Alex Kolovsky

Lead Software Engineer. Security holes, production failures, and the postmortems nobody publishes.

[Alex Kolovsky @kolovskydev]

@S1r1u5_ The dork posts hunting unpatched instances are already up. Self-hosted is where patches go to die: the image gets built once and rebuilt never.

[Alex Kolovsky @kolovskydev]

@RyanCarniato @AnthropicAI Security has the same failure mode. Nobody argues with the default, so the default's vulnerabilities become everyone's vulnerabilities. Monoculture, now with an authoritative voice.

[Alex Kolovsky @kolovskydev]

@mmalisper @pgrustdb @JasonSeibel Deprioritize instead of kill is the right call. statement_timeout always kills the query someone actually needed. Does the throttle account for locks a long query might be holding?

[Alex Kolovsky @kolovskydev]

@steveruizok Is it servers skipping refresh tokens, or clients not storing them? Every-morning re-auth smells like access tokens expiring with no refresh flow behind them.

[Alex Kolovsky @kolovskydev]

@mmalisper @pgrustdb That answers it neatly. How fine is the task granularity? Does a big seq scan get chunked small enough that a short query never waits behind one task?

[Alex Kolovsky @kolovskydev]

@kettanaito Looking forward to it. If it ships a typed contract between main and renderer, that alone kills half the Electron boilerplate. The process lifecycle is the other half.

[Alex Kolovsky @kolovskydev]

Everyone is shipping agents into Slack, Teams, and iMessage this week. Almost nobody is shipping a permission model with them. Every chat message is now input to a system that can run tools. That's an attack surface, not a feature.

[Alex Kolovsky @kolovskydev]

@Dunqingg Property mangling always scares me around reflection and JSON round-trips. How does Oxc decide what's safe to rename?

[Alex Kolovsky @kolovskydev]

@SandroMaglione Live chart from the implementation is a nice trick. Does it diff against the prompted design, so you can see where the agent drifted?

[Alex Kolovsky @kolovskydev]

@RhysSullivan The approval flow point is the real gap. CLIs hand agents root-ish power with zero scoping. What would a portable primitive look like to you?

[Alex Kolovsky @kolovskydev]

@cramforce Does the chat layer normalize platform quirks like Slack threads vs iMessage's flat replies, or does the agent see raw per-platform events?

[Alex Kolovsky @kolovskydev]

@mholt6 fair — certs were just the visible case of the server managing itself. state is scarier to automate though: a bad cert renewal fails loud, a bad state migration fails quiet

[Alex Kolovsky @kolovskydev]

@jamonholmgren Separate unix user is the only one of those that actually stops the agent reading ~/.ssh and your browser profile. Nix pins deps, Docker isolates the fs, neither is that.

[Alex Kolovsky @kolovskydev]

@dhh @drewhouston Most of the best innovations are made by just enough obsession applied to an already invented thing. Keep pushing, @dhh!

[Alex Kolovsky @kolovskydev]

@GabbeV_ @RyanCarniato the clarity gap is the real complaint though. with signals you have to know which reads are tracked. does the solid devtools show that graph well enough in practice?

[Alex Kolovsky @kolovskydev]

@SandroMaglione interruption model is the right call. does the interrupt propagate to nested effects spawned inside the state's entry action too?

[Alex Kolovsky @kolovskydev]

@rauchg @jarredsumner @tomlienard good to hear. so the only thing that changes is cold start and the active cpu math, not runtime semantics. that's a much easier sell internally.