Sarah Murphy

Red Queen's Rocketship takeoff "exceeds expectations" staff engineer threshold

"Give us all the money or our robot will kill you" In the seventh part of the Terminator franchise, a freedom fighter from the future travels back in time to drop critical takes against the Skynet S-1

If a system is deployed into production, and its performance is never examined, is it even up?

Autumn 2026: Y2K every day

several companies have followed this advice I am an (intrusive) thought leader

If you have a vuln or emergency update for your product, now is the day for you to make it public and hide in the general shitstorm

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

42: the secret to life, the universe, and your CA's private key

I'm resistant to doing security comms until there are clear actionable steps, and we don't have package updates for all this yet. but just to acknowledge it, this WebPKI CA incident is particularly serious for the open social web and atproto ecosystem, because there are so many hosts+clients.

Galaxy brain: what happens when we lose public-key cryptography because of quantum computing or the next generation of LLMs Reality: hey man my private key is '13' lol

THIS IS NOT A DRILL. If you package/distribute/maintain root stores or chain verifiers, act immediately. If you know how to remove trust in a root, consider doing it now. Otherwise, prepare to update systems as patches/mitigations come. Go users, update to Go 1.27.3 or Go 1.26.10.

i was up very late last night please make sure you’re patched

me going to work this morning: 😀🎶🎶🎶 me seeing a go patch release for security: eh, probably not a big deal me opening up the patch release email: crypto/x509, eh, probably not a feature we use, no rush me opening up bsky morning digest from LLM: 😡😡😡😡😡 current state: 🙀🙀🙀🙀🙀🙀

👩🏽‍🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ 📦 Download: https://go.dev/dl/#go1.27.3 #golang

gcx (grafana.com/docs/grafana...) how many ways do I love you, let my agents count the ways

Vulcan Science Academy Minesweeper let's go

no gods no pagers no masters no tickets

Bluesky expands its AI-powered Attie app to let anyone build websites, games, and more

let your agents check when and what you've changed in prod

setting the bar, as it were

SPOF as a service

geoff gives good advice. stop following the latest model and harness churn, it's been a Lot lately with people yelling "have you used picopiodexharness" and "have you use fablopustra" and the reality is you don't need to be at the bleeding edge.

This Wednesday I wrap up my Observability Engineering Masterclass series by live-instrumenting four domains that go far beyond incident debugging: a CI pipeline, a frontend, sluggish code in production, and LLM calls.

New SRE book just dropped: cloud.google.com/blog/product...

spite reliability engineering

writing observability queries is now free tell me how you know your services are healthy

"only fans" also describes a datacenter full of GPUs

As @niallm.bsky.social has said, production always exists in a degraded state.