Owen O'Malley

I made an explorable esoteric research environment with a Custodian named MERIDIAN that can launch its own agent swarms to solve problems. Does isopsephic arithmetic and lookup for any Neoplatonists :-) https://lnkd.in/gYzqVn7m

1

1 Comment

Jensen Huang just called OpenClaw "the most important release of software, probably ever." When it comes from the man who defined the GPU era, then people listen ( after discounting the vested interest obviously :) While people focus on his quote, we should understand that the real story is adoption speed of Openclaw: it took 3 weeks to reach Linux's 30-year milestone. That's not growth, but an explosion. OpenClaw isn't a tool. It's the operating system for agents that do work. When NVIDIA's CEO calls a project THE thing, every CTO adds it to their roadmap. ByteDance, Alibaba, Tencent are integrating OpenClaw —not for GitHub stars, but because they're terrified of falling behind. On March 6, 2026, nearly 1,000 people queued outside Tencent's Shenzhen headquarters for free, on-the-spot installation of OpenClaw AI. That shows the desperation to be in-step with the technology. In many orgs, OpenClaw is already in production. JPMorgan handles fraud detection with it, Walmart wired it into loan approvals. These are real systems with real money and stakes. The Agenci AI market is fragmented: LangGraph, CrewAI, AutoGen, LangChain, Semantic Kernel, smolagents, PydanticAI. Seven frameworks fighting. But the outcome is obvious. Whoever controls the execution layer controls the decade ahead. The builders who shipped agents in 2024 when LLMs were not ready for it, they already know the significance of these events in 2026 . Which side of this are you on?

74

22 Comments

New blog post: A Fork in the Road: Deciding Kafka's Diskless Future. Kafka is getting serious about S3 and finds itself at an architectural crossroads that will shape its next decade. Several new KIPs (1150, 1176, 1183) aim to reduce replication costs across cloud availability zones, but the implications go far beyond networking cost. It’s a mistake to think of S3 as simply a cheaper disk or a networking cheat. Building on object storage opens the door to operational benefits such as elastic, stateless compute — something many modern analytics systems already exploit. In my latest post, I outline two competing future paths: 🔹 Evolutionary path: Reuse large parts of existing Kafka components to reduce code changes and long-term maintenance. 🔹 Revolutionary path: Separate stateless and stateful layers to realize the full operational benefits of disaggregated storage. The post examines the trade-offs of each path, how the current KIPs map to these two paths and poses a broader question: what should Kafka become? And what will keep it relevant in the decade ahead? https://lnkd.in/d4E2BAe4

149

12 Comments

AI-tools are everywhere, but they require thoughtfulness, creativity, and grit to use well. Josh continues to blaze the trail on this at Encamp. If you're interested in getting the most of AI development in an existing and fast-moving code base, I highly recommend reading this post.

9

We at Edera just published the write-up on TARmageddon (CVE-2025-62518) — a stream desynchronization bug in the Rust async-tar lineage including tokio-tar, astral-tokio-tar, and krata-tokio-tar. The root cause is a header interpretation flaw between PAX and USTAR entries. In the TAR format, a PAX header (type x) precedes the USTAR header for the same file, carrying extended metadata such as size=N. The vulnerable parsers correctly store the override but later advance the read head using the USTAR size field instead of the effective PAX one. When those disagree, especially when USTAR reports size=0, the parser skips zero bytes instead of N, leaving the cursor sitting at the start of the file payload. From that moment, the stream is out of phase. The next 512-byte block, which should have been file data, is treated as a header. If that payload happens to contain valid ASCII header bytes — and an attacker ensures it does — the parser interprets it as a new entry. By embedding a nested TAR in that payload, the inner headers get treated as top-level entries during extraction. The result is silent file injection or overwrite during unpack, using an archive that looks perfectly clean to every validator or SBOM scanner. The exploit is straightforward. A crafted archive defines a PAX header claiming size=N, a USTAR header claiming size=0, and then embeds a valid nested TAR in the data region. Alignment still holds because of 512-byte padding, so even low-level tar validators see nothing wrong. There’s no unsafe code and no memory corruption. It’s a pure logic failure — a parser state machine that drifted off its expected trajectory. Rust’s safety guarantees don’t cover that class of error. The fix is equally simple conceptually but disruptive across forks: always honor PAX overrides, reject inconsistent header pairs, enforce 512-byte boundary discipline, and fail closed on malformed metadata instead of skipping. The patched versions of astral-tokio-tar and krata-tokio-tar are available; tokio-tar remains unmaintained. Anyone unpacking untrusted TARs in CI systems, container build paths, or runtime extractors should audit dependencies immediately. This one is a good reminder that language safety is not protocol safety. Memory-safe code can still misparse a valid archive into doing something catastrophic. Full breakdown: https://lnkd.in/eABNCgPM Huge thanks to everyone who helped handle the disclosure and mitigation cleanly — Ann W., Alex Zenla, Kaylin Trychon, Marina Moore, and Steven Noonan for moving fast, keeping coordination tight, and avoiding what could have been a messy ecosystem incident.

39

1 Comment