# Blog

> Writing on software architecture, security and AI

Source: https://samye.li/blog/

- 2026-11-02 · [NFS World in the Browser: From 11 fps to 80](https://samye.li/blog/nfs-world-in-the-browser-performance/): Need for Speed World is a 2010 Windows game. We run it in Chrome by lifting its x86 code to WebAssembly and its Direct3D 9 calls to WebGPU. It started at 10–11 fps. This is how we profiled it, what was actually slow, and what fixed it.
- 2026-08-11 · [Stop Defending Your Moat with Policy (3/5)](https://lodos.md/en/blog/make-your-moat-a-ratchet) (lodos.md): Policy moats rot the moment a junior engineer or a late-night refactor arrives. Two assertions run on every commit, one that fails the build on a refusal regression and one that fails the wiki on a forgotten lesson, both sealed in the same HMAC chain.
- 2026-07-02 · [We Built a Workflow Engine That Can't Have n8n's CVE (1/5)](https://lodos.md/en/blog/workflow-engine-cant-have-n8n-cve) (lodos.md): n8n shipped a CVSS 9.9 RCE through expression eval. The lodos workflow engine can't have that bug, there's no evaluator anywhere to inject into, and a build-time grep keeps it that way.
- 2026-07-02 · [Zero-Knowledge as Architectural Blindness (2/5)](https://lodos.md/en/blog/zero-knowledge-architectural-blindness) (lodos.md): Most secret managers expose getSecret(name), and the plaintext lands in the AI's transcript. The lodos schema makes that exchange structurally unanswerable, the AI cannot see a secret's value, and the build enforces it.
- 2026-06-22 · [A wiki that maintains itself: the Karpathy LLM-wiki pattern](https://lodos.md/en/blog/self-maintaining-wiki-karpathy-pattern) (lodos.md): Most company wikis rot the moment you stop tending them. The Karpathy LLM-wiki pattern turns a knowledge base into something your AI keeps alive. Here's how.
- 2026-06-15 · [Local-first software: why your company's data belongs on your machine](https://lodos.md/en/blog/local-first-software-own-your-data) (lodos.md): The cloud became the default home for everything you own. Local-first flips that back: your data lives on your device, works offline, and answers only to you.
- 2026-06-08 · [How your AI uses your Stripe key without ever seeing it](https://lodos.md/en/blog/ai-that-cant-read-your-secrets) (lodos.md): The runtime secret-injection pattern that lets lodos charge a customer with your Stripe key, while the key never enters the AI model's context.
- 2026-05-30 · [Why we built a zero-knowledge company OS](https://lodos.md/en/blog/the-zero-knowledge-company-os) (lodos.md): Your company lives scattered across tools that all want your data on their servers. Here's why lodos keeps everything on your machine, and can't read a byte.