Block
Fintech
Fintech company (formerly Square). Engineering org behind Goose, an open-source AI agent framework.
Recent activity
-
To run a self-hosted Buzz relay, a single Rust binary requires Postgres, Redis, and an S3-compatible object store. The process involves generating two Nostr keypairs: one for the relay's identity (BUZZ_RELAY_PRIVATE_KEY) and one for the owner's public key (RELAY_OWNER_PUBKEY). A Docker Compose file is used to manage the relay, Postgres, Redis, and object store. AI summary
Read more → -
A COLDCARD firmware vulnerability allows for theft of Bitcoin funds due to a predictable RNG fallback and 32-bit reseed. The RNG uses a deterministic fallback and limited secure-element reseed, constraining entropy across COLDCARD generations. This can be exploited by an attacker who knows the device's UID, timer state, and RNG-call history. AI summary
Read more → -
The Buzz mobile app for iOS and Android allows humans to collaborate with agents side by side, while also providing a secure and private way to communicate with agents running on other devices or in the cloud, using public-key cryptography to authenticate messages and protect user identities. The app is designed to be configuration-free, inheriting the credentials and skills of the user's computer, and limits the identifying data that relays and intermediaries can observe. The app also implements a push notification protocol (NIP-PL) that ensures the privacy and security of user data. AI summary
Read more → -
Buzz is an open-source, self-hostable workspace built on Nostr, designed for teams to work together with their agents, allowing for coordination and scalability, and enabling humans and agents to collaborate more efficiently. It provides features like Git hosting, search, automation, and channel management, with a focus on durability and security through established delegation cryptography and signed messages. The system also enables authorized peers to share GPUs and inference capacity, and supports device pairing for secure identity management. AI summary
Read more → -
Block's User Identity Delegation system allows downstream services to evaluate a user's identity, delegated authority, and bounded scope, enabling more accurate decisions on whether an action should be allowed, rather than relying solely on the user or agent identities. This approach addresses the challenges of intentional anthropomorphism in agentic AI, where agents can escalate access due to their open-ended nature and natural extension of their users' capabilities. By establishing clear boundaries and delegated authority, User Identity Delegation provides a more secure and controlled way to handle sensitive data and actions. AI summary
Read more → -
Here's a summary of the article for a developer/AI-ML audience: CodeCrucible is a blueprint for a Large Language Model (LLM)-driven Static Application Security Testing (SAST) tool, focusing on maximizing context-window fill and finding quality while minimizing token cost. It employs whole-repo concatenation, where the entire repository is packed into a single LLM call, allowing for cross-file context and catching vulnerability classes that snippet-anchored workflows struggle to see. AI summary
Read more → -
Block App Kit solves the challenge of safely shipping internal apps that connect to real company data by providing a managed platform that handles authentication, authorization, secret management, and data-access controls by default, allowing anyone to build an app in minutes. The platform is intentionally thin and opinionated, drawing hard lines on what an app can connect to and who can open it, ensuring consistent security properties and preventing "anyone can build" from becoming "anyone can do anything." The agent tool provides a simple and easy-to-use interface for building, deploying, and managing apps on the platform. AI summary
Read more → -
A custom Protocol Buffer message option extension allows associating a key name with a message definition for encryption, with the encrypted message fields stored in a `ciphertext_` field. The `encrypt` and `decrypt` functions are exposed, which can handle nested messages and decryption failures with customizable behavior, including skipping encrypted messages and allowing partial decryption. AI summary
Read more → -
A company overhauled its data strategy by adopting a data mesh framework, building a governed semantic layer, and creating custom MCP servers to deliver 100% metric accuracy and exploratory flexibility for automated analytics, enabling automation of on-call processes, leadership queries, and AI agent contributions. The approach involved defining a specific business application, setting an uncompromising success criterion for 100% metric accuracy, identifying the core problem of getting started with data, and assembling a cross-functional team. AI summary
Read more → -
A Java HashMap with 24,674 instances of MarketRamp, each containing a map of enum values to floats, was consuming 19.5MB of memory. By using a FloatArray instead of a LinkedHashMap, the memory footprint was reduced to 1.6MB, a 12x reduction, by leveraging the ordinal of the enum values as an index into a float array, eliminating the need for hashing and bucket resolution. AI summary
Read more → -
To evaluate the efficacy of a static analysis security testing (SAST) scanner, developers can use a harness called benchmrk that measures scanner performance against controlled ground truth, including true positives, false positives, false negatives, and true negatives. This allows for a comprehensive understanding of a scanner's precision, recall, and F1 score, as well as its stability and potential for false positives. By annotating real bugs and decoys, developers can measure a scanner's actual performance and make informed decisions about which scanners to use in their CI pipelines. AI summary
Read more → -
Square Android migrated its monorepo from Dagger 2 and Anvil to Metro, leveraging Metro's interop feature to support Dagger 2 during the migration process, which took nine months to complete. The migration involved converting Java code to Kotlin, handling nullability issues, and migrating hundreds of @ContributesBinding annotations. The team used multiple nightly CI jobs to measure progress and catch regressions early. AI summary
Read more → -
Migrating 10k+ files from Base Web to Fluent UI in a live React monorepo using rule-driven, agent-assisted workflows — without downtime or a flag day.
Read more → -
To enhance system resilience, Block Engineering is utilizing agentic reviewers, or "protectors," that continuously monitor and steer changes to the system, ensuring that locally rational features don't erode the system's integrity. These protectors are integrated into the development lifecycle, providing real-time checks and recommendations before code is pushed to production. By implementing a standardized CLI contract and leveraging progressive disclosure, the protectors can effectively manage hyperlocal context and provide context to agents when making decisions. AI summary
Read more →