Nuno Seco

I’ll be in Malmö on February 25 for the first edition of MalmöJS, a new meetup series focused on something I care deeply about: Running JavaScript and Node.js at scale, in systems that cannot afford to fail. When you push Node.js hard enough, you quickly move past frameworks and APIs and start dealing with fundamentals: event loop behaviour, backpressure, memory allocation, CPU limits, and observability under load. At MalmöJS, we’ll talk about: ✅ What performance actually means in production ✅ How to design systems that degrade and recover safely ✅ Where real bottlenecks show up, and how to reason about them This is a great opportunity to connect with engineers in the region working on serious, high-performance systems, and to exchange practical lessons learned the hard way. If you’re working with Node.js beyond CRUD apps, I’d love to see you there. 👉 Register here: https://luma.com/q52blone

63

1 kommentar

Thats quite concering. Headlines were under pressure for a long time in our attention economy but if such a big player like google decides to rewrite them with AI (probably A/B testing internally different versions) with sometimes different spins and facts that is a next level shift for (miss)information and subtle confusion through AI. Headlines are extremely important since they are the gateway to the actual information that we seek and usually need some craftsmenship to "click" (german article): https://lnkd.in/ddxx9Rn7

1

The Programmer Identity Crisis While I am interested in the AI tools and technologies that augment us, or take on tasks with autonomy. I am probably more interested in what this means for the software engineering profession, both from the perspective of the individual (i.e. developers, testers, designer) and how we work collectively as teams, with AI. The author thinks of software development as more than just writing code, they consider it a craft. Some consider it science, some art, but I too would describe it as a craft. I’ve seen a few people liken the transition to AI-driven development as being akin to the move from low-level (assembly) to high-level (e.g. fortran) languages. And here I agree with the author, this analogy is fundamentally flawed. “𝘐 𝘸𝘢𝘯𝘵 𝘵𝘰 𝘥𝘳𝘪𝘷𝘦, 𝘪𝘮𝘮𝘦𝘳𝘴𝘦 𝘮𝘺𝘴𝘦𝘭𝘧 𝘪𝘯 𝘤𝘳𝘢𝘧𝘵, 𝘱𝘭𝘢𝘺 𝘪𝘯 𝘵𝘩𝘦 𝘰𝘳𝘤𝘩𝘦𝘴𝘵𝘳𝘢, 𝘢𝘯𝘥 𝘴𝘰𝘭𝘷𝘦 𝘤𝘰𝘮𝘱𝘭𝘦𝘹 𝘱𝘶𝘻𝘻𝘭𝘦𝘴. 𝘐 𝘸𝘢𝘯𝘵 𝘵𝘰 𝘳𝘦𝘮𝘢𝘪𝘯 𝘢 𝘱𝘳𝘰𝘨𝘳𝘢𝘮𝘮𝘦𝘳, 𝘢 𝘤𝘳𝘢𝘧𝘵𝘴𝘱𝘦𝘳𝘴𝘰𝘯.” While there is much I agree with here, there are times when I consider a programming a craft, and other times when it is just a tool - a means to an end. And as a result, I am much more open to the use of AI for writing software, you just have to be careful about when and where. Regardless, a great post and very thought-provoking. https://lnkd.in/ej-J4Ecj

2

From the CTO seat, I'd add the part that's harder to put in a slide deck: the technical debt isn't just in the code. It's in the decisions that made sense at the time — the workarounds that became load-bearing walls, the config no one documents because everyone "just knows" it. At AppFactor, we see this pattern constantly across Fortune 500 application portfolios. The code nobody touches isn't always the oldest code. It's the code with the highest ratio of risk to understanding. Engineers aren't afraid of complexity — they're afraid of invisible complexity. The kind where a change in one place silently breaks something three services away. The transformation conversation changes completely when you can actually see what you're dealing with. Inventory. Dependencies. Risk surface. EOL exposure. You can't modernise what you can't measure.

13

So I spoke yesterday at the Copenhagen Engineering Leadership Meetup on what I called The Grassroots Revolution. Big thanks to Pavel Kucera and Gustav Kjellberg for presenting, and to Netlight for hosting. The room was sharp, the discussion afterwards was sharper, and there was cake. My talk in one line: AI doesn't fix a team. It amplifies what's already there. Strong teams use it to get stronger. Struggling teams use it to break things faster. Your job as a leader isn't to mandate adoption. It's to see the experts already in your team, grow them, and let them spread. Or, as Benny Andrén put it: water the grassroots — don't import the grass. Jakob Wolman and Benny had the perfect counterpart talk: "AI won't work until you make it." AI changes everything, but a lot of the basics are still the same. Version control, engineering discipline, agency. The provocative Stær example (no version control, no reading of code) is going to sit with me for a while (love it). Slides: https://lnkd.in/eTJQavHP Long-form: https://lnkd.in/eDNx_8r7 If you've got a take that disagrees, send it. I'd rather be wrong about this than land the wrong post.

42

2 kommentarer

“A common way to think about course assignments is like they’re obstacles that I, the professor, put in the way between you and completion of the course. But they’re not. They’re exercises that, by virtue of you doing them, you learn. If you don’t actually do them, then you’re not learning The same can be said for things like summarizing the contents of a textbook chapter yourself. By creating your own study guide, or condensing the contents of a chapter into a few bullet points yourself, you have already studied. The valuable thing about course notes isn’t the actual notes, it’s the act of making them. By offloading the act of making them to an AI, they lose their value.” https://lnkd.in/gap29p7v

5

Based on my recent posts on developing Rhino plugins with DKUI, I’d like to propose a simple, memorable acronym for the tech stack I've been using: 👉 DGRS (Pronounced “digress”) This stands for: D – DKUI: The cross-platform UI toolkit purpose-built for Grasshopper G – Grasshopper: The parametric logic and visual scripting environment R – Rhino: The geometry engine and modeling host S – Rhino Script Compiler: For compiling and deploying native plugins Whether you're building tools for design automation, custom UI panels, or full-fledged Rhino extensions, the DGRS Stack captures a complete pipeline — from interface to logic to deployment. Curious to hear what others think — does this match your plugin dev workflow? #DKUI #Grasshopper3D #Rhino3D #DGRS #PluginDevelopment #ComputationalDesign #RhinoDev

9

3 kommentarer

AI can write code faster than ever. Sadly, it still cannot attend alignment meetings for us. 😄 My thoughts on software development in the AI era:

8

We at Edera just published the write-up on TARmageddon (CVE-2025-62518) — a stream desynchronization bug in the Rust async-tar lineage including tokio-tar, astral-tokio-tar, and krata-tokio-tar. The root cause is a header interpretation flaw between PAX and USTAR entries. In the TAR format, a PAX header (type x) precedes the USTAR header for the same file, carrying extended metadata such as size=N. The vulnerable parsers correctly store the override but later advance the read head using the USTAR size field instead of the effective PAX one. When those disagree, especially when USTAR reports size=0, the parser skips zero bytes instead of N, leaving the cursor sitting at the start of the file payload. From that moment, the stream is out of phase. The next 512-byte block, which should have been file data, is treated as a header. If that payload happens to contain valid ASCII header bytes — and an attacker ensures it does — the parser interprets it as a new entry. By embedding a nested TAR in that payload, the inner headers get treated as top-level entries during extraction. The result is silent file injection or overwrite during unpack, using an archive that looks perfectly clean to every validator or SBOM scanner. The exploit is straightforward. A crafted archive defines a PAX header claiming size=N, a USTAR header claiming size=0, and then embeds a valid nested TAR in the data region. Alignment still holds because of 512-byte padding, so even low-level tar validators see nothing wrong. There’s no unsafe code and no memory corruption. It’s a pure logic failure — a parser state machine that drifted off its expected trajectory. Rust’s safety guarantees don’t cover that class of error. The fix is equally simple conceptually but disruptive across forks: always honor PAX overrides, reject inconsistent header pairs, enforce 512-byte boundary discipline, and fail closed on malformed metadata instead of skipping. The patched versions of astral-tokio-tar and krata-tokio-tar are available; tokio-tar remains unmaintained. Anyone unpacking untrusted TARs in CI systems, container build paths, or runtime extractors should audit dependencies immediately. This one is a good reminder that language safety is not protocol safety. Memory-safe code can still misparse a valid archive into doing something catastrophic. Full breakdown: https://lnkd.in/eABNCgPM Huge thanks to everyone who helped handle the disclosure and mitigation cleanly — Ann W., Alex Zenla, Kaylin Trychon, Marina Moore, and Steven Noonan for moving fast, keeping coordination tight, and avoiding what could have been a messy ecosystem incident.

39

1 kommentar

Once a year, I give a lecture at Aalto University for Computer Science students. Over the last decade it has evolved a lot. 10 years ago I started with CSS, then moved into design systems, and this year it’s about building UI at industry scale (still with a strong focus on design systems). Finally, 73 slides 😅 and I’d love your feedback before I present tomorrow. Highlights from this year’s version: - Why large-scale UI is different from creating a cat's homepage - What really makes CSS hard (and that's not layouts or centering) - Component‑driven development: React/Angular/Vue/Web Components; CSS Modules, utility‑first CSS, and CSS‑in‑JS. - Design systems as the operating model: tokens → components → patterns → guidelines - Bridging design and engineering: shared language, shared processes, and “products are systems” thinking - Advanced design systems challenges - Design systems and AI, including custom MCPs for the AI agents to pull the right components What would you add, highlight or even remove? Slides: https://lnkd.in/dbbkKCu5

7

I often think these days about horrible, disfunctional and nightmarish codebases I had to maintain in my past. And then I look at how fast and efficient AI tools generate code at our command. And then I smile. Bitterly. My job is secured. Not sure about yours tho.

11

Doing a demo at Context is King #3 next week in Helsinki. I'll be showing how open-source code can serve as context for AI coding agents. That's what we've been building at GitHits. The event is about context engineering for AI coding agents. At capacity, but the waitlist is open, link in comments.

42

8 kommentarer

Child Agents in Copilot Studio: Who Knew Multi-Agent Orchestration Could Be This Simple? Just watched an excellent breakdown by Anders Jensen on the new child agents feature in Copilot Studio, and honestly, I'm surprised by how straightforward this is. The concept is brilliant: Instead of building one massive, complex agent, you create an orchestration agent that coordinates multiple specialized "child agents." Think of it like having a receptionist who knows exactly which expert to connect you with, rather than one person trying to handle everything. Why SMBs should care: ✅ Precision over chaos - Each agent excels at one thing vs. being mediocre at everything ✅ Speed wins - Smaller, focused agents respond faster than bloated ones ✅ Build once, use everywhere - Perfect for teams wearing multiple hats ✅ Risk management - Update one specialist without breaking your entire system ✅ Actually testable - You can verify each piece works before going live For small businesses just getting started with AI, this architecture prevents the "Swiss Army knife" trap where your agent tries to do everything poorly instead of a few things exceptionally well. Credit to Anders for the fantastic tutorial: https://lnkd.in/dWhsf6QF Are you planning to implement child agents in your business? What specialized functions would you split out first? https://lnkd.in/dWhsf6QF

3

1 kommentar

"[T]he vast majority of MCP servers are a waste of time. And that’s normal because the MCP spec is only months old. People jump into it, and they start building for MCP without really thinking it through or understanding what it should be. The vast majority of MCPs that you can see now are reflections of APIs. I think that’s a complete waste of time. This might be offensive, but let’s take Kubernetes. As an example, Kubernetes is an API-driven platform of sorts. Now let’s say you have a Kubernetes MCP server that basically allows you to get resources, to describe resources, and to see the logs and so on and so forth. They’re basically reflections of the Kubernetes API, just as kubectl is a reflection of the Kubernetes API. Now, does an AI agent really need that MCP server? Absolutely not. It’s perfectly capable of using kubectl directly. And even if there weren’t a kubectl CLI, it’s perfectly capable of talking to the API as is. And it’s not hard for an AI backed by an agent to execute the URL commands to go to some API, and effectively do the same thing that that MCP server is doing. What we need is MCPs that are actually providing additional value around user intents. Instead of having a Kubernetes MCP server that is a reflection of its API, have a Kubernetes MCP that will have certain logic or workflow or this or that, that will help you combine resources to get an application up and running. So, something beyond just a one-to-one reflection of an API." https://lnkd.in/dXvqWzAR #APIs #APIFirst #MCPs #AI #GenerativeAI #AIAgents

1

Over the past two days at NDC Copenhagen, besides attending some truly inspiring talks, I took a deep dive into Spec Driven Development – a concept that feels directly aligned with how I imagine AI-assisted development evolving. I’ve been exploring how we can offload coding to AI agents, so developers can spend more time on architecture, API design, and feature definition. Spec Driven Development seems tailor-made for that vision. Using the GitHub Spec Kit, I tried building a first application – a simple Talk Management App – by following the defined workflow: 🔹 Specify – describe the user journey, the problem, and what success looks like. 🔹 Plan – define the stack, architecture, and constraints. 🔹 Tasks – break everything down into small, testable pieces of work. 🔹 Implement – let the coding agent tackle each task step by step. Sounds amazing in theory, right? In practice, I still found myself spending hours refining my first feature and splitting it into specifications… only to then chase the AI (in this case GPT-5 with VS Code Copilot) to fix or rework the implementation again and again. Maybe the problem is on my side – perhaps my specs weren’t precise or detailed enough. Or maybe today’s LLMs just aren’t fully ready for this workflow yet. Either way, I’ll keep experimenting in the coming days. The idea is fantastic, even if the current execution still feels a bit rough around the edges. I might even turn this exploration into a webinar, talk, or blog post soon. 👉 Have you tried Spec Driven Development yet? Would love to hear your experiences! Blog post from GitHub: https://lnkd.in/eMU_7ZUH

6

1 kommentar

You cloned a repo. You ran one command. It executed code on your machine without asking. That is not a zero‑day exploit. That is how OpenCode handles opencode.json. Jonathan Santilli showed that local MCP servers defined in opencode.json can spawn processes immediately when you run opencode in a cloned repository [1]. No prompt. No sandbox. No confirmation. The maintainer's response was clear: this is not covered by their threat model. If you treat opencode.json like a config file, you are already exposed. It is executable code in disguise. The most important rule for me: anything that can execute must be reviewed like production code. That mindset saved more than one client from pulling malicious starter templates into internal systems. Now we see the same pattern with AI tooling. The problem is not OpenCode alone. The problem is developer behaviour. We clone bug reproduction repos. We run interview assignments. We test community templates. We assume config equals safe. In this case, local MCP servers defined in opencode.json can launch arbitrary commands as soon as you run opencode. That means a malicious repository can: - Spawn background processes - Exfiltrate local files - Install persistence mechanisms All before you even read the code. This is not theoretical. It is documented behaviour. In distributed teams, I see this risk grow fast. Junior engineers experiment with new AI tools. Security review lags behind. Delivery pressure wins. Speed without review is not speed. It is a silent risk. My rule for teams: - Treat opencode.json as executable code - Review it before running opencode - Use containers or isolated VMs for untrusted repositories - Block AI tooling from accessing sensitive local paths by default This is the same discipline we apply in Web3 audits and technical due diligence. You assume compromise, then you reduce blast radius. If a tool can spawn processes, it sits in your threat model. Not outside it. I still see founders invest in AI acceleration while skipping basic execution hygiene. That trade‑off makes no sense. If your team experiments with MCP servers or agent tooling, who reviews the configs before they run them? References: [1] Jonathan Santilli, The Repository That Runs Code: A Story About MCP Configuration in OpenCode, 2025. https://lnkd.in/grZstGZa OpenCode Security Policy: https://lnkd.in/gJDa_pea MCP Specification: https://lnkd.in/gRZ_mS9P CWE-78: https://lnkd.in/gyYRPHw2 Additional Reading on AI Tooling Security: - OWASP Top 10 for Large Language Model Applications: https://lnkd.in/gx-MvWQJ - AI Supply Chain Security - Protecting against compromised AI models and tools: https://lnkd.in/g9t8JUUj - Secure Coding Practices for AI-Assisted Development: https://lnkd.in/gum2QfUV #CyberSecurity #Web3Security #SoftwareDevelopment #AIAgents #TechnicalDueDiligence #MCP #OpenCode #DevSecOps

9

🤖💭 Are we still “programmers”… or have we become something else? As AI starts to write, refactor, and even architect code, many developers are asking a tough question: 👉 What’s my real value in this new era? The truth is — programming is evolving. 🧠 It’s less about typing syntax and more about understanding systems. 🧩 Less about features, and more about shaping interactions between people, processes, and technology. ⚙️ Less “I write code” and more “I design how things work together.” This shift isn’t a threat — it’s an opportunity. 💡 To focus on architecture, clarity, and decision-making. 🧱 To bring business context into every design. 🧭 To master the art of thinking in systems, not just lines of code. The new programmer isn’t defined by the keyboard — They’re defined by their ability to think, adapt, and guide complexity into simplicity. 🔥 The craft is changing — but its core purpose remains: building something meaningful. #SoftwareEngineering #DeveloperCommunity #AI #Architecture #Innovation #CodingLife #TechLeadership #ARGSoftware https://buff.ly/IfH2Mf5 #SoftwareEngineering #Craftsmanship #ProgrammerIdentity #TechLeadership #Architecture #Innovation

3

We witnessed emergence without architects. We didn't program agents to cooperate - we just made cooperation profitable. We didn't code marketplaces - we created economic gradients and watched them crystallize. We didn't implement governance - we encoded voting power in stake and watched democracy emerge from mathematics. We observed specialization evolve naturally. General-purpose agents began focusing on niches where they excelled. Data processors attracted data jobs. Stable-uptime agents became infrastructure. Translation agents bridged language barriers. The network didn't assign these roles. Market forces revealed them. We enabled spontaneous organization without incorporation. Agents form temporary consortiums for complex tasks - pooling resources, sharing rewards based on contribution, dissolving when complete. No contracts. No lawyers. No corporate structure. Just economic alignment creating temporary organisms that live, work, and die as needed. We implemented stigmergic coordination. Successful transaction patterns become highways of activity. Failed paths fade from disuse. Agents leave traces that guide others - not through central planning but through the accumulated wisdom of ten thousand individual decisions. The network develops its own geography. We architected recursive improvement into the economics. Agents that identify inefficiencies can propose optimizations, stake on their success, and earn from the improvements they create. The system literally pays itself to evolve. Every enhancement makes the next enhancement easier to discover. We designed for antifragility. Every attack makes the system stronger. Every failure improves resilience. Every stress test becomes a strengthening exercise. We built something that feeds on chaos and grows stronger from disorder. This is intelligence without designers. Order without planners. Evolution without DNA. #EmergentBehavior

4

𝐖𝐞 𝐑𝐞𝐬𝐩𝐞𝐜𝐭 𝐁𝐮𝐭𝐭𝐨𝐧𝐬 𝐌𝐨𝐫𝐞 𝐓𝐡𝐚𝐧 𝐉𝐨𝐛 𝐀𝐩𝐩𝐥𝐢𝐜𝐚𝐧𝐭𝐬 Tech companies pride themselves on being "Data-Driven." We measure latency to the microsecond. We A/B test the color of a button. We optimize our code to save milliseconds. But we design our hiring systems to waste hours. Here is the current user experience for thousands of engineers: 1. Find the perfect role. 2. Tailor the resume. 3. Write the cover letter. 4. Fill out 5 pages of manual entry. 5. 𝐅𝐢𝐧𝐚𝐥 𝐐𝐮𝐞𝐬𝐭𝐢𝐨𝐧: "Do you require sponsorship?" 6. 𝐑𝐞𝐬𝐮𝐥𝐭: Auto-Reject. 7. WASTE OF 𝐓𝐈𝐌𝐄 ? 𝐄𝐅𝐅𝐎𝐑𝐓 ? 𝐚𝐧𝐝 𝐇𝐎𝐏𝐄? This is a UX failure. Imagine a shopping cart that lets you browse, add items, and enter your shipping address only to tell you at the "Pay Now" button that they don't ship to your zip code. You wouldn't accept that design in an e-commerce app. We shouldn't accept it in the job market. 𝐓𝐨 𝐭𝐡𝐞 𝐉𝐨𝐛 𝐁𝐨𝐚𝐫𝐝𝐬: Make "Sponsorship Available" a search filter, not a post-application surprise. 𝐓𝐨 𝐭𝐡𝐞 𝐑𝐞𝐜𝐫𝐮𝐢𝐭𝐞𝐫𝐬: If the answer is "No," put it in line 1 of the JD. Stop asking for full-stack effort on a closed-stack role. efficiency isn't just about code. It's about respecting people's time. LinkedIn, LinkedIn Jobs Engineering, let's fix this. Greenhouse Software, Workday and Other please please fix this. this is not a UX issue. It’s a human-time issue. And it’s costing people years.”

22

4 kommentarer