simmoril🇵🇭🇺🇦✊ @simmoril

A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name. He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping. His name is Fabrice Bellard. Here is the story, because almost nobody outside the systems programming world knows what one man has built. Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code. In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years. Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it. He was not done. In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth. He kept going. In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real. In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark. Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory. Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links. A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet. He is still shipping.

Linus Torvalds explains "taste" in code by showing how to remove an entry from a singly linked list in C without adding extra complexity.

the engineering teams/people that build their systems with debug-ability and introspection as first principles are going to side-step this (probably short) period of painful AI-induced tech debt

Adam Rackis @AdamRackis

5 months ago

The mountain of ai slop tech debt that's coming is gonna be wild 😏😬

33 16 482 60K 41

these types of bugs give me nightmares, imagine trying to debug something like this in prod

Tavis Ormandy @taviso

9 months ago

Sometimes it really is a cpu bug 😂 A weird AVX512 bug on Zen 4 (Genoa) just got officially confirmed as erratum 1514 in the latest spec update. There's a workaround/chicken bit too. My testcase: godbolt.org/z/4zE8svEPK

5 38 261 46K 67

My security strategy in one sentence: if engineering doesn't like working with you, you aren't going to have a secure environment no matter what else you do.

It's never too late to get started:

MIT CSAIL @MIT_CSAIL

10 months ago

To give context on age, Grace Hopper began computing at 38, completed the first compiler at 46, helped shape COBOL at 53, kept developing COBOL for the Navy in her 70s, retired from the Navy at 80 & then became a consultant for the Digital Equipment Corporation. v/@cooperx86

30 259 1K 68K 249

Having to frequently patch is a sign of a poor security architecture.

Luke Stephens (hakluke) @hakluke

10 months ago

What’s your cybersecurity take that’s got you like this? I’m heading out but when I’m back I’ll drop some of my own in the comments.

125 15 215 69K 52

One of my favorite aspects of discovery of buffer overflows is how the Morris worm used literally the exact same technique (overwrite stack pointer, jump to hand-written machine code that issues direct system call to exec /bin/sh) in 1988. That's 7 years of it in public domain.

Today In Infosec @todayininfosec

10 months ago

1995: Mudge published "How to Write Buffer Overflows", one of the first papers about buffer overflow exploitation. Afterwards, Mudge sent a copy to Aleph One, who later wrote "Smashing the Stack For Fun and Profit" in 1996. Seminal security paper to seminal security paper.

8 128 618 50K 221

A personal update... after nearly 20 years at Google, today is my last day! I'm going to be working on independent research for the foreseeable future, then who knows! I've worked with so many talented people, made so many friends and seen incredible research over the years 🫡

A major cheat code in life: Being a pleasure to deal with. Kind when others aren’t. Calm when things go sideways. Reliable under pressure. Intelligence alone is overrated. Be someone who lightens the load for folks around them. People value people who make their lives easier.

Dont know if I can think of a time an athlete at the top of his sport has been this open and honest about their craft

Is Oxide Hyperconverged Infrastructure (HCI)?

This Dostoevsky line destroyed me

👋 Please join us in welcoming @RolfRolles as Hex-Rays’ new Chief Scientist! Rolf brings decades of RE expertise, with standout work in obfuscation, decompilation, and software protection. At Hex-Rays, he’ll lead research into next-gen decompilation and automated program understanding to keep our tools at the cutting edge. We’re thrilled to have him on board! #ReverseEngineering #IDAPro #BinaryAnalysis #Decompilation

FWIW today is my first day at @OpenAI. Very exited to work with the team on the sharp edge of security and AI!

If there’s one thing that drives me absolutely bonkers in code review, it’s this 100%

Anton Zhiyanov @ohmypy

2 years ago

Early return is probably the most underrated practice, even among experienced developers.

keyboard_arrow_left Previous keyboard_arrow_right Next

446 428 7K 2.2M 2K

Filipinos and Filipino Americans have enriched the very essence of America. This Filipino American History Month and always, I hope each one of you feels pride – not only in your achievements and aspirations, but also in the dreamers and doers around you.

The secret behind Steph Curry's greatness? A revealing anecdote from 2007.

keyboard_arrow_left Previous keyboard_arrow_right Next

Only highlighting security failures and not highlighting good security designs creates security nihilism and learned helplessness. People give up when they don't think winning is possible or know how. If you don't want your teams to give up, celebrate proactive security wins.