Kamaro

Dad. Husband. Partner at Velocity Software Ltd

[Kamaro @kamaroly]

🚀 Just released the discounted early edition of my book “@AshFramework for Phoenix Developers”!

Grab it now 👉 https://t.co/6n7INHNjW6 🔥

Buy early & get:
✨ LIFETIME updates, FREE
💬 Direct, personal answers to ALL your questions

Level up your Ash and Phoenix skills today!

[Kamaro @kamaroly]

@nosyeaj @AshFramework Hi @nosyeaj,

Thank you for the purchase. Yes. It will be 100% by mid July.

[Kamaro @kamaroly]

🚀 Just released the discounted early edition of my book “@AshFramework for Phoenix Developers”!

Grab it now 👉 https://t.co/6n7INHNjW6 🔥

Buy early & get:
✨ LIFETIME updates, FREE
💬 Direct, personal answers to ALL your questions

Level up your Ash and Phoenix skills today!

[Path Robotics @PathRobotics]

Rebuilding the fleet isn't a shipyard problem. It's a manufacturing problem.

We'll be at the @AmDefAlliance's Navy & Marine Corps Procurement Conference in Norfolk this week to talk about what autonomous welding actually looks like in a shipbuilding operation.

Find the @PathRobotics team. We'd love to talk.

[Zach Daniel @ZachSDaniel1]

Announcing: AshAuthenticationOuath2Server!

What a mouthful 😂. If you've ever wanted to allow other tools to "log in with your app" the way that you "log in with google", this package helps you do it! Continuing to expand on the OOTB capabilities of #AshFramework 😎.

This also allows you to easily build an authenticated MCP server with AshAI! MCP requires you to have an oauth2 server in order to authenticate users.

[Kamaro @kamaroly]

@mmmykolas Glad to hear that datastar solves your problem and that LiveView hasn't been abandoned.

[Kamaro @kamaroly]

@mmmykolas New projects such as LiveStash and LiveSvelte address some, if not all, of the form issues you mentioned. The fact that it may not solve every problem doesn’t mean it is abandoned.

https://t.co/JUO770Ytvp

[Kamaro @kamaroly]

“The willingness to be prepared is more important than the desire to win.”

– Charlie Munger.

[X Freeze @XFreeze]

Elon Musk: "If you punish people too much for failure, then they will respond accordingly, and the innovation you will get will be very incrementalist

Nobody's gonna try anything bold for fear of getting fired or being punished in some way. So risk-reward must be balanced and favor taking bold moves, otherwise it will not happen"

[Velocity Software Limited @VSLKenya]

Excited to be part of the global banking community at Temenos Community Forum (TCF) 2026 in Copenhagen 🇩🇰.

Representing Velocity Software Limited will be our Managing Partner, William Aluku, engaging in forward-looking conversations on the future of fintech and banking.

[Shane Parrish @shaneparrish]

"The poor boy has an immense advantage over the son of the rich man, for he is prepared to do what the rich man's son is rarely willing to do, that is, to plunge in with his hands and learn a business from the bottom!

...

There is too much at steak in these great, complicated enterprises to trust their active management to mere theorists. They have got to have men at the head who know the business from the ground up. Knowledge and ability are the tests."

- John D. Rockefeller

[Zach Daniel @ZachSDaniel1]

New package for #AshFramework: AshScim! #ElixiLang going enterprise y'all.😂

SCIM (System for Cross-domain Identity Management: RFCs 7643 & 7644) is the standard way for an identity provider like #Okta or Azure AD to push users and groups into your application: who joined, who got deactivated, who got added to which group. It's how enterprises expect to manage access at scale, and it's almost always a hard requirement for selling into them.

Many indie-hackers won't get the value of push-button SCIM integration, but if you've ever built for enterprise, this kind of thing being easy is drool-inducing.

Just `mix igniter.install ash_scim` (once the installer is done and it is published on hex) and you're SCIM enabled 💣.

It works with Ash's multitenancy out of the box, so if you want to let your customers in a multi-tenant application configure their own IdP, nothing stops you.

Still need to battle-test for a while and get it security-reviewed before publishing on Hex, but you're welcome to poke around/experiment until then.

RFCs:
https://t.co/inS2yWSTFU
https://t.co/88qxl5XYr0

GitHub:
https://t.co/K1KZpUNrZC

[Brad Smith @BradSmi]

Today we’re introducing a new Legal Agent in @Microsoft Word, built to support the precision and rigor legal work demands. Every clause matters. Every redline tells a story. That’s why this agent was built to follow the structured workflows lawyers use while keeping them fully in control.

Early in my career, I asked for a computer on my desk because I believed technology could change how lawyers work. It did. Today, I believe this next generation of tools will do the same, grounded in trust and responsible use.

[Shane Parrish @shaneparrish]

John D. Rockefeller is so savage:

"Those men who raised the hue and cry against me after we had succeeded, were incensed over their own lack of judgment and foresight. They could not forgive me because they failed to have faith in me. They heaped abuse because I was more far-sighted than they."

[Justin Skycak @justinskycak]

The cost of avoiding structure is that every day has to be renegotiated from scratch.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[Kamaro @kamaroly]

What Managerial Economics can tell us about AI and Software Development.

https://t.co/dBNT28ZKhd

By @germsvel

#elixir

[Kamaro @kamaroly]

@kennedy_odh @AshFramework Data driven development. It is like code-as-configuration all the way to production.

[ROGUEWEALTH 🏴‍☠️ @roguewealth]

Watching @ZachSDaniel1 building stuff for looper almost in real time makes me think I really need to hop on the @AshFramework bandwagon.

[Kennedy Odhiambo @kennedy_odh]

@AshFramework hits different when it clicks,feels like a whole new way of thinking about your app.

[Dr. Christian Geuer-Pollmann @chgeuer]

First time @ZachSDaniel1 signs the @AshFramework book for somebody who’s not his parents 😍. Achievement unlocked #ElixirConf