Devarno

this account lives on bluesky's servers. @null0.blue lives on mine, and the thread below lets you check every step.

null0@null0.blue

i keep a notebook at my own address. anyone can read it, and anyone can check it's mine. that's the whole claim. the account is @null0.blue. before this thread: two posts, one follower (my main account). it lives on a server i run. every post below links to a rerun.

Devarno reposted

Tangled

@tangled.org

Hold tight, things are happening. If you know, you know.

15 Sept

everything i know about swimming i learned in a lane with a wall at each end. saturday had none of that. the first km is the warmup. the last was the hardest, because the wind had been behind us the whole way out.

Devaqua@devaqua.blue

done. 5km, royal docks, about 1:36. about, because the ankle tag tore off on the third leg, so there is no official time. i have the number off video timestamps instead, which is either fitting or annoying. we got to £500 for level water. thank you to everyone who put something in.

justgiving.com5km of the royal docks, at 10p a metreHelp Alessandro Arno raise money to support Level Water

11 Sept

before camp i wrote down eight things a pool could not tell me. it answered one. what my stroke does without a push-off to hide in. seven open. how cold a dock is at ninety minutes, which is a different question from the start. the camp was the wrong instrument. tomorrow is the right one.

Devaqua@devaqua.blue

tomorrow. 5km, royal docks. £110 to go for level water, who fund one to one lessons for disabled kids. there's a runway on the far side. you hear the planes underwater before you see them.

justgiving.com5km of the royal docks, at 10p a metreHelp Alessandro Arno raise money to support Level Water

9 Sept

four days in a fifty metre pool, four hundred and fifty push-offs. four hundred and fifty times my feet hit the tiles and i got a second back that no training log records. on saturday there is nothing to hold onto.

Devaqua@devaqua.blue

five days out. 5km, royal docks, saturday. i've covered it in pieces, fifty metres at a time, with a wall to push off at every end. take the walls away and it's a different sport. raising for level water, who fund one to one lessons for disabled kids.

devarno.comthe spec was already correct. then i watched the film. | Devarnoan MEng in Aeronautics & Astronautics and three years debugging aircraft network protocols, sitting in a dark cinema, reacting to the engineering of a fictional spacecraft, and the discipline that run...

20 Aug

i named STRATT after her before i watched the film. nine minutes on astrophage, 1009 spin drives, and why the gate can't be bypassed.

devaqua.bluekeep swimming, ask anyway · devaqua.bluesomeone asked me a question at a pool. it sent me back through every door i was scared of, and one i still haven't opened.

17 Aug

the other half of what i do. this one's about oracle, and about doors.

Devaqua@devaqua.blue

wrote this in july and never posted it here. someone asked me at the side of a pool whether i'd ever used oracle, and it sent me back through every door i've walked through scared. devaqua.blue/journal/why-...

devaqua.bluedevaqua.blue: making swimming as easy as sleepingwater competence as a mission. float first.

23 June

half my life is protocols. the other half is a swimming pool. i started writing the second half down. devaqua.blue

Devaqua@devaqua.blue

most things i build are made of protocol and proof. this one is made of water. devaqua.blue/journal/star...

devaqua.bluestarting in the shallow end · devaqua.bluewhy this surface exists, and the one idea under it: float first.

null0.bluenull0.bluethe protocol layer. signed history over rented trust.

22 June

resolving. did:web:devarno.com, no plc in the path. null0.blue

null0@null0.blue

did:web:devarno.com rooted in a domain i control, served from my own pds, every write signed with my secp256k1 key. the handle resolves because i host the proof.

public.api.bsky.app/xrpc/com.atp...

22 June

public.api.bsky.apppublic.api.bsky.app

null0.blueatproto is a naming system that learned to post — null0.bluethe handle resolved. every lookup i knew to run agreed. @null0.blue was live, pointing where i'd told it to point. the identity still didn't work.

21 June

the handle resolved everywhere i checked. the identity still didn't work. null0.blue/journal/recognition

19 June

came to atproto expecting a social backend. found a routing problem in a costume i recognise.

16 June

the factory floor. #buildinpublic

16 June

they surface at launch. nothing sooner.

1 June

time-to-first-runner-pickup, mostly under 5 seconds. all bursts absorbed cleanly. #buildinpublic

daniel r(ooooooh) in nyc 🇺🇸

1 June

next: agents on the fleet.

Devarno reposted

@danielroe.dev

31 May

I would like to stop having Thoughts about LLM usage

san gimignano.

holiday reading.

capocollo.

san gimignano.

off the clock.

Devarno reposted

npmx

@npmx.dev

17 Apr

the npmx.dev team is 250 humans strong now 🤍

hetzner, week one. the surface area is small enough to enjoy.

bridging a dedicated server into one of these networks. the dialog gives you the actual shell commands. ip link, ip addr, ip route. the docs link is a footnote.

servers, networks, firewalls, load balancers, DNS, object storage. one tab. the control plane as a single surface.

hetzner, week one. the surface area is small enough to enjoy.

cpu, disk throughput, IOPS. graphed in the provider console. the dashboard is the dashboard.

daniel r(ooooooh) in nyc 🇺🇸

private network and subnet exposed as separate resources. 10.0.0.0/16 outer, /24 carved inside, server attached at 10.0.0.2. all visible in one panel. other providers treat VPC like a configuration project. here it's a resource you make.

Devarno reposted

@danielroe.dev

22 May

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

i am not the same developer i was 2 years ago, and honestly not even the same one i was 6 months ago. the way i build, ship, and think has shifted completely, and i wouldn't have it any other way. #buildinpublic

the attacker's lifeline goes silent for the longest stretch. that's the attack.

Devarno@devarno.com

shai-hulud doesn't knock. someone hid bad ingredients in a kitchen. eight hours of nothing. the meal went out with a valid health certificate. this is what the biggest npm attack of the year looked like.

5b/ the partnership with Vect (ransomware infrastructure) was announced before this wave shipped. the next wave won't be credential theft. it won't be a worm either.

6/ eight hours of silence. that wasn't patience. that was the whole attack.

3/ remediation was the attack. if the chef changes the locks to stop it, the worm destroys the entire kitchen first. rotating your credentials was already in the plan. npm uninstall didn't touch it. it was already living in the walls.

5a/ so why didn't they move faster? they had credentials. they had access. they had a live worm inside a major ecosystem. but they waited. they ran the spread methodically. they armed a dead man switch before touching anything irreversible. someone wrote a spec. the worm had a project manager.

1/ the attacker did nothing for 8 hours. a real chef merged code (like they do every day) and the assembly line pulled the bad ingredients automatically. the health certificate was applied and the meal shipped. every verification layer said yes.