Senior full-stack engineer and founder of gazla.co and lodos.md. Writing about software architecture, security and AI.https://samye.li/enSat, 07 Nov 2026 15:54:16 GMThttps://samye.li/icon-512.pnghttps://samye.li/https://samye.li/blog/nfs-world-in-the-browser-performance/https://samye.li/blog/nfs-world-in-the-browser-performance/Need for Speed World is a 2010 Windows game. We run it in Chrome by lifting its x86 code to WebAssembly and its Direct3D 9 calls to WebGPU. It started at 10–11 fps. This is how we profiled it, what was actually slow, and what fixed it.Mon, 02 Nov 2026 00:00:00 GMTwebassemblyperformancewebgpureverse-engineeringnfsworldsam@samye.li (Samet Samyeli)https://lodos.md/en/blog/make-your-moat-a-ratchethttps://lodos.md/en/blog/make-your-moat-a-ratchetPolicy moats rot the moment a junior engineer or a late-night refactor arrives. Two assertions run on every commit, one that fails the build on a refusal regression and one that fails the wiki on a forgotten lesson, both sealed in the same HMAC chain.Tue, 11 Aug 2026 00:00:00 GMTmoatwikisecurityarchitecturesam@samye.li (Samet Samyeli)https://lodos.md/en/blog/workflow-engine-cant-have-n8n-cvehttps://lodos.md/en/blog/workflow-engine-cant-have-n8n-cven8n shipped a CVSS 9.9 RCE through expression eval. The lodos workflow engine can't have that bug, there's no evaluator anywhere to inject into, and a build-time grep keeps it that way.Thu, 02 Jul 2026 00:00:00 GMTworkflow-enginesecurityarchitecturezero-knowledgesam@samye.li (Samet Samyeli)https://lodos.md/en/blog/zero-knowledge-architectural-blindnesshttps://lodos.md/en/blog/zero-knowledge-architectural-blindnessMost secret managers expose getSecret(name), and the plaintext lands in the AI's transcript. The lodos schema makes that exchange structurally unanswerable, the AI cannot see a secret's value, and the build enforces it.Thu, 02 Jul 2026 00:00:00 GMTzero-knowledgesecurityarchitectureencryptionsam@samye.li (Samet Samyeli)https://lodos.md/en/blog/self-maintaining-wiki-karpathy-patternhttps://lodos.md/en/blog/self-maintaining-wiki-karpathy-patternMost company wikis rot the moment you stop tending them. The Karpathy LLM-wiki pattern turns a knowledge base into something your AI keeps alive. Here's how.Mon, 22 Jun 2026 00:00:00 GMTwikiknowledge-graphllmkarpathyai-nativesam@samye.li (Samet Samyeli)https://lodos.md/en/blog/local-first-software-own-your-datahttps://lodos.md/en/blog/local-first-software-own-your-dataThe cloud became the default home for everything you own. Local-first flips that back: your data lives on your device, works offline, and answers only to you.Mon, 15 Jun 2026 00:00:00 GMTlocal-firstofflinedata-ownershipprivacysam@samye.li (Samet Samyeli)https://lodos.md/en/blog/ai-that-cant-read-your-secretshttps://lodos.md/en/blog/ai-that-cant-read-your-secretsThe runtime secret-injection pattern that lets lodos charge a customer with your Stripe key, while the key never enters the AI model's context.Mon, 08 Jun 2026 00:00:00 GMTai-securitysecretsprompt-injectionarchitecturesam@samye.li (Samet Samyeli)https://lodos.md/en/blog/the-zero-knowledge-company-oshttps://lodos.md/en/blog/the-zero-knowledge-company-osYour company lives scattered across tools that all want your data on their servers. Here's why lodos keeps everything on your machine, and can't read a byte.Sat, 30 May 2026 00:00:00 GMTzero-knowledgelocal-firstcompany-osprivacysam@samye.li (Samet Samyeli)