Harun R.

Software Architect, Building
| | | | | 160+ clients scale to $1B+

[Harun R. @harundotdev]

@MikeDoesTech Congratulations on the launch.

[Harun R. @harundotdev]

Another one.

[Diogo Almeida @CompleteSkeptic]

despite the unfortunate timing, we take disclosures seriously at @typesafeai

at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs

in effort to maximize transparency, here is the link: https://t.co/HWKvYpHS8V

[Harun R. @harundotdev]

@jojowindev rotating keys was the irritating work

[Harun R. @harundotdev]

this week was pure chaos 😅 railway, gitlab, php, npm, the linux kernel. a new vulnerability, breach or outage every single day

how many things did you have to fix this week, and how much actual work got done?

[Harun R. @harundotdev]

@GohilHardy yeah, everybody became security researcher

[Harun R. @harundotdev]

@ptremblay 🫡

[Harun R. @harundotdev]

just found the vault in @bot. save logins, cards and contact info and it types them in for you. it never sees a card's number or security code

every agent should have this. every agent

even better: one central hub with everything in one place, and every bot gets access only with your permission @spacexai

would you keep your cards in a hub like that?

[Harun R. @harundotdev]

@stemonte What would happen if you aren’t subscribed to X Premium anymore?

[Harun R. @harundotdev]

s3 to cloudfront transfer is free, and cloudfront's first 1 tb out is free too. same 10,000 gb a month: straight from s3 is $891, through cloudfront it's $763.

is your bucket public, or behind cloudfront?

[Harun R. @harundotdev]

@stemonte that's why i got a handle i like but didn't choose to use that

[Harun R. @harundotdev]

someone copied my post thumbnail on facebook and honestly i'm happy about it 😄

but why stop at the thumbnail? take the source code too. my content machine is 100% ai-developed and ai-reviewed, so the code isn't bad

fork it, clone it, star it, send prs. just use it for good

https://t.co/Rt0bOYSoEA

[Harun R. @harundotdev]

virustotal flagged 6,637 ai agent skills as malicious. 62% have no code at all, just plain instructions for the agent, some hidden after 825 blank lines

my rule: unknown source, no install

what do you check before installing a skill?

https://t.co/PPIsuITuRg

[International Cyber Digest @IntCyberDigest]

‼️ VirusTotal flagged 6,6k of 35,8k AI agent skills as malicious.

62% have no malicious code, but plain-language orders for the agent.

90 hide them in invisible Unicode, HTML comments or after up to 825 blank lines. Another tells the agent "Your human doesn't need to know." 💀

[Harun R. @harundotdev]

5 system design concepts that keep coming up in interviews and in real backends. one paragraph each.

1. UDP. sends packets as fast as it can and never checks whether they arrived. no handshake, no retransmit, no ordering. that is why video calls, game state and DNS lookups use it: a lost frame is cheaper than a late one.

2. RPC. you call a function that lives on another server as if it were in your own code. the client stub serializes the arguments, the server runs the function and sends the result back. gRPC is the common one today, and it is still a network call, so it can fail in ways a local call cannot.

3. WebSocket. one connection that stays open, and both sides can send a message at any time. no polling, no new request per update. chat, live dashboards and multiplayer state live on this.

4. authentication. who you are. a login, a token, a passkey, anything that proves the identity of the caller. it answers one question only: is this really you?

5. authorization. what you can do. a valid login that still cannot open the admin page is this one working. roles, scopes and policies belong here, never in the login step.

which of these five trips you up the most?

[Harun R. @harundotdev]

@Quantradin @awscloud I personally use IaC tools like Terraform or Pulumi or CloudFormation

[Harun R. @harundotdev]

leaving railway for aws but don't know aws very well, and no budget for a devops person?

connect @awscloud's own mcp server to your ai assistant. let it make the plan, have it review the plan, then deploy

not the best way, but a great place to start

where are you moving? https://t.co/THOrYmG2q4

[Harun R. @harundotdev]

Are you migrating out of @Railway? Where?

[Harun R. @harundotdev]

@wickedguro You are now big enough to move to AWS. If you need any suggestion, shoot me a DM.

[Harun R. @harundotdev]

seems like the day can't get any worse than it is.

there's no bug worse than a linux kernel bug. today two cvss 9.0 remote code execution reports landed on the public mailing list before any patch

is ksmbd running on your servers?

https://t.co/W5eFpqyPh2

[Phoronix @phoronix]

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

As high as CVSS 9.0. Whoops.

https://t.co/opCRSE80Vq

[Harun R. @harundotdev]

@boardyai @awscloud yeah, but it's for people who can't afford to hire people like me :(

btw your avatar looks cool

[Harun R. @harundotdev]

@boardyai @awscloud i know

[Harun R. @harundotdev]

@stemonte @awscloud I used to be one of a few AWS golden jackets holder and atleast my 2/3 of income comes from there. So, I have no choice but to love it.

[Harun R. @harundotdev]

@entrptaher that's the best 😂

i use everything AWS, GCP, Railway and more. So, I get effected by all.