I wrote in feb that the sdlc was dead
since then every piece has been falling down, one after the other
the last standing will be production and on call will suck 100x more than it currently does
since then every piece has been falling down, one after the other
the last standing will be production and on call will suck 100x more than it currently does
now that we all agreed to not review most of the code any more, CI became the next bottleneck
at agent speed, if our CI pipeline is simply "run all the build, lint, tests", it'll become a major slow down
here are a few things i suggest for how to optimize:
1. balance load between CI and CD
CI protects main branch. CD protects production. if you can tolerate some delay in deploying your main branch to production, then you can do less in CI and do more in CD
for example, for a cross platform app i made my CI pipeline skip most mac and windows tests because linux already covered the same functionality
the tradeoff is occasionally i'd catch a mac or windows-only bug in CD before release, but in exchange, my CI pipeline became 15x faster - well worth it
2. modularize your codebase such that changes are isolated
then you can make your CI only run build, lint, test for the module being touched
this requires careful consideration for cross-module protocols. they should likely be their own modules, so when they do change, you know you probably need to test all dependent modules
3. for large modules, invest in test selection
in CI, try to only run tests that are covering the areas being changed. doing accurate test selection is not easy though, and often requires continuous tuning
i have a nightly loop specifically doing audit of past test runs and tweak my test selection to be more accurate. a big codebase of mine got pretty good at this - 20x faster CI compared to running all tests, and almost never miss any real problem
0
0
14
1,571
sounds like a joke lmao
someone outside our GitHub org deleted one of our private repos.
no membership or invite or role. nothing in our org or enterprise audit logs gave them access. just one repo.destroy from the gh CLI.
and it's not in deleted repositories, so no restore.
@github how is this is this?
1
1
15
4,404
4 strikes again lmfao
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-yo…
1
0
17
2,151
trialing @polylane for cybersecurity for a few customers
kinda wild results right now, all those patches you've been doing all week, just on auto-mode
and there's so much more we can do
kinda wild results right now, all those patches you've been doing all week, just on auto-mode
and there's so much more we can do
1
0
19
1,707
RT @pulkitakini: had so much fun at @flybridge founders week talking on a panel along with @BhaiyaVidhan about what happens when AI agents…
0
1
0
95
boris retweeted
@astuyve i’m drafting an article related to this but tldr: on-call is dead. long live on-(api-)call*.
*for small enough teams with well defined security boundaries and blast radius
*for small enough teams with well defined security boundaries and blast radius
1
1
4
436
boris retweeted
introducing @polylane memory
we built our memory system on git, it's a graph that learns from every incident, every investigation, and every pull request
every night it dreams and self-corrects with context from production
I wrote down everything for you to build yours
we built our memory system on git, it's a graph that learns from every incident, every investigation, and every pull request
every night it dreams and self-corrects with context from production
I wrote down everything for you to build yours
16
16
221
12,235
introducing @polylane memory
we built our memory system on git, it's a graph that learns from every incident, every investigation, and every pull request
every night it dreams and self-corrects with context from production
I wrote down everything for you to build yours
we built our memory system on git, it's a graph that learns from every incident, every investigation, and every pull request
every night it dreams and self-corrects with context from production
I wrote down everything for you to build yours
16
16
221
12,235
Pulkita was my product intern at @CloudflareDev and now she’s building something pretty awesome
how does you content strategy change when agents are the primary consumers ?
how does you content strategy change when agents are the primary consumers ?
hi x 👋
been heads down building taza this year around a question we've been obsessed with: what happens as AI agents become the buyers of information?
the internet wasn't exactly built for that, & we think there's a lot to figure out
excited to share what we're building & learning along the way :)
2
0
22
3,327
lol bro are they reading the @polylane blog?
Anthropic is now recommending that companies REMOVE unnecessary subagents from their AI systems.
This is a pretty significant shift in agent architecture, with their team finding that a single agent equipped with skills can frequently outperform complex multi-agent systems, and one customer seeing roughly 2x faster execution.
The emerging rules of thumb:
→ Skills: Teach the agent HOW to do something, including procedures, expertise, and instructions.
→ Tools / MCP: Give the agent the ability to DO things through APIs, actions, and live data.
→ Subagents: Use for parallel work, isolated context, or tasks a single agent struggles with.
The interesting part is progressive disclosure. Instead of spawning specialized agents or stuffing everything into a giant prompt, one agent discovers and loads skills and tools as needed.
Their advice is to fold existing subagents into the main loop, turn their instructions into skills, expose their actions as tools, and run evals to see if performance holds up.
As models have gotten smarter, improving agent architecture is becoming less about what you can add and more about what you can delete.
claude.com/resources/arti…
5
0
48
11,938