Self-driving infrastructure @Vercel CTO. Immigrant πΊπΈ/π©πͺ/acc
San Francisco
Joined July 2008
- Tweets61.4K
- Following939
- Followers51.8K
- Likes54.3K
Malte Ubl retweeted
WebSocket support in Vercel Functions is now generally available.
Vercel now serves 15 million WebSocket connections a day across AI chat, streaming, and realtime multiplayer apps.
vercel.com/changelog/websockβ¦
For Vercel-managed deployments we are updating Node for you. Additionally, the Vercel WAF blocks the attack pattern, so you are protected even if you self-host Node.js behind Vercel. In that case, update Node today.
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-β¦
Here is a graph of Vercel's WAF blocking attempted exploits of the PHP vulnerabilities.
Volume is still low, but I expect it to ramp up quickly. Treat the WAF as temporary protection while you upgrade, but upgrade ASAP
php2shell Security Advisory: two critical RCE flaws in the PHP engine affect PHP 5.4+. Public exploits are out.
Vercel WAF rules were shipped before disclosure and have been blocking known exploit patterns. Patch PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. vercel.com/kb/bulletin/php2sβ¦
Malte Ubl retweeted
We have huge respect for the engineering at Vercel and are excited they are building with Pi-Durable
Introducing πππππππ-πππππππ. Run Pi, OpenCode, Codex, Claude Code, eve, fx, or your own harness durably on Vercel.
With πππππππ-πππππππ, agents automatically resume work after failures and run for hours, days, or months. vercel.com/blog/making-everyβ¦
The key to bringing complex harnesses to the cloud is to execute them on durable compute that can run for days or years.
πππππππ-πππππππ ships adapters to make the most popular harnesses durable with the option of adding your own.
Supports Vercel or self-hosting
Introducing πππππππ-πππππππ. Run Pi, OpenCode, Codex, Claude Code, eve, fx, or your own harness durably on Vercel.
With πππππππ-πππππππ, agents automatically resume work after failures and run for hours, days, or months. vercel.com/blog/making-everyβ¦
Vercel AI Gateway
- Zero fees for BYOK
- Zero markup on list prices
- Zero payment fee with ACH
- Volume discounts available
[email protected]
Me to the teenager: What happened to your leg? It looks like a bruise
"It's nothing really"
It looks pretty bad honestly
"It doesn't even hurt when you press it"
Bro, that's definitely a bruise. It's fucking huge
"What are you even talking about, dad?"
Did you get run over by a truck?
...
...
"Ok, so to be honest I was playing hide and seek and hid in a trash can. And then I got scared and bumped my head on the lid. And then the trash can fell over"
ROFL
Malte Ubl retweeted
I've been building ecommerce agents for a while and tried many AI frameworks along the way. I must say:
@eve is the first one that really clicked.
I told @shardara this recently and he asked me why, so I thought it was worth sharing publicly.
In my first AI consulting gigs (mostly custom shopping assistants) I was stunned by how much infra work it takes to ship an agent. I'd say 60β70% of my time went into infra, and only the rest into the actual AI work: context engineering, data, evals. That was insane tbh, because none of that infra felt custom to me. Most frameworks either didnβt help much with infra, or if they did, they forced clunky abstractions on the AI side, and I kept fighting the framework instead of doing my work.
That's probably why so many folks say "don't use a framework, just build from scratch." I felt that too (we all have our Claudes and Codexes, right?), but going framework-less never felt right either. Thereβs so much repeatable stuff, and way too many footguns, to rebuild it every time.
So for a long time I was looking for something very simple:
1. Pls pls handle infra for me. Durable execution, sandboxes, streaming, reconnects, subagents, file uploads that land in the sandbox, auth, web search, easy deployment.
2. LEAVE ME FREEDOM on the AI part. I want to own the harness, not have the framework own it for me.
@eve is just the first one that ticks all these boxes.
Bonus: every production agent quickly needs a UI and often a custom API. A playground, a context view, a domain-specific data viewer (inspired by @HamelHusain, highly recommend). With Eve + Next.js itβs all in a single repo (not even a monorepo!), deployed with one click. Framework-defined Infrastructure at its finest, it really feels good.
btw, I come from front-end world and I remember exactly how the world looked before and after nextjs. Now it feels like this again, just with AI.
Everything we do at the eCommerce AI Lab at @commerce_ui now runs on Eve: shopping assistants and analytics agents for our clients, plus our own company agent that lives in Slack. It all just works, and a huge amount of custom code just evaporated.
Highly recommend
Malte Ubl retweeted
Todayβs AI is the slowest you'll ever use.
In 5 years, it will look like dial-up.
Last week, I joined @Vercelβs panel on fast AI with @CompleteSkeptic, founder of @typesafeai.
We discussed where AI goes next.
We both agreed - people keep underestimating the demand for faster AI.
There is no ceiling.
10x, 100x, 1000x.
In the 1950s, computing experts guessed a handful of computers could cover a whole countryβs needs.
For 70 years, we have delivered more compute.
And builders have used all of it. Every time.
Demand for AI will be no different.
Every gain will be spent on bigger problems:
-Websites that rebuild their UI for each visitor, the moment they arrive.
-Apps you can build as fast as you can describe them.
In 10 years, we will look back at todayβs AI the way we look at black and white TV.
The future will be fast.
Thanks for having us, @rauchg, @cramforce and @vercel.
I'm equally excited. Jarred knows a thing or two about the ecosystem compatibility.
For `scriptc` it should be possible to get it almost to 100% but there are two things that pure AOT cannot do:
1. eval
2. Computed file location require (which is really also eval)
You can get really far on (2) in many cases by compiling the whole reachable file set but the general case cannot be supported.
IMO it is time to rip eval from JS/TS. RCE is too dangerous in the age of AI. A single uncontrolled read of `.constructor` and you are toast.
bun --aot needs to ship a 100MB or so of dependencies into the AOT to support the RCE vector. Probably not worth it. For the few legit cases, apps should opt in and ship QuickJS or a quickly vibed JS interpreter themselves.
Respectively, I think the right goal is full ecosystem compatibility where you have AI rewrite the minimal set of libraries that cannot be otherwise supported.
I benchmarked scriptc.dev against bun --aot
scriptc is 1.6x faster than bun --aot
Should you trust this benchmark? Nope. You should never trust benchmarks, but especially not this one, because it is the one that scriptc was optimized against and it does not benchmark *your* app nor does it benchmark any *real* app. Of course, you all already understand that this is true for all benchmarks you've seen here and are consequently very calm and rational about it.
big draft pr
github.com/oven-sh/bun/pull/β¦
