Pinned Tweet
First blog post in a longg time.
Felt important to re-orient around what it means to be a senior engineer in the era of agentic development and what still holds true: first principles thinking.
sunilsadasivan.com/writing/f…
Inspired by / response to @threepointone's recent post.
new post: the senior engineer death spiral
sunilpai.dev/posts/the-senio…
a friend just started a big job and asked for some advice. so I braindumped a monologue about a super common failure mode I see with engineers and posted it here, hope it helps whoever it can.
Sunil Sadasivan retweeted
In third-party OSS vs first-party vibe-coded evaluation, the question will turn from "which has better code quality/security?" to "which has a smaller supply chain attack surface?", which is a very easy answer.
One potential outcome of the vulnpocalypse is that companies decide the cost (in risk, dollars, and engineering hours) of OSS dependencies is too high. Vulnerability management isn’t cheap or glamorous, and it’s unlikely that you need all of the attack surface you inherit with these packages. All of the small packages from the many transitive dependencies you inherit present supply chain risk that likely outweighs whatever value you’re getting from that few hundred lines of code.
The cost of the tokens to rewrite the fraction of that code you need, and maintaining it as 1p code, will eventually be lower than the continued cost of dependency management.
This will improve security, but would have negative consequences for the OSS ecosystem.
Sunil Sadasivan retweeted
This one maybe as bad or worse than the PHP ones. Get used to lots of patching.
Sunil Sadasivan retweeted
Why are people acting like it's @OpenAI/@AnthropicAI's fault that vulns are being fixed/disclosed? This is the result of decades of security debt from poor software engineering. The labs' models are not creating net-new security risk, the risk has always been there and we're finally able to uncover and fix it.
Kudos to @stripe for doing this.
We may need more API companies to detect and send these notices. IMO it's fair game for them break integrations to force app developer's hands to address.
Sunil Sadasivan retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
This moment is meant for those who put the expertise in a box and let curiosity roam free.
Great catching up with @hnshah - a mentor of mine since my first startup back in 2011… still remember pitching him as a 👶🏾 24 yo in South Bay.
Ramen with @petergyang in San Mateo. Then caught up with @sunils34 in South Park.
With Peter, we got into open source and finding people worth building with. Sunil and I dove into AI adoption, skills, agents, and where software is headed.
I love spending time with OG engineers who are deeply AI-pilled.
These are the builders who've been building software for so many years and are still this curious about what's next. That's the energy I want more of.
