Fernando Rodriguez Olivera

Software Engineer | Distributed Systems, Data Infrastructure & Performance | Professor | Creator of

[MotherDuck @motherduck]

Your Obsidian vault can now run SQL.

We built a DuckDB + MotherDuck plugin: write a SQL block in a note, run it, freeze the result as a plain markdown table. Local files, cloud tables, or both joined in one query.

DuckDB runs in WASM, works on mobile too.
https://t.co/sEhajBDind

[Nicolas Bustamante @nicbstme]

The big story here is that GPT 5.5 (high/xhigh) outperforms claude-opus-4.8 (max/xhigh) by 20.7% succeeding on 12 additional tasks!

More impressive: GPT is roughly half the cost and twice as fast.

OpenAI is back in the game. Overall, this competition is healthy for the industry. I'd love to see a third player rise to the top of the leaderboard!

[StepSecurity @step_security]

🚨 Breaking: 31 npm packages from @RedHat have been compromised.

100,000+ weekly downloads affected. The upstream CI/CD pipeline was compromised, with all packages published via GitHub Actions OIDC.

The payload:
⚠️ Reads GitHub Actions runner process memory to extract masked secrets
⚠️ Sweeps credentials across AWS, GCP, Azure, K8s, Vault, and npm
⚠️ Self-propagating worm that republishes backdoored packages using stolen npm tokens, bypassing 2FA
⚠️ Persists on dev machines via Claude Code settings hijack and VS Code task injection
⚠️ Exfiltrates data through GitHub API commits, blending in with normal git operations

We have responsibly disclosed the incident to the maintainers.

Full technical analysis: https://t.co/63nZYH1cMO

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…

[AWS Open Source @AWSOpen]

🚀 Just launched: ExtendDB — an open source DynamoDB-compatible adapter written in Rust.

✅ Full wire-protocol compatibility ✅ PostgreSQL storage backend ✅ Pluggable architecture for more backends ✅ Works with existing AWS SDKs & CLI

Apache 2.0 | v0.1 — come build with us 🛠️

https://t.co/U6xouvSRwX

[Socket @SocketSecurity]

UPDATE: So far we've identified 639 compromised npm package versions across 323 unique packages in tonight’s Mini Shai-Hulud wave.

That includes 558 versions across 279 unique @​antv packages. Most were detected within ~6 minutes of publication.

https://t.co/JXJK1NT4dp

[Nebula Security @nebusecurity]

Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0.

nginx-rift has been patched, but our security agent Vega has found a new 0 day.

We will release the full technical writeup with ASLR bypass 30 days after the patch on https://t.co/LAhOC5UHrp.

[Andrej Karpathy @karpathy]

Personal update: I've joined Anthropic. I think the next few years at the frontier of LLMs will be especially formative. I am very excited to join the team here and get back to R&D. I remain deeply passionate about education and plan to resume my work on it in time.

[kache @yacineMTB]

Claude Code detects whether you're accessing it over SSH, and severely throttles your tokens. They are doing this to combat people who are prompting too much. They want you to use their product on a macbook only, using a signed claude code distribution

[Mitchell Hashimoto @mitchellh]

I strongly believe there are entire companies right now under heavy AI psychosis and its impossible to have rational conversations about it with them. I can't name any specific people because they include personal friends I deeply respect, but I worry about how this plays out.

I lived through the great MTBF vs MTTR (mean-time-between-failure vs. mean-time-to-recovery) reckoning of infrastructure during the transition to cloud and cloud automation. All those arguments are rearing their ugly heads again but now its... the whole software development industry (maybe the whole world, really).

It's frightening, because the psychosis folks operate under an almost absolute "MTTR is all you need" mentality: "its fine to ship bugs because the agents will fix them so quickly and at a scale humans can't do!" We learned in infrastructure that MTTR is great but you can't yeet resilient systems entirely.

The main issue is I don't even know how to bring this up to people I know personally, because bringing this topic up leads to immediately dismissals like "no no, it has full test coverage" or "bug reports are going down" or something, which just don't paint the whole picture.

We already learned this lesson once in infrastructure: you can automate yourself into a very resilient catastrophe machine. Systems can appear healthy by local metrics while globally becoming incomprehensible. Bug reports can go down while latent risk explodes. Test coverage can rise while semantic understanding falls. Changes happens so fast that nobody notices the underlying architecture decaying.

I worry.

[Chubby♨️ @kimmonismus]

Until recently, layoffs could still be attributed to overhiring. Now it should be clear that layoffs in the tech sector have other causes.

[SpaceX @SpaceX]

SpaceXAI and @cursor_ai are now working closely together to create the world’s best coding and knowledge work AI.

The combination of Cursor’s leading product and distribution to expert software engineers with SpaceX’s million H100 equivalent Colossus training supercomputer will allow us to build the world’s most useful models.

Cursor has also given SpaceX the right to acquire Cursor later this year for $60 billion or pay $10 billion for our work together.

[BuBBliK @k1rallik]

VERCEL GOT HACKED

ShinyHunters - the group behind the Ticketmaster breach - is selling Vercel's internal database for $2M on BreachForums

here's why every developer should care:

- they have NPM tokens and GitHub tokens
- Vercel owns Next.js - 6 million weekly downloads
- one malicious push = global supply chain attack
- Vercel confirmed the breach today, April 19
- they literally DMed the hackers on Telegram asking them to stop

rotate your env variables RIGHT NOW

[Pato Molina @patomolina]

@claudeai you took down our entire organization with 60+ accounts belonging to a legitimate company for no apparent reason, without any explanations. The only way to appeal the decision is by filling out a Google Form? Very bad UX and customer service.

[Dawid Moczadlo @kannthu1]

I will say it again, we used GPT5.4 and Opus, and we were able to autonomously find zero-days in the Linux Kernel (in the last 3 weeks)

Mythos is probably better at the task of finding potential issues in code, but imo the threshold for "scary" was reached in December or even earlier

This is a great hype machine for Anthropic, especially that they plan to do IPO eoy

I totally agree - this is not a new capability

[awksedgreep @awksedgreep]

Elixir concurrency rule of thumb:

Pass messages

[“paula” @paularambles]

we accidentally created a time capsule of the last era in which humans wrote code

[flavio @flaviocopes]

How Axios was compromised 🤯

[Wes Bos @wesbos]

HEADS UP. Popular JSON formatter extension has started injecting geolocation tracking and donation UI into websites

Reddit thread seems to think they are also swapping tracking IDs for affiliates (a-la honey)

Uninstall and switch to another one

[Max the VC 👨‍🚀 @mreiffy]

Google is basically saying:

“We’ve cut the quantum resources needed to break Bitcoin’s encryption by 20x. We can now break it. We can prove it. We’re just not going to tell you how.

We’ve slowed down research to give crypto a chance. You have until 2029 to figure out a solution. Good luck.”