alias @loadingalias

The obvious lesson is CA certificates need to leave the Stone Age and move to threshold ECDSA signatures. The root programs need a blanket policy of only accepting certs with secret sharing between multiple independent HSMs. Crypto custodians figured this out years ago. When you have really important private keys that require resistance to nation state actors, the only solution is combining multiple independent sources of entropy

The Hacker News @TheHackersNews

20 hours ago

‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised. Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes. Full details - thehackernews.com/2026/10/eight-…

22 228 683 297K 254

What is the best data room tooling? Are we building this ourselves? No way, right?

@ColinGardiner I don’t know what the right answer is… but if I’m that VC - I immediately sit down with said founder and tell him exactly the truth. If he can’t figure it out; I start building the avengers.

@samlambert Weak. So weak.

@ohryansbelt I don’t think so, but if they do… Vercel is about to get WAY more efficient.

@rustaceans_rs I don’t think another team could have pulled in off, honestly. The @voidzerodev developers are in another class entirely. I’ve followed their work for years and they’re just insanely talented. Elegant is the word that comes to mind, I guess?

@dummerspast39 I kept expecting this massive xAI jump.

@DeGatchi Damn. You’re going to have a blast. It’s fucking stunning there. Enjoy the trip, bro.

1. What does "Code Is Cheap" mean? How does it interact with open-source projects? 2. When code is cheap, is open-source (collaboration) still necessary? 3. What can we do to better maintain open-source projects today? x.com/i/article/2112…

There are ≈3.1 million roots spread across ≈350k crates to test against on crates.io. It’s an absolute gift to Rust tooling development.

I think like 90%, conservatively, of the companies that exist in tech today are dog shit and will die in the next few years.

Unfinished coding side projects are now way easier to complete than unfinished blog posts. I’m perfectly OK with AI writing my code, even the docs. But I flinch at the idea of AI writing my blog posts, which feels like an egregious violation of a fundamental ethnical contract.

Every single Eng leader out there is iterating on some kind of PR autoapprover, coding automations, AI cost optimization, and model switching/eval stuff. Just a million people doing the same thing.

@Cyberlane @Cloudflare In all my time developing I’ve never heard anyone complain of Cloudflare’s pricing model or tooling.

@GeoffreyHuntley Hey, use TrailofBits skills. It will catch the extras. They’re really quite good.

@GeoffreyHuntley @AntithesisHQ Agh, enjoy! Antithesis testing is quite the ride. They have done such a wonderful job over there.

@jezell @criccomini This is probably one of the best stacks today for the workloads that fit well.

@Nekrolm I assume you’ve tried to run u see stacked and/or tree borrows?

I have thoughts: 1) This is a non-issue. It’s OSS. You want a better compiler? Build it. My only gripe is that buying a seat at the foundation shouldn’t be that simple. 2) Rust IS the only way forward with respect to programming languages until we have a better option. What’s the issue here? It’s a better way to write software; the trade-offs are almost nonexistent… the compilation and build speed is going to fall in mere weeks or months. I’m not guessing - I know this because I am working on it. The DX will improve considerably and complexity cost will fall for devs massively. 3) Rewriting old legacy codebases using a better language or set of tools is how software evolves. I don’t know about anyone else, but I’m not dedicating my time to rewriting something just because… if I do it - it likely needs to be done to reach a goal impossible to reach as is. You can always decide to use the legacy stack - you’re not forced to use the Rust tool. Also, engineers don’t rewrite and walk away… not real ones. If someone rewrites a tool in Rust - you can bet it’s going to get the same attention to detail and hardening over time the predecessor did. 4) Licensing exists in any language or framework. Again, write your own fork. Or, use MIT only. Or, don’t use that distro. We have exactly zero cases or this bait and switch happening in the real world. In fact, I’d argue we have MORE quality open source software today because of Rust. Jody lost the plot, man. 5) If the Rust compiler has some backdoor, not only would a significant number of brilliant engineers know it - we all work on it or study it or fork it or fuck with it daily - but I would likely know. I’m not insinuating that I’m some all seeing oracle of insight, but I live and breathe Rust. I have two experimental versions of rustc on my machine today; I have Cranelift and GCC backends on my machine today; I am weeks from shipping a genuine alternative to Cargo. I have looked at the compiler’s code in one way or another for the last six years - almost weekly. There isn’t a backdoor and if there is… it’s definitely not going to last long after this. Finally, everything you’ve said here could be said of Zig or Typescript or C. This entire argument is a nonstarter and Rust Bytes has better shit to do. I’m sorry, friend, but the train isn’t going to stop because you’re unsure of the trip. Best of luck, man… but I don’t think we have anything to fear of Rust.

@christophersaum You take 2500 messages - or like 84/day all month, including weekends - and 3-4 calls a day? Then, somehow you manage to dive into 20 of those projects? What did you invest in over the last three months? Who were the three teams you believed in? Give them some airplay!