King of the internet, VP of engineering at Portchain, Love new green technology, Self Driving cars, Machine Learning and Stocks. Hiring node.js devs!
Copenhagen, denmark
Joined April 2008
- Tweets2.7K
- Following1.6K
- Followers391
- Likes54.4K
Johnny J. Andersen retweeted
Today we are starting the rollout of Device Bound Session Credentials (DBSC) for vercel.com
DBSC makes it impossible to steal session cookies from a device. So, if you install info-stealer malware (e.g. through a supply chain attack), that malware can not steal your vercel.com session.
Malware can still do bad things while residing on the device. But the abuse we are seeing in practice separates the stealing from the eventual abuse, and DBSC effectively prevents this.
DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie. The private key can never be retrieved ever again. Not by us, not by you, not by the malware.
Every website should use DBSC but given how new of a technology it is, we still need to build more experience in rolling it out. In our case there were lots of special cases for things like oauth apps that we needed to resolve. This is also why we are taking a slow approach to the rollout.
DBSC is currently only supported by Chrome on Mac and Windows. We are also working on a kind of polyfill for other browsers. However, the polyfill is less secure and we would love to see broader browser adoption.
There is a related technology called DPoP which is essentially the same but for apps that run on your device. We're in the process of shipping this for Vercel CLI. Ideally, all CLIs and apps would adopt this technology. Luckily rolling out DPoP is much easier than DBSC and it does not depend on browser vendor support.
Johnny J. Andersen retweeted
Great line from the CTO of Proton. I’m paraphrasing and stealing it :
Your job is not to use agents to help you write code. Your job is to lead the agents to help them write code.
Johnny J. Andersen retweeted
Day 26/ You can now easily switch between multiple accounts on mobile, and coming soon to desktop too. Next two days will be resets… banked… do with this what you may 👀.
help.openai.com/en/articles/…
Johnny J. Andersen retweeted
BREAKING: Vice President JD Vance has just cancelled his trip to St. Cloud, Minnesota scheduled for Friday at the last minute, per the Attorney's Office in Minnesota.
Trump has cancelled all rallies this weekend, including his Saturday rally in Kansas and his Sunday rally in Iowa hours earlier.
Johnny J. Andersen retweeted
A ‘hello world’ milestone for Project Suncatcher 🚀
After launching our prototype satellite a few weeks ago, we’ve now successfully sent a command up to orbit, booted up the TPU, ran the prompt, and received our first complete response back on earth - a haiku!
Johnny J. Andersen retweeted
有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。
Johnny J. Andersen retweeted
Our robots built this in the city of Almere: curved walls, different types of bricks and bonds, indented text.
Real world deployment, insane complexity, 100% of every brick done by our robots, with another 15 houses to come in the coming weeks.
Johnny J. Andersen retweeted
Apple M5 Ultra 512GB is live on Apple store!
27K EURO!!! with 4TB SSD in Italy 👀
Availability 23rd November!
Johnny J. Andersen retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
Johnny J. Andersen retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
Johnny J. Andersen retweeted
>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
>NET::ERR_CERT_AUTHORITY_INVALID
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back