@kaklabs

Software Engineer x Security Engineer. Personal: @kuntoaji

[Proton Mail @ProtonMail]

If you use Gmail, you need to read this.

Google’s AI, Gemini, can read your emails, attachments, bank statements, etc.

For many, this feature was switched on without consent.

Here's how to turn it off 🧵

1/

[Ihtesham Ali @ihtesham2005]

A Japanese programmer looked at every existing programming language in 1993, decided none of them made him happy, and spent two years building his own the language he built became the foundation GitHub, Shopify, Airbnb, and Coinbase were all built on.

His name is Yukihiro Matsumoto.

Everyone in the programming world calls him Matz. He was born in 1965, studied information science at the University of Tsukuba, and graduated in 1990 with a head full of ideas about what programming languages could be and a quiet frustration with what they actually were.

He knew Perl. He did not like it. He said it had the smell of a toy language. He knew Python. He did not like it either, because he felt its object-oriented features were add-ons bolted onto a language that was not designed around them from the start. He wanted something that was genuinely, completely object-oriented, easy to use, and built for the person writing the code rather than the machine running it.

He looked for that language. He could not find it.

So on February 24, 1993, he opened a chat window with his colleague Keiju Ishitsuka and typed: "Let us decide the codename now."

They wanted to name it after a gemstone, inspired by Perl. Ishitsuka suggested Coral. Matsumoto suggested Ruby. Ruby was shorter by one letter. Ruby won.

He spent the next two years building it alone, working through the architecture piece by piece. The object system. The string class. The IO streams. He later said he talked through specific features while speaking to his baby daughter, using her as a sounding board the way programmers use rubber ducks. In August 1993, he finally wrote the line of code that produced "Hello, world." on the screen.

The first public version, Ruby 0.95, was released to Japanese domestic newsgroups on December 21, 1995. No press release. No launch event. Just a quiet post to a mailing list.

The design principle underneath everything was the one nobody else had ever made primary. Matsumoto called it programmer happiness. He believed programming languages should be built for the joy and productivity of the person writing the code, not optimized purely for machine efficiency. Every decision in Ruby's design ran through that filter. If it made the programmer's life harder, it was wrong.

That philosophy attracted a small but devoted following in Japan through the late 1990s. Then in 2003, a Danish programmer named David Heinemeier Hansson discovered Ruby and used it to build an internal project management tool for his company. He called the tool Basecamp. He extracted the framework underneath it and released it publicly in 2004.

He called it Ruby on Rails.

Within a year of that release, the framework had changed how web applications were built. Rails introduced the principle of convention over configuration, meaning developers could make decisions about structure quickly because the framework had already made sensible defaults. What used to take weeks of setup took days. What used to take days took hours.

Shopify started on Rails in 2005. GitHub built on Rails a couple of years later. Airbnb, Twitch, Coinbase, SoundCloud, and Zendesk all followed. The first generation of consumer internet companies that defined how people think about software products were largely built by small teams moving fast on a framework that traced directly back to one Japanese programmer who was dissatisfied with his tools in 1993.

Shopify now processes over $200 billion in annual commerce volume. It still runs on Rails. GitHub became the largest code hosting platform on earth and was acquired by Microsoft for $7.5 billion in 2018. It started on Rails.

Matsumoto has said many times that he created Ruby for selfish reasons. He was so underwhelmed by every available option that he built something that would make himself happy. The programmer happiness he was chasing was his own.

The community that grew around Ruby adopted a motto that says everything about who he is. Matz is nice and so we are nice. They abbreviated it MINASWAN. It spread because it was true. He answered emails from strangers. He engaged with the community with patience. He treated the language as a gift, not a product.

He is still the chief designer of Ruby today. The language is 31 years old. It is still being improved.

The last stable release was Ruby 4.0.4, shipped on May 11, 2026.

One programmer, unhappy with his tools, built something better in the evenings in 1993. The companies you use to buy things, to store code, to book travel, and to watch streams were built on top of what he made.

He just wanted to be happy while he worked.

Did you know Ruby was behind the tools you use every day?

[MEGA @MEGAprivacy]

How attackers steal your account nowadays:
- Credential stuffing ❌
- Brute force attack ❌
- Just ask Meta AI nicely ✅

[@kaklabs @kaklabs]

LLMs don't find vulnerabilities, they find patterns that resemble vulnerabilities.

[@kaklabs @kaklabs]

I just attended DEF CON training: Harnessing LLMs for Application Security.

From this training, I learned a ton about LLM fundamentals such as inference, temperature, top-p/top-k sampling, prompt engineering, RAG, and agentic AI.

[@kaklabs @kaklabs]

This means:
* They predict what secure looking code resembles
* Common vulnerabilities-> often detected
* Well-known fixes -> often suggested
* Repeated code patterns -> higher confidence
* Business logic flaws -> frequently missed
* Authz/Authn edge cases -> inconsistent

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[@kaklabs @kaklabs]

@dhh You should try HHKB

[Florian Roth ⚡️ @cyb3rops]

This is bad.
Putty level bad.
https://t.co/3w1C8YiBu8

[Garry Tan @garrytan]

I think people are sleeping a bit on how much Ruby on Rails + Claude Code is a *crazy unlock* - I mean Rails was designed for people who love syntactic sugar, and LLMs are sugar fiends.

[@kaklabs @kaklabs]

I struggled to get my Apple Studio working on my Linux machine until @dhh share this: use a DisplayPort + USB-A to USB-C cable from WJESOG.

I tried HDMI + USB-A to USB-C cable version from WJESOG, it works flawlessly with my Linux

https://t.co/cgG7WuAEKg

[Have I Been Pwned @haveibeenpwned]

New scrape: Instagram allegedly had 17M rows of largely public data scraped from an API and posted to a hacking forum this week. 6.2M rows also included an email address, and some rows a phone number. 100% were already in @haveibeenpwned. Read more: https://t.co/VG5mTRF9xD

[Malwarebytes @Malwarebytes]

Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more.

[@kaklabs @kaklabs]

I’ve tried Ghostty, Kitty, Fish, and Starship as replacements for Oh My Zsh! (OMZ), Zsh, and iTerm2 over the past few months.

In the end, I settled on this stack: Ghostty (low memory usage), Zsh with OMZ (seamless, tons of plugins), and Starship (for customization).

[@kaklabs @kaklabs]

I did not expect this to happen to Samsung S25

[Elorm Daniel @elormkdaniel]

Hackers exploited Zero-click vulnerability in Samsung S25 Ultra under 1 min Pwn20wn 2025 hacking Contest and earned $100,000 💀

[@kaklabs @kaklabs]

Ghostty vs Kitty memory usage - empty terminal

[@kaklabs @kaklabs]

Came across this story from Google. Security and reliability can clash if not designed correctly.

https://t.co/fJzCNabBWO

[@kaklabs @kaklabs]

What I learn from AWS us-east-1 outage

[Yatish Mehta @yatish_me]

At a past company, the head of engineering and the principal engineers decided to break our Ruby on Rails application into a Go microservices mesh.

They created very detailed design documents and architecture diagrams. They went all out and used Kubernetes, gRPC, service templates, the whole shebang.

The whole senior engineering leadership came from Amazon, where they were used to each team owning a distinct service. They tried to apply that model directly. But our issues were with code ownership and poor domain modeling.

The entire application could have run on just a handful of EC2 instances.

What was the result?

Five years later, 70% of the application is still running on the Ruby on Rails monolith. Never completed the migration. But now they have to maintain two systems.

None of the original leadership works there anymore.