I make cool things, e-com obsessed, DJs, and festivals for fun, Chelsea ⚽️ Fan for life. Check my link for my latest projects. DM's Open
US
Joined September 2009
- Tweets2K
- Following1.2K
- Followers3.8K
- Likes1.2K
I try to always listen to @dhh
and while I am at it... @gofundme your site search is not good - When I search for the EXACT handle to donate in a logged in state, I can't find it. (see pic)
I DID get a Bogus profile (that is removed) and an nginx bad gateway.
Here is the link if anyone else couldn't find (courtesy of my @bot )
gofundme.com/f/support-a-har…
I came here to see what ppl are saying ! I was praying that @redbaronpizza was going to show up and support. Who says giant corps can't get it right. I am literally going to go to a store and buy a red baron pizza.
I came here to see what ppl are saying ! I was praying that @redbaronpizza was going to show up and support. Who says giant corps can't get it right. I am literally going to go to a store and buy a red baron pizza.
amazon just put this in writing
nobody cares how the code got written. they care if it ships and holds up.
the agent types. i own the judgment.
what do you never hand off? Keys what else
Great lesson for hobby builders like myself... these are the basics.
Want to run a real business? Here's some things I need to see:
- where are you located/headquartered
- where is data stored/hosted (EU is great choice overall)
- legal entity owner (needs to be a legal entity). Idc about trademarks and copywrites. Just need a legal entity.
- face behind the brand. I don't need a founder led brand, but if I can't see ANYONE behind it (ex. no employees on linkedin) then I'll assume there's nothing behind it
Not rocket science.
agent bugs have a fingerprint lol
human bug: the off-by-one you wrote at 2am
agent bug: a perfectly formatted function calling an API that doesn't exist... The second one is scarier bc it looks right in review
what's the tell you look for?
I just read the Google is asking merchants for an EIN to verify a business for a Google Business Profile, Huge win for GBP spammers, loss for the avg. business owner.
This is the most important post on X RIGHT NOW.
26% is wild. But that's not the scary part.
The scary part: a skill runs with the same access as my agent. My files, my env, my keys.
After rotating every key this week, my new rules for skills:
- read it before I install it, like an npm package from a stranger
- nothing it touches gets a real key
- one agent, one token
Convenience is how I got burned last week. Not doing it twice.
YOU must actually read the skill B4 you install!
Please don't install another AI skill until you read this.
Everyone's sharing free packs of Claude Code skills right now.
NVIDIA checked 31,132 of them. 26% had security holes. 5% looked deliberately malicious.
A skill gets the same access as your coding agent. Your files, your keys and your terminal.
So NVIDIA open sourced the scanner it uses. It's called SkillSpector.
Run it on any skill before you install it. It checks for 71 kinds of attack and gives each skill a risk score out of 100.
Free tools are great but check them first.
This DID NOT age well, now moving back to fly.io because @Railway is down AGAIN, even for a hobby dev not being able to deploy is rough.
Why I'm staying put at @Railway, and you should too.
8:22 last night: Railway emails me to rotate credentials.
I already knew something was wrong, and I suspected security. Yesterday was a security team's nightmare at a lot of companies.
"Railway detected anomalous activity involving systems that store customer environment variables."
And it wasn't just Railway. Any ONE of these would normally be the biggest story of the year. They all hit this week:
PHP: two critical bugs (9.2/10) let attackers take over servers, in the language behind ~70% of websites
Node.js: high-severity remote code execution flaw in versions 22, 24, 26
Java: Oracle emergency alert, 9.1/10. Three of the most used languages patching at the same time
GitLab: 10/10 hole in every version since 2014
Signal: bug could keep your mic/camera on after you hang up
WordPress: hackers stole a plugin maker's keys and planted backdoors on sites
LiteLLM: a release of the popular AI tool shipped with a password stealer
So I spent last night and this morning rotating keys and hardening how I use AI in my apps.
And I'm staying. Here's why:
Railway = easy for hobby developers like me. That's about to be the fastest-growing group in tech.
We're entering the "my agent can build that" era. Railway is the perfect tool for it, and after this they'll come out HARDENED.
Shoutout to @itsnoahd from Railway, who was all over X answering everyone he could. Pretty sure he didn't sleep last night. This is a nightmare for all of us, and that's what showing up looks like.
What are you changing in how your agents handle keys?
Why I'm staying put at @Railway, and you should too.
8:22 last night: Railway emails me to rotate credentials.
I already knew something was wrong, and I suspected security. Yesterday was a security team's nightmare at a lot of companies.
"Railway detected anomalous activity involving systems that store customer environment variables."
And it wasn't just Railway. Any ONE of these would normally be the biggest story of the year. They all hit this week:
PHP: two critical bugs (9.2/10) let attackers take over servers, in the language behind ~70% of websites
Node.js: high-severity remote code execution flaw in versions 22, 24, 26
Java: Oracle emergency alert, 9.1/10. Three of the most used languages patching at the same time
GitLab: 10/10 hole in every version since 2014
Signal: bug could keep your mic/camera on after you hang up
WordPress: hackers stole a plugin maker's keys and planted backdoors on sites
LiteLLM: a release of the popular AI tool shipped with a password stealer
So I spent last night and this morning rotating keys and hardening how I use AI in my apps.
And I'm staying. Here's why:
Railway = easy for hobby developers like me. That's about to be the fastest-growing group in tech.
We're entering the "my agent can build that" era. Railway is the perfect tool for it, and after this they'll come out HARDENED.
Shoutout to @itsnoahd from Railway, who was all over X answering everyone he could. Pretty sure he didn't sleep last night. This is a nightmare for all of us, and that's what showing up looks like.
What are you changing in how your agents handle keys?
Meta settled with all but one state in the 2018 Cambridge Analytica case, New Mexico held out and was just awarded a 25 Billion dollar award by a jury.
Meta has:
Cash and cash equivalents: $11.222 billion
Marketable securities (short-term investments): $71.227 billion
Total: $82.45 billion
~1/3 of their cash is at risk
I was just on a webinar doing research for the brand I work for, best - most productive hour of work today. if you care about AI automation and agentic Search AEO SEO @ericosiu (and Max) @singlegrain are at the forefront. I can not say enough about them, they are literally giving away secrets.
I am now trying to figure out what to do, the status updates that say we are working on it are not enough. What are the best RailWay alternatives?
My friend Cam said it best:
I love @Railway
I migrated my entire stack over a few weeks ago and was happy with it.
but not being able to deploy for ~22 hours is scary.
at this point, it makes you question whether you can trust the platform for production.
Using xCash to pay $50 - call it a "make me better" bounty to the best answer.
I am quickly realizing that I am using different AI Products for very different things. No one LLM is bringing to the table what I need to the jobs in front of me. They all are building things that they are "good at" and using them effectively is the new moat, i guess.
My problem: I am the context engine - flipping between tools (LLMs), although my brain can't do it efficiently.
How are others solving this using the tools? Sending $50 in xCash to the best reply - I need workflow improvement help.
@bot to stay organized and actually do work in my daily life.
@ChatGPT for analysis and planning (some code on codex)
@claudeai for design this workflow/presentation
@GeminiApp to work on Google specific work and fact check
I like @cursor_ai to code (although I use them all) and always have worktree fatigue.
Hey @elonmusk this steering wheel seems a little obsolete! when are we going to get the gold robotaxis here in dallas? Also the Spotify integration is gold!
