Mokhtar Bacha

Founder and CEO at @joinformal. Youngest @Consensys Alum.

I subscribe to crocker's rules

[Mokhtar Bacha @AHMB84]

There are far fewer one-way doors than people think

[Mokhtar Bacha @AHMB84]

@NathanFlurry @NathanFlurry if you like tailscale you'll love @joinFormal :)

[Mokhtar Bacha @AHMB84]

GraphQL is a terrible idea. To me, it feels like giving your client direct access to your database. You need a proper API layer with strong boundaries, and gRPC does that pretty well.

[Benۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗ☁️ @benswerd]

I think it might be time to bring back GraphQL.

I helped bring GraphQL to my team at Apple. It was a terrible mistake, probably my worst.

GraphQL has incredible potential, it allows you to organize queries in a way where every client asks for exactly what it wants in combinations no api engineer could ever build all of.

However, because of that, maintaining GraphQL servers is horrible. Building the GraphQL POC worked great, but maintaining it, adding to it, auditing its security was all a continual struggle that was not worth the effort.

Also, humans dont write that much code, so the advantage of custom queries for everyone wasn't too relevant if you weren't Facebook.

But code is cheap now and agents ask for a lot of specific data.

I'm going to benchmark this internally and see what makes sense.

[Mokhtar Bacha @AHMB84]

Least privilege is the most high-stakes puzzle in security right now.

The unit of permission is larger than the unit of work, and agents use every permission they get.

Three things I’m seeing right now:

1) Permissions are coarse. GitHub’s “pull requests: write” lets a review agent comment and approve.
2) Controls are fragmented. Every database, API and infrastructure tool has its own authorization model.
3) Access is static. A support agent should lose access to a customer’s records when the case closes. A standing role can’t express that.

Agents reach every one of those systems over the network, so @joinFormal enforces least privilege there:

- Every request checked at the level of the action: read these rows, open a PR but never merge it, etc.
- Policies tied to the person or agent acting
- API keys and passwords held at the proxy, never in the agent’s environment

We are proud to partner with some of the best engineering teams working today at Cursor, Decagon, Render, Granola and many more.

DMs are open

[Mokhtar Bacha @AHMB84]

@maayanalbert @proto_ide my team loves @proto_ide!

[Mokhtar Bacha @AHMB84]

@mschoening @Tailscale I resonate quite a lot with this vision. It's effectively what we are building @joinformal

[Mokhtar Bacha @AHMB84]

@TechCrunch I prefer @sandbar form factor

[Mokhtar Bacha @AHMB84]

@ivanhzhao @NotionHQ is AI transformation has been incredible to watch. Proud to be able to work with you all @joinformal

[Mokhtar Bacha @AHMB84]

Finally

[Go @golang]

“A new Go API for JSON” by Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhorst-Satzkorn, Roger Peppe, Chris Hines, and Damien Neil — https://t.co/Hyxsj7FQtj #golang

[Mokhtar Bacha @AHMB84]

@sahilhandapanda @showrunnernyc that's pretty cool!

[Mokhtar Bacha @AHMB84]

@minafahmi So excited to get mine soon!

[Mokhtar Bacha @AHMB84]

@IamAroke Yup you can't have sateless sessions

[Mokhtar Bacha @AHMB84]

the best line of code is the one that doesn't exist

[Mokhtar Bacha @AHMB84]

2025: pretty dashboard about the problem > solve the problem
2026: prevent the problem > solve the problem

[Mokhtar Bacha @AHMB84]

@TomHacohen We operate under the same principle of least-privilege at Formal.

https://t.co/lsd6wKPQHK

[Mokhtar Bacha @AHMB84]

@dinodaizovi this is literally the problem we've set to solve @joinformal. We use mTLS to authenticate our Endpoint to our Connector over p2p MASQUE connection (quic)

[Mokhtar Bacha @AHMB84]

@UK_Daniel_Card Making proxies easy is what we do @joinformal

[Mokhtar Bacha @AHMB84]

Preach!

[Shreya Shekhar @_shreya_s]

Cybersecurity is an industry where historically, the best product has rarely won.

In a world of human-constrained attacks, cyber was still effectively a checkbox. As long as the product met a baseline functionality, the CISO said, “I have my VM/SIEM/DLP solution, I’m good to go.” In this paradigm, marketing and sales mattered way more than technical superiority.

But in a world where agents can attack your systems at massive volume and scale, the efficacy of cybersecurity products is put to the test. Even a difference of 96% vs 99% in attack prevention is magnified. Brittle solutions which can’t perform at scale will quickly be ousted and we’ll see companies that grew purely on marketing and Gartner magic quadrants sink quickly.

The cyber industry is changing, and now the best technology will win.

[Mokhtar Bacha @AHMB84]

@dinodaizovi is right, proxies are powerful primitives to secure your environment!

[Dino A. Dai Zovi @dinodaizovi]

Everyone is sleeping on applying the pattern of hardware-bound private keys and mTLS to authorization-aware reverse proxies. We all have the knowledge and means to build and deploy it today using our little robot friends.

It's a phenomenal way to massively reduce attack surface.

[Mokhtar Bacha @AHMB84]

@signulll Indeed, that's effectively what we are building @joinformal