つとーむ

Staff Engineer / エイチームライフデザイン 取締役 / 名古屋で働く三重県民

[つとーむ @tsutorm]

@aiji42_dev @chimame_rt
発売おめでとうございます🎉

[つとーむ @tsutorm]

ヒェー
明日は我が身😰

[マネーフォワード @moneyforward]

【重要】『GitHub』への不正アクセス発生に関するお知らせとお詫び（第一報）
https://t.co/yLbK3S6BVy

[Guillermo Rauch @rauchg]

Here's my update to the broader community about the ongoing incident investigation. I want to give you the rundown of the situation directly.

A Vercel employee got compromised via the breach of an AI platform customer called https://t.co/7PY6gGtzgI that he was using. The details are being fully investigated.

Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments.

Vercel stores all customer environment variables fully encrypted at rest. We have numerous defense-in-depth mechanisms to protect core systems and customer data. We do have a capability however to designate environment variables as “non-sensitive”. Unfortunately, the attacker got further access through their enumeration.

We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.

At the moment, we believe the number of customers with security impact to be quite limited. We’ve reached out with utmost priority to the ones we have concerns about. All of our focus right now is on investigation, communication to customers, enhancement of security measures, and sanitization of our environments. We’ve deployed extensive protection measures and monitoring. We’ve analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community.

The recommendation for all Vercel customers is to follow the Security Bulletin closely (https://t.co/BLVnic9fJC). My advice to everyone is to follow the best practices of security response: secret rotation, monitoring access to your Vercel environments and linked services, and ensuring the proper use of the sensitive env variables feature.

In response to this, and to aid in the improvement of all of our customers’ security postures, we’ve already rolled out new capabilities in the dashboard, including an overview page of environment variables, and a better user interface for sensitive env var creation and management. As always, I’m totally open to your feedback.

We’re working with elite cybersecurity firms, industry peers, and law enforcement. We’ve reached out to Context to assist in understanding the full scale of the incident, in an effort to protect other organizations and the broader internet. I also want to thank the Google Mandiant team for their active engagement and assistance.

It’s my mission to turn this attack into the most formidable security response imaginable. It’s always been a top priority for me. Vercel employs some of the most dedicated security researchers and security-minded engineers in the world. I commit to keeping you updated and rolling out extensive improvements and defenses so you, our customers and community, can have the peace of mind that Vercel always has your back.

[Takeo Imai (bonotake) @bonotake]

日本ソフトウェア科学会 機械学習工学研究会 AIとアジャイルWG にて作成した 「2030年のAIとアジャイル」レポート v1.0 を本日発行いたしました。
https://t.co/YIZ1sdtmqh
実践者・研究者の双方にAI駆動なアジャイルの未来展望と今後の課題を文献調査とインタビューを通じてまとめました。

[つとーむ @tsutorm]

👀
https://t.co/cft8G8jZwj

[つとーむ @tsutorm]

https://t.co/9GAyanPGp0

[Eric S. Raymond @esrtweet]

Is it weird that AI coding assistance is not giving me identity fracture?

A lot of software developers are feeling disoriented and threatened these days. Programming by hand is clearly going the way of the buggy whip and the hand-cranked auger. Which is how we're finding out that a lot of people have their identities bound up in being good at hand-coding and how it feels to do that.

That's not me. It's not me at all. Rather to my surprise, I don't miss coding by hand, not any more than I missed writing assembler when compilers ate the world and made that unnecessary. (That was in a couple years back around 1983, for you youngsters.)

Maybe the fact that I'm not feeling any of this disorientation disqualifies me from having anything to say to people who are. On the other hand...if you can learn to emulate my mental stance and be completely unbothered, maybe that would be a good thing?

So. If you're a programmer, and you're feeling disoriented, try this on for size:

I like being a wizard. I like being able to speak spells, to weave complex patterns of logic that make things happen in the world. Writing code is a way to manifest my will.

Yes, I've piled up a lot of arcane knowledge over the 50 years I've been doing this. But languages of invocation, they come and they go. Been a long time since I've had any use for being able to program in 8086 assembler, and that's okay. I have better spells now, and these days some rather powerful familiars.

What I'm inviting you to do is think of yourself as a wizard. Not as a person who writes code, but as a person who is good at assuming the kind of mental states required to bend reality with the application of spells.

And if that's who you are, does it matter if the spells are painstakingly scribed in runes of power, versus being spoken to an obedient machine spirit?

It's all one; it's all the manifestation of will. Arcane languages come and go, machine spirits appear and then diminish to be replaced by more powerful ones, but you? You are the magic-wielder. Without you, none of it happens.

Same as it ever was. Same is it ever was. And so mote it be.

[Matt Shumer @mattshumer_]

https://t.co/ivXRKXJvQg

[つとーむ @tsutorm]

https://t.co/3kyeiPA0vi
おぉこれは良いのでは

[つとーむ @tsutorm]

XSLT外していくのか
https://t.co/namrDy2xTy

[React @reactjs]

There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.

A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.

https://t.co/kue7kd0XEX

[つとーむ @tsutorm]

独自で入れてたけど既製製品出てきた
https://t.co/cNWnG1qoDa

[つとーむ @tsutorm]

👀
https://t.co/LtwZax0lpp

[つとーむ @tsutorm]

feature fileが安定して不具合モードに寄らず揺らいだ状態で伝搬したことで初動でDDoSと見誤った

これはムズそう

[つとーむ @tsutorm]

👀

[Cloudflare @Cloudflare]

On November 18 Cloudflare experienced a service outage, triggered by an issue with a Bot Management feature, impacting multiple Cloudflare services. Here's a detailed breakdown of what happened. https://t.co/7WArlr5ghI

[つとーむ @tsutorm]

こんなのあったのか。良さそう
https://t.co/LtjHLnw1Sc

[つとーむ @tsutorm]

最新版が来たぞ👀
https://t.co/kvaCMML593

[つとーむ @tsutorm]

@Dominion525 お疲れ様でした！！！

[つとーむ @tsutorm]

[決断する役割、指示する役割] https://t.co/Yz5sJazPoG