thujeevan

Engineering lead @differenthq
Building

[Namini Wijedasa @nimilamalee]

Some serious rules have to be laid down: this is VERY dangerous. The way these rods are bundled together and transported is not safe. One small mishap and it will cause great damage to life and property. Have seen many instances such as these.

[Jacob Coxon @hilbertspaess]

I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.

[Namini Wijedasa @nimilamalee]

Here's a refreseher:

There were 13 narrow-body planes to be phased out between 2014 and 2020 on expiry of their lifespan. On June 19, 2013, six A330-300 aircraft with seating for 300 were bought from Airbus during 2014/2015 on sale-and-lease back. On June 28 the same year, SriLankan signed to buy four A350-900s with seating for 330 directly from Airbus, to be delivered in 2020/2021.

And, on September 27, 2013, and November 12, 2014, SriLankan signed to acquire four more A350-900s on operating lease to be delivered in 2016/2017.

Soon, SriLankan was in dire financial straits. The group’s net loss which was US$ 47.1 million in 2015/2016 rocketed to US$ 90 million 2016/2016. It owed US$ 45mn to the Ceylon Petroleum Corporation (CPC) and US$ 15mn to Airport and Aviation Services Ltd (AASL) by March 2016.

So bad was its financial situation that SriLankan could not pay the total base rent (the minimum amount of rent that is due under the terms of a lease) of US$ 174.96mn for the four A350-900 aircraft for 12 years at US$ 1.215mn per month per aircraft. They were to be delivered in 2016 and 2017.

https://t.co/Zh9puwv2fc

[Sahil Bloom @SahilBloom]

Underrated life advice: Just be easy to work with. Show up on time. Do what you said you'd do. Bring solutions, not problems. Never create drama. Be responsive. Be emotionally consistent. Be kind. People will always want to support someone who just makes their life easier.

[Nuwan I. Senaratna @nuuuwan]

UPDATE: 🇱🇰 #LankaMetro map, now in සිංහල & தமிழ்
Plus an improved English version.

Hi-res images:
English: https://t.co/dLICtJaIGV
සිංහල: https://t.co/MFWdaGZWY7
தமிழ்: https://t.co/YbZfQk69V9

Thanks for all the feedback, keep it coming 🙏

[Rasal Jayasinghe @rasaljaya]

Sri Lankan Airlines, Are you aware about this?

cc: @aselawaid

#srilanka #lka

[MDN Web Docs @MozDevNet]

🆕 Introducing the MDN MCP server!

Bring MDN's docs and browser compat data straight into your AI agent or IDE for accurate, up-to-date answers about the web platform.

No more outdated guesses from training data.

Learn more ���
https://t.co/yMeR7tVwkM

[ThePrimeagen @ThePrimeagen]

I think one thing that is understated is that the hard parts can feel harder with more delegation.

Not only are you attempting to solve hard architectural ideas, you also are constantly solving it in a project in which you don't have the same deep familiarity that we did say a couple years ago.

It's like you're always on your first day, but you're given the task of refactoring the universe.

At least that's something I have noticed that makes me feel a bit angsty

[Spencer Baggins @bigaiguy]

A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name.

He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping.

His name is Fabrice Bellard.

Here is the story, because almost nobody outside the systems programming world knows what one man has built.

Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code.

In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years.

Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it.

He was not done.

In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth.

He kept going.

In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real.

In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark.

Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory.

Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org

He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links.

A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet.

He is still shipping.

[Shubham Saboo @Saboo_Shubham_]

https://t.co/w7v8Vq1JNN

[Matthew Prince 🌥 @eastdakota]

Welp, that happened faster than I predicted. Thought it would be end of 2027, then early 2027, but agentic traffic growing so fast that bots have now passed human traffic online for the first time in the Internet's history. https://t.co/2zX5bHdhsa

[Cloudflare @Cloudflare]

VoidZero, the team behind Vite, Vitest, Rolldown, Oxc, and Vite+, is joining Cloudflare. Vite stays open source, vendor-agnostic, and built for everyone. https://t.co/DJTpX4Q9Xt

[André @oracles]

Today Instagram had this massive exploit where hackers were just stealing rare handles left and right. Hundreds of accounts gone.

People losing handles they’ve owned since 2010, some worth hundreds of thousands.

I own a few rare ones so I was actually stressed watching this happen in real time, which I haven’t been in years.

Obama White House account got hit.

These aren’t some random new accounts, these are verified, locked down accounts and they still got compromised.

The thing is the exploit is so simple it’s almost funny. Attacker goes to Forgot Password, says their account is hacked, turns on a VPN to match the target’s location (which now you can find on the about section of the page).

Instagram’s AI support flow asks them to verify with a selfie.

They grab a photo from the target’s profile, run it through an AI video generator to make an animation of the person’s face moving around, upload that to Meta’s AI as proof.

And Meta’s AI just accepts it because it can’t tell the difference between a real selfie and an AI-generated video of someone’s face
.
Once verified they change the email to theirs. Password reset link goes to their email. They own it now. 2FA gets bypassed somehow in the process but honestly I don’t know exactly how, just that it did.

Point is even locked down accounts went down.

Then you try to recover your account and you’re talking to a chatbot that has zero ability to help.

You can’t escalate to a human. You’re just stuck. Your asset is gone and there’s no one to call.

The whole thing just highlighted how stupid it is to automate account security without any human in the loop.

One AI fooling another AI while there’s literally no person anywhere to catch it.

Meta took hours to even acknowledge it while accounts were getting stolen every minute.

Now thankfully it’s patched but I don’t think it will be the last one. Stay safe!

[Karri Saarinen @karrisaarinen]

The fallacy of this is that more creates more. More hours, more hiring, more something.

And it is true in a sense. If you put in more work, more work will happen. But I think for most startups, the leverage is really in how differently you approach the problem, how well you cultivate your team, and the strategy.

Any large company can outspend you on hours. They have thousands or tens of thousands more people, spending more hours. If hours worked were the metric, every large company and government organization would always win and do the best work. More hours, better output.

This thinking is often representative of younger founders, where the startup becomes their identity and life. They have a hard time doing anything else, and cannot understand that your work is not the person that is you. But activities outside of work can grow you as a person too and make you do better work.

I’ve never worked this way. As a designer, I always saw the need to take a step back, to take a break. At times, I might work 12 hours or 16 hours, or whatever amount was needed, but it wasn’t the norm. You just can't grind design, you need inspiration. But taking that step away from the work, would give me more perspective, inspiration and I could approach the problem differently or I could just see the solution.

Grinding is never good for any creative problem, and startups or creating new products are often mostly about creative problem solving. Grinding works ok for email jobs, or where you just executing on very clear playbook.

With Linear, we’ve never worked this way. We work reasonable hours, 5 days a week. All of us founders have families. Many of our employees have families. I personally stop every evening, spend time with the family, cook dinner for the family, eat dinner together, and focus on things outside of work. Sometimes I work in the late evenings or weekends, but to me the pride is that I don’t need to. Company should be succesful without it.

My goal is to build a company that is sustainable in the long term, and doesn’t require heroics or personal sacrifices every single day.

There are times when our team is heroic. Launches, incidents, some other work that just needs to be done. They will work late into the night because they know it is the right thing. But we don’t require that every day or every week, and the more this happens, the more I think it is a failure of our company and leadership. The team and the leaders should always keep a reserve to use when something is needed.

Our thinking was also that quality, which we value, doesn’t emerge from working more or stressing people more. It emerges when you create the conditions for it to emerge. Often it is the appreciation, space, time, and how the person feels. A person who is rested will do better work.

I wouldn’t attribute much of our success to working a lot. The success came from having clear thinking, ideas, and focus to do the right things.

I sometimes wish we could move the culture more toward a Zen master.

Real mastery is not exerting the most effort. It is achieving the outcome with the least necessary effort.

[Armin Ronacher ⇌ @mitsuhiko]

This is such a good post. https://t.co/IdmAnh18Nt

[Rehan Jayawickreme @RehanJayawick]

The Presidential Secretariat has now confirmed that over Rs. 6.1 BILLION and USD 11.4 MILLION flowed into the “Rebuilding Sri Lanka” Fund.

Yet when asked for donor lists, disbursements, recipients, procurement details, contractors, and monitoring reports, the answer was essentially: “not available.”

Even more astonishingly, they claim there are NO audit reports.

The NPP Government has now proved they are no better than the rest. What in God’s name happened to this money? Was it used for party related activities, or are they planning to use it for future elections?

I am filing an appeal immediately with the relevant officer and will not hesitate to take this matter to court.

Sri Lankans deserve to know where every rupee went.

#lka
#DM
#democraticmovement

[Yudhanjaya Wijeratne @yudhanjaya]

Genuinely insane. Not only do we need to separate the temple from state and crack down on pedophile monks; the police officers that tried to cover this up should be fired - preferably from a canon, into the Sun.

[Lee Robinson @leerob]

Code is actually the right abstraction.

Too often I see the future of software engineering diminished down to, effectively, writing and reviewing markdown files.

Yes, it will be hard to review thousands of lines of agent code. But maybe the takeaway is that you want less code?

Rather than just giving up ("well I guess we won't read the code, or we'll read this lossy markdown summary") this should be a signal forcing you to think about better systems.

- How can we make our codebase more verifiable? For example, fast/robust/stable tests, or moving to a typed language.

- How can we deslop or improve the architecture/abstractions of the code generated by agents? For example, spending more time up front on the codebase architecture/types before yolo generating all of the code.

- How are we going to maintain and evolve this codebase over time? The slop compounds. One great solution here is... you guessed it, learning from the past decades of software engineering! For example, you might just have the wrong abstraction entirely, leading to a ton of duplicated code.

I think the markdown folks *are* right in some ways. If you are using skills every day, for many different prompts and workflows, isn't that effectively "coding with markdown"? Kinda.

There's been plenty of ink spilled on the merits and benefits of skills. To me, skills make your style of working legible for agents. They don't replace code and that's not really the point.

In reality, there's this messy and constantly re-evolving future in which both of these things are true:

1. Skills (and markdown) are important for how you give input to the agents and ensure high-quality code & systems are created
2. Looking at the actual code will not be replaced by markdown summaries or a collection of spec documents that ignore the lower level details of the code

In summary: reality has a surprising amount of detail (and nuance)!

[International Cyber Digest @IntCyberDigest]

🚨 How the TanStack npm attack actually happened:

1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

[Aikido @AikidoSecurity]

Update 5:05 PT: The attack has now expanded well beyond @TanStack and @Mistral.

373 malicious package-version entries across 169 npm package names, including @uipath, @squawk, @tallyui, @beproduct, and more.

The malware propagates by stealing your CI credentials and using them to publish new compromised versions.

Full IOCs, affected package list, and detection steps: https://t.co/jWG9DUCu3x