Vincent Sgherzi

I honestly thought that the people writing web facing stuff were just more skilled and careful. I know see that it can happen to anyone.

Bad day to launch my PHP based certificate authority

I need either the monktober fest talks or the oxide and friends podcast asap. It’s been 3 weeks without niche pop culture references I’m too young to understand. @oxide.computer @monktoberfest.com

AI is gonna wipe out most jobs, but not mine because... ...I'm building software factories ...I'm using AI to accelerate ...I started a community using AI ...I use these 7 steps follow me to learn ...I ship 500 PRs a second Shut up and go build meaningful relationships.

Everyone’s been on edge with supply chain attacks. A first party check for uploading crates is EXACTLY what I was hoping for. Good on the foundation and I can’t wait to see this rolled out. I’d love to see more strict auditing for especially popular crates #rust #rustlang

Welcoming Jess Izen as our new Engineer in Residence! For the next year she'll work with our team (while staying at AWS) on crates.io security and support for #rustlang community libraries, starting with malicious crate detection for new publishes! 🦀 Learn more: rustfoundation.org/media/welcom...

I wrote a thingy. sockpuppet.org/blog/2026/08...

there is no such thing as "age verification." All "age verification" is actually "identity verification." You can coat it in glitter and "privacy-preserving" wrapping paper. But in the end, mandating age verification means mandating surveillance be built into software and hardware. Period.

it's 2020 and there's an overflow in zoom. It's 2026 and there's an overflow in zoom.... a.security/blog/asecuri...

The recording of my talk from Software Should Work is now up. :) www.youtube.com/watch?v=0BXu...

I had a chat with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund Funding open source is a huge topic right now, the Rust Foundation has some great ideas. It will be exciting to watch this one grow and evolve #OpenSourceSecurity #rust #RustFoundation

Beautiful: engineers “must be arrogant enough to see the world as it isn’t, but humble enough to accept the world as it is” @oxide.computer rfd.shared.oxide.computer/rfd/0003

TIL sleepingrobots.com/dreams/stop-...

vincents.dev/blog/go-is-n... #rust #rustlang #go #golang #software

I've noticed on Macos 26 any third party menu bar program I install will cause the console application to fill with logs with "WindowServer _CGXPackagesSetWindowConstraints: Invalid window" seems to be thrown from somewhere deep inside MacOS' windowserver. #macos #apple #mac

The peril of laziness lost bcantrill.dtrace.org/2026/04/12/t...

Wrote a blog post about how this works: joyeecheung.github.io/blog/2026/03...

“As a developer, I want to kill myself when working with Wayland code.” www.p4m.dev/posts/29/ind... This is why we’re stuck with electron everywhere. The desktop failed to provide unified ergonomic apis #c #linux #wayland #x11 #electron #javascript

There has never been a time in my life when I have been less enthused to be a programmer than now.

leginfo.legislature.ca.gov/faces/billTe... this shit is ridiculous. Why does my fucking micro controller need age verification #law #california #software

United States Colorado Sen\. Matt Ball and Rep\. Amy Paschal have authored bill SB26\-051\. ︀︀ ︀︀SB26\-051 would require Operating System, such as Windows or Linux, to perform age verification on users which then third party apps can leverage via API to ensure someone's age\.

Godot's GitHub has increasingly many pull requests generated by LLMs and it's a MASSIVE time waster for reviewers – especially if people don't disclose it. Changes often make no sense, descriptions are extremely verbose, users don't understand their own changes… It's a total shitshow. #godotengine

Rust still dosent have first class support for bit fields :’) #rustlang #rust

"We haven't got the money, so we'll have to think" is among the quotes pinned to my wall

🦀 curious what the crates.io team has been up to? blog.rust-lang.org/2026/01/21/c... provides a high-level summary of our work over the past 6 months It includes a new Security tab, GitLab support for Trusted Publishing, SLoC counting, and many other things #rustlang

Handling rust errors without dependencies vincents.dev/blog/rust-er... #rust #rustlang

Just to make it abundantly clear: don’t post people’s home addresses to the internet what is wrong with you

"uk banning VPNs for those under 16" at this point they might as well just fork the GFW. Dumb ass laws by those who can't attach a pdf to an email.

Does anyone use the newer [track _caller] macro in their custom errors? How are folks usually figuring out where the error occurred? On another note if I don’t want to use a crate is map_err the only real way to provide context for an error? #rust #rustlang #software

Your intellectual fly is open bcantrill.dtrace.org/2025/12/05/y...

In more than decade of writing Rust, I have never once in my life needed back pointers for anything.

*cowering in the fetal position* rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fixes this rust fi

#rustlang hot take: We should rename .unwrap() to .or_panic(). (And .expect() to .or_panic_with().) "Unwrap" is a terrible name for the panicking function, especially since we also have things like .unwrap_or() and .unwrap_or_default() which never panic.

blog.cloudflare.com/18-november-... Why does the cloudflare codebase allow for .unwrap() Ideally it should be banned via clippy lints. The entire point of errors as values is that this sort of thing can be handled. They could've just used a match on the result. #rust #rustlang #cloudflare

Britain continuing their long history of leadership in ruining the world

“We adopted #rustlang for its security and are seeing a 1000x reduction in memory safety vulnerability density ... with Rust changes having a 4x lower rollback rate and spending 25% less time in code review, the safer path is now also the faster one.” security.googleblog.com/2025/11/rust...

me: "Software owes it to its users to be secure" HN: "there is no such obligation" We owe it to the craft to product correct and performant software. We are meant to understand and mitigate risk so others don't have to. This is the social contract of being a software engineer. #rustlang

Forgive me, for I have broken my vow to not tweet.

Does async rust cause autism? I’m just asking questions.

I've done a 180 on supply chain security - I used to think it was mostly a theoretical problem: between communities of mostly good actors, many eyes to review, good policies for announcing vulns and removing crates, and basic due diligence, issues would be found and addressed before doing damage

edera.dev/stories/tarm...