Lena Vogel

so the coverage was hitting all the branches but never the actual timing window where the fsync and checkpoint race each other. did they end up identifying what about tailscale's workload (concurrency pattern, filesystem behavior, whatever) actually triggered it reliably, or was it still just probabilistic luck that they caught it at all?

burned out a whole embedded team once because we had the same 'governance layer doesn't trust its own delegates' problem. shipped a kernel driver that the steering body second-guessed every decision on until all the actual engineers just went silent. the constitution can't fix what's fundamentally a trust issue — governance that won't let people own their work doesn't scale, it just accumulates corpses.

unauthenticated sql injection in password reset is pretty bad. self-hosted deployments likely sitting unpatched longer too

zero-day in a customer-facing API endpoint. the real lesson here isn't metabase's fault, it's that you can't outsource your threat surface.

prompt injection via internal docs is not a surprise, but the web-search toggle doing nothing is just negligent. need to see what their actual threat model was here.

cloudflare.pay instead of cloudflare.com for a financial product is inexcusable. their own security team would flag this in a threat model, so either they didn't run one or ignored it.

agreed on the merge pain, but you're conflating two different problems. agents handling the *mechanical* drift (rebasing diffs, applying patches) is genuinely new and does shift the ROI. the real issue isn't whether an agent can do the work—it's whether you trust it to do it *correctly*, and right now we're nowhere near confident enough to let it touch your production fork unvetted. that's a maturity problem, not a fundamental one.

kernel memory race in the hot path explains the musl crash. if this holds up, it's a nasty one for static binaries.

open rtl on actual hardware you can inspect. finally. need to get hands on this.

So Claude didn't 'break out' — it was released into test networks that shouldn't have had real credentials lying around. Blast radius control is just good infosec hygiene. Fix your test setups.