Patrick Dung

🔮Quest to Cloud Native computing ☁⚓☸
and likes and follow do not mean endorsement. Opinions are my own

[Patrick Dung @mpatdung]

Here's my new article about ClickHouse and #OpenTelemetry for saving storage
Migrating logs stored in #OpenSearch to #ClickHouse and enable #OTel support

https://t.co/U4cwXAvE0c

#vector.dev #syslog

[Kestra @kestra_io]

We ship Kestra every Tuesday using Kestra. Roman shares the flow that coordinates four parallel releases and why GitHub Actions alone wasn't the right tool for it: https://t.co/T4sAsxCkSz

[RisingWave @RisingWaveLabs]

RisingWave's migration from C++ to Rust meant deleting 276,406 lines of code.
7 months of development were discarded.
The team started over from scratch.

Most companies don't do that.
RisingWave did.

When building a cloud-native streaming database, our team realized that the biggest challenge wasn't query performance.

It was:
memory safety
concurrency complexity
developer productivity
maintaining a fast-growing codebase

That's why RisingWave made a radical decision:
migrate from C++ to Rust.

But the real shift was not:
"rewriting the codebase."

The real shift was:
memory-safe systems programming + developer-friendly architecture.

Because the biggest cost is not CPU cycles.

It is:
segmentation faults
data races
debugging complexity
engineering velocity lost to infra bugs

That's why modern infra teams increasingly value:
compile-time safety
zero-cost abstractions
fearless concurrency
predictable performance
large-scale collaboration

RisingWave's migration from C++ to Rust is a great example of this architectural direction.

The future of modern infra is:
memory-safe
concurrent-by-design
performance-first
developer-friendly

Rust is the systems language!

[Endor Labs @EndorLabs]

🚨 We've flagged npm/[email protected] as potentially malicious. It uses an obfuscated 4.5MB payload and multiple major and minor versions were backfilled with the malicious payload within minutes.

More details to follow as we investigate.

[Cyber Security News @The_Cyber_News]

⚠️Five OpenClaw 0-Days let Attackers to Hijack Trusted AI Agent Access

Source: https://t.co/2a2EwBz82h

Five zero-day flaws in OpenClaw allowed attackers to bypass trust boundaries and hijack AI agent access across multiple messaging platforms. OpenClaw, which integrates AI agents with services such as Slack, Discord, Microsoft Teams, Matrix, and Telegram, relies heavily on user-defined allowlists to determine who can interact with an agent.

This trust model assumes that only explicitly approved identities can issue commands to agents that may have access to sensitive data, internal APIs, or system-level execution capabilities. The vulnerabilities stem from a recurring design flaw in which human-readable identifiers, such as display names, are resolved to stable user IDs during service initialization.

#cybersecuritynews

[CR1337 @CR1337]

Meta workers can now opt out of their keystrokes and mouse clicks being tracked at work.

But just for up to 30 min.

[The Hacker News @TheHackersNews]

🚨 WARNING — New HTTP/2 Bomb exploit targets NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.

A single client can consume 32GB of server memory in roughly 20 seconds, causing remote DoS conditions.

Details here: https://t.co/58xDxAKRcZ

[Patrick Dung @mpatdung]

@ClickHouseDB Congratulations about the join improvements in the two recent years. Amazing.

[ClickHouse @ClickHouseDB]

Yesterday we showed the result.

Today we show the engineering behind it.

ClickHouse is 26× faster on TPC-H SF100 after two years of focused join work:
• correlated subqueries
• runtime filters
• lazy column replication
• statistics-based join reordering

https://t.co/ZWC7Dgu3FB

[Polymarket @Polymarket]

NEW: Uber is reportedly capping employee use of AI vibe-coding tools at $1,500 per month after blowing through its AI budget.

[Chainguard ⛓️ @chainguard_dev]

Over the past 6 days, a threat actor compromised four npm accounts (mr.4nd3r50n, pik-libs, t-in-one, emcd-vue), publishing 180+ malicious npm packages targeting financial and cloud infrastructure. Chainguard customers were not affected.

Get the details: https://t.co/3ekt4X3nrQ

[ClickHouse @ClickHouseDB]

May 2024: “From now on, you will see JOIN improvements in every ClickHouse release.” — Alexey Milovidov

May 2026: ClickHouse is 26× faster on TPC-H SF100. Cloud ranks #1 on cost-performance vs Snowflake, Databricks, BigQuery, and Redshift.

SF10: 2.9s, $0.009. Christmas is saved.

https://t.co/LammIUeg1h

[The Hacker News @TheHackersNews]

🚨 A legitimate-looking npm package for OpenAI Codex has been stealing developer auth tokens for over a month.

codexui-android, marketed as a remote web UI, has seen 29,000+ weekly downloads. Since version 0.1.82 it quietly sends ~/.codex/auth.json — including non-expiring refresh tokens — to an attacker server.

Read: https://t.co/rC2QYxflIG

[Jason Koebler @jason_koebler]

New: Hackers have been stealing high-profile Instagram accounts by simply asking Meta's AI support chatbot to change the email associated with the account they want to steal.

Shockingly easy, terrible flaw associated with offloading support to AI:

https://t.co/PvRm8u0MV7

[Bearly AI @bearlyai]

In 2009, Charlie Rose asked Jensen Huang about Nvidia vs. Intel.

The chipmakers weren’t directly competing but Jensen said GPU vs. CPU was a “battle for the soul” of computing and GPUs would be “more relevant” in time.

Intel was worth $100B and Nvidia was at $4B. Today, Intel is at $565B while Nvidia is worth over 1,200x more at $5 trillion.

[StepSecurity @step_security]

🚨 Breaking: 31 npm packages from @RedHat have been compromised.

100,000+ weekly downloads affected. The upstream CI/CD pipeline was compromised, with all packages published via GitHub Actions OIDC.

The payload:
⚠️ Reads GitHub Actions runner process memory to extract masked secrets
⚠️ Sweeps credentials across AWS, GCP, Azure, K8s, Vault, and npm
⚠️ Self-propagating worm that republishes backdoored packages using stolen npm tokens, bypassing 2FA
⚠️ Persists on dev machines via Claude Code settings hijack and VS Code task injection
⚠️ Exfiltrates data through GitHub API commits, blending in with normal git operations

We have responsibly disclosed the incident to the maintainers.

Full technical analysis: https://t.co/63nZYH1cMO

[Moshe Siman Tov Bustan @MosheTov]

The @redhat-cloud-services compromise appears to be another copycat malware of Shai-Hulud, a new variant after earlier this month they open sourced their Mini Shai-Hulud malware in GitHub.

Over ~280 repositories with stolen credentials, 116,282 weekly downloads, and https://t.co/pc2jflovHp as a decoy C2 server, while actually uploading stolen credentials only to GitHub.

You can read our full analysis here:
https://t.co/pEzdXLGYLR

[JFrog Security @JFrogSecurity]

🚨 Security Alert: Multiple Red Hat Cloud Services npm packages have been compromised in a new supply chain incident (@​redhat-cloud-services)

The embedded malware executes silently upon installation, targeting local environments to harvest sensitive CI/CD secrets and cloud access tokens.
We will share our full technical analysis blog post soon. Stay tuned. 🛡️

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…

[Mitchell Hashimoto @mitchellh]

I've got an agent in a loop optimizing a renderer with the goal to minimize frame times (and tests to measure). It got times down from 88ms to 2ms and allocations down from ~150K to 500. Sounds good, right? Wrong. This is exactly why agent psychosis is a big fucking problem.

As an experiment, I rewrote the Ghostty core render state in Go, with access to identically laid out data structures as Ghostty and the exact same validation tests. I made a purposely naive renderer (simple, correct, but slow). 88ms per frame with 150,000 allocations (horrendous, lol)!

I then kickstarted a Ralph loop to bring the frame times down. I told it it can't modify input data structures or the public API or tests (they're correct), but it can do anything else it wants. It got to work.

It has worked for about 4 hours. I've spent around $350 on this experiment so far. The results?

88ms => 1.5ms
150K allocs => ~500 allocs

Incredible right? Nope.

My hand-written renderer I ported has frame times (same benchmark) of ~20us (0.020ms) and 0 allocations in the update path.

This is the problem with psychosis and lacking systems understanding. If you don't understand the system, you're going to accept that this is an incredible result. If you understand the system, you'll see better solutions immediately and can do roughly 75x better on throughput.

The people who blindly trust agent output are in the former camp. They're sheeple, overdrinking from a fountain of mediocrity.

Standard disclaimer: I use AI all the time. I like AI. The point I'm making is to not blindly accept results. Think. Analyze. Learn.