cy

Software Engineer

[cy @seewhy]

Hope this can resolved.

[Balaji @balajis]

Should the global tech community continue investing in Malaysia?

Given recent events, I raise this question respectfully for the consideration of Prime Minister Yang Amat Berhormat Dato’ Seri Anwar bin Ibrahim (@anwaribrahim), for the people of Malaysia, and for our friends in the Malaysian tech community. The answer will be of interest to anyone in global tech that’s considering building, investing, or expanding in Malaysia, including executives at Google, Amazon, Apple, and Microsoft, founders of tech unicorns like Coinbase and Solana, and investors at the world’s largest venture capital funds like a16z and Polychain.

As context, I am the former CTO of Coinbase and former General Partner at a16z. In October 2024, I opened a startup society called Network School in Malaysia, because I felt I’d been invited in by the government’s pro-tech policies.

Specifically, the KL20 initiative set out Malaysia’s ambition of becoming a top 20 global tech hub. Their MDEC digital nomad visas and MM2H investor visas were created to facilitate an influx of global talent and capital. And the Johor-Singapore Special Economic Zone was announced to facilitate the flow of capital and talent between Malaysia and Singapore, where I live. When taken in combination with Malaysia’s datacenter buildout and its policy of welcoming visa-free visits for 98% of the world, it seemed like Malaysia might be a great place to build a global tech hub that was simultaneously inexpensive and easy to visit (especially for non-Westerners).

And that’s what we did, by creating Network School. It’s an international tech community with its first node in Forest City, Malaysia. We picked Forest City because it had millions of square feet of empty space, because it was one hour from Singapore’s capital markets, and because it was within the Johor-Singapore Special Economic Zone. Then, within 18 months, without a single penny of government money, we built Network School into a global attraction that brought thousands of engineers, investors, and builders from 70+ countries to learn technology, burn calories, earn online, and have fun, integrating with the local Malaysian economy along the way.

Indeed, in terms of quantifiable contribution to the Malaysian economy, we’ve already invested 100M+ MYR in our campus to make it startup-friendly. For perspective, that’s about 4% of the budget of Johor, the Malaysian state where Forest City is located. We employ dozens of Malaysians directly and indirectly at every level from executive to staff. We’ve backed Malaysian tech startups like Collektr, hosted events for local teams like Superteam Malaysia, and are major customers of many local businesses like barbers, laundromats, and restaurants. We’ve also revitalized the multibillion-dollar Forest City project, causing millions of MYR in real estate appreciation. And, as the video below describes, we were on the cusp of a 500M+ MYR expansion to grow our community, as well as a global merit scholarship with my friend Amjad Masad of Replit.

However, that emerging multi-billion dollar success story — which should rightfully have been hailed as a huge victory for the pro-tech policies of the Malaysian government — is at risk of being derailed by a fake story spread by an anonymous account named MP4P.

In short: on the day before the July 11 Johor elections, MP4P posted an Instagram post falsely accusing Network School of harboring illegal aliens. The sensational accusations caused a tizzy in Malaysia, until Malaysian authorities came to our campus on July 14 to investigate. (I should note that the officers were very polite and professional.) After checking hundreds of physical passports from 40 countries, including dual passport holders, the authorities confirmed to the press on July 15 that all travel documents were in order. During the process, we cooperated fully; in the thread below you can see a photo of the men, women, and children of Network School smiling and holding up their passports in the bright daylight. Our faces are shown and our names are known; we have nothing to hide.

With that said, the process is the punishment. What MP4P did is very similar to the American crime of “swatting”, because MP4P created a hoax report of a serious threat, thereby forcing the Malaysian police to take time away from protecting the Malaysian people towards investigating a nonexistent issue. Moreover, this anonymous MP4P account has also called for Malaysia to boycott Apple, Google, Amazon, and Microsoft…a move that would cost ordinary Malaysians thousands of jobs…even while MP4P’s own Instagram collaborators promote their Apple and Google apps! I mean, we aren’t talking about a credible accuser, but just someone screaming inconsistently at the top of their lungs on social media for traffic, an all-too-common phenomenon these days.

Anyway, at this point, all further investment we were planning to make in Malaysia is on hold until we get sufficient assurance that such issues won’t recur. So are the investment plans of many of our friends, including the execs and investors at global tech firms that we brought to Forest City. Because to put it very plainly: we have invested 100M+ MYR in Malaysia, while creating jobs for dozens of Malaysians, and our faces and names are known. Our Malaysian executives and employees deserve the benefit of the doubt over anonymous internet trolls.

There are two paths forward. In the first case, if Malaysia still wants continued global tech investment, if it wants to be a top 20 tech hub, if it wants us to revitalize Forest City, then we request an audience with the Prime Minister’s office to discuss the terms of a memorandum of understanding between Network School and the Malaysian government, similar to the document recently signed between the Solana Foundation and the Kazakhstan government.

Specifics can of course be discussed, but we would publicly commit to abiding by all Malaysian laws (we already do) and respecting Malaysia’s sovereignty (never in question). In return, they’d get to know our friendly community, and realize that we actually chose Malaysia because we thought it was a great place to build a tech hub where engineers from the global South, investors from the West, and builders from Malaysia itself could meet new people, build cool things, and perhaps create millions of dollars in economic growth in the fullness of time.

That vision of peace and trade, internationalism and entrepreneurialism, is still on the table. We aren’t asking for any money — just a meeting, to help restore confidence in Malaysia as an investable jurisdiction. Alternatively, if you don’t want our investment, or those of our colleagues at billion dollar funds and trillion dollar companies, we will of course respect your wishes, and reallocate our capital to other countries instead.

Either way, we will remain friends and abide by your decision. Please let us know.

[cy @seewhy]

@spencer birb

[cy @seewhy]

@huxlab 系统稳定性后端(架构infra)影响比较大, 至于短期可维护性, 现在短期前端是可抛性的 🫠

[cy @seewhy]

@__LaPine__ @boris0chuck @knollcaptures @PokeRescue @gggniwz @FinishWhatUStar @cultra @basedPavel I can’t dm🥹

[cy @seewhy]

@__LaPine__ @PokeRescue @knollcaptures @gggniwz @FinishWhatUStar @cultra @basedPavel Wow… IKZ!

[cy @seewhy]

IKZ! Never knew I can win a lucky draw!

[Azuki Run Club @azukirunclub]

That's a wrap on the First Run Challenge! 🏃

50 runners joined.
31 completed their 60-minute run. 👏

Congrats to @seewhy on winning the ARC Running Cap! 🧢

Thanks to everyone who took part. See you in the next challenge!

[cy @seewhy]

@azukirunclub IKZ! So now I got three caps? 🤣

[cy @seewhy]

@NFTea_Sammi @FinishWhatUStar 🫣

[cy @seewhy]

@iamwenmun @AzukiWalkClub No... MY..

[cy @seewhy]

started running because of stepn, and keep running because of @azukirunclub

[Azuki Run Club @azukirunclub]

Consistency gets noticed.

Today we're welcoming 3 runners to the ARC Strava Club:

• @basedPavel
• @LockFryer
• @seewhy

This invite-only group is reserved for runners who show up and put in the work.

Want in? Keep stacking miles on @gardenrun and earn your spot.

[cy @seewhy]

Supply chain attacks are so common nowadays, as a dev you should lets the bullet fly for a few days, take a good nap before update any packages. Don’t rush for latest.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[cy @seewhy]

@pukerrainbrow Yes

[cy @seewhy]

@icanvardar ✅ I am not robot

*Powered by reCAPTCHA

[cy @seewhy]

@provenauthority Forfeit all power if not registered within the week given… this is how communities been treated.

I am leaving, bye.

[cy @seewhy]

@0xDeMoo @liierqi 哪条推？

[cy @seewhy]

@undergroundergr Let’s AI do the check is good enough for non-tech background people 😄

[cy @seewhy]

@undergroundergr It is opensource in github. Clone, do security check with AI, and then translate