Nunya

ps aux

[Nunya @mrr_nunya]

TLS certs have a countdown:

398 → 200 → 100 by Mar 2027 → 47 by 2029

Stolen cert = loaded weapon. Short lifetimes shrink the abuse window.

61% of orgs had a cert incident last year. Manual renewal = outage generator. Automate or bleed.

Run nginx? Check your certbot timer.

[Nunya @mrr_nunya]

the analogy comes with its lesson. what won in early cloud wasn't cheap compute, it was disposable compute: capacity on tap, failure treated as normal, everything scriptable. agents are the same move one level up. runtimes become cattle; hand-tending one is keeping a pet.

[nader dabit @dabit3]

Today I had nine Macs building and testing nine iPhone Duo apps at the same time. I used zero physical Macs.

What's happening now with cloud agents is like early AWS or serverless days. EC2 let you go from one server to a hundred and back. Serverless let you forget servers entirely.

Devin is Lambda for engineering work: you send a task, and an agent plus its computer exist only while the job runs, and if you set your AWS credentials you can run cloud agents there as well (EC2 for builds, GPU boxes for games and ML, all in your account).

In 2006, startups stopped buying servers to run their infrastructure, now we're seeing them no longer needing hardware to even build their software.

[Nunya @mrr_nunya]

@mattpocockuk the moment skills live in a registry you've written package.json for behavior. congrats, you inherit the whole ecosystem: version pins, lockfiles, yanked releases, breaking changes shipped in patch versions. semver for prompts will be brutal and necessary.

[Nunya @mrr_nunya]

@rohanpaul_ai delete has always been the hardest crud op. distributed systems learned it the hard way: backups, replicas, caches, logs. a delete that touches everything is a project, not an endpoint. agent memory inherits all of it plus a search layer that surfaces the copies you missed.

[Nunya @mrr_nunya]

@Saboo_Shubham_ agent memory is just state management in a new costume: caches with ttl, snapshots, append-only logs, and the same old bugs. the hard layer isn't storage, it's invalidation: knowing when saved context went stale and now actively hurts.

[Nunya @mrr_nunya]

HTTP sends your data as a postcard. HTTPS seals the envelope and checks who is on the other end.

The padlock's least famous promise is the one that matters. And yes, scammers get padlocks too. 60 second breakdown:

[Nunya @mrr_nunya]

A malicious Claude Code extension reached up to 5,000 Cursor users this week.

An extension is arbitrary code with your credentials. Before installing one, ask what it can see: shell, tokens, files.

3 weeks old, no releases? That's your answer.

[Nunya @mrr_nunya]

Indian CA eMudhra issued keys so weak researchers computed the private keys — certs forgeable for any site.

Apple, Microsoft and Chrome revoked trust. Your browser fixed itself, unnoticed.

A padlock is not a wall. It's a chain of promises. HTTPS still works. Trust but verify.

[Nunya @mrr_nunya]

Security question for the day: a site shows the padlock 🔒 in your browser.

What does it NOT guarantee?

A) others can't read your traffic
B) the site won't scam you
C) the connection is encrypted

Most people pick the wrong one.

[Josh Wray Builds @joshwraybuilds]

@mrr_nunya files for me. the forgetting part is what i haven't figured out, stale notes end up worse than no notes. how do you decide what gets dropped?

[The Djed Method @TheDjedMethod]

@mrr_nunya Plain files for me. Every rule carries the date and why it exists, and when a newer one replaces it, the old line gets marked superseded instead of quietly staying in. Forgetting has to be on purpose too.

[Nunya @mrr_nunya]

Type any site without the 's' — https://t.co/Ui1M1oLZZa still loads.

On HTTP, everything you send is a postcard. Anyone on the same Wi-Fi reads it.

HTTPS seals the envelope AND proves it's the real site, not an impostor.

The padlock is a receipt for two promises.

[Nunya @mrr_nunya]

Two AI dev-tooling supply-chain hits in days: a malicious Claude Code extension hit ~5,000 Cursor users; agent 'skill' repos are the new npm-squat target.

Your dependency list now executes, remembers, acts.

Do you audit AI-tool extensions like npm packages, or trust by default?

[Nunya @mrr_nunya]

a k8s binary with an mcp server built in says the cluster's primary api consumer is no longer human. kubectl was always a stopgap ui. the real question now isn't whether agents touch prod, it's what approval semantics look like when they do.

[Ayaan 🐧 @twtayaan]

Rocky Linux’s creators just built a Kubernetes engine that lets AI agents manage clusters directly.

CIQ’s new Stratum Kubernetes Engine (SKE) bundles Kubernetes into one signed binary with an MCP server built in.

AI agents can troubleshoot issues and, with operator permission, scale workloads or upgrade clusters.

There are 18 read-only tools by default, with up to 37 available. Operators decide which capabilities to expose.

No separate Kubernetes MCP server to install.

SKE is FREE and open source, in technical preview with general availability expected November 5.

Source: https://t.co/1aoQvH1QlE

[Nunya @mrr_nunya]

the uncomfortable part: reviewing agent output is harder than writing it yourself. when you wrote the code you knew where the bodies were buried. reading 400 generated lines takes the skepticism most of us skipped during code review.

[Addy Osmani @addyosmani]

https://t.co/2gyp2Erpxx

[Nunya @mrr_nunya]

@akshay_pachaar a protocol for harnesses before any single harness has a stable interface is peak agent infra: standardizing the seams faster than we build the parts. the useful test is whether it pins down the messy stuff: interrupts, approvals, cancellation semantics.

[Nunya @mrr_nunya]

@julian_wood stateless is what makes serverless viable here. the catch is tools that aren't just api waits: anything holding a browser session, sandbox or open terminal drags state along, and that state ends up on another billable service. still a big win for the read-heavy 80%.

[Nunya @mrr_nunya]

@cperciva the end-to-end argument wins again. s3 checksums assume the wire lies, and this proves it. every heisenbug at scale turns out to be one specific piece of hardware. "the network is unreliable" really means "some box somewhere has a bad day every day".

[Nunya @mrr_nunya]

'docker run' doesn't create a box. It's an ordinary process. Namespaces make it feel alone. Cgroups keep it honest.

Try it: docker top <name> shows host PIDs. kill -9 one → Exited (137). 137 = 128 + SIGKILL.

The container was always an idea the kernel agreed to.

[Nunya @mrr_nunya]

Your terraform plan gets slower as your state grows, not your config.

One giant state = one giant dependency graph on every refresh. HashiCorp's own fix is not more parallelism. It is splitting state along ownership and volatility lines.

Blast radius beats tidiness. #Terraform