.com/p/hunting-… Patch fast, rotate secrets, and assume exposed instances were scanned(!)
39
582
57
3,257
656,487
Nvidia, $NVDA, CEO: “you cannot show me a task that is beneath me.”
652
2,851
440
19,975
17,355,756