About
I build and run the systems that power the world’s largest platforms. With over 20 years…
Articles by Alvaro
-
RFC 9842: From Abandoned Google Experiment To Production Standard
RFC 9842: From Abandoned Google Experiment To Production Standard
Dictionary compression just went from "neat idea" to "why aren't you using this already." The concept is simple: if a…
1 Comment -
IPv6 at 30: What Doesn't Hurt Gets Deferred
IPv6 at 30: What Doesn't Hurt Gets Deferred
In 2026, only 35% of the top million websites on the internet serve traffic over IPv6. That number alone is damning…
9 Comments -
HTTP/3 Has Officially Overtaken HTTP/2
HTTP/3 Has Officially Overtaken HTTP/2
I've witnessed numerous protocol transitions throughout my career working on infrastructure at some of the largest…
2 Comments -
Ultra Ethernet: When "Best Effort" Isn't Good Enough for AI
Ultra Ethernet: When "Best Effort" Isn't Good Enough for AI
I've spent the better part of two decades watching networking technologies come and go. Most of them promised…
-
Microsoft, I Buy It Now
Microsoft, I Buy It Now
Three years have passed since I wrote a short article titled “Microsoft, I Don’t Buy It” where I expressed disbelief…
7 Comments -
Microsoft, I Don't Buy It
Microsoft, I Don't Buy It
Microsoft, I don’t buy it. I emptied my mind of prejudices and tried to believe in it, but I still don’t buy the whole…
10 Comments -
SaaE: Software as an Excuse
SaaE: Software as an Excuse
Something fundamental about ownership is changing and it seems that it’s going under the radar for most people. Common…
6 Comments -
Innovation Won't Fix a Broken Company Culture
Innovation Won't Fix a Broken Company Culture
Once upon a time, there was a company with a completely broken culture, and it almost deserved it. In their defense…
2 Comments -
Innovation Is ALL About The People
Innovation Is ALL About The People
Do you know the feeling of watching somebody you respect making a blatant mistake? It is a mix of not understanding…
-
Open Source Is the New Standard. How Did It Happen?
Open Source Is the New Standard. How Did It Happen?
There is something extremely interesting about the times we are living in, especially for people who have constructed…
6 Comments
Activity
16K followers
-
Alvaro Lopez Ortega shared thisImpressive feat! Truly a testament to what's possible right now. I'm sure the engineering is brilliant, though the real challenge isn't probably building it but what happens next: how to navigate adoption, ecosystem compatibility, and sustainability long term. Regardless, a seriously cool experiment.Alvaro Lopez Ortega shared thisas somewhat of an april fools joke that i planned a month in advance, i used claude and spent my evenings in march rewriting kubernetes from the ground up in rust. it's now passing over 90% of the kubernetes 1.35 conformance tests, and uses 90% less memory. https://lnkd.in/gNxXhZ37 then i wanted to make it something special to me, as a developer, by providing options that make it fun for development environments. it now essentially takes the place of not only a full kubernetes deployment, with high availability options that you'd expect for a product infrastructure, but also can be an all-in-one binary (one process, not separate processes like k3s) and has the ability to swap out etcd for sqlite/mysql/postgres via a rewrite of the kine project, also in rust called rhino. https://lnkd.in/gFNzPWe4 the joke turned into something very, very real.
-
Alvaro Lopez Ortega shared thisLLMs give biased strategic advice. New Harvard Business Review research tested GPT-5, Claude, Gemini, and other leading models across 7 fundamental business trade-offs. The result: they consistently recommend whatever sounds trendy, not what's strategically sound. The researchers call it "trendslop." Key findings: • LLMs overwhelmingly favor differentiation over cost leadership, yet companies like Walmart and Costco built empires on cost leadership • They push "long-term thinking" even when immediate action is critical • They prefer "collaboration" over competition regardless of competitive dynamics • Better prompts and richer context? Didn't fix it. Why? LLMs are trained on internet content that reflects cultural biases. TED Talks, Medium posts, and startup narratives dominate over rigorous strategy theory. The result: AI that predicts 'the most socially desirable response' rather than the strategically sound one. The "Hybrid Trap" is even more dangerous: when given flexibility, LLMs often recommend doing everything (differentiation AND cost leadership), which strategy scholars warn leads to being "stuck in the middle." https://lnkd.in/efDNtxWjResearchers Asked LLMs for Strategic Advice. They Got “Trendslop” in Return.Researchers Asked LLMs for Strategic Advice. They Got “Trendslop” in Return.
-
Alvaro Lopez Ortega shared thisDictionary compression (RFC 9842) is finally practical, and the numbers are hard to ignore. YouTube's JS bundle drops 90%. Google search HTML shrinks 50%. Pinterest has already deployed it in production. I wrote about what this means for web infrastructure and why it took 30 years to get here.RFC 9842: From Abandoned Google Experiment To Production StandardRFC 9842: From Abandoned Google Experiment To Production Standard
-
Alvaro Lopez Ortega shared thisIPv6 is 30 years old. Only 35% of the top million websites serve it. Most of them run on infrastructure that already supports it but it is turned off. This isn't a technology failure. It's what happens when something doesn't hurt badly enough to make the list. The costs are real. They're just distributed across enough teams and time to stay invisible until they're not. I wrote about why that is, and the questions worth asking before the pain becomes obvious.
-
Alvaro Lopez Ortega shared thisInteresting article on how OpenAI scaled PostgreSQL to handle 800 million ChatGPT users with a single primary writer. Nearly 50 read replicas. Millions of queries per second. Five nines availability. And they deliberately chose not to shard. The article explains the mechanics behind those replicas, which is where it gets interesting. The primary streams Write Ahead Log data directly to every single replica to keep them synchronized. That means one database instance shipping changes to nearly 50 followers. They built a custom proxy layer with PgBouncer pods behind Kubernetes services, all colocated in the same regions to minimize latency. The bottleneck is obvious: at some point the primary runs out of network bandwidth or CPU just from sending WAL. They're working with Microsoft Azure on cascading replication so replicas can feed other replicas, buying headroom to scale even further. Worth a read if you've ever wondered how far you can push a relational database before reaching for the sharding knife. https://lnkd.in/ekabDH9eHow OpenAI Scaled to 800 Million Users With PostgresHow OpenAI Scaled to 800 Million Users With Postgres
-
Alvaro Lopez Ortega shared thisFor the first time, HTTP/3 adoption (37.5%) has surpassed HTTP/2 (34.2%) according to W3Techs 2025 data. This isn't just another protocol upgrade but a fundamental shift in web transport evolution. What surprised me most? HTTP/3 achieved this milestone in just 3 years, while HTTP/2 took nearly a decade to reach peak adoption. The acceleration comes from: • CDNs enabling HTTP/3 by default • 93% browser support through auto-updates • Mobile performance demands creating business pressure
-
Alvaro Lopez Ortega shared thisTraditional Ethernet promises to try delivering your packets. It doesn't guarantee anything. That worked fine for decades. TCP handled the rest. But when you're synchronizing gradients across thousands of GPUs, a single dropped packet can stall your entire cluster. Ultra Ethernet flips the model: instead of reacting to problems after they happen, it prevents them before they occur. The network knows its own state and sends exactly what it can handle. What's more interesting than the technology is who built it. 97 competing companies (AMD, Intel, Broadcom, Meta, Microsoft, Cisco, and more) agreed on a 560-page specification in 30 months. That kind of alignment doesn't happen often.Ultra Ethernet: When "Best Effort" Isn't Good Enough for AIUltra Ethernet: When "Best Effort" Isn't Good Enough for AI
-
Alvaro Lopez Ortega shared thisBig opportunity alert! These roles offer the chance to lead cloud infrastructure development that serves hundreds of millions of Pinterest users. Perfect roles for engineers who want to shape the future of infrastructure platforms at Internet scale. Based in beautiful Zurich, working on problems that matter at massive scale.Alvaro Lopez Ortega shared thisJoin Our Growing Pinterest Engineering Team in Zurich! We are hiring a Principal Engineer and Sr Staff Engineer to join our new Engineering Excellence Hub working with our Cloud Platform team. You'll shape how Pinterest engineers build and deploy services, driving innovation in areas like container orchestration, service mesh, developer experience, and cloud-native architectures at Internet scale. Apply here! https://lnkd.in/edU-CdHV https://lnkd.in/eu4GMjKi
-
Alvaro Lopez Ortega shared thisThe Open Source Initiative just released the official Open Source AI Definition 1.0 - and it sets a high bar for what truly qualifies as "open source" AI. After months of community input, OSI has established clear criteria that go far beyond just releasing model weights. To qualify as Open Source AI, systems must provide: - Complete data transparency: detailed documentation of training data, including sources, processing methods, and labeling procedures - Full source code: everything used to train, validate, and run the system - Model parameters: weights, configurations, and key training checkpoints The definition extends the four fundamental freedoms of open source to AI: use for any purpose, study how it works, modify as needed, and share with others. This matters because it prevents "open washing" - companies claiming their AI is open source while withholding critical components. True Open Source AI enables the same benefits we have seen in software: transparency, collaborative improvement, and frictionless innovation. For organizations building AI systems, this definition provides a clear roadmap. For users, it offers protection against vendor lock-in and ensures genuine transparency. https://lnkd.in/d9spgv7D #OpenSource #AI #MachineLearning #Transparency
-
Alvaro Lopez Ortega reacted on thisAlvaro Lopez Ortega reacted on this732 bytes of Python. Root on every major Linux distribution shipped since 2017. Today we disclose CVE-2026-31431 — "Copy Fail" — a logic flaw in the Linux kernel's authencesn cryptographic template. An unprivileged local user can trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. The same script gets root on: • Ubuntu 24.04 LTS • Amazon Linux 2023 • RHEL 10.1 • SUSE 16 No race conditions. No per-distro offsets. No version checks. 100% success rate. A few things make this one interesting: → It doesn't touch disk. The page cache is corrupted in memory, so on-disk checksums and file integrity tools miss it entirely. A disk image won't show that root was taken. → The page cache is shared across the host, including across container boundaries. One pod can compromise the entire Kubernetes node. (Part 2 of the writeup covers the container escape.) → It's been silently exploitable for ~9 years. The bug sits at the intersection of three changes between 2011 and 2017, each reasonable on its own. Nobody connected the dots. How we found it: Taeyang Lee, a Theori researcher who had previously mapped the AF_ALG attack surface in kernelCTF, suspected that scatterlist page provenance was an underexplored source of bugs. He pointed Xint Code — our autonomous vulnerability analysis platform — at the Linux crypto subsystem with a one-line operator prompt. About an hour later, Copy Fail came back as the highest-severity finding. The same scan surfaced additional high-severity bugs, still in coordinated disclosure. This is the workflow we keep proving out: a researcher (optionally) sets the direction, Xint Code covers the depth and breadth no human team has bandwidth for. Coordinated disclosure with the Linux kernel security team wrapped cleanly — the fix landed in mainline on April 1. If you run Linux infrastructure, please patch. Full root-cause analysis, demo, and exploit: 📄 https://copy.fail 🔗 https://code.xint.io
-
Alvaro Lopez Ortega reacted on thisAlvaro Lopez Ortega reacted on thisDaniel Stenberg started writing curl in 1998. his code ships in PlayStation. it's on billions of devices. he's been the founder and lead developer for nearly 30 years. he's not on the Glasswing founding partner list. most of the people holding the internet together aren't either. we've been here before. in 2014, Heartbleed hit and every service running affected versions of OpenSSL had to assume their keys were compromised. patch, revoke certificates, reissue, restart, then tell users to change passwords only after all of that. three years later, Shodan scans were still finding roughly 180,000 vulnerable devices on the public internet. and these are companies. staffed with engineers. the person maintaining OpenSSL at the time? one full-time paid developer. the project was getting about $2,000 a year in donations. it secured two-thirds of the web. that was one bug. Anthropic says Mythos found thousands. Daniel, Theo de Raadt who's led OpenBSD for 30 years, the hundreds of others — these are the people who need these capabilities first. last week Daniel posted that no one from Glasswing had reached out to him. and then there's the shop owner who vibe coded her first app last Tuesday. she doesn't know what a key is. the tools didn't tell her she needed one. i wrote about all of this for the The New York Times opinions this week. OMG - it was on the front page of nytimes.com. and can i say how much i love the title we ended up with. link in comments. subscribe to Owners Not Renters if you want more. also in comments.
-
Alvaro Lopez Ortega reacted on thisAlvaro Lopez Ortega reacted on thisThe OSS ecosystem is under attack, and it all started with a few innocuous options in Github. Let me explain. On Feb 27th, a new Github account called hackerbot-claw and opened a pull request on Trivy and immediately closed it. But it was too late, the Github Actions were already running. Github has an *incredibly dangerous* setting that allows forks to run Github Actions with the secrets and context of the upstream repository. This makes it trivial to export secrets. One repo, not that big of a deal right? Wrong, the real hack was just beginning. March 19th the attackers publish compromised releases of Trivy. Trivy is a popular open source security scanner. You know where that's used a lot? In Github Actions. Suddenly, everyone who was configured to use the latest Trivy version in their Github Actions had all their tokens compromised. A lot of those repos published NPM packages. Do you see where this is going? The attackers now started publishing compromised NPM packages. Those are pulled into CI workflows and onto developer machines, where they helpfully install a service on every machine to propagate the worm and pull instructions from distributed dead drops that are almost impossible to take down. CannisterWorm is 6 days old. 140 compromised NPM packages. Hundreds of thousands of downloads. Anyone who thinks this is over, isn't paying attention. Update: This post originally linked the compromise to an incorrect settings panel in Github org permissions dealing with private forks. In fact, the attack vector was a misconfigured pull_request_target within a Github action. Removed here https://lnkd.in/gaRDt7SS
-
Alvaro Lopez Ortega reacted on thisPour one out for Sun MicrosystemsAlvaro Lopez Ortega reacted on thisIn 2005, Sun Microsystems introduced containers. Then everyone forgot. If you've ever debugged container networking at 3 am, you might want to hear about Solaris Zones. Sun shipped Zones in Solaris 10 — a full 8 years before Docker existed. And they got it right in ways the Linux ecosystem is still trying to replicate. What made Zones different? Linux containers bolt isolation onto a kernel that wasn't designed for it: → Namespaces (2002-2016) — "pretend you're alone" → Cgroups (2008) — "stay in your lane" → Seccomp-BPF (2012) — "don't touch that syscall" Three independent mechanisms, duct-taped together, sharing one kernel. A single kernel CVE can bypass all of them. It has happened (runc CVE-2019-5736, cgroups CVE-2022-0492). Zones took a fundamentally different approach. The Solaris kernel was aware of zones as a first-class concept. Every subsystem — processes, networking, filesystems, IPC — was zone-aware from the ground up. A process inside a zone didn't have restricted access to the host. The host didn't exist from its perspective. Then there was the holy trinity: ☀ Zones — isolation built in, not bolted on ☀ ZFS — instant cloning, snapshots, copy-on-write ☀ DTrace — deep observability without breaking isolation The Linux ecosystem took 15+ years to approximate this using namespaces, overlayfs, and eBPF. It's still not as clean. So what happened? Oracle acquired Sun in 2010. Killed OpenSolaris. Bryan Cantrill and the DTrace/ZFS/Zones engineers walked out. They built SmartOS on illumos to keep the flame alive. Meanwhile, Docker arrived in 2013 with something Zones never had: portability. Dockerfiles, image registries, "build once, run anywhere." The packaging and developer experience won, even though the isolation model was weaker. A container to one is not a container for the other.
Experience
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Education
-
The University of Chicago - Booth School of Business
-
-
A top-tier executive program jointly delivered by University of Chicago Booth and IE Business School, designed for C-Suite leaders driving growth in complex international markets.
• Strategic Focus: Corporate Strategy, Digital Transformation, and Financial Management in volatile global environments.
• Leadership: Mastering the intersection of geopolitics, innovation, and organizational agility to lead multinational teams.
• Outcome: Advanced preparation for general management…A top-tier executive program jointly delivered by University of Chicago Booth and IE Business School, designed for C-Suite leaders driving growth in complex international markets.
• Strategic Focus: Corporate Strategy, Digital Transformation, and Financial Management in volatile global environments.
• Leadership: Mastering the intersection of geopolitics, innovation, and organizational agility to lead multinational teams.
• Outcome: Advanced preparation for general management governance and steering organizations through large-scale disruption. -
-
-
-
-
-
-
-
-
-
-
- Present
Volunteer Experience
-
Industry Mentor, Performance Engineering of Software Systems
Massachusetts Institute of Technology
- 5 years 1 month
Science and Technology
Guiding MIT EECS students in the architecture and optimization of scalable, high-performance software systems.
• Role: Partnering with Professors Leiserson and Amarasinghe to teach advanced topics including performance analysis, cache optimization, and parallel programming.
• Impact: Mentoring the next generation of architects to build systems that run at hyperscale. -
-
Advisory Board Member
Bitergia
- 7 years
Science and Technology
Advised the leadership team on product strategy for Open Source analytics. Bitergia provides the standard tooling for tracking the health and evolution of open source communities (used by CNCF, OpenStack, and Uber, among many others).
-
Advisory Board Member
Madrid On Rails
- 4 years 2 months
Science and Technology
Served on the Board of a government-backed initiative (Madrid City Hall & Ministry of Industry) to promote the Information Society and increase the competitive position of the Madrid IT industry.
-
Mentor
Tetuan Valley
- 2 years 1 month
Science and Technology
Mentored early-stage technical founders on product strategy and infrastructure scaling at one of Spain's leading pre-accelerators.
Publications
-
Learning OpenStack Networking (Neutron)
Packt Publishing
Served as the Technical Reviewer for this comprehensive guide on OpenStack Neutron.
• Role: Validated the technical accuracy of complex networking architectures, including L3 agents, load balancing, and security groups for cloud environments.
• Author: James DentonOther authors -
-
OpenStack Essentials
Packt Publishing
Served as the Technical Reviewer, ensuring the architectural integrity of this foundational guide to cloud computing.
• Role: Reviewed best practices for deploying and managing OpenStack clouds, covering Keystone, Glance, Nova, and Cinder.
• Author: Dan RadezOther authors -
Courses
-
21st Century Leadership Challenge
The University of Chicago
-
Advanced Internet Services
139
-
Advanced Negotiation
IE Business School
-
Advanced Negotiation II
IE Business School
-
Advanced Topics in Networking
416
-
Artificial Intelligence
Artificial Intelligence
-
Building a High Performance Environment
IE Business School
-
Corporate Agility
The University of Chicago
-
Data Mining
Artificial Intelligence
-
How to Compete in Global Markets
IE Business School
-
Intelligent Agents
427
-
Keys to Implementing Strategy
The University of Chicago
-
Knowledge-based Systems
Artificial Intelligence
-
Leading Your Most Talented Employees
IE Business School
-
Machine Learning
with distinction
-
Machine Learning and Statistical Pattern Recognition
Artificial Intelligence
-
Natural Language Processing (NLP)
Artificial Intelligence
-
Neural Networks
Artificial Intelligence
-
Principles of Strategic Management
The University of Chicago
-
Public Speaking — University of Washington
COM 220
-
Regression Models
with distinction
-
Satellite Networks
411
-
Simulation of Telecommunication Networks
191
-
Statistical Inference
with distinction
-
Strategic Innovation
The University of Chicago
-
Telecommunications and Network Security
423
Projects
-
GNU Maintainer / Author
- Present
Author and maintainer of GNU MAC Changer, the industry-standard utility for network identity masking.
• Ubiquity: Shipped by default in all major Linux distributions (Debian, Red Hat, Ubuntu) and BSD systems.
• Security Standard: A core component of security and penetration-testing suites, including Kali Linux. -
Core Open Source Contributions
Long-term contributor to the foundational technologies of the internet. I have made technical contributions to the Linux kernel, Kubernetes, OpenStack, Ansible, Ubuntu, PyData (numexpr), OpenSolaris, GNOME, WebKit, and the GNU Project. My code runs on tens of millions of devices globally.
-
Presto Foundation
-
Founded the Presto Foundation under the Linux Foundation to establish open governance for the Presto distributed SQL engine.
• Governance: Led negotiations to unite Meta, Uber, Twitter, and Alibaba as founding members, securing the future of the standard for exabyte-scale analytics. -
Cherokee Web Server
-
Created the high-performance web server ranked as the fastest in the world during its peak.
• Hyperscale Usage: Deployed on the International Space Station (ISS), by the U.S. Department of Energy, and embedded in every GoPro camera and Xiaomi device.
Honors & Awards
-
EB-1: Individual of Extraordinary Ability
U.S. Citizenship and Immigration Services (USCIS)
Granted the EB-1A classification, reserved for individuals who demonstrate extraordinary ability in the sciences, arts, education, business, or athletics through sustained national or international acclaim.
• Significance: Validated by the US Government as being in the top small percentage of the field of Hyperscale Infrastructure and Open Source Software. -
Red Hat "Mega" Ambassador
Red Hat
Recognized for exceptional evangelism and community leadership, representing Red Hat at international technology conferences and fostering the growth of the Open Source ecosystem.
-
Canonical's Spotlight Award 2012
Canonical Ltd. (Jane Silber, CEO)
Awarded by the CEO for demonstrating a rigorous approach to development and quality assurance in the Ubuntu product strategy.
Languages
-
English
Native or bilingual proficiency
-
Spanish
Native or bilingual proficiency
Recommendations received
50 people have recommended Alvaro
Join now to viewOther similar profiles
Explore more posts
-
Ververica
When Airbus needed to deploy Apache Flink® at scale, they came to the team that built it. The challenge: A leading aircraft manufacturer needs to run hundreds of streaming jobs across multiple teams. Each job processes critical operational data. Downtime isn't an option. Requirements: → Enterprise-grade reliability and security → Multi-tenant isolation for different teams → Simplified operations for Flink deployment → Support for complex, mission-critical workloads Why Ververica Platform: "We needed a solution that could handle our scale and complexity while reducing operational overhead. Ververica's deep Flink expertise made the difference." The result: Airbus deployed streaming applications across the organization with: • Centralized Flink management • Reduced operational complexity • Enterprise security and compliance • Expert support from the Flink creators When your streaming infrastructure powers critical operations, you need more than open-source tools. Read the Airbus case study: https://hubs.li/Q03YQFRQ0 #CaseStudy #Aerospace #Manufacturing #ApacheFlink #EnterpriseData
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content