I make mobile apps, AI agents, and a fool of myself live on Code with the Italians podcast. Speaker, author. Father and husband in the Italian countryside
Italian countryside
Joined November 2007
- Tweets30.1K
- Following1.9K
- Followers6.4K
- Likes77.2K
Ivan Morgillo retweeted
We are launching the Tesla Robotaxi safety report today.
Till date, Robotaxi has driven a total of 3.3 million miles autonomously, and has had zero injuries nor airbag deployments. If the same number of miles were to be manually driven, we should expect roughly 9 injuries to the occupants or other pedestrians and 4 airbag deployments on average.
We will continue to transparently share our progress with the public using this page.
tesla.com/robotaxi/safety
📋 Daily Standup — 2026-10-22
MyGoo — mygoo.fun/
• Recorded Play production versionCode 1762. Sent iOS build 1754 (2026.10.21) to TestFlight.
• Wallet and phone-save errors now show once, from the listener. The page has a working RETRY. A failed wallet load shows the error page, not the register screen.
Kindle Gratis — kindlegratis.fun
• The API now stops busy retries at the deadline. Contribution detail waits out the daily VACUUM lock instead of failing.
• The scraper scans every second and never saves a group without its leader. It keeps Chrome groups per child, and it cleans up leftover Chrome when a scrape is killed.
City Deals — citydeals.it.com/
• Moved the web scanner and the duplicate judge to Gemini 3.5 Flash Lite.
Ludus Magnus — ludusmagnus.fit/
• Fixed the container rule, the access link retry, and the iOS heading.
• Updated the Flutter docs, the design system guide (Electric + Volt theme), and the mobile API endpoint docs.
• Recorded the October decisions in llm-context.md.
Smart Pantry — nowastefood.app/
• Items can move to another pantry, both from the API and from the item sheet. Maestro flow 13 covers it.
• The item sheet scrolls on short screens. Regenerating an invite code sends the shown code.
• A provider refusal in AI now returns 503 and gives the slot back.
• /health caches the Open Food Facts check for 60 seconds and runs one refresh at a time.
• Barcode scans are normalized before lookup. Products are found under any zero-padded GTIN form.
• Each user's time zone is now stored for expiry's "today."
5 projects updated.
Winter is coming
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
In the last few weeks I’m really suffering the constant attitude by @claudeai
“The classifier this…. The classifier that… I can’t do this in auto-mode… This is a cybersecurity violation…”
Bro!! I want to do things FFS!! I’m paying for this shit!! Just do the fucking work!
🤖 Made with AI
Ivan Morgillo retweeted
@riggaroo new skills release has release notes! thank you!
Now that this tweet has almost 50k impressions, can we have somebody from the @GooglePlay team look into this, please.
This is clearly painful for many devs.
Half the internet is panicking because somebody realised that half the internet runs on a certificate that has “4” as a security key.
Denialists and doomers complain about AI.
Opus or Astra would never pick “4” as a security key.
A human picked “4”. A fucking savage picked “4”.
📋 Daily Standup — 2026-10-21
app-promo-reel — github.com/hamen/app-promo-r…
• Sound scoring now reads the finish report, because a model cannot hear the mix.
AI Bedtime Stories — bedtimestories.click/
• Recorded Android build 1217.
• The paywall leaves room above the fold on every build host.
StreakUp — streakup.fit/
• iOS build 47 (47) went to TestFlight. Android build 57 recorded.
Kindle Gratis — kindlegratis.fun
• The footer year now follows the build year, not a fixed 2026.
MyGoo — mygoo.fun/
• Public company reports need a token.
• Role tests cover more admin-only actions. A manual merge test ran.
#showmethemoney
• Bedtime weekly plan is listed first. On Android 1217, the plan rows were below the fold before.
• App Store prices and trials for Bedtime recorded.
• Repository count wording now says "more than fifty". The count is 58.
Smart Pantry — nowastefood.app/
• Barcode scanner prefixes are stripped. Non-digit codes no longer go to Open Food Facts.
Ludus Magnus — ludusmagnus.fit/
• Android 20 release notes recorded. Android 20 and iOS 19 built with the access link and the session expiry fix.
• Session expiry: the notice shows once per expiry. A rejected refresh sends the member to login with a "session expired" message. Open screens close when the session ends. Old snackbars clear first.
• Access link: attempt IDs now bind each request. The rate limit uses a capped key. A closed screen or a newer session wins over a late answer. A link that switches the member builds a new app tree. An iOS app banner was added.
• Login, access link and logout now run one at a time.
• Foreign phone numbers stay as typed. The backfill write is now conditional.
• The WhatsApp hand-off is refused when the send would fail.
• Staff copy no longer says that ending a membership fixes a shared number.
• New tests cover the late profile, the no-answer refresh, the spent notice and the rate limit.
Total: 8 projects.
I still have 99% of the weekly quota of my GLM subscription.
I have just unleashed it on my wifi network to look for my Amazon Echos:
"I want to know all the hacking we can do on those devices. I want to use @youtubemusic on with Alexa".
🤖 Made with AI
Ivan Morgillo retweeted
How well do you know your times tables? 🧠✨
Practice with Times Table Quiz, the app that makes learning multiplication fun with quick quizzes and progressive challenges.
📲 Try it here: timestablequiz.xabaras.dev
#TimesTableQuiz #TimesTables #Math #LearnThroughPlay #indiedev
Questa è una cosa che mi sono sempre chiesto e adesso è effettivamente una feature!
@matteosalvinimi vogliamo l'FSD per strade più sicure!
Ivan Morgillo retweeted
Abbiamo pubblicato su @DVNSoldi una nuova sezione dedicata ai documenti declassificati dello Stato italiano: caso Moro, terrorismo e stragi.
Siamo partiti da 10 schede che raccolgono atti parlamentari, fondi d’archivio e riferimenti ufficiali di Camera, Senato e Archivio Centrale dello Stato.
Per ciascuna trovi un riassunto, i punti chiave, una cronologia e i collegamenti alle fonti originali.
Che cosa ci trovi, concretamente?
Il bollettino della Commissione Moro del 17 gennaio 2018, per esempio, registra la decisione di rendere «liberi» 319 documenti precedentemente «riservati». Un altro resoconto, del novembre 2017, documenta il passaggio di alcuni atti da «segreti» a «riservati» e richieste di documentazione ad AISE, AISI, Carabinieri e Polizia.
Ci sono anche i riferimenti al fondo della Commissione Moro, con rapporti DIGOS e documentazione sul sequestro e sull’omicidio di Aldo Moro, e al fondo Terrorismo e stragi, che comprende materiali su Bologna e carteggi dei servizi e del Ministero dell’Interno.
Una cosa che spieghiamo nelle schede: «declassificato» non significa automaticamente scaricabile online. Alcuni materiali sono pubblici sul web, altri richiedono accreditamento, SPID o consultazione in archivio.
L’obiettivo è rendere più semplice orientarsi tra queste fonti: capire che cosa contengono, quando è cambiata la loro classificazione e dove andare a leggerle.
È una prima raccolta.
La trovate qui:
dovevannoinostrisoldi.com/do…
Every time I release a new Android app, I get a few crashes on a "OnePlus 8 Pro with an x86_64 CPU and 4 GB storage".
That device doesn't exists. It's a chimaera device that Play uses to run tests and systematically crashes the app for some weird native lib that it can't find.
📋 Daily Standup — 2026-10-20
remozio — github.com/rock3r/remozio
• The iOS app has a native design, an app icon, and the Add computer flow.
• Buttons grow with the text size. The Computers screen scrolls.
• iOS tests and the iOS build now run in CI.
• A development tool creates invitations for phone import tests.
• Work in progress: splitting the protocol library for multiplatform builds.
#showmethemoney
• Bedtime yearly price in Italy is €34.99, not €29.99. The deck now says so.
• Refreshed RevenueCat, AdMob and GA4 figures, with corrected show-rate requests.
• App Open rule matches on both slides: once a day, cold or warm.
• First Android sale of Smart Pantry Plus is counted.
Ludus Magnus — ludusmagnus.fit/
• Members get an access link from staff. It opens the app on iOS and Android.
• Shared phone numbers are flagged on a new "Numeri duplicati" page.
• Gym opening hours now handle past-midnight, 24-hour and split schedules.
• Gym address, contacts and hours show on the Profile screen, and the owner can edit them.
• Android builds 18 and 19 went to Play internal. iOS builds 17 and 18 went to TestFlight.
• Athletes see exercise volume on the Me screen, which replaces the Today tab.
• Weight field steps by 1 kg and speeds up when held.
MyGoo — mygoo.fun/
• Gift cards allow one card per 30 days, checked under the wallet lock.
• Deleting a wallet transaction now undoes it.
• Missed-reward corrections award the GOOX.
• Daily game failures log their reason and send it with the preflight alert.
• The Vinci Buoni Amazon page is removed, with no redirect.
Kindle Gratis — kindlegratis.fun
• Evergreen "most often on our free lists" pages are live for Italian and German, with monthly rebuilds and tests.
• Each book now shows how many days it spent on the free lists.
• Share-with-a-friend unlock added to the VIP dialog. Rules and remote settings are off by default.
• Share-with-a-friend tracking fixes, including the referrer and the clock edge cases.
• Privacy policy is linked from Settings.
• Home pages no longer carry rating markup.
• Android build 2158 is claimed for Play.
Two Notes — twonotesapp.com/
• iOS build 7 (7.0.0) went to TestFlight. The feedback release is version 7.
• End-to-end tests hide the keyboard on iOS only.
• Pre-push hook was re-copied from app-tools.
AI Bedtime Stories — bedtimestories.click/
• Paywall now shows all three plans on the first screen.
• Savings tag no longer overlaps the yearly label at large text.
• Italian and Spanish homepage snippets now use the search queries they rank for.
StreakUp — streakup.fit/
• Restored a Firebase setup so iOS keeps signed-in users.
• Updated the Firebase iOS SDK and the Android build tools.
• English push-ups and squats snippets now use the queries they rank for.
• Weekly dependency update: 84 packages.
Smart Pantry — nowastefood.app/
• Android build 2133 went to Play internal. iOS build 38 went to TestFlight.
• The free daily AI limit changed from 20 to 10 calls.
• Plus users get higher AI limits. A refused call gives its daily slot back.
• The app tells users to wait for the purchase webhook before they retry at a limit.
• Each Gemini call now has a cost cap.
• Daily report shows AI calls and their list-price cost.
• App Open ads show once a day, cold or warm.
• Home and German search snippets now use the queries they rank for.
3 things a day — 3things.day/
• iOS build 56 went to TestFlight. Android build 139 went to Play, with release notes in 12 languages.
• Widgets now roll to the next day at midnight, even when the app is closed, on iOS and Android.
• Widgets push tomorrow's slate and the start of the next six days.
Blackjack Trainer — trainblackjack.app/
• iOS build 40 went to TestFlight. Android build 39 went to the Play internal track.
• Feedback posts retry after an account switch.
• Account merge email now arrives before the sheet finishes.
• Weekly dependency update: 9 packages.
City Deals — citydeals.it.com/
• The silent-channel alert now says when the next post is due.
12 projects today.
Ivan Morgillo retweeted
Claude Code just found a hidden camera in my Airbnb. In the smoke detector…
Checked into one of those $60 Airbnbs where the microwave sits on top of the fridge. Opened Claude Code and asked what else is on this Wi-Fi
It listed everything on the router. All of it was the usual stuff except one box made by a company that only makes CCTV cameras, quietly sending video out of the room every 4 seconds
Claude sent it the "find me" ping installers use. The smoke detector above the bed beeped for 5 seconds and its red recording light came on
The check takes 2 minutes:
step 1 → join the Wi-Fi, open Claude Code, paste the prompt from the first comment
step 2 → it lists every device and flags anything that looks like a camera or a mic
step 3 → if it flags one, turn the lights off and shine your phone flashlight at smoke detectors, clocks and chargers. A lens glints back
You won't remember this at 1am in a strange room. Save it now, thank me on your next trip
Every week I point Claude Code at something in my life and post what it finds. Follow if you want the next one
Ever found one? What did you use to check?
Readers added context they thought people might want to know
This did not happen. The image is created with Google AI, it contains a SynthID watermark. This post was made to farm engagement.
synthid.com/image-detection
metricool.com/what-is-engage…
TIL @claude has a @telegram integration and you can bind a session to a bot.
In progress experiment with @seebrock3r and @fourlastor 🔥