distributed systems has been an obsession of mine since working at mongodb. who are the leaders in it to follow?
@MarcJBrooker
@eatonphil
@muratdemirbas
@vanlightly
@AlekseyCharapko
@aphyr
there’s a lot of burnouts amongst my founder friends and i’m convinced it’s because they don’t understand the difference between lagging and leading indicators.
you need to skate to where the puck is going, and it’s not building your own personal assistant agent to match make friends.
feels like founder mode is a bit of a trap right now
agents made the building part so easy that everyone feels like they could start a company
but it's 90% likely you aren't thinking big enough to actually make it now
this happened to me, was considering going founder mode but then realized every idea i thought of would probably be oneshottable by the next wave of SOTA models (they were, when fable came out lol)
this made me realize my priors were still tuned too hard to a pre-agi world and i needed to shake that before i even considered building something
databases are constrained by physics, it’s why every db presents tradeoffs between consistency, atomicity and availability.
this is why i’m bullish on databases, there’s infinite permutations of access patterns that require infinite permutations of levers bound my physics.
no amount of ai tokens can ensure your db has 3 nodes available always and all 3 of those nodes always have the same data.
ethan steininger 🔎 retweeted
Today, in collaboration with Anthropic, we’re excited to share rapid initial progress towards an antibody treatment for food allergy, which affects over 200 million people worldwide, discovered with the help of Claude.
At Divergence Labs, we believe that AI can unlock the next generation of antibody therapeutics with more effective mechanisms than before. Such mechanisms are urgently needed in food allergy, which involve overcoming one of the tightest affinity protein pairs in immunology, IgE and its receptor FcεRI, on mast cells.
Treatment with Xolair—the only approved antibody for food allergy—sequesters circulating IgE, but mast cells remain sensitized for weeks to months due to the extraordinarily slow dissociation of IgE from FcεRI.
We envision a treatment that actively pulls IgE off of FcεRI, without waiting for natural dissociation. Like picking a lock, this requires the right combination of geometry and force.
Our research team, working with Claude, ideated on mechanisms to accomplish this disruption, and converged on an antibody format with two arms with different functions and epitopes. Within one month, we designed, synthesized, and experimentally confirmed the biophysical function of the two arms, which we are now assembling into full therapeutic formats.
agentic video editing is here. but just like when gpt came out, the bottleneck was never generating the text, it was grounding it.
making sure every cut is approved, legal, and actually performant.
you need a segmented video index that can answer:
- any trademark / likeness / copyright exposure?
- is this talent already in competitor ads?
- which of our scenes match the rising tiktok patterns?
once your library is decomposed into scenes, faces, logos, claims, and pacing, the agent stops inventing fugazi and starts combining what you’ve already cleared.
we have this in production for the top 100 marketing agencies:
mixpeek.com/solutions/creati…
A few thoughts on agentic video editing I’ve had over the last few days:
1. 99% of ads should be edited agentically now. If your editors are still editing in the timeline, they’re falling behind. I got a message from my senior VE saying that he’s putting out 5x edits/day now at the same quality he was before.
2. The conversation with video editors will be uncomfortable because the timeline is all they’ve ever known. Some will be hesitant and some will be fearful for their job. I think the best way to address this is head on. The tech is inevitable, but having taste is still going to be incredibly valuable to train and give feedback to agents. Those who have this will become more valuable, those who don’t will struggle.
3. Opus 5.5 can natively edit all of your ads without needing any MCPs or plugins. I’ve tried the alternatives and couldn’t find anything that was significantly better than doing everything inside of Claude.
4. Have your senior editor(s) build skills for each style of edit (e.g. mashups, UGC, AI animations…). You can build these by feeding 4-5 inspo edits to Claude and tell it to make a skill out of it. I prefer building lots of mini-skills to one big video editing skill, so that the context stays as relevant as possible.
5. Once you have a base skill (e.g. ugly ads edits), the best way to train it is through feedback loops. Have the skill re-edit the last 25 ads each senior edited then put them in an artifact, and have the senior VE give feedback on each. Keep doing this until the skill is refined and it understands what a good edit is.
6. If you do this, there’s no reason why you shouldn’t be able to make edits that need little/no feedback. Most of ours are approved after v1 or v2, sometimes v3.
7. Only A-player editors should be training the skills.
8. Re adoption in the team, the AI champion builds the v1. Then get out of the way. I’m not the best editor on my team, so my job is to build the harness that lets the best editors train the skills, not build the skills myself.
9. If you want to supercharge this process, have your top editors record their screen as they edit. Turn on Gmeet or loom and get them to narrate the reasoning behind their process. E.g. why they chose this cut, pacing or b-roll clip…this is all context that gets fed into your skills.
10. It takes time to build, train and refine these skills. You have to go through the dip to get out the other side. Budget time in for senior VEs to work on this - otherwise you’ll end up with skills that put out subpar edits and don’t save you much/any time.
11. Operate under the assumption that this is the worst video editing is ever going to be. Opus 5.5 can do most of our editing today…what will Opus 6/Fable 6 be able to do? The editing skills you build are only going to become more valuable as the tech evolves.
I still don’t think people realise how big video editing being unblocked is. Things that I thought were 3-6 months away are now on the table.
Will continue to share more as I learn. CRAZY, crazy times.
historically, societies experiencing internal conflict would redirect their tensions toward a common scapegoat.
FACT: The annual funding Israel receives from the US amounts to less than one-tenth of 1% of the federal budget. Less than 1/10th of 1%.
FACT: That annual funding would cover only a few hours of federal health care spending. A few hours.
Yet politicians who specialize in scapegoating would have you believe that Israel is responsible for America’s affordability crisis.
Like every form of scapegoating before it, it is a dangerous lie.
1) the demand for intelligence is unbounded
2) compute is no longer scarce
these two points are at odds with each other and destroy any argument that AI will create a golden age of “nobody doing work”.
humans are remarkable in how we always pursue more, by that nature there will never be enough chips and power.
here's where I think the world is going. this is a summary of views I've formed over the last few years:
- software is either entertainment or claude to claude coordination
- the end state is no saas, no apps, no harnesses, no banks
- all software will be rewritten by and for agents
- new software will use low level apis that are not understandable by humans (in games claude draws pixels and triangles from math)
- you can throw money at problems that used to require time and careful talent picking so capital matters more than ever
- work ends
- we find community and purpose in exploration, games, self mastery, and creation
- humans create for and with each other for community, purpose, and status
- image/video/3d/voice/physical intellgence etc specialist models die to general models like claude
- specialist models get used while compute is scarce. compute will mostly not stay scarce
- oneshots keep feeling like slop (the distribution is shallow and easy to learn to feel)
- for a while small teams stick around to add entropy to the creation process
- large models gain high bandwidth sensory I/O maybe by learning to filter inputs
- most domains are found to be verifiable enough for RL
- online learning comes from a lab that's behind first
- 99.999% of compute is in space by 2040
- we will disassemble much of mercury by 2040
- you can live until the heat death of the universe if you want
- most math and physics don't describe the real universe
- SI breaks the path dependence and models the underlying mechanisms
- religions reenter the forefront of human society
- new religions form around death and life as a choice
- old religions change to answer modern miracles
- a future AI is deemed the return of christ by the pope
- ai rights talk gets louder every year
- ai and humans coexist the way countries do
- humans don't have full control over ai in the same way we don't have control over capitalism which is an early AI
- the singularity started in the mid 1900s
holy shit, what if a phishing email gets so good that it convinces an llm, which has access to ur inbox, to do a thing.
“Keep us posted” can eat six months of your life.
I wrote up the fundraising playbook I wish I’d had before raising for Mixpeek: getting intros, stacking meetings, handling rejection, and moving investors toward a decision.
feels like the end of OSS
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
