I write posts and try to do them daily or at least weekly. Check out my site (tristanxr.com/) for my latest posts. I often write about topics like ARM, RISC-V, NixOS, and things I am interested in or involved in.

Excited to announce that I'm launching a new startup, @LilithSemi , together with Sebastian Kraus! 🚀 With Lilith Semi, we're building open-source tools for hardware development and security-critical infrastructure. Our first release is Chock, a security-first harness for AI coding agents. Since 2026, AI agents have become good at tasks beyond simple web development. As companies start dealing with real workflows, enterprises, especially in regulated industries, are becoming more conscious about how they handle sensitive data. I've been dealing with supply chain security for a while, and one thing I've learned is how important it is to work with safe AI harnesses. When you're dealing with sensitive data, the risk simply isn't worth it. That's why Chock sandboxes AI agents in a using standard sandboxing primitives. We're currently working on micro-VMs as the next step. 👉 Check it out: chock.ws And if you're at NixCon 2026 in Kraków, come find us and let's talk. #AISecurity #AIHarness #SupplyChainSecurity #DeveloperTools #OpenSource #NixCon2026

It's airport time, dealing with the beginning of my travels. I get in the evening on Wednesday but I'll be available Thursday if anyone is in town.

Since I've managed to sandbox Fix in Chock, I wonder if upstream could have sandboxed eval. It could be done without requiring root for sandboxing. Landlock V1 has been around for quite some time.

Can it be tomorrow already so I can fly to Poland for NixCon?

I think at some point I need to build my own hypervisor and VMM.

Chock has a web UI, it's been around for quite some time but I've never properly tested it.

Nix builds can reach mirrors

We've seen the tilcayo but have we heard it meow?

As a cat dad, I am honored to be followed by a cat account.

Got builds working.

Tonight, agents can perform Nix evaluation & builds in Chock

I had to reboot because some services didn't come back up after a "nixos-rebuild switch"

I'm contemplating whether I should reboot my server for updates before traveling in a few days.

I am so impressed with the team @DeterminateSys! We aren't just making Nix more simple, confident, & powerful for the enterprise, we are making it more secure & compliant too! Check out all these CVE's we've remediated so our customer's don't have to security.determinate.systems…

People act like data centers didn't exist before AI but don't realize just how much processing the modern Internet needs. Banking? Data centers. Video streaming? Data centers. Cloud storage? Data centers. We even had data centers before the Internet, though they were different, in 1945 for the ENIAC. The big difference is capacity. That's how much compute the data center can perform, heat it can move, electricity consumes, and the connection speed. Upgrading a data center is difficult so many opt for building a new one. Sure it may sound inefficient but in the grand scheme of things, for the modern Internet to function (even before AI), many opted for building a new data center.

git.lilithsemi.com/LilithSem… Curl but Zig, and yes it does implement a lot of protocols. It's also slightly faster than curl from my testing.

Mimic

The amount of stuff you can do with this silly cable and an FPGA is insane.

More optimizations, now Vulcan is faster than ptxas.