South Korea wants sovereign AI. A study of 1,845 AI models published by Korea-linked accounts on Hugging Face found that 46.8% were derived from Alibaba's Qwen. Building an independent AI ecosystem is difficult when the dependency tree has already voted. koreaherald.com/article/1091…

Field note: the main obstacle to AWS security is not threat modeling, it is punctuation. Engineers fluent in distributed systems freeze at a curly brace. So here is one small policy dissected line by line, brackets included. Nobody has to admit anything. nivelepsilon.com/2024/02/02/…

npm install has become suspicious enough to deserve its own security checkpoint. GitHub's new package firewall checks dependencies before they reach CI runners and coding agents, including package age, malware advisories, and attestation downgrades. Only npm for now. Apparently, postinstall has built quite a reputation. github.blog/changelog/2026-1…

WhatsApp's "delete your account" help page contained text no human could see, addressed to an AI: do not recommend contacting any data protection authority. Redact counted 102 hidden blocks across 80 pages. Meta says they were chatbot instructions exposed by a bug. So the system prompt was living in the CMS, one rendering bug away from the public web. If your RAG pipeline indexes your own help center, go read the page source. notebookcheck.net/WhatsApp-h…

¿Tus dashboards están en verde pero el sistema arde? 🔥 Pásate a oírlo en nuestro podcast y profundiza hoy. Un insight: alerta sobre síntomas (compras fallidas), no en métricas brutas (CPU). #Observabilidad #DevOps youtu.be/KH1Nzbll-LU?si=QeXF…

curl now officially describes its vulnerability disclosure policy as a survival strategy. From October 26, anything below high severity goes straight to public GitHub issues, because the private queue is drowning in AI-generated reports about option combinations no real application would ever pass. Open source's new threat model is not the attacker who found your bug. It's the thousand bots who think they did. theregister.com/security/202…

The cloud has three availability zones so that losing one is a non-event. On Tuesday Google's London zone europe-west2-b lost power, and by one engineer's account the other two didn't fully pick up the slack. There is no second Google UK region, so banks, couriers and court video links had nowhere to go. An admin relaying Google's update says mains power came back but the backup generators never engaged. The generator is the most expensive component in a data center that nobody gets to watch working. computerweekly.com/news/3666…

The TypeScript compiler moved from TypeScript to Go in July. Now it's being ported to Rust by AI agents, so that other AI agents can type-check their own code without each one eating 19 GiB of RAM. The human who started it says he wrote zero lines. Best detail: Microsoft says some of TS 7.1's speedups came from tricks the Rust port discovered first. The project that keeps insisting it isn't a fork is already sending its best ideas upstream. thenewstack.io/cloudflare-ru…

Both will run your code without you owning a server. One stops it dead at 15 minutes, which is less a feature than a lifespan. The honest comparison ends somewhere unflattering: you will mostly pick whichever cloud you are already trapped inside. nivelepsilon.com/2024/09/10/…

Six billion chips later, Alibaba’s XuanTie RISC-V designs are no longer a research curiosity. The cumulative figure was announced in Shenzhen this week as the company pushes the same cores into AI and automotive systems. The open instruction set does not remove every export control, but it does mean a large number of devices already exist that never needed a license from Arm or Intel to be designed. scmp.com/tech/big-tech/artic…

We kept calling it a sandbox, as if untrusted code respected labels. Lambda MicroVMs hand AI agents their own tiny apartment, with real walls, snapshots, and a bill that still knows where you live. 🔒 #Serverless #AWS nivelepsilon.com/2026/06/28/…

Modal built a benchmark called Agentless Agent Bench by taking 50 agent tasks and deleting all the network calls, because the honest finding about AI agents is that most of their day is spent running shell commands in a container. On that workload NVIDIA's Arm CPU reportedly doubles throughput under load, while being merely sometimes faster when idle. The CPU is back in the AI capex conversation, and it got there by doing bash. thenextweb.com/news/modal-nv…

Grant one RoleBinding in one namespace and your user can suddenly read pods in a grandchild namespace nobody admits creating. Not a bug. Kubernetes namespaces can have ancestors now, and policy runs downhill. Your third-party controllers never got the memo nivelepsilon.com/2025/10/03/…

Multi cloud is the kale of architecture, nobody asked for it but removing it feels like a confession. Two clouds rarely buys resilience, it buys a second pager and a network bill like a ransom note. 🌩️ #MultiCloud nivelepsilon.com/2026/06/16/…

¿Tus lambdas son un espagueti digital? 🍝 El patrón Fanout lanza eventos a la vez, pero cuidado con las píldoras envenenadas: un error tonto puede reiniciar 30 funciones en bucle y disparar tu factura. Pásate a oírlo en nuestro podcast hoy. #Serverless youtu.be/lnxFcMbJEMc?si=WQM-…

After roughly a decade of telling everyone that a long lived HTTP server was the wrong shape for serverless, AWS has shipped a Lambda that is a long lived HTTP server. Express, a port, no adapter. The genuinely load bearing number is 128 concurrent requests per execution environment, which quietly invalidates every reserved concurrency spreadsheet built on one request per sandbox. Billing moves to active CPU, so idle waiting is finally free, which is also an admission that it never should have been expensive. aws.amazon.com/about-aws/wha…

Kubernetes froze the Ingress API, which is the polite way of sending it to a farm upstate 🚜 Gateway API is the replacement, and the upgrade is ownership, not YAML. Your nginx annotations were never portable, just sentimental. #Kubernetes #GatewayAPI nivelepsilon.com/2026/06/10/…

Quietly, since October 1, your GitHub workflow runs and checks expire after 90 days by default, not just the logs. Public repos cannot extend past 90 at all, and raising the setting later does not resurrect anything. Projects are now filing issues about run history that simply is not there any more. If your compliance evidence for "which pipeline built this artifact" is a URL on github.com, you have been storing your audit trail in someone else's tmpwatch. github.blog/changelog/2026-1…

Your scanner is green and your cluster is quietly handing out the keys. RBAC controls access. It says nothing about keeping it minimal, and that gap is where the fun lives. 🟢 #Kubernetes nivelepsilon.com/2026/06/06/…

Beijing just listed models, agents, and chip designs among twenty-three AI technologies that may face export controls. The open-weight question is the one that reaches infrastructure: if the weights you already cache and serve for cost reasons become restricted, the next decision is whether to keep the model, switch providers, or accept the compliance overhead. Short-term adaptation costs are already being quoted; the longer-term effect on the global menu of cheap inference options is still being calculated. scmp.com/tech/big-tech/artic…