Founding Engineer @boltdotnew • Lead for AI/ML and WebContainer • JS • Node.js • Rust 🦀 • WebAssembly • Deep Learning 🤖 • Amateur Athlete • Ironman • Dad
null
Joined October 2014
- Tweets21.2K
- Following1K
- Followers7.7K
- Likes36.5K
Pinned Tweet
🚀 Thrilled to announce my interactive #WebAssembly course!
Learn WebAssembly from the ground up with:
🔍 Custom-built debugger & VM
📊 Live stack & memory insights
💻 Hands-on exercises
🛠️ Build real projects
Level up with WebAssembly! ✨
Link below 👇
Dominic Elm retweeted
Node.js 26 “Lithium” is now Long Term Support 🎉
v26.13.0 is out, with updates through April 2029.
Heads-up for Linux users coming from an earlier LTS: libatomic may need to be installed separately.
nodejs.org/en/blog/release/v…
Well, days after my post on the browser as a sandbox, there are more Wasm CVEs.
Every Wasm engine has compiler bugs, browsers included. What matters is what's behind the sandbox. In a browser, it's another sandbox, and fixes ship automatically.
Link to post in 🧵
‼️ ALERT - 2 New critical Wasmtime flaws (CVSS 9.9) could let malicious WebAssembly modules escape their sandbox.
• CVE-2026-115889 Affects multiple architectures
• CVE-2026-115893 ARM64-only, present since 2020
Embedded apps need rebuilding.
Read ↓ thehackernews.com/2026/10/tw…
The recent CVE-2026-111497 in Node.js, where a process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code, does not affect WebContainer. Read more about it in my latest post 👇
ngl but this landing page looks dope af openbot.run 👏
Dominic Elm retweeted
genuine question
who is still paying for cursor in 2026 and why?
i haven't opened it in weeks
i'm kinda curious what keeps people there
Dominic Elm retweeted
Read Dominic's post.
(Here is mine from a while ago - aifoc.us/the-browser-is-the-…)
The browser is an amazingly powerful sandbox, hardened over decades to run unknown and risky code as safely as possible.
Dominic Elm retweeted
Rough week to run Node-based web apps.
WebContainers are the infinitely scalable secure sandbox for Node.js. Untrusted code runs isolated in the browser, away from your OS and your servers. Same tech powering @boltdotnew
Get a demo: bolt.new/demo More below 👇
⚠️ Node.js is vulnerable to remote code execution.
CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)
Aikido detects this. Patches are available.
Ok guys, I am switching back to @code from @cursor_ai.
Cursor has way too many memory leaks especially with multiple windows open at the same time. The fact that chats are leaking is annoying and also that the UI is hella behind and that I can't use all _official_ extensions.
. @cursor_ai Did you know that you're leaking a ton of data? Deleting a conversation doesn't actually clean everything up and leaves a lot of things behind in the local database as well as agent and sub-agent transcripts. Is that intentional? This really piles up over time.
I am absolutely loving Claude Desktop lately. It’s gotten so much faster and with remote control and remote ssh it’s absolutely bonkers. Paired with Codex Desktop it’s so powerful.
🤯 I found a Chromium bug where since Chrome 142 background-color transitions run on the GPU compositor and when a hover starts or ends the fill can be one frame out of sync with the text. This means fast hovers flicker... 😭
Thread 🧵
This is not fixed in the latest Chromium!
The workaround is to draw the hover fill as an inset box-shadow instead of a background color. Shadows always paint on the main thread, so they stay in sync with the text:
```
box-shadow: inset 0 0 0 100vmax ; transition-property: color, box-shadow;
```