@alain
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
Agent detection and better stealth browsers: @usefoil Co-founder of @getcognito, acquired by @Plaid.
San Francisco, CA
Joined July 2008
- Tweets1.6K
- Following438
- Followers2.5K
- Likes1K
Pinned Tweet
Discovered a new method for detecting if someone is using Incognito in Chrome:
Write 512 tiny 1-byte responses into a scratch Cache API cache, then read:
navigator.storage.estimate().usageDetails.caches
Normal Chrome: ~393kb
Incognito: ~85kb
Why? When you're in incognito, Chrome writes to memory instead of disk, which leaves less metadata residue
You should be minimizing cloud data. There’s never been a better time to store exports + your sensitive files on an air gapped external hard drive.
SSDs are expensive right now, and you want redundancy in case a drive fails so I recommend getting these in a RAID setup:
- 2x WD Red Plus 6TB newegg.com/red-plus-wd60efpx…
- OWC 2-Bay enclosure bhphotovideo.com/c/product/1…
It’s not much, but it’s something
xitter.cf/0xcordeiro/status/2112…
In the last 24 hours:
1. iPhone 11 through 16 are apparently vulnerable to remote attacks.
2. SSL certificates are broken until browsers remove eMudhra CA.
3. PHP >9 vulnerability CVE published (tomorrow).
The world is about to witness things that have never been seen before.
Readers added context they thought people might want to know
The post's iPhone claim is inaccurate; a leaked Cellebrite forensic tool targets a Bluetooth bug patched in iOS 26.5 and does not affect updated devices. The eMudhra CA and PHP issues are real incidents but framed sensationally.
justin.sh/blog/2026/10/c…
blog.mozilla.org/security/2026/…
php.net
If your company has sensitive data right now, here's some of what I'd do as a pre-2027 priority:
- Lockdown Mode for all devices (incl. phones)
- killing BYOD (phones) for roles with sensitive data access
- automating agent security patching pipeline (24x7, find, validate, remediate, deploy)
- instant page on stale builds + CVEs
- automated, same-hour cve patching on all services
- shutting down / sandboxing as many legacy services as possible
- lock down CI/CD: signed builds, pinned dependencies, no secrets in pipelines
Feels very much like we’re approaching the “rage against the machine” era
Businesses vs. personal agents
Government vs. abliterated models
People vs. ai
Most companies don't even have automatic CVE patching, let alone security agents running 24x7. The next few months will be extremely difficult for many
xitter.cf/thdxr/status/211179051…
Was excited to give Grok Bot a try, but saw it's $350/mo just to kick the tires. What's up with that @johnbai !?
CSS + canvas animations with Fable are *dramatically* better
One of the things Anthropic has RL'd into Fable is a frame stopper
Build a Fable animation and you'll notice it adds a URL anchor system (ex. # t=3.66) so the model can reliably screenshot at specific times
What are your favorite scraping, anti-detect, and AI agent browser services? Eg: @brightdata, @browser_use, @browserbase, @nottecore
Working on a report
You can detect if someone is using iCloud Private Relay super easily
Apple publishes a database of their egress IP addresses and the entire world's iCloud Private Relay traffic exits through ~105K IPv4 addresses.
I analyzed it and found some surprising stuff. Let's dig in:
But iCloud Private Relay users can rejoice: its traffic is typically associated with *lower* levels of fraud because it requires having a valid Apple ID with a working credit card.
So (good) fraud models treat this as a risk reducer, despite it being a VPN
You can find the raw data, straight from Apple, here:
mask-api.icloud.com/egress-i…
Follow me @alain for more opsec, browser security, and privacy/fingerprinting explorations
AI is still terrible at writing
One of the remaining disciplines where the proof-of-work of human sweat *is* the value
Same for design
Excited for @jgreze and team - looking forward seeing what Town becomes
xitter.cf/jgreze/status/20621786…
Today, we’re launching @TownAI: the AI assistant that learns you.
We’re coming out of beta with a $55M Series A led by @ARampell at @a16z, with participation from @KirstenGreen at @forerunnervc and continued support from @firstround, @altcap, and @conviction.
Right now, getting real value from AI means prompting, configuring, building workflows, managing agents.
We think that’s backwards.
The future of AI is a companion that already knows you and how you work. Town connects across your inbox, calendar, Slack, docs, messages, and workflows to understand what you need, then starts doing the work with you.
Drafting. Scheduling. Project tracking. Follow-ups. Context gathering. Multi-step tasks. And it only acts when you say so.
All adapting to your voice, priorities, routines, and relationships over time.
Your Townie is the AI assistant you actually need.