Who is Alessandro Sangiorgi?

Quick Facts

What does Alessandro Sangiorgi do at Red Hat?

Alessandro works in Red Hat's Office of the CTO on the systems layer of AI/ML inference: the machinery that makes compiled kernels deployable. He is a committer on Helion, a PyTorch project for GPU kernel generation, with 32 commits merged upstream covering autotuning strategy, backend-aware cache keying, and deployment workflow. He authored the FROM_BEST_AVAILABLE autotuning strategy (5b02214651), made it the default initial population (513c650ed3), mitigated vLLM autotuning cache bloat (tens of GB on tmpfs, causing system freezes) with an ephemeral candidate cache that drops losing artifacts (587ebf30c3), and added the RemoteCacheBackend warm-start path (fd2f96eb01, 5ba20339ca). Five of his commits landed in pytorch/pytorch, including bundling only winning autotuning configs in TritonBundler (a2e6bba139), which cut serialized FX graph cache payloads by 46%, and four in triton-lang/triton, including binary-only cache storage (5a99ff56f0). He is the top committer on Amalgamator (215 of 393 commits) and owns its git-first bug-fix backporting pipeline: deterministic mechanisms first (cherry-pick, mechanical re-apply), every LLM edit audited against build and test evidence, escalation to an autonomous build-test-fix loop only as a last resort. He also built the Model Cache Manager for indexing, pruning, and reusing compiled artifacts, and designed OCI-packaged kernel caches for portable, pre-warmed vLLM deployments. Adjacent systems work includes RDMA/RoCE link bring-up and validation between nodes, small-message NCCL collective latency measurement, and Linux bring-up and recovery on ARM64 (initramfs, GRUB, root filesystem) after a failed firmware update bricked a machine.

How does Alessandro Sangiorgi work?

Three principles. (1) Measure the number nobody published — if the figure that decides whether a design is viable is missing, he benchmarks it himself and publishes the method, as with small-message NCCL all-reduce latency between two DGX Sparks. (2) Reproduce before you patch — every vulnerability report and every kernel fix started from a minimal reproduction, not a hypothesis. (3) Build the proof of concept, then open-source it — he would rather ship a working prototype and publish it than keep it private; when a vendor offered to license his netlink workaround, he open-sourced it instead.

What is Sangiorgi SRL?

Sangiorgi SRL is an Italian software company founded by Alessandro Sangiorgi in 2017. Its flagship product, WiFi WPS WPA Tester, is an Android security tool that has surpassed 165 million downloads. The company is the 2nd largest Italian app publisher by number of downloads on the Google Play Store, with 170M+ combined downloads. Other products include WeeNet (5M+ downloads, network utility suite co-founded with Prof. Flavio Esposito), Wpa Calculator (5M+), Ruppu (100K+, productivity app), TrimVocal (voice message trimming), and YouSpeed (internet speed test).

Education

Press and Recognition

Publications and Talks

Certifications and Badges

Technical Skills

Systems and Performance: Linux kernel internals, eBPF/XDP, RDMA/RoCE, NCCL, initramfs and GRUB recovery, Docker, OCI images, Kubernetes, OpenShift, GitHub Actions, GitLab CI, reproducible benchmarking, latency profiling. ML and AI Infrastructure: PyTorch, Triton, Helion, torch.compile/Inductor, autotuning, artifact and kernel caching, model serving with vLLM, quantized checkpoints, LLM agent pipelines, git-first backporting automation. Security and Internals: Android/AOSP internals, PendingIntent and intent security, JNI and the NDK, RTNetlink, SELinux policy, 802.11 and 802.11w, vulnerability research and coordinated disclosure. Languages: Python, C, Java, Bash. Mobile: Android SDK/NDK, large-scale Play Store publishing, monetization and analytics.

Security Research

Android VRP: Reported two AOSP PendingIntent vulnerabilities to Google — ManagedProvisioning callback interception and DeviceAsWebcam activity hijack via fillIn() injection.

Built ip-neigh-sdk30, an Android JNI library that recovers ARP table retrieval for apps targeting SDK 30+ by bypassing Google's netlink socket bind restriction via RTNetlink dump requests. Ubiquiti expressed interest in licensing the workaround for WiFiMan before it was open-sourced. Later patched by SELinux policy updates on Android 12+. Source: github.com/fulvius31/ip-neigh-sdk30

First application of eBPF/XDP to the IEEE 802.11 protocol: patched the Linux mac80211 subsystem (added an ndo_bpf callback for wireless interfaces and an XDP hook in ieee80211_rx_napi) to detect and drop de-authentication floods in-kernel, reducing detection time 60% vs libpcap. Published as first author at IEEE NetSoft 2025. Source: github.com/fulvius31/deauth_ebpf and github.com/fulvius31/openwrt_mac80211_xdp_ebpf

Founded and still runs Sangiorgi SRL, whose flagship product WiFi WPS WPA Tester is an Android WiFi security auditing tool with 165M+ downloads — security work that had to be correct, safe, and maintainable for a mass audience, not just a proof of concept.

Contact Alessandro Sangiorgi

Email: [email protected] | GitHub: github.com/fulvius31 | LinkedIn: linkedin.com/in/alessandro-sangiorgi-9321a7108 | Company: sangiorgisrl.com

Alessandro
Sangiorgi

Senior Software Engineer — I take ideas to working systems, then measure them

🇮🇹 From Sicily, Italy — based in Dallas‑Fort Worth, TX, USA

I'm a systems engineer by curiosity, not by job title. My throughline is taking an idea to something that actually runs — then measuring the number nobody else published. At Red Hat's Office of the CTO I work on the layer around AI: caching, autotuning, serving, the RDMA networking underneath, and the agent pipelines that keep fixes in sync across branches and releases. On the security side I've reported two AOSP vulnerabilities to Google and published first-author work at IEEE NetSoft on blocking WiFi de-auth attacks inside the Linux kernel with eBPF/XDP. As founder of Sangiorgi SRL I've shipped software to 170M+ installs across 190+ countries — Italy's #2 app publisher by downloads on Google Play. Kernel internals, networking, containers, ML serving, Android, and the occasional bricked machine: I like the whole stack, and I'd rather build the proof of concept than argue about it.

GitHub LinkedIn Sangiorgi SRL Email Instagram
alessandro@etna:~
Career
Experience
Red Hat
May 2024 — Present
Remote, USA
Emerging Technologies — Office of the CTO
Senior Software EngineerApr 2026 — Present
  • 41 commits landed upstream: 32 in Helion (committer), 5 in pytorch/pytorch, 4 in triton-lang/triton.
  • Helion: authored FROM_BEST_AVAILABLE, now the default autotuning bootstrap for quick-effort runs (513c650ed3). Full random search costs 10–20 minutes per compile and the fast default yields kernels 14–31% slower; his strategy seeds the search with prior good configs matched by input characteristics and device, using a cache key decoupled from source identity, and merges local and remote cache entries via RemoteCacheBackend so one machine's winner warms the whole team. Measured: 1238 s → 92 s at full-search quality. Presented at PyTorch Conference NA 2026.
  • Helion: killed the vLLM autotuning cache bloat (tens of GB on tmpfs, freezing machines) with an ephemeral Triton cache that discards losing candidates (587ebf30c3); added the RemoteCacheBackend interface (fd2f96eb01) and wired warm-start through it (5ba20339ca); fixed cross-backend cache poisoning by putting the backend in the cache key (90f2fa2a6c).
  • pytorch/pytorch: bundle only winning autotuning configs in TritonBundler — measured 46% smaller FX graph cache payloads (21.4 MB → 11.6 MB, 400 dead artifacts removed); recorded Triton's base32 cache key in .best_config (f57754e815); base32 cache-key fallback when base64 is unavailable (726424f4de).
  • triton-lang/triton: store only compiled cubin/hsaco in the cache directory (5a99ff56f0), base32 cache keys to avoid names starting with a hyphen (a69ebfaa08).
  • Top committer on Amalgamator — 215 of 393 commits, the most of any contributor. Owns the bug-fix backporting side: authored the git-first backport pipeline (e9294fe280) and the scanner that feeds it, and built its test coverage (404dc6b683, 0ae6e5c905, acfb4ab6a7). The pipeline exhausts deterministic mechanisms — git cherry-pick, mechanical re-apply — before any LLM edit, audits every LLM change against git, build, and test evidence, and escalates to an autonomous build-test-fix loop only as a last resort.
Software EngineerJan 2025 — Apr 2026
  • Built Model Cache Manager for indexing, pruning, warming, and reusing compiled GPU kernel artifacts (Triton/Helion); unified cache trees under a single directory.
  • Designed OCI-packaged kernel caches for portable, pre-warmed vLLM deployments, reducing cold-start overhead and simplifying artifact distribution across environments.
  • Presented cache-management work at DevConf.US 2025 and Triton Developer Conference 2025.
Software Engineer InternMay 2024 — Nov 2024
  • Automated Red Hat hardware certification pipeline using bootable containers and CI/CD workflows.
Sangiorgi SRL
Sep 2017 — Present
Italy
Founder & Lead Engineer
  • Shipped a portfolio of Android products reaching 170M+ combined downloads across 190+ countries, including WiFi WPS WPA Tester (165M+), WeeNet (5M+), Wpa Calculator (5M+), and Ruppu (100K+).
  • Owned end-to-end product delivery across client, backend, infrastructure, analytics, and monetization systems.
  • Co-founded WeeNet (Spaghetti Code Labs LLC) with Prof. Flavio Esposito at Saint Louis University — a network utility suite that grew to 5M+ downloads.
  • Built ip-neigh-sdk30, an Android JNI library to recover ARP table retrieval for apps targeting SDK 30+, after Google blocked netlink socket binding.
  • Reported two AOSP PendingIntent vulnerabilities to Google via the Android VRP: ManagedProvisioning callback interception and DeviceAsWebcam activity hijack via fillIn() injection.
Saint Louis University
Jan 2023 — Aug 2024
Saint Louis, MO
Graduate Research Assistant — Computer Science
  • First-authored IEEE NetSoft 2025 paper on eBPF/XDP-based mitigation for 802.11 de-auth DoS attacks in the mac80211 Linux kernel module.
How I work
Operating Principles
Measure the number nobody published
If the figure that decides whether a design is viable is missing from every writeup, I benchmark it myself and publish the method. Every dual-DGX-Spark article reported bandwidth; none reported small-message NCCL all-reduce latency — the number that actually decides whether a latency-bound multi-node workload is viable. So I measured it: ~2 µs RDMA write floor, ~40 µs for a 16–32 KB all-reduce, plus the firmware and NCCL traps that silently wreck the result.
Read the measurement
Reproduce before you patch
Nothing here started from a hypothesis. The AOSP reports, the mac80211 XDP work, and the bricked DGX Spark all began with a minimal reproduction and a working tool: a script that detects, configures, and validates a RoCE link end-to-end with green/red gates; two kernel patches to add XDP to wireless interfaces; an initramfs and GRUB recovery that diverged from the vendor's official guide.
Read the tooling
Build the PoC, then open-source it
I'd rather ship a working prototype and publish it than keep it private. When Google blocked netlink socket binding and broke ARP discovery for every Android app targeting SDK 30+, I wrote the JNI workaround, shipped it in my own apps, turned down a vendor's offer to license it, and open-sourced it. Same pattern for the de-auth defense and the RoCE validator.
github.com/fulvius31/ip-neigh-sdk30
Live from GitHub
Open Source Activity
Loading profile…
Loading repositories…
Contributions
Key Projects
Helion Committer
32 commits landed upstream. The FROM_BEST_AVAILABLE autotuning strategy (5b02214651) and its promotion to the default initial population (513c650ed3), the ephemeral candidate cache that ends vLLM autotuning bloat (587ebf30c3), RemoteCacheBackend warm-start wiring (fd2f96eb01, 5ba20339ca), and backend-aware cache keying (90f2fa2a6c).
View commits
Amalgamator Top committer
215 of 393 commits — the most of any contributor, while at Red Hat. Owns the bug-fix backporting half of the project: the git-first backport pipeline (e9294fe280) and the scanner that feeds it. It exhausts deterministic mechanisms (git cherry-pick, mechanical re-apply) before an LLM touches anything, audits every LLM edit against git, build, and test evidence, and fails closed to a human.
View commits
PyTorch Contributor
5 commits landed in the torch.compile/Inductor pipeline: TritonBundler now bundles only winning autotuning configs (a2e6bba139), cutting serialized FX graph cache payloads 46% (21.4 MB → 11.6 MB), plus Triton base32 cache-key work (f57754e815, 726424f4de).
View commits
Triton Contributor
4 commits landed. Binary-only cache storage — keep just cubin/hsaco in the cache directory (5a99ff56f0) — and base32-encoded cache keys so names never start with a hyphen (a69ebfaa08). Both are the cache-size work that later shaped the Helion and Inductor fixes.
View commits
WiFi WPS WPA Tester Author
Android security tool with 165M+ downloads. Founder and lead developer since 2014. Italy's #2 app publisher by downloads on Google Play.
Google Play Store
WeeNet Author
Network utility suite with 5M+ downloads. WiFi scanner, device discovery, speed testing, Wake On LAN, ping, traceroute, port scanning, and intruder detection. Co-founded with Prof. Flavio Esposito at Saint Louis University. Featured in SLU News.
Google Play Store
Ruppu Author
Productivity app with 100K+ downloads. Pin notes, links, PDFs, audio, checklists, and location to your notification shade. Name from Sicilian dialect for "knot." Also available as a web app.
Google Play Store
ip-neigh-sdk30 Author
Android JNI library that recovers ARP table retrieval for apps targeting SDK 30+, bypassing Google's netlink socket bind restriction via RTNetlink dump requests without binding. Later blocked by SELinux policy updates.
github.com/fulvius31/ip-neigh-sdk30
openwrt_mac80211_xdp_ebpf Author
Linux mac80211 patches that add XDP support to wireless interfaces — an ndo_bpf callback in iface.c plus an XDP hook in ieee80211_rx_napi() — packaged for OpenWrt. First application of eBPF to the 802.11 protocol.
github.com/fulvius31/openwrt_mac80211_xdp_ebpf
Security & internals
Security Research
VRP
2026
FLAG_MUTABLE PendingIntent in DeviceAsWebcam — foreground activity hijack
Reported to Google via the Android VRP. A mutable notification PendingIntent in the system-UID DeviceAsWebcam service allows a NotificationListenerService app to inject intent fields via fillIn() and force-launch DeviceAsWebcamPreview over whatever the user was doing.
VRP
2026
Intercepting Android's ManagedProvisioning — a PendingIntent vulnerability in AOSP
Reported to Google (Issue 493654042). A mutable implicit PendingIntent with a predictable action string lets any unprivileged app intercept privileged provisioning callbacks — leaking install timing and session metadata with no permissions. Root cause included FLAG_ALLOW_UNSAFE_IMPLICIT_INTENT bypassing Android's own protection.
Kernel
2025
Blocking WiFi de-auth attacks in the kernel with eBPF and XDP
First author, IEEE NetSoft 2025. Patched Linux mac80211 to support XDP on wireless interfaces, then dropped 802.11 de-authentication floods in-kernel — 60% faster detection than libpcap, up to 7× at peak, and stable throughput where 802.11w collapses. Kernel patches on GitHub · writeup
Tool
2014→
OneShot — WPS PIN attacks without monitoring
Pixie Dust, online PIN brute-force, and PIN prediction implemented for Android, ★104 on GitHub. The research behind WiFi WPS WPA Tester, which grew to 165M+ downloads — security tooling that had to be correct and safe for a mass audience, not just a proof of concept. Open-source client (★91).
Internals
2021
Working around Android's netlink bind restriction — until SELinux closed the door
Google blocked netlink socket binding in Android 11, breaking ARP table access for every network tool. I wrote a JNI library that recovers it via RTNetlink dump requests without binding (writeup). A vendor offered to license it; I open-sourced it instead. Later closed off by SELinux policy updates on Android 12+.
Research & Talks
Publications
Press
2026
Sangiorgi SRL: Turning Free Apps Into a Global Success Story
Featured by Google — Publisher Success Story. The origin and growth of WiFi WPS WPA Tester (165M+ downloads) and Sangiorgi SRL, building free, ad-supported security and productivity apps used across 190+ countries.
Poster
2026
Accelerating Helion Autotuning with Warm-Start and Shared Caches
PyTorch Conference North America 2026 — Community Expo, Kernel Engineering track, October 20, 2026. Full random autotuning costs 10–20 minutes per compile; the fast default finishes in seconds but yields kernels 14–31% slower, and the cache ties results to exact source, so renaming a variable invalidates a tuned config. FROM_BEST_AVAILABLE seeds the search with prior configs matched by input characteristics and device using a key decoupled from source identity, and RemoteCacheBackend merges and deduplicates local and remote entries so one machine's winning config becomes a team-wide warm start. Measured: 1238 s → 92 s while matching full-search quality. Slides (PDF)
Badge
2026
Poster Session Presenter — PyTorch Conference North America 2026
Verifiable Credly badge issued by The Linux Foundation to presenters selected by the PyTorch Conference North America Program Committee.
IEEE
2025
Mitigating De-authentication DoS Attacks in 802.11 via eBPF and XDP
A. Sangiorgi, F. Esposito, A. Pinto, R. Tourani — IEEE NetSoft 2025. First author.
Real-time, in-kernel defense against 802.11 de-auth floods using eBPF/XDP hooks in the mac80211 subsystem.
IEEE
2025
Quantifying Privacy Risk in Online Agreements with COAT: An LLM Approach
IEEE WETICE 2025. Co-author. LLM-based framework for automated privacy risk scoring of Terms of Service documents.
Talk
2025
From Cold Start to Warp Speed: Triton Kernel Caching with OCI Container Images
Speaker — DevConf.US 2025. OCI-packaged pre-compiled Triton kernel caches eliminating cold-start latency in vLLM deployments. Watch the recording.
Poster
2025
Tame the GPU Kernel Chaos and Take Control in Triton-Based Systems
Triton Developer Conference 2025. Cache management tooling for Triton-based ML inference pipelines at production scale.
Blog
2026
Blog
2025
ACM
2019
Propelling Haptic Devices into the Mobile World to Advance K-12 STEM Learning
A. Sangiorgi, F. Esposito, J. Gorlewicz, G. Schembra — ACM MobiHoc 2019. First author.
Android-based platform enabling haptic device connectivity for K-12 Physics education, with open-source haptic emulations and instrumented network metrics.
Grant
2025
NGI Sargasso Winner — €100k EU Grant for COAT
Awarded through Sangiorgi SRL for the COAT privacy platform.
Writing
Latest from the Blog
Sep
2026
Codex, Qwen3.8, and a Chat Template That Refused to Bend
Codex CLI against a self-hosted Qwen3.8-27B-NVFP4 on vLLM worked fine for exactly one turn, then started throwing a raw 400 the moment a tool call came back: 'System message must be at the beginning.' Here's the trail from a stale config comment, through vLLM's Responses API internals, into the model's own Jinja chat template, and the upstream GitHub issue that told me not to patch vLLM at all — but to override the template instead.
Jul
2026
Serving DeepSeek-V4-Flash-0731 in Tensor Parallel Across Two DGX Sparks
DeepSeek shipped the official V4-Flash-0731 release today, folding its speculative-decoding module into the base checkpoint and beating V4-Pro-Preview on agentic benchmarks despite a far smaller activated parameter count. Here's what's actually inside the checkpoint (mixed FP8/FP4, not the plain FP8 config.json advertises), whether 155 GiB fits across two 121 GiB unified-memory GB10 boxes, the vLLM tensor-parallel launch recipe over the RoCE link, and the JIT-warm-up trap that will silently wedge a multi-node deployment on its first real request.
Jun
2026
Unboxing Two DGX Sparks, and Recovering One From a Kernel Panic on First Boot
The DGX Spark setup is a phone-style hotspot-and-wizard flow that pulls down new software and firmware over Wi-Fi. On one of my two units that update left me staring at 'Unable to mount root fs on unknown-block(0,0)'. Here's the out-of-box experience, and exactly how I recovered the bricked one — including where my recovery diverged from NVIDIA's official guide.
View all posts →
Stack
Skills
Systems & Performance
Linux internals
mac80211 patching
RDMA / RoCE
NCCL
initramfs & GRUB recovery
Docker & OCI images
Kubernetes / OpenShift
CI/CD
Reproducible benchmarking
Latency profiling
Security & Internals
eBPF / XDP
AOSP internals
PendingIntent security
RTNetlink / nl80211
SELinux policy
802.11 / 802.11w / WPS
JNI & NDK
Vulnerability research
Coordinated disclosure
ML & AI Infrastructure
PyTorch
Triton
Helion
torch.compile / Inductor
Autotuning
Artifact & kernel caching
vLLM serving
Quantized checkpoints
LLM agent pipelines
Git-first backporting
Languages
Python
C
Java
Kotlin
Bash
Android & Shipping
Android SDK/NDK
Play Store at scale
Monetization (AdMob)
Analytics
Idea → PoC → production
Education
Degrees
Saint Louis University
Dec 2024
Saint Louis, MO
M.S. in Computer Science — GPA 3.93 / 4.00
U. of Catania & eCampus
Mar 2021
Catania, Italy
B.S. and M.S. in Computer Engineering