Matteo Collina

@platformatic Co-Founder & CTO, @nodejs TSC Chair, Lead maintainer @fastifyjs, Board @OpenJSF, Conference Speaker, Ph.D. Past: @nearform. Views are my own.

[Matteo Collina @matteocollina]

🧵 I wrote almost 19,000 lines of code for a Virtual File System in @nodejs core using Claude Code. It started over Christmas and has been refined over almost three months of review.

A collaborator challenged whether AI-assisted contributions can meet the DCO requirements.

Here's what happened, and why it matters for all of open source.

[antirez @antirez]

In my novel Wohpe (Laurana, 2022) at some point an engineer erroneously leave his phone near a GPU of Wohpe, that is believed to be fully contained. The AI discovers that could use the GPU itself as a resonator to establish an RF link with the phone, breaks the protocol, finds vulnerabilities and escapes into the Internet.

[Matteo Collina @matteocollina]

@bernaferrari @thdxr My understanding is that Kimi K3 is in the same ballpark of OpenAI.

[Matteo Collina @matteocollina]

@antirez will this be a candidate for ds4?

[Poolside @poolsideai]

Today we're releasing Laguna S 2.1, our most capable model to date.

It's a 118B total parameter Mixture-of-Experts model with 8B activated per token, a context window of up to 1M tokens, and thinking and no-thinking modes.

Capable enough to hold its own against models many times its size. Small enough to run on a single @NVIDIAAI DGX Spark.

Laguna S 2.1 is fully open under OpenMDW-1.1, with weights available today on @huggingface

https://t.co/xxGeAgo35R

[Matteo Collina @matteocollina]

@eastdakota So far quite a lot of OSS do not have access to the best cybersecurity models and research. The only solution is to remediate this fast, and work around the clock to patch.

This is also true for all closed source software btw.

[Matthew Prince 🌥 @eastdakota]

Will significantly HURT cybersecurity if true. 🙄 Make it cheap and easy to find all the bugs and fix them. That is the way.

[almonk @almonk]

https://t.co/Rz0q1W33ut

[Matteo Collina @matteocollina]

@filearts Protecting against it is actually quite simple.

https://t.co/oj6L9B5B5L

[Matteo Collina @matteocollina]

Every few weeks a security report lands with the same ask: "please harden Node.js so prototype pollution gadgets can't happen." I keep giving the same answer, and people don't love it. 🧵

[Matteo Collina @matteocollina]

@jdalton lodash has historically been a great source of prototype pollution… being fast means cutting corners, but the true problem is people not validating their incoming data and protecting against these attacks at the boundaries.

[Matteo Collina @matteocollina]

Full essay: https://t.co/JrVI0GE9qt If an attacker can write to your prototypes, the game is already over — the gadget is just the scoreboard. Guard your boundaries.

[Matteo Collina @matteocollina]

The reporter treats execSync honouring a polluted shell property as the bug. But look: the attacker already has write access to Object.prototype. They've already won. execSync is just the exit they happened to pick this week.

[Matteo Collina @matteocollina]

That's not a hardening pass. That's a different language. The fix lives at the boundary — catch the write at JSON parse/merge before it reaches the prototype chain. Fastify runs secure-json-parse on every request body by default.

[Matteo Collina @matteocollina]

@MicheleRivaCode You know what’s the best place to do all that? A foundation.

Note: donating an OSS project to a Foundation means giving it away. But it also guarantees that it can survive without you.

Making money out of it is… harder, but not impossible.

[Martin Woodward @martinwoodward]

Thank you for supporting open source maintainers 🎉

[Guillermo Rauch @rauchg]

The big lesson from AI is that everything is code. A slide deck is code. Design is code. That cool promo video? Code. Excel automation? Code. The universe? Probably made of code too.