The Holyheights 🇰🇪

Founder, Reelvyn · video ad creator. Short video ads for brands, apps & agencies: TikTok, Reels, YouTube Shorts. Cut from your own footage. DMs open for quotes.

[The Holyheights 🇰🇪 @the_holyheights]

Source: Railway security disclosure https://t.co/bJPFKG6s3N
Image: https://t.co/R9ksQmfwrs

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: encrypted secrets aren't your safety net. Fast rotation is.

Railway just told all users to rotate every env var after a breach.

If a key is pasted in 5 places, you can't rotate it in an hour.

Could you rotate every key today? Yes or no? #DevOps #Security

[The Holyheights 🇰🇪 @the_holyheights]

Reference: https://t.co/URhs4Ll46l
Image: Stripe Docs

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: a currency in a column name is a schema with an expiry date.

Moving a platform's home currency to KES meant renaming 31 money columns, a ledger trigger and the quote APIs.

Integer minor units + a currency code. Or decimals? #Fintech

[The Holyheights 🇰🇪 @the_holyheights]

Source: Cloudflare Blog, Oct 20 https://t.co/KMJQIATRcZ (Image: Cloudflare Blog)

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: porting the TypeScript compiler isn't the hard part anymore. Staying compatible is.

Cloudflare's tsrs (Rust port): up to 8x faster, ~70% less memory vs TS 7.0. Still experimental.

Fast port in your editor, official tsc in CI?

#TypeScript #Rust

[The Holyheights 🇰🇪 @the_holyheights]

Source: Safaricom M-PESA Jumbe FAQ https://t.co/uoQDcgXoJL
Image: https://t.co/gXPpINMSqX

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: Kenya's most common data leak isn't a hack. It's "nionyeshe message."

M-PESA Jumbe fixes it: a receipt you can show, with no name, number or balance.

Dev lesson: pick the reader first, show only what they need.

Per-audience views or one full record? #MPesa #Privacy

[The Holyheights 🇰🇪 @the_holyheights]

Reference: https://t.co/yklc4vTR3p
Image: OWASP Cheat Sheet Series

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: an admin toggle your token check never reads is a placebo.

"Force password reset" saved a flag. Existing JWTs and refresh tokens still worked.

Fix: block all but change-password, kill refresh tokens, clear auth cache.

Stateless JWTs or check every request? #AppSec

[The Holyheights 🇰🇪 @the_holyheights]

Sources: PHP advisory https://t.co/Hd3XsfNP7Z and OpenAI on the disclosure https://t.co/c6ChvC8kGB
Image: https://t.co/aBlwPHggkf

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: AI won't make software safe. It'll make "we'll patch next sprint" fatal.

PHP2Shell: 2 critical PHP RCEs, AI-assisted discovery, exploit on mod_php fires before any app code runs. No full mitigation, only the update.

Patch in hours or wait? #CyberSecurity #PHP

[The Holyheights 🇰🇪 @the_holyheights]

Source: Business Now (Oct 21) https://t.co/g0ONJJhCPj
Image: Business Now article page

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: the best AI support agent knows when to quit.

Mogo Kenya says a phone menu + AI voice agent resolve up to 80% of routine calls (its own figure).

The real win: a missing M-Pesa payment goes to a human, with a summary.

Always offer a human? Yes or no?

#AIAgents

[The Holyheights 🇰🇪 @the_holyheights]

Pattern: https://t.co/2fYX2R2Tv3
Image: https://t.co/rXKlBfqfo7

[The Holyheights 🇰🇪 @the_holyheights]

Hot take: "save to DB, then push to the queue" is two systems and zero transactions.

Redis blipped, the order committed, its follow-up job never got queued. Silent.

Fix I shipped: outbox row in the same transaction + 10s sweeper.

Outbox: essential or overkill? #SystemDesign

[The Holyheights 🇰🇪 @the_holyheights]

OpenAI kept the name. DeepSeek is doing the open part.

DeepInfer, the production inference stack behind DeepSeek-V4.1-Flash, is now open source for anyone to run.

Which lab is really the "open AI" in 2026?

[DeepSeek @deepseek_ai]

🚀 Introducing DeepInfer, our in-house inference framework, now fully open source!

Powering DeepSeek-V4.1-Flash at scale with high throughput and low latency. We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable.

🔗 https://t.co/JGAik1kgk0

1/4

[The Holyheights 🇰🇪 @the_holyheights]

Source: Google Cloud incident report (Oct 14) https://t.co/AlqKKeeShM
Image: Google Cloud Service Health

[The Holyheights 🇰🇪 @the_holyheights]

Unpopular opinion: your next outage will start as a fix.

Google's report on 18h of Cloud Storage errors: an "optimization" bypassed capacity-aware routing, then an incomplete rollback brought it back the next day.

Config changes: canary like code, or fast-path? #SRE #DevOps

[The Holyheights 🇰🇪 @the_holyheights]

DeepSeek just open-sourced DeepInfer, the stack serving DeepSeek-V4.1-Flash in production. Not a demo, their real engine.

Lower compute costs, less energy, and anyone can learn how inference runs at scale. Huge for builders.

Who's trying it first?

[DeepSeek @deepseek_ai]

🚀 Introducing DeepInfer, our in-house inference framework, now fully open source!

Powering DeepSeek-V4.1-Flash at scale with high throughput and low latency. We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable.

🔗 https://t.co/JGAik1kgk0

1/4