Christian Van Der Henst✨ retweeted
In 2019, United made $12 million in operating profit flying across the Pacific. Last year it made $735 million, more than twice Delta.
Its SFO hub is the Golden State Warriors of airlines: bad for a decade, then a dynasty. In 2010, United flew from SFO to just seven cities across the Pacific, and its Asia hub was in Tokyo. Now it flies to 16.
This week it added Hartford, Oklahoma City, and Charleston to SFO, and every one of them feeds that machine.

ALT Two maps of United nonstops from SFO to Asia and Oceania. 2010: seven cities, Tokyo Narita, Osaka, Seoul, Beijing, Shanghai, Hong Kong, and Sydney. Now: 16 cities, adding Tokyo Haneda, Taipei, Manila, Singapore, Brisbane, Melbourne, Adelaide, Auckland, Christchurch, and Tahiti. Pacific operating profit: 2019 United $12 million, Delta $415 million; 2025 United $735 million, up 6,025%, Delta $327 million, down 21%.
Christian Van Der Henst✨ retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Christian Van Der Henst✨ retweeted
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
Christian Van Der Henst✨ retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Christian Van Der Henst✨ retweeted
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
Christian Van Der Henst✨ retweeted
Incredible post.
It’s why I think “marketing to agents” is a waste of time.
“Personal agents will, I think, act as a kind of structural subsidy for product quality.”
“…personal agents will be on the consumer's side. I suspect that that will be the winning strategy”
Agents will sniff out bullshit and look out for their humans. Trying to game them won’t work. Trying to buy their influence won’t work either.
Build high quality differentiated products and be world class at marketing to humans.
Everything else is midwit curve.
Assorted things I've been mulling over regarding agents in the economy:
• Companies are in some sense the original superintelligence. It's often the case that they can use their amortized cognitive surplus to advance their interests against those of certain consumers: relative to the optimization capacity of companies, consumers can be inattentive, underinformed, irrational, etc. (Think, say, of some of the classic insurance upsells at the end of a booking process, which is typically priced substantially above what a regular policy would cost.) Herbert Simon introduced the idea of bounded rationality, and firms often end up benefiting from it. Thanks to personal agents, we will probably get somewhat more rational in how we engage with companies.
• How exactly will outcomes change? Well, certain kinds of price discrimination will work less well (how do coupons work if every agent hunts fastidiously for them?), and certain kinds of customer cross-subsidy will change (today, people who forget to cancel subscriptions subsidize those who don't). Taken across the economy as a whole, I'm not sure what the incidence of all of this will be.
• In corporate strategy, people have long debated the relative importance of distribution and product quality. Perhaps you've made something better, but does anyone know about it? Won't people just continue to buy the ACME Corp Mousetraps? Personal agents will, I think, act as a kind of structural subsidy for product quality. How would markets look different if individuals always spent at least 10 hours researching their purchases? On the margin, focusing on making a product better is, I think, going to become a more effective strategy for companies. This is good!
• It true, a corollary is that information about product quality will become more important and impactful. Today, most people have very limited ability to aggregate and integrate such data, but agents will have insatiable thirst for such signals. (It's often said that data is becoming more valuable because it helps in the training of models. That's obviously true, but I think there's a secondary way in which it's more valuable simply as a complement to cheaper intelligence.)
• A big question is whether agents will increase superstar effects (rational agents all settle on the same product) or increase dispersion (because everyone has slightly different tastes and preferences, which agents are good at eliciting, finally overcoming the artificial clustering we've been subjected to).
• Many internet companies have monetized demand routing, which is in turn often predicated on short attention spans. "I'll click on the first thing I see." This has led to some amount of inefficiency, as companies try to propitiate capricious ranking algorithms and incur various placement fees. It's not all deadweight loss (willingness to pay is itself a kind of signal, which is valuable to buyers), but it's not great. How will the nature and value of this routing change in a world of personal agents? I don't know the answer, but I think that the effects might be pretty big.
• Much of what I'm writing hinges on the assumption that personal agents will be on the consumer's side. I suspect that that will be the winning strategy, but whether it's true, and what it means to be true, involves a lot of other questions.
Taken as a whole, the market is a massively parallelized, decentralized, and highly imperfect value attribution machine, and, taking stock of all of the effects, it seems to me that the quality point may well be the biggest: that agents will change the nature of the backpropagation such that the rewards for better products increase. Maybe this is too optimistic, but I suspect (and hope) that companies that make things that they're proud of will feel that the universe is a little more partisan in their favor.
Christian Van Der Henst✨ retweeted
I've vibe coded replacements to 7 of Adobe's apps in Rust. They're open source (links below)
Christian Van Der Henst✨ retweeted
We aggregated five years of Google Flights data to find the best booking windows for holiday travel this year. Here’s what to know:
✈️ For Thanksgiving travel, flights tend to be cheapest in October.
✈️ For Christmas travel, the sweet spot for booking is 56 days out (October 30th).
✈️ Connecting flights can also be a big money saver. Nonstop tickets are 20% more expensive on average.
✈️ When you travel is key for saving: Departing on a Monday and returning on a Tuesday or Wednesday saves about 14% over weekend flights (and up to 20% domestically versus Sunday).
✈️ Wednesday beat Tuesday as the absolute cheapest day to book a flight, but the difference is negligible — buying a ticket on a Wednesday only saves you about 1.4% compared to Sunday, the most expensive day.
Christian Van Der Henst✨ retweeted
RIP all-remote video interview hiring processes, hello onsite rounds
It was a matter of time, wasn't it?
The whole point of building Tavus has been simple: talking to a machine should feel as natural as talking to a friend or coworker.
It’s hard to describe all the tiny nuances that make a conversation feel human. The little expressions. Moving around in your chair. Knowing when to speak and when to listen. The dance of it all.
Griffin is by far the closest anyone has come to a model that can capture those nuances. The first time I saw it being used, I had no idea I was watching our model rather than just a normal video call.
I’m so incredibly proud of this team and what they’ve built.
Impressive. This set of talks, along with the new America dot gov website, has the unmistakable feel of an Apple launch event. They're rebooting the federal government as a tech startup. Several observations.
(1) First, with this new AI interface to the entire federal government, if it works as promised, there won't be a single American who can't say their life wasn't helped at least in part by AI, or that the benefits accrued solely to zillionaires. This in itself cannily mitigates anti-datacenter sentiment.
(2) Second, Joe Gebbia and Marco Rubio's talks on simplifying name changes and passport filings introduce a completely new era where the US government is actually launching tangible features that benefit users.
(3) Third, this launch event in and of itself may visibly drive reform. It could become much more important than the State of the Union. Unlike laws, code is user-visible, and can be instantly audited by the public, as Obama found out with the failed obamacare website launch. So: the annual America dot gov event may be substance, whereas SOTU is traditionally optics. I wouldn't be surprised to see the President present at the next one.
(4) Fourth, this kind of event is a perfect example of where tech and red cooperate best. They both hate bureaucracy. Automating paperwork with code reduces the power of statists over both capitalists and nationalists. It's also hard to undo by other admins: once you digitize a process, hard to turn it back to paper.
(5) Fifth, it's an obvious point perhaps, but think about how much influence YCombinator has had in 20 years. From Gebbia's Airbnb joining their 2009 batch to a complete overhaul of the user interface of the US bureaucracy, and thus the US government.
(6) Sixth, this is another take on the network state. The functional part of the US (the network, meaning tech) is merging with and partially reforming the dysfunctional part (the state, meaning bureaucracy) by automating 20th century paper forms.
As a tech startup, there will no doubt be bugs and user issues and so on, but unlike with paper laws those issues will be visible and the code fixes will be verifiable. A new era of AI America. Rooting for them.
Christian Van Der Henst✨ retweeted
Te podrá gustar más o menos @dhh, pero esta pequeña parte de su charla es muy buena. Creo que debería verla cualquier programador o ingeniero que siga escéptico con la IA.
Y en realidad, cualquier persona.
Primero, por quién lo dice: el creador de Ruby on Rails y cofundador de Basecamp, Hey y ahora Omarchy.
Pero también por el mensaje positivo pese a todo el cambio que esto supone.
De hecho, casi todos los programadores que conozco (yo empecé a programar en los 80) estamos más ilusionados que asustados.
PD: le invité a VDS, no puede venir este año, pero igual hacemos algo online o lo dejamos para el 10.º aniversario ;)
Christian Van Der Henst✨ retweeted
1/ I'm a cardiologist. I've practiced for twenty-five years, through a lot of "breakthroughs" that turned out to be press releases. So understand the weight of what I'm about to say: I have never seen a single week in medicine like the one we just lived through.
In the span of a few days, four separate scientific breakthroughs landed. The stock market treated them as four unrelated stories and sent a handful of biotech companies soaring. But that's the shallow read. Look closer and they are not four stories at all. They are four faces of the same story — the biggest shift in medicine since the discovery of antibiotics.
Medicine is becoming programmable. Individualized. Written for one human being instead of the average of millions.
Let me walk you through exactly what happened, in plain language, and show you where this is actually headed. Because the future arrived quietly this week, and most people scrolled right past it.
Christian Van Der Henst✨ retweeted
Omarchy Quattro is out!! This is one of the greatest software releases in my professional career. I hope you enjoy using it just as much as I did building it ✌️ omarchy.org/
Christian Van Der Henst✨ retweeted
Wow: Stripe and Advent have bid more than $53 billion to take PayPal private. 🤯
This is the biggest story in payments I can remember, and I write about payments for a living.
The details, per Reuters:
- $60.50 a share
- a 28% premium, backed by roughly $50bn in committed bank financing.
- Stripe and Advent would own PayPal 50/50 and keep the company whole.
- The first approach was April. PayPal hasn't responded yet.
The timing is poetic.
Last year was the first year Stripe's payment volume passed PayPal's. $1.9 trillion vs $1.79 trillion. The challenger passed the pioneer on volume, then went straight for the whole company.
Same volume, wildly different price tags. Stripe's tender offer in February valued it at $159bn.
PayPal peaked at $360bn in 2021 and just got bid at $53bn.
The gap is the growth rate: Stripe grew 34% last year, PayPal grew 7%. Growth is everything.
Advent's name in this deal tells you as much as Stripe's does. PayPal generated ~$6.4bn in adjusted free cash flow last year, so $53bn is roughly eight times cash flow.
That is private equity maths. Advent takes on the turnaround of a 23,800-person company.
And Stripe? Stripe spent 15 years building the merchant side of the internet. PayPal hands it the consumer side: 439 million active accounts, Venmo, and the yellow checkout button consumers know on sight.
If this closes, one company touches $3.7 trillion in annual payment volume. Around 3% of global GDP and would be by far the largest US merchant acquirer by volume.
My questions
- Can anyone fix the back end mess of PayPal?
- It's employee heavy, I image a lot of layoffs would be required?
- Is this actually a distraction for a very healthy growing Stripe?
- Would you keep bits and jettison others?
I get the attraction to the raw volume and assets. But underneath is a mess of company M&A and systems that never got fully integrated. Doing that is hard and not for the feint of heart!
There is no certainty it happens.
But someone just put $50bn of committed financing behind the idea that PayPal is worth more off the stock market than on it.
Discl: Stripe sponsors my podcast, opinions 100% my own – at Peschiera del Garda, Veneto
































