liam

Building @withevideo | not building twitter following

[liam @liamcode]

Vancouver mentioned

[Hunter Biden @HunterBiden]

@delicatebliss I love Canada. I especially love Vancouver.

[liam @liamcode]

My favourite Canadian startup continues to rewrite the rule book. Highly profitable DB startup, based in Ottawa, founder not posting AI psychosis grind slop, etc etc.

[Simon Eskildsen @Sirupsen]

turbopuffer crossed $100M run-rate in March. 19mo after $1M. Profitable & <$1M raised.

Cursor・Anthropic・Notion・Cognition・Harvey・Bridgewater・Ramp・Linear・Legora・Superhuman・Atlassian・Granola

We’d be nowhere without them. We work like hell to exceed their expectations.

[liam @liamcode]

@thsottiaux Allow setting default branches, it’s annoying that most PR and branch and worktree functionality doesn’t work when you don’t use main branch. In my case, it’s always against staging, yet worktrees open against main, prs open automatically against main, etc.

[liam @liamcode]

@RhysSullivan So annoying to change the branch to staging every time

[liam @liamcode]

@thsottiaux Every time I create a worktree I have to change branch to staging, and I can’t use the Open PR button cause it auto opens against main branch. Would love if it detected the GitHub default branch, or had a way to set it. Small annoyance but still an annoyance!

[liam @liamcode]

Happy Key Rotating Sunday to those who celebrate

[Guillermo Rauch @rauchg]

Here's my update to the broader community about the ongoing incident investigation. I want to give you the rundown of the situation directly.

A Vercel employee got compromised via the breach of an AI platform customer called https://t.co/7PY6gGtzgI that he was using. The details are being fully investigated.

Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments.

Vercel stores all customer environment variables fully encrypted at rest. We have numerous defense-in-depth mechanisms to protect core systems and customer data. We do have a capability however to designate environment variables as “non-sensitive”. Unfortunately, the attacker got further access through their enumeration.

We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.

At the moment, we believe the number of customers with security impact to be quite limited. We’ve reached out with utmost priority to the ones we have concerns about. All of our focus right now is on investigation, communication to customers, enhancement of security measures, and sanitization of our environments. We’ve deployed extensive protection measures and monitoring. We’ve analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community.

The recommendation for all Vercel customers is to follow the Security Bulletin closely (https://t.co/BLVnic9fJC). My advice to everyone is to follow the best practices of security response: secret rotation, monitoring access to your Vercel environments and linked services, and ensuring the proper use of the sensitive env variables feature.

In response to this, and to aid in the improvement of all of our customers’ security postures, we’ve already rolled out new capabilities in the dashboard, including an overview page of environment variables, and a better user interface for sensitive env var creation and management. As always, I’m totally open to your feedback.

We’re working with elite cybersecurity firms, industry peers, and law enforcement. We’ve reached out to Context to assist in understanding the full scale of the incident, in an effort to protect other organizations and the broader internet. I also want to thank the Google Mandiant team for their active engagement and assistance.

It’s my mission to turn this attack into the most formidable security response imaginable. It’s always been a top priority for me. Vercel employs some of the most dedicated security researchers and security-minded engineers in the world. I commit to keeping you updated and rolling out extensive improvements and defenses so you, our customers and community, can have the peace of mind that Vercel always has your back.

[can @can]

your db query is slow? just add this! boom, now you are ai-native instead of lazy!

[liam @liamcode]

@leejooca I think Novus is hiring

https://t.co/6CzMGl91nh

[“paula” @paularambles]

“this is a significant refactor” just put the tokens in the bag lil bro

[Sam Hogan 🇺🇸 @samhogan]

I am the only person in my family that can write typescript. My parents couldn't and my children won't have to. All this knowledge will die with me. Like tears in rain.

[Vilhelms 🇨🇦🇱🇻 @venus4937]

Just got added to the Chongqing 2026 group chat

[liam @liamcode]

because I like Canada

[tobi lutke @tobi]

@TheBillykirk because I like Canada

[liam @liamcode]

This is a perfect example of how to motivate positive change. Every other take on this was inherently negative with regard to YC. Big fan of this and the outsized impact it will have.

[Jordi Hays @jordihays]

Rage Baiting is for Losers

Yesterday, YC announced Chad IDE aka “the brainrot code editor.” Chad is an AI code editor that allows you to gamble, watch TikTok, and use dating apps while working on coding tasks.

Their launch rightfully got a lot of attention. On one hand it’s funny. On the other hand, what are we doing here and why does this belong on the official YC account?

To understand Chad IDE, Cluely, Icon, Friend, and the new class of Gen Z startups, you have to understand the online environment these founders grew up in. If you grew up on the internet and studied how and why certain people would regularly go viral, you know that making people mad has and always will be a highly effective way to get attention. The feedback loop is simple: 1) make something (product or ad) that makes people angry; 2) people comment/ share/ dunk; 3) because feeds are optimized to show posts with high engagement the most, you get more reach.

Rage baiting for commercial purposes was pioneered by course bros. People like Tai Lopez realized that making the masses mad was an effective way to drive course sales. They could flaunt Lamborghinis, make a bunch of people angry, and as long as a handful of people found their way into their course, it was a viable, repeatable strategy.

Historically on X, rage baiting was a marketing strategy, not a product strategy. Accounts like @sweatystartup frequently post things to get an angry reaction and subsequent reach, but behind the scenes he's always been running a normal commercial real estate fund.

In 2025, rage baiting has become a product strategy. Cluely started as an app for cheating on coding interviews. Chad IDE’s only known differentiation from the other hundred AI native IDEs is that you can gamble and swipe on dating apps in it. The rage bait is sitting at the product level now.

It’s becoming clear that while rage bait might occasionally work as a marketing strategy, it really should not be employed as a product strategy. Running a successful VC-backed company requires you to build a coalition of people that want to see you win. Getting media, investors, talent, and customers on your side is not an easy task. Rage baiting (whether at the marketing level or product level) is the most effective way to get people (who could be potential investors, customers, or team members) to actively pray for your downfall.

YC has long provided some of the most durable, high quality, generalizable advice for startups and I believe it has had a tremendously positive impact on the companies that go through YC and even those that don’t. Launch now, make something people want, do things that don’t scale, ignore your competitors, etc.

As someone who believes that YC is one of the most important and influential institutions in tech, I believe it might be time to include this in their list of essential startup advice: “Rage baiting is for losers.”

[Simon Eskildsen @Sirupsen]

SF, this is what the true “great lock in” looks like

GDP season is upon us

[liam @liamcode]

Has @partykit_io been disabled? 504's when deploying, "This Worker does not exist on your account" when tailing, "WebSocket is closed before the connection is established" on existing deployment.

CC @threepointone (I'm happy to deploy to own CF account if that's the fix)

[liam @liamcode]

@BrandonWaselnuk The return of the king

[liam @liamcode]

@flydotio @mrkurt heads up

[liam @liamcode]

@flydotio @mrkurt @chris_mccord @senyeezus @benbjohnson @davissp14 @joao_lubien

[liam @liamcode]

@flydotio This feels like a scam, account hacked or is this legitimate @mrkurt

[liam @liamcode]

@BrandonWaselnuk Also banger

https://t.co/6SSt8WNvn5