Engineering leader building developer platforms and AI products. Creator of FirstRecall, BYOK Runtime, and LLM-Now. Ex-Stripe/Twitch/Snowflake/Sentry.
Oakland, CA
Joined April 2007
- Tweets15.5K
- Following1.1K
- Followers1.1K
- Likes29.5K
"Roses are red, their smells don't annoy, but 15k repo lines did not spark joy". Okay probably should have run that through an llm, but keeping it fresh for today.
Dylan's post (nitter.cf/_dylanga/status/211740…) is another great example this year (for me) of "Oh, I didn't even think to ask AI about that!". One of the most helpful posts I've seen on X!
And ChatGPT is like "The first pass found about 500 regex literals inside runtime functions and several reads that load large JSON records for just a few fields." and I have to come back and ask "Until I mentioned Dylan's post, you.... didn't even think this may be useful?" 🤔
more bangers for those who like healthy systems, fast software, and happy users
> find every place we load a whole row from the database just to read a couple of fields. instead, select only what we need
> remove all unnecessary `new URL()` parsing
> compute all regexes at the module level instead of instead functions and loops
> find hot-path reads of a single key from a large jsonb column and promote that key to a real column
(avoid large jsonb like the plague if you can)
before doing that last one, we had queries that had to detoast 20gb+ of data just to need a couple of kb. highly recommend.
what else do people need?
I _believe_ that I'm in favor of healthy systems, fast software, and happy users.... what are the downsides?
more bangers for those who like healthy systems, fast software, and happy users
> find every place we load a whole row from the database just to read a couple of fields. instead, select only what we need
> remove all unnecessary `new URL()` parsing
> compute all regexes at the module level instead of instead functions and loops
> find hot-path reads of a single key from a large jsonb column and promote that key to a real column
(avoid large jsonb like the plague if you can)
before doing that last one, we had queries that had to detoast 20gb+ of data just to need a couple of kb. highly recommend.
what else do people need?
Jason Swartz retweeted
There has been a security incident at Trigger.
We have emailed the owners of all impacted accounts.
We’ll be providing more information but for now the focus is on giving the impacted account owners what they need to mitigate.
trigger.dev/blog/security-in…
Jason Swartz retweeted
If you're working on making your CI faster and want your agent to visualize the timeline of jobs for you, give it a GitHub Actions link and ask it to output a .pftrace file that you can upload to Perfetto
Jason Swartz retweeted
This is why I said you want your VPS ports all closed
Then only let it be accessible inside your Tailscale for SSH and via a Cloudflare Tunnel to receive web traffic
Any Linux box can be taken over with just a single TCP port exposed to the internet now
A stop gap is disabling MPTCP on your VPS now but even better is not having any public ports exposed!
This seems like the next leap in HCI
We’ve raised $1.3M from YC & Afore Capital so you never have to type or speak again.
Typing is slow. Talking into your computer is awkward. Subvocal fixes both
Our glasses give you the speed of speech without you making a sound or touching a keyboard.
It tracks your internal speech muscles with non-contact sensing and decodes silent, almost invisible mouthing into text at more than 200 words/min.
Pre-orders are now live at:
subvocal.co/preorder?utm_sou…
Jason Swartz retweeted
this might be my last normal tweet before biotech goes vertical
i'm not a whistleblower. I don't work at Lilly, Novo or any of the big labs
but there is a massive shift happening in human biology right now.
it's sitting in press releases and almost nobody reads them
the last 6 months alone:
- a once-daily pill roughly doubled median survival in metastatic pancreatic cancer (13.2 vs 6.6 months)
- a one-time gene editing infusion cut hereditary angioedema attacks 87%, and 62% of patients stayed attack-free and off all other prevention for 6 months
- a one-time gene edit for cholesterol dropped LDL up to 62%, and it held for over a year
- a personalized mrna vaccine beat keytruda alone in a 1,137 patient melanoma phase 3
- retatrutide hit ~28% weight loss in a phase 3
- an ai-designed drug entered phase 3
- a pill that regrows hair passed its second phase 3
- an immunotherapy that could let some rectal cancer patients skip surgery, chemo and radiation just got fda approved
- a man lived 271 days off dialysis on a pig kidney
- human cells were caught passing chromosome-sized chunks of DNA to their neighbors, and it changes how the neighbors behave
we are on the verge of an era where the human body is a software problem and the update cycle gets shorter everyday
stick around, it's going to get weird
bio/acc
Jason Swartz retweeted
I would strongly consider uninstalling any third party js right now if I were you. Especially if it comes from a startup.
Analytics, monitoring, etc are all massive site takeover risks. If you use a tracking script from a third party SaaS, then if they get hacked the hackers have total control over your site too.
This is what took down Polymarket today. They used a tiny script from a SaaS that tracks page load speed. That company got hacked, and the hackers subsequently stole millions from Polymarket users.
If you want to use analytics safely, I would use a product that lets you pin the tracking script and control when it changes. Most of the mature products support this, e.g. Sentry, Amplitude, PostHog, Mixpanel, Heap. If not, you need to trust the company behind it a lot...
Railway got hacked last week. Railway! That's a very competent team, with particularly strong infra chops. The agent swarms are on another level.
A typical analytics company is nowhere near as sophisticated. You should ask yourself: do I trust this company's security more than Railway? I was an analytics CTO in a past life, and I will be the first to admit: we had some great people but we were not on this level.
We (Detail) just uninstalled our session replay, which was a product I loved but is not worth the risk right now.
I hate to write this because I spent a good chunk of my 20s benefitting from product teams taking a chance on a nothing startup and installing our js on their site. But in the past two weeks this risk vector has exploded. It's better for the ecosystem if we move away from third party js as fast as we can.
If you're evaluating your AI Agents don't miss out on Promptfoo. There's some excellent apps to evaluate them in production (e.g. Langsmith & Braintrust) or monitor & alert on what they're doing (neatlogs, others?), but Promptfoo's a great way to verify them locally or in CI. Don't miss out on the red-teaming, moderation, and anti-hallucination evals available at promptfoo.dev/docs/guides/
Jason Swartz retweeted
Tailscale has published an update on the security issues it's addressing: tailscale.com/ssh-investigat…
Or, you know, use @neatlogs
Jason Swartz retweeted
Finally summarized what I've been sending to friends in DMs View article
Thats some real hustle
1,300 people told @lennysan the best thing they bought for under $250.
I got @bot to read every reply and turned the most-liked ones into a site you can filter. It updates twice a day.
Here are the curated ones that are too good to pass up: 👇🏼
lenny-recs.netlify.app
oh heck yes
write-judge is a small Pi extension that sits in front of every edit / write.
Before the change lands it asks one narrow question of @Cloudflare’s Clef decision model:
Does this change delete or weaken a test, assertion, check or guard?
github.com/acoyfellow/write-…
Jason Swartz retweeted
P.S. both Cloudflare Tunnel and Tailscale are 100% free so you don't really have any excuses
They make money upselling to big companies and enterprise so they'll probably stay free
Maybe important to repost this now that everyone is getting hacked
If you have a VPS, I recommend you to get if off the public internet and into a Tailscale network and Cloudflare Tunnel ASAP
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
There's 2 ways into a VPS:
- via your site/app (like the PHP exploit of this week with a file upload hack)
- via your server (like hacking into SSH or some open port)
The site/app side you put on a Cloudflare Tunnel and then with the default Free Plan it has WAF security enabled by default and they jump on new security exploits fast, it means that the only way to reach your website is via the Cloudflare Tunnel, your server does not respond to port 80 or 443 anymore
The server side you put on a Tailscale network which is like your own private network that nobody can access but your own devices (like your laptop, your phone and your VPS) kinda like a VPN
Then you switch off ANY regular access to your VPS on the firewall, in my case I use Hetzner and you create a new firewall then empty it and that blocks everything (test it)
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound. They make a tunnel to outside which sends and receives
Now you've reduced your attack vector to Tailscale and your Cloudflare Tunnel, much safer, not perfect btw, but nothing is
Jason Swartz retweeted
I recommend everyone upgrade Ruby immediately. This is a DoS and RCE vector if you accept user input into Regexp.new() ruby-lang.org/en/news/2026/1…
Jason Swartz retweeted
Ruby’s turn 😅
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now 🚨
Happy Friday 🤠
ruby-lang.org/en/news/2026/1…
Jason Swartz retweeted
Maybe important to repost this now that everyone is getting hacked
If you have a VPS, I recommend you to get if off the public internet and into a Tailscale network and Cloudflare Tunnel ASAP
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
There's 2 ways into a VPS:
- via your site/app (like the PHP exploit of this week with a file upload hack)
- via your server (like hacking into SSH or some open port)
The site/app side you put on a Cloudflare Tunnel and then with the default Free Plan it has WAF security enabled by default and they jump on new security exploits fast, it means that the only way to reach your website is via the Cloudflare Tunnel, your server does not respond to port 80 or 443 anymore
The server side you put on a Tailscale network which is like your own private network that nobody can access but your own devices (like your laptop, your phone and your VPS) kinda like a VPN
Then you switch off ANY regular access to your VPS on the firewall, in my case I use Hetzner and you create a new firewall then empty it and that blocks everything (test it)
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound. They make a tunnel to outside which sends and receives
Now you've reduced your attack vector to Tailscale and your Cloudflare Tunnel, much safer, not perfect btw, but nothing is
When I set up a new Hetzner VPS first thing I do install Tailscale and once I'm in via Tailscale lock down the firewall to only accept web traffic on HTTPS 443 for Cloudflare IPs and SSH 22 for Tailscale IP
That way nobody can get in
I know I keep repeating this but it should be basics of setting up a new VPS
So basic IMHO it should be part of any VPS service to default install Tailscale and enable it so it's the only way to get in
Why?
A VPS server is just like your laptop or destop computer but now imagine if it's connected to the entire internet with 8 billion people that can access it and try hack it
You want to only have it accessible to you
And if you want to host a website on your VPS (like I do), you should only let Cloudflare access your VPS so it can stand in front and block any hack attempts
Never expose a VPS to the world wide web which realistically is the world WILD web