CTO at Vercel @cramforce on Twitter industrialempathy.comhttps://bsky.app/profile/industrialempathy.comhttps://bsky.app/profile/industrialempathy.com/post/3m3fkpf7dx22gWe're celebrating the life of Mikeal, creator of request, forker and reuniter of Node.js, renaissance and family man on November 12. We received a very generous donation and are now able to make this event completely free. Looking forward to see all of you! an-event-mikeal-would-have-liked.com https://an-event-mikeal-would-have-liked.com/17 Oct 2025 15:12 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3m3fkpf7dx22ghttps://bsky.app/profile/industrialempathy.com/post/3m2kj3dzy2c2qTo honor a great friend and open-source pioneer Mikeal Rogers we're organizing a "conf" and charity auction. I'll be auctioning an exclusive wagyu BBQ at my house for up to 15. Join us and ideally offer more donations! All proceeds go to his wife and 2 kids an-event-mikeal-would-have-liked.com https://an-event-mikeal-would-have-liked.com/06 Oct 2025 21:01 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3m2kj3dzy2c2qhttps://bsky.app/profile/industrialempathy.com/post/3lz2pwpzpfk2zPrompt injection is sometimes called an "unsolvable". But we shouldn't give up like that. I've been on a mission to introduce hard security boundaries into AI agents and this is the next step: What if compromised MCP tools couldn't just passively prompt inject your app? [contains quote post or other embedded content]17 Sep 2025 20:56 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lz2pwpzpfk2zhttps://bsky.app/profile/industrialempathy.com/post/3lqaat6tr6s2kI'm traveling to Berlin next week and we're doing a Vercel meetup to celebrate the opening of our new Berlin office. I have a whole queue of blog posts about agents coming out and will be turning them into a lightning talk, and we'll have a panel, etc. The usual! https://partiful.com/e/9Is88RwZV95uLTTEFsxP28 May 2025 12:55 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lqaat6tr6s2khttps://bsky.app/profile/industrialempathy.com/post/3loa7jdx2i22uCan't wait to spend the summer at the pool03 May 2025 01:41 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3loa7jdx2i22uhttps://bsky.app/profile/industrialempathy.com/post/3lnqmxxjcnc2eWe looked deeply into the recent React Router/Remix CVE & deployed mitigation for Vercel customers through our firewall - It enables stored XSS - High likelihood that any React Router app is impacted - If using another CDN action may be required - Upgrade recommended https://vercel.com/changelog/protection-against-react-router-and-remix-vulnerabilities-cve-2025-4386426 Apr 2025 20:59 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lnqmxxjcnc2ehttps://bsky.app/profile/industrialempathy.com/post/3lg2kagakbk26I finished university in 2004 and made a big stupid mistake: I wrote my thesis in German. I've literally been sad about this ever since. But AI to rescue: I dusted off an old PDF and had Gemini Pro translate it to English https://industrialempathy.com/posts/p2p-transactions/#6-trust19 Jan 2025 00:16 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lg2kagakbk26https://bsky.app/profile/industrialempathy.com/post/3lfknszku2k2pDoes anyone know the status of the Private State Token API? It seems shipped in Chrome but the demos appear broken and it doesn't look like Google shipped a generic issuer like Apple did for Private Access Tokens.12 Jan 2025 16:37 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lfknszku2k2phttps://bsky.app/profile/industrialempathy.com/post/3leull2ge5223I just remembered how an internet mob chastised the Google intern who wanted to ship an async version of Local Storage using tech that allowed shipping Chrome feature using only JS knowledge. Both the feature and the underlying tech was killed. Imagine what could have been.03 Jan 2025 21:58 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3leull2ge5223https://bsky.app/profile/industrialempathy.com/post/3lektqk2fzc2fFingerprinting is bad for privacy because it is out of user control. The villainification of browser cookies has pushed the world into a direction that is objectively worse for users. Cookies you can delete, auto-rotate, scope per site. Fingerprints stay with you https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting/31 Dec 2024 00:58 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lektqk2fzc2fhttps://bsky.app/profile/industrialempathy.com/post/3lek7rbabqk22Corporate organizations are distributed systems! My new blog post somewhere between tautology, cause of course they are, and hot take. But I think I might have stumbled over a helpful framing to manage risk & velocity when shipping software in larger teams https://www.industrialempathy.com/posts/organizations-are-distributed-systems/30 Dec 2024 19:00 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lek7rbabqk22https://bsky.app/profile/industrialempathy.com/post/3lefzrpfsts2sMost folks outside the US don't realize that Fahrenheit is a super intuitive temperature unit. The degrees Fahrenheit, represent the maximum miles per hour you can drive safely at the temperature29 Dec 2024 03:03 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lefzrpfsts2shttps://bsky.app/profile/industrialempathy.com/post/3ldy6mkx6lc26I was randomly looking at the Vercel Firewall for my personal site. Turns out a small attack was mitigated. I then looked at our global dashboard, and, indeed, the attacker only hit my site and they got a total of 19 requests through before they were blocked. What have I done to you, attacker?23 Dec 2024 14:52 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3ldy6mkx6lc26https://bsky.app/profile/industrialempathy.com/post/3ldlohfgnvs2iRight now Vercel responds with your project's HTML 404 response for all system-identified 404s (for functions/APIs you control the response directly). How would you feel if we changed it such that we responded with a generic response if the client doesn't expect HTML?18 Dec 2024 15:31 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3ldlohfgnvs2ihttps://bsky.app/profile/industrialempathy.com/post/3ldjirpokh22eThe Rise of the AI Crawler [contains quote post or other embedded content]17 Dec 2024 18:44 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3ldjirpokh22ehttps://bsky.app/profile/industrialempathy.com/post/3ldefwzbcys2uBlue sky15 Dec 2024 18:10 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3ldefwzbcys2uhttps://bsky.app/profile/industrialempathy.com/post/3ld5kzpbdvk2sExcited about my demo tomorrow at the internal Vercel hackathon13 Dec 2024 00:52 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3ld5kzpbdvk2shttps://bsky.app/profile/industrialempathy.com/post/3lctjgdl32k2lYou can't make this up: The spec for SSRing web components is itself not isomorphic. It only works when running through the document parser, but not innerHTML. Respectively, the code needs to know where it is running and use vastly different code paths.09 Dec 2024 00:57 +0000at://did:plc:efr3ow2v22u45efltglpm3rs/app.bsky.feed.post/3lctjgdl32k2l