Predrag Gruevski

@predr.ag

Querying (Almost) Everything // Frontier Systems @ OpenAI // Author of cargo-semver-checks & Trustfall // https://predr.ag/blog // ex Kensho // MIT alum // https://hachyderm.io/@predrag // not from around here 🇲🇰 // he-him

@astrojaz.bsky.socialReposted by @predr.ag

in honor of margaret hamilton, i’m posting this iconic image of her standing next to the printed apollo flight software that she and her team developed that helped take humans to the moon. rest in peace to an incredible inspiration for women in the space industry.

Margaret Hamilton standing proudly next to a large stack of books as tall as her.
@predr.ag

Excited to chat with Orhun on the livestream tomorrow! I'll bring my bag of spicy hot takes 🌶️ It's gonna be great, hope to see you all there.

@thdxr.comReposted by @predr.ag

a weird inversion with LLMs is the models improve faster than the tinkerers when i see people with custom workflows and setups they're all addressing problems that don't exist anymore the person naively using vanilla codex is more likely to be experiencing state of the art

@predr.ag

Yes, this is SemVer-major. In general, implementing a pre-existing unsealed trait on a pre-existing type where the orphan rule wouldn't apply is a major breaking change.

@predr.ag

New cargo-semver-checks release 🎉 Variadic functions have only been stable for a few days, and we immediately have SemVer lint support for them.

cargo-semver-checks v0.51.0 release page. C-ABI variadic functions are new in Rust 1.99, and this is the first time a new language feature has had immediate SemVer linting support in the corresponding `cargo-semver-checks` release. - Six new lints for variadic functions: - `function_no_longer_variadic` - `function_now_variadic` - `inherent_method_no_longer_variadic` - `inherent_method_now_variadic` - `trait_method_no_longer_variadic` - `trait_method_now_variadic` - Bugfix in `inherent_method_now_doc_hidden` when multiple `impl` blocks for the same type have the same method name - Support for symlinks inside git repos used by the `--baseline-rev` flag - Thanks to @heaths for the initial PR that helped set this up. - Lots of security hardening, both in this repository and in dependencies that I also manage
@ieni.devReposted by @predr.ag

I’m now team leader of the Rust Infrastructure team! I’ll keep shipping, but I’ll also pay more attention to the load, health, and overall direction of the team.

https://rust-lang.org/governance/teams/infra/
@theophite.bsky.socialReposted by @predr.ag

yes, i am saying this. literally this. i am saying that you should not care about water for 16,000 people when "growing alfalfa for export in deserts with approximately zero precipitation" is literally orders of magnitude more water and vastly more pointless.

@predr.ag

I keep saying, big SemVer is always hard at work adding more SemVer 😆 Little-known fact, I wrote a cargo-semver-checks equivalent for Python, and it could handle both positional and keyword arguments, including their "only / both" flavors. It was kind of amazing how many footguns were in there.

@predr.ag

This security issue, and ones yet to come, all require a team effort. I'm proud of Rustaceans' willingness to lead with urgency and repeatedly choose a "fall into the pit of success" approach. Knowing that the language, toolchain, and community have my back is why I love being here 🦀

@predr.ag

In response, the Codex team and I have been working to equip the defenders with the best tools. On top of Codex for OSS with our latest models, we've also extended tens of thousands of dollars' worth of API credits to Rust's security professionals. As a start. There's more to be done.

@predr.ag

GitHub Actions + Rust's Miri can leak your secrets in CI 🧵 If you run Miri in CI: - upgrade to the 2026-09-22 nightly - clear caches - rotate any secrets that the `cargo miri` CI job had access to GPT-6 Astra helped find this 🦀

GitHub Actions makes it possible to cache directories between runs. Typical setups allow CI runs on main (and other branches) to write to cache, and PRs can only read from cache (preventing cache poisoning). Rust projects tend to speed up CI by caching binaries built by cargo install and sometimes the contents of target/. PR CI can be triggered by anyone who can open PRs on your repository. GitHub requires maintainer approval for the first PR, but future PRs will rerun CI on every push. Anyone who has previously landed a change can trigger a CI run extracting information from cached target/ and then cover their tracks by pushing a second commit to the PR. GitHub sometimes hides overwritten commits in its UI, making this kind of attack harder to detect. CI run logs and overwritten commits are also deleted after a few months. When cargo miri is invoked, Miri needs to retain build-relevant environment variables between runs. The current code to do so achieves this by storing all environment variables to target/. This, of course, persists when target/ is cached. If your environment contained secrets, these can now be accessed by PRs via the cache.
Older posts