ai engineer, experimenting
Madrid, Spain
Joined November 2021
- Tweets5K
- Following2.4K
- Followers1.7K
- Likes50.4K
javi retweeted
I am okay with Kimi 3.1 deliberately leaving out top-end offensive cyber capabilities from their training data.
Discriminating against use cases is MUCH less bad than discriminating against users. And the world does need all the time it can get to prepare, harden, check old code, (properly) formally verify new code, etc before the full weight of very powerful cyber attacks is upon us.
And if this first big wave of AI risk is not handled well, then we may well get a dystopia of highly locked down models, KYC gating on everything, highly intrusive surveillance on everything, a society where you may be a second or third or fourth-class citizen in terms of model access based on your credentials and nationality.
javi retweeted
what if the solution to the cyber apocalypse is to roll your own software?
- we use human slopware libraries because code used to be expensive
- turns out these libraries have tons of vulnerabilities
- exploiting them makes economic sense as they’re deployed at scale
—> what if we just don’t use libraries and have agents write idiosyncratic custom solutions/versions from scratch?
those still will have vulnerabilities but the economics of attack change significantly?
the whole npm this npm that is from an era where software was hard and expensive, no?
javi retweeted
hi everyone! excited to finally share what we've been building at sprout
our team of ex-fb engineers and a PM (founders’ median tenure: 6 years) banded together to save your kids from brainrot, and give parents their time back.
We just launched ParentBench, a live board testing whether AI can do the school-app errands parents do every day. Muse is way ahead: Muse Power can save parents 56 minutes every week. Help us map your kid's apps: sproutgoodhabits.com/map View article
javi retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
javi retweeted
now that i have your attention.
a month of free decentralized vpn for y’all from @nym frens
Privacy should be something you can use, not just something you talk about🫡
Lens is collaborating with
@nym to make private internet access available to the Lens community.
Lens users can now claim a free NymVPN pass and put privacy into practice.
Claim through Lens → activate on NymVPN → browse privately
No complicated questline. Just a little more privacy, now in your hands.
👇 Claim yours now: nym.lens.xyz
javi retweeted
Your community goes everywhere you go, your years of posting and commitment stays with you.
This is what @LC Lens offers, this is what you're sleeping on.
Lens is built for you, you own your followers, your content, you're absolutely in control.
javi retweeted
It’s crazy to ban people from a supposedly decentralized social network for posting takes the VC owner disagrees with. How is this better than X?
We need a real decentralized and anonymous free speech platform where users own their data. Try @lc, make an anon account with @nym.
If you were banned from Farcaster after the acquisition and are looking for a new home, @LC is for you.
Continue your journey on @heydotxyz , connect with the Lens community, and keep building. 🫡
🔗 hey.xyz
javi retweeted
AI is going to eat through our dependencies. We'll be using fewer and fewer external code/system. You will want an internal "open code" registry not buried inside node_modules. Agents pull from your registry and reshape it. on demand.
Less code reuse. More knowledge reuse.
