I am Srikanth Sastry. I am currently an engineering lead at Meta working on privacy infrastructure. Before Meta, I was a software engineer at Google in Cambridge, MA, and before that a postdoctoral associate with Nancy Lynch at CSAIL, MIT. Prior to that, I received my PhD from Texas A&M University.
My professional interests include distributed system design, software engineering processes, and building engineering teams. I also maintain a digital garden — a collection of evolving ideas and notes that complement my blog posts.
In a previous life, during my years in academia, I worked on distributed systems, networking, fault tolerance, and algorithm design and analysis. My list of publications are available on DBLP.
Recent Writing
All 64 posts →
AI vs. Open Source, Part 3: The Constant Eyes
Linus's Law assumed the number of eyes was the bottleneck for security. AI removed the bottleneck. When vulnerability discovery runs through a handful of frontier models, the "many" in "many eyes" collapses to a constant.
AI vs. Open Source, Part 2: The Hollow Commons
AI vs. Open Source, Part 1: The Empty Grant
SECURE Data Act: The dilution in pseudonymization
Subsidiarity is not Hayek
Deliverance from Directive Governance
The Suggestible Actor: A New Model for AI-Assisted Software Development
From the Garden
All 86 notes →AI Collapses the Economic Moat of Clean-Room Reimplementation
🌳The copyleft moat was never purely legal. It was economic: compliance was cheaper than reimplementation. AI collapsed that cost.
AI Security Cost Asymmetry Favors Closed Source
🌳AI equalizes the defender's security cost across open and closed source but varies the attacker's cost by source availability. This inverts Linus's Law.
Align Alerts to SEV Criteria
🌳Alerts should fire at or near the threshold where an SLO breach would occur, not well before.
Backward Compatibility for Leaky Abstractions
🌳When a framework leaks implementation details (like serializing arguments at schedule time but loading code from HEAD at execution time), changing a function signature breaks the assumption that old code calls old signatures.
Check If Concern Is Systemic
🌳Before resolving a concern, check whether it is isolated or systemic.
Command Control Misnomer
🌳"Command and control" is a misnomer for directive governance.
Confabulation Is Plausible
🌿AI agent confabulation is not random — it is plausible-looking wrongness constructed from pattern and proximity rather than knowledge.
Crisis Centralization Ratchet
🌿Tech companies centralize decision-making during crisis and almost never decentralize afterward.
Data Pipeline Is Achilles Heel
🌿The data pipeline is directive governance's Achilles heel, not the decision-maker's rationality.
Delegation Mimicry Without Cultural Substrate
🌿Most tech CEOs copy the structural form of delegation without the deliberate cultural investment that makes it work.