Roger Peppe

Roger Peppe

@rog.bsky.social

CUE, Go, fiddler, climber, gardener, curry maker.

1.4K followers166 following457 posts

Roger Peppe reposted

Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. I put together a list updated for the renewed urgency of migrating to post-quantum algorithms.

words.filippo.io(Post-Quantum) Cryptographic Right AnswersIn the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.

Roger Peppe reposted

Electric car emissions benefits are far greater than first thought Their results showed that the climate benefits were generally greatest when gasoline vehicles were retired at year one, resulting in a 58% reduction in carbon emissions over a 16-year period. www.futurity.org/carbon-emiss...

futurity.orgElectric car emissions benefits are far greater than first thoughtNew research shows the carbon emissions benefits of electric vehicles are far greater than initially suspected.

Roger Peppe reposted

a very effective presentation of androgen insensitivity (& indirectly, non-cell-autonomy, a core principle in development & evolution of multicellularity) in many situations, the cells in your body get external signals that tell them who they are & what they do, rather than knowing it internally

Johnathan Perkins@johnathanperk.bsky.social

“Intersex” is the “I” in LGBTQIA. Learned a lot, watching this.

For any LLM sceptics out there. Russ is probably the most talented dev I've ever met.

Russ Cox@swtch.com

Frontier LLMs are much better and dramatically faster than I am at finding and fixing bugs. If you are not asking them to debug your code and review your bugs, you are doing it wrong. A thread of Claude wins. (No longer at Google, btw.)

I've seen it's being more common to put historical articles (eg all previous designs and associated documents) directly into a repo's content rather than leaving it in git history. What should I be thinking about this in this new age?

Roger Peppe reposted

I'm officially looking around, if anybody needs a Go software engineer with a very strong background in web security lmk. I also know a fair share of frontend dev and was a SWE/SE for Google and Microsoft. I'm looking for security-sensitive dev projects and security reviews.

I'm here! Come by for a chat.

CUE@cuelang.org

We're at KubeCon Amsterdam. If you want to find out how to prevent misconfigurations ending up in production, come by (Hall 5, 1163). Or join us for a chat about configuration, preventable outages, schemas, or our configuration control plane.

View full thread

5/ Note: there's more to come — in particular some way to automatically include injected values without building a Go binary, but these should provide a foundation for that.

Roger Peppe reposted

Are you still hiding if no one is looking? People aren't reading the code at all—they'd see the weird decoder+eval—and machines can see that and also the private use code points. Also, it's been public since May 2025 and GitHub/NPM/Microsoft have done nothing. www.aikido.dev/blog/glasswo...

aikido.devGlassworm Returns: Invisible Unicode Malware Found in 150+ GitHub RepositoriesThe Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.

A great example of how the Google #golang team put thousands of lines of ultra-technical code in service of an incredibly easy-to-use and useful tool. If you ever deprecate code, you really should know about the go:inline directive!

5 authors I've read at least 5 books by: E J Swift Adam Roberts Alasdair Reynolds Christopher Priest Adrian Tchaikovsky

Elizabeth Bear@matociquala.bsky.social

5 authors I've read at least 5 books by: Ursula K. Le Guin Octavia Butler C.J. Cherryh Connie Willis Roger Zelazny

I don't understand why Claude is such a resource hog when it's not actually doing that much locally. For example, it's currently idle on my machine and it's coming up as using just under 500MB of memory. WTF?!

"Is it too much to expect that a hotel should provide an easily accessible mains power socket within a relatively short distance of the bed?", I think as I delve under my bedside table for the 5th night in a row. #firstworldproblems

One of the most frustrating things in the modern age: on an Android phone, having a set of photos selected in Google Photos and wanting to attach them to a specific Facebook reply.

Using Claude Code, I sometimes find myself in the situation where I want to interrupt a generic sub-agent (but not its parent!) and tell it to do something differently. Is there some way to do that, or some other similar-ish UI that allows this kind of thing? @simonwillison.net might have ideas?

I'm enjoying using Claude Code, but... why does it use so much CPU time when surely it's essentially just blocked on I/O almost all the time? Is it just doing some really inefficient polling or something?

Roger Peppe reposted

Roger Peppe reposted

Today, I'm proud to officially announce CUE Labs! I co-founded CUE Labs with @mpvl.io to build a Configuration Control Plane, solving config chaos with CUE. Our work also provides the stewardship for the @cuelang.org open source project. Read our launch post: cue.dev/blog/announc...

cue.devA World Without Configuration Chaos: The Configuration Control PlaneImagine a world where you can answer, with absolute confidence, the critical question: “What is the full impact of this change?” A world where configuration isn’t a source of fear, but a source of rel...

Roger Peppe reposted

This heartfelt and meaningful statement by Portland resident and author Cristina Breshears on another social media platform bears reposting here. I don't think the intent is to idealize Portland but to remind all of us what is important and why. (Posted here with permission.)

Just been mostly-vibe coding a PoC. I feel a bit like I feel when I'm on a drag lift up a ski slope: very aware how much work is being done for me. And then I get to play on the downhill after each feature is built. Lots of fun!

Roger Peppe reposted

TIL Claude's new code interpreter mode has a /mnt/skills/public/ folder full of prompt instructions and Python utilities for creating and manipulating pdf, docx, pptx, xlsx files - and you can ask Claude for a copy and learn a TON about working with those formats simonwillison.net/2025/Oct/10/...

simonwillison.netsimonw/claude-skillsOne of the tips I picked up from Jesse Vincent's Claude Code Superpowers post (previously) was this: Skills are what give your agents Superpowers. The first time they really popped …

It makes me really happy that this talk is (still!) appreciated. Quite surprising but deeply gratifying. #golang

Konrad Reiche@konradreiche.com

Whenever I find myself going in circles with Go's type parameters, I revisit @rog.bsky.social's Generics Unconstrained talk. It's a reminder that sometimes interfaces are all you need and that unconstrained type parameters might be what you're actually looking for www.youtube.com/watch?v=eU-w...

I actually still think about those points too FWIW, and sometimes find the techniques really useful. But I also often that constraints _are_ very useful for bridging the gap between real-world Go and generics. So happy with how Go's generics turned out in the end.