Sergei @smthdf

The difference between having a tool and being a tool is subtle these days and it’s easy to accidentally build yourself into being a tool. Don’t be a tool.

We believe voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full-duplex speech model ever built. Talking with it feels like talking with a person…full of emotion, nuance, pauses, and a natural cadence. block.xyz/dessa

People often want to ask me if their startup idea is good, as if my opinion means anything. I think 99% of ideas are good if the team can execute well. The problem is, 98% of teams fail at execution. So, no need to sell me your idea, show your execution.

@FilipJanur Can’t wait for the inauguration in 2089

@MaisonGhost „It’s a hustle“

@SteveLovesAmmo @grok No collapsing but quality of life heavily decreasing

Who's gonna tell vibe coders about... 1. SQL Injection 2. XSS 3. CSRF 4. CORS 5. SSRF 6. IDOR 7. Path Traversal 8. Mass Assignment 9. Clickjacking 10. Content Security Policy 11. Security Headers 12. Input Validation 13. Server-Side Authorization 14. Row-Level Security 15. Least Privilege 16. RBAC 17. Secrets Management 18. .env in .gitignore 19. API Key Rotation 20. Secret Scanning 21. Hashing vs Encryption 22. Password Salting 23. bcrypt & Argon2 24. JWT Expiry 25. Refresh Tokens 26. OAuth 2.0 27. OpenID Connect 28. Session Fixation 29. MFA 30. Brute Force Protection 31. Account Enumeration 32. Timing Attacks 33. File Upload Validation 34. Webhook Signature Verification 35. TLS Certificate Expiry 36. HSTS 37. Encryption at Rest 38. Dependency Vulnerabilities 39. Supply Chain Attacks 40. Threat Modeling 41. Indexes 42. EXPLAIN ANALYZE 43. N+1 Queries 44. Full Table Scans 45. Connection Pooling 46. Database Migrations 47. Down Migrations 48. Transactions 49. ACID 50. Isolation Levels 51. Deadlocks 52. Optimistic Locking 53. Pessimistic Locking 54. Normalization 55. Denormalization 56. Foreign Keys 57. Unique Constraints 58. Cascading Deletes 59. Soft Deletes 60. UUIDs vs Auto-Increment 61. Cursor-Based Pagination 62. Full-Text Search 63. Read Replicas 64. Replication Lag 65. Sharding 66. Partitioning 67. Hot Partitions 68. Postgres VACUUM 69. Materialized Views 70. Backups 71. Testing Your Restores 72. Point-in-Time Recovery 73. Change Data Capture 74. Outbox Pattern 75. ORM Lazy Loading 76. CAP Theorem 77. Eventual Consistency 78. Strong Consistency 79. Raft Consensus 80. Leader Election 81. Split Brain 82. Quorums 83. Clock Skew 84. Distributed Locks 85. Consistent Hashing 86. Bloom Filters 87. Two-Phase Commit 88. CQRS 89. Event Sourcing 90. Race Conditions 91. Backpressure 92. Load Shedding 93. Bulkheads 94. Jitter 95. Retry Storms 96. Cascading Failures 97. Thundering Herd 98. Cache Invalidation 99. Cache Hit Ratio 100. TTLs 101. Cache Warming 102. Write-Through vs Write-Back 103. Redis Eviction Policies 104. CDNs 105. Cache-Control Headers 106. ETags 107. Dead Letter Queues 108. Poison Messages 109. At-Least-Once Delivery 110. Exactly-Once Semantics 111. Message Ordering 112. Kafka Consumer Groups 113. Partition Keys 114. Background Jobs 115. Webhook Retries 116. DNS 117. DNS Propagation 118. HTTP Status Codes 119. HTTP Method Semantics 120. Keep-Alive 121. HTTP/2 122. WebSockets 123. Server-Sent Events 124. Long Polling 125. gRPC 126. Protocol Buffers 127. API Versioning 128. OpenAPI Specs 129. Backward Compatibility 130. Request Size Limits 131. Compression 132. Latency vs Throughput 133. Egress Fees 134. VPCs 135. Subnets 136. NAT Gateways 137. Firewalls 138. Security Groups 139. Service Mesh 140. Ingress Controllers 141. Health Checks 142. Liveness vs Readiness Probes 143. Graceful Shutdown 144. Connection Draining 145. Stateless Services 146. Failover 147. Multi-Region 148. Availability Zones 149. Single Points of Failure 150. Disaster Recovery 151. RTO & RPO 152. SLAs 153. SLOs 154. Error Budgets 155. Incident Response 156. On-Call 157. Runbooks 158. Postmortems 159. Chaos Engineering 160. Graceful Degradation 161. Autoscaling 162. Horizontal vs Vertical Scaling 163. Cold Starts 164. Capacity Planning 165. Load Testing 166. Memory Leaks 167. OOM Killer 168. Structured Logging 169. Log Levels 170. Log Rotation 171. Distributed Tracing 172. OpenTelemetry 173. Correlation IDs 174. Metrics Cardinality 175. p99 Latency 176. Alert Fatigue 177. Error Tracking 178. Profiling 179. Flame Graphs 180. Infrastructure as Code 181. Terraform State 182. GitOps 183. Blue-Green Deployments 184. Canary Releases 185. Rollbacks 186. Feature Flags 187. Environment Parity 188. Staging Environments 189. 12-Factor Apps 190. Multi-Stage Builds 191. Non-Root Containers 192. Image Scanning 193. Resource Requests & Limits 194. Pod Disruption Budgets 195. Semantic Versioning 196. Lockfiles 197. Reproducible Builds 198. Branch Protection

Every week someone tells me they vibe-coded their app over the weekend and don't need developers anymore. Before it touches a paying customer, make sure it includes: > a schema someone designed, instead of one the AI improvised table by table > login that still works when someone puts a plus sign in their email > password reset links that expire and work once > MFA, plus a recovery path for the user who lost their phone > sessions that time out, and a way to kill every session for one user > SSO for the enterprise customer who won't sign without it > SAML, because that customer's IT team doesn't do magic links > SCIM, so a fired employee loses access the moment IT offboards them > roles and permissions deeper than "admin" and "everyone else" > checks that stop user A from reading user B's data by changing one number in the URL > tenant isolation, so one customer's bug never shows another customer's records > an admin "log in as this user" button for support, with an audit trail on every use > rate limits on login, so nobody can guess passwords at scale > lockouts that stop attackers without locking out your CFO the night before the board meeting > database migrations that run forward and roll back > migrations that don't lock the main table at 2pm on a Tuesday > indexes, because the query that was instant on 50 test rows times out on 5 million real ones > connection pooling, so a traffic spike doesn't exhaust the database > backups every night > a restore from those backups, tested, because a backup you've never restored is a hope > point-in-time recovery for the day someone runs a delete without a where clause > soft deletes, so "I deleted it by accident" is a support ticket and not an incident > validation on the server, not just in the form > timezones stored right, so the 9am reminder doesn't fire at 4am > the customer with an apostrophe in their last name > emoji, accents and right-to-left text in every field > money stored as integers, because 0.1 + 0.2 doesn't equal 0.3 in floating point > currency, rounding and tax rules for every country you sell into > a data model that survives your second customer asking for "one small change" > idempotency keys, so a retried payment doesn't charge the card twice > deduplication for the user who clicks submit four times > pagination that still works on page 400 > exports, because sooner or later every customer wants their data in a spreadsheet > imports that survive the CSV someone saved in 2009 > retention rules, and code that deletes what your contract says you'll delete > secrets out of the code, out of the repo and out of the AI chat history > rotating every key the AI pasted into a config file last month > confirming every package the AI installed exists and is the one you meant > dependency scanning, because the AI pulled in libraries nobody reviewed > input sanitization everywhere a user can type > protection against SQL injection, XSS, CSRF and the rest of the OWASP list > file uploads that get scanned, size-limited and stored where they can't execute > CORS rules that aren't "allow everything" > security headers on every response > encryption at rest and in transit > least-privilege access for everyone, including the AI agent holding production credentials > logs that record who did what, without recording passwords, tokens or card numbers > a penetration test before your enterprise customer's security team runs their own > answers to the security questionnaire every enterprise buyer sends, with evidence behind each one > a disclosure process for the day a stranger emails you a vulnerability > a plan for the day a laptop with production access gets stolen > SOC 2, which means policies, evidence and an auditor, not a checkbox > HIPAA, the moment a single patient record touches your system > a BAA with every vendor that touches that data, including your AI model provider > audit trails that show who viewed a record, not just who changed it > PCI scope, and card numbers kept out of your database > GDPR deletion requests that reach every table, backup and log > data residency for the customer whose contract says EU only > quarterly access reviews someone signs off on > dev, staging and production environments that match each other > infrastructure written as code, so the setup lives somewhere other than one person's memory > a deploy pipeline that runs the tests before anything reaches customers > one-click rollbacks, because Friday deploys happen > zero-downtime deploys, because your customers don't have maintenance windows > feature flags, so you can ship the code without shipping the feature > autoscaling for the Monday morning spike > a CDN, so the app loads fast in Singapore too > DNS, SSL certificates, and renewals that don't expire on a Sunday > background job queues, so slow work doesn't freeze the page > retries with backoff, so one flaky API call doesn't become a lost order > a dead-letter queue for the jobs that fail every retry > cron jobs that don't run twice the day you add a second server > caching, and clearing that cache when the data changes > SPF, DKIM and DMARC, so your password resets don't land in spam > bounce and complaint handling on every transactional email > storage rules, so you stop paying to keep 2021's temp files > cost alerts, so a runaway agent loop shows up the same day and not on the invoice (we learned this one for $1,382.59) > a disaster recovery plan, written down and tested once a year > a second region, if your contract promises uptime one region can't deliver > structured logs you can search at 3am > error tracking that groups the same bug instead of sending you 4,000 emails > uptime checks from outside your own network > alerts that page a human, tuned until they stop paging for nothing > dashboards for latency, error rate and throughput > tracing for one slow request across every service it touches > an on-call rotation, and a person who picks up > runbooks, so the engineer on call knows what "queue depth critical" means > postmortems that change something > a status page customers check before they email you > unit tests written by someone who knows what the logic should do > integration tests for every third-party API you depend on > end-to-end tests for signup, checkout and the other flows that make you money > load testing before the launch email goes out > test data that looks like production without being production data > regression tests, so fixing bug 41 doesn't bring back bug 12 > testing on the five-year-old laptop your biggest customer's ops team still uses > accessibility compliance, because the enterprise contract requires it > subscriptions, upgrades, downgrades and proration > failed-payment retries and dunning emails > invoices with the customer's PO number on them, because procurement won't pay without it > sales tax and VAT > refunds, credits and partial refunds > usage metering that matches what you bill, to the cent > annual contracts with custom terms your billing logic never planned for > revenue reports your finance team can reconcile > webhooks that verify signatures > webhooks that retry, with a log of every failed delivery > a versioned API, so you can change it without breaking your customers' integrations > API keys customers can create and revoke > API rate limits that protect you without blocking real integrations > a plan for the day a third-party API changes its response format without telling you > OAuth token refresh, because tokens expire at the worst possible moment > a sandbox where customers can test their integration > protection against prompt injection in every field that reaches the model > customer and patient data kept out of prompts that leave your network > a model spend cap per customer, so one heavy user can't run up your bill > evals, so you find out when a model update makes your answers worse > a fallback for the afternoon your model provider goes down > a migration plan for the day your model gets deprecated > prompt and output logs for debugging, minus whatever you're not allowed to keep > a human approval step for anything the AI does that can't be undone > pages that load on hotel wifi > empty states, loading states and error states on every screen > error messages a customer can act on, instead of "something went wrong" > forms that keep what people typed when one field fails validation > emails that render in every mail client your customers use > notifications people can turn off > undo > keyboard navigation and screen reader support > translations, with dates and numbers formatted for each locale > a back button that does what people expect > code a human can read > code review on every change > a branching strategy, so two people can work without overwriting each other > monthly dependency upgrades, so you're never two major versions behind > framework upgrades before the old version stops getting security patches > deleting the dead code the AI left behind from its first three attempts > splitting up the 2,000-line file the AI kept appending to > architecture decisions written down, with the reasons > a README that gets a new engineer running locally in under an hour > documentation for whoever inherits this > an admin panel for your ops team > support tooling, so customer success can answer questions without pinging engineering > a changelog customers can read > terms and a privacy policy that match what the code does > every account, domain and repo in the company's name, not the name of whoever built the prototype > a bus factor higher than one Oh, and besides keeping all of this working every day, forever… your vibe-coded app will still need people who know what they're doing: > reading every line the AI wrote before it ships (a senior engineer) > designing the data model before your second customer breaks it (a backend engineer) > explaining why the AI's fix for one bug created two new ones (a senior engineer, again) > deploys, rollbacks, servers and the cloud bill (a DevOps engineer) > answering the page at 3am when payments stop (whoever's on call) > patching the framework the week a vulnerability goes public (security) > walking an auditor through how patient data moves (security and compliance) > testing what the AI says it tested (QA) > running a migration on a live database without losing a row (a backend engineer) > saying no to the feature that breaks three others (a tech lead) > turning "works on my laptop" into "works for every customer at once" (an architect) > debugging the code when the AI that wrote it can't (a senior engineer) > remembering why it's built this way, a year from now (someone who was there) …wishing them the best 🫡

insane take from Gemini 4 Argon

@Bagdex Paid ads

@ParamSiddh MC

@thsottiaux Bank reset incoming 🙌

Reverse Engineer Anything 😂 Software is done.

@brian_millot It’s not X, it’s Y

We’re making it easier to qualify for higher OpenAI API rate limits. Five paid usage tiers become three: Build, Launch, and Grow. You can qualify for Grow, our new highest tier, with $500 in total API payments—down from $1,000 for the previous highest tier.

Andrej Karpathy makes a good point: as AI does more of the work, more of your job becomes reading what it produces. His first tip caught my eye. Ask the model to explain things in ASD-STE100. ASD-STE100 is a controlled English standard built for aircraft maintenance manuals. A mechanic anywhere in the world should read a step once and get it right. The core rules: 1. Keep sentences short 2. One action per step 3. Say who does what 4. Give each thing one name and stick to it AI output breaks that last rule all the time. It says "worker," then "agent," then "executor," and you can't tell if it means one component or three. The full spec is strict. Karpathy asks for "80% of the way," and that works for daily use. Someone turned it into an open-source skill: github.com/danyuchn/asd-s…

Andrej Karpathy @karpathy

3 weeks ago

We'll be spending a lot more time trying to understand the outputs of language models. A few thoughts, tips & tricks: Writing. Something I've had success with: Ask your LLM to explain something in ASD-STE100, it's a controlled language specification originally developed for

2K 7K 56K 8.0M 82K

@DataChaz

@X *that pays

@0xAlaric Source: trust me bro

@techbyhez Still more rewarding that working for someone else