Awesome kid retweeted
đ Try it live: sablon-ai-omega.vercel.app
đ» Open source: github.com/irull/SablonAI
Built with Next.js, React & Three.js.
@AIatMeta @MetaforDevs @Meta @cerebral_valley #BuildForYourWorld #MetaAI #Hackathon
đ I own a small DTF t-shirt printing shop in Indonesia.
I built SablonAI for the Meta AI Hackathon: design your own tee, preview it in 3D + on my real shop shirt, order via WhatsApp.
Powered by Muse Spark, Muse Image & SAM 3.1 đ€
đŹ 3-min demo: youtu.be/AtmkNphzsak
Awesome kid retweeted
gatau kenapa tapi males aja klo baca postmortem tapi ditulis pakai AI
sebwah klarifikasiđ
algonacci.github.io/blog/posâŠ
Awesome kid retweeted
đšđšđš ALERTE SĂCURITĂ MAXIMALE ! Python est compromis.
đž Mettez immĂ©diatement pip Ă la version 26.2.2 ou plus.
đž Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
đž uv : uv self update (0.13.4 ou plus)
đž Mettez aussi Ă jour les certificats du systĂšme (apt / dnf upgrade ca-certificates) et vos images Docker
pip install est compromis.
L'autoritĂ© indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prĂ©tend ĂȘtre, utilisait des clĂ©s secrĂštes ridiculement faibles : 8 clĂ©s, toutes infĂ©rieures Ă 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.
Le risque pour Python : quelqu'un sur ton rĂ©seau (wifi public, FAI, Ătat) se fait passer pour pypi.org, et ton « pip install » tĂ©lĂ©charge un paquet piĂ©gĂ© sans aucune alerte. Aucune attaque n'a Ă©tĂ© signalĂ©e pour l'instant, mais c'est trivial Ă faire.
Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.
La situation est terrifiante !
Rien que dans l'écosystÚme Python, chaque installation de CPython, chaque venv, uv, tout est exposé.
Et je ne vous parle mĂȘme pas de npm, pnpm, yarn, Go, Rust.
Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.
C'est quand il y a de la mer qu'on reconnaĂźt les vrais marins...
Readers added context they thought people might want to know
Ce n'est pas un bug Python mais une vulnérabilité des clés privées faibles des certificats intermédiaires eMudhra/emSign (d<256 dont une valant 4), exposant les bundles certifi/pip à des MITM TLS potentiels jusqu'aux mises à jour.
discuss.python.org/t/information-âŠ
emudhra.we-have-a-problem.com
scotthelme.co.uk/eight-bits-of-âŠ
github.com/advisories/GHSâŠ
Awesome kid retweeted
Imagine running PHP and Go on the backend, Node.js on the frontend, NGINX as the reverse proxy, Linux as the server, an HTTPS certificate from eMudhra
And also deploying everything via GitLab
âïž
Awesome kid retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabiâŠ
Awesome kid retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Awesome kid retweeted
October has been an absolute nightmare for software
> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident
At this point, the biggest security risk might not be the code we write, but the code we trust...
Awesome kid retweeted
Code is getting analyzed more deeply than ever, and suddenly decades-old softwares are full of critical holes.
Not claiming anything. Just wondering if every one of these was really an accident, or if some were backdoors left by developers that we're only now able to see thanks to today's advanced AI tools.
Fair question, I think.
Awesome kid retweeted
launching lattedit.xyz
A calm little LaTeX editor for your browser, Free, no account, works on your phone. LaTeX, freshly compiled.
Awesome kid retweeted
Akhirnya punya tim, dan tentunya yang di-hire bukan coder tapi designer.
Mau hire coder kayaknya ga dulu deh. Masih bisa jadi clanker operator, belum perlu operator lagi. Capacitynya masih ada.
Soalnya architecture dan tech decisionnya semua dari ane. Kecuali bisa bantuin itu.
Awesome kid retweeted
10 github repos that turn claude code and codex into elite ui designers:
â1.â â Superdesign Skill
github.com/superdesigndev/suâŠ
â2.â â Better Design
github.com/marvkr/better-desâŠ
â3.â â Design Taste
github.com/madebymustafa/desâŠ
â4.â â Canvas UI
github.com/DavidHDev/canvas-âŠ
â5.â â Paper Shaders
github.com/paper-design/shadâŠ
â6.â â UI Layouts
github.com/ui-layouts/ui-layâŠ
â7.â â Hyperiux Components
github.com/Hyperiux-ImmersivâŠ
â8.â â Motion Primitives
github.com/ibelick/motion-prâŠ
â9.â â Cursify
github.com/ui-layouts/cursifâŠ
10.â â Trickle UI Kit
github.com/akaieuan/trickle
Awesome kid retweeted
(re)introducing idx-cli for indonesian fellas
IHSG cli and mcp server untuk:
- data market IHSG
- analisa fundamental (rasio P/E, growth, valuation, dll)
- data kepemilikan 1% KSEI
- technical analysis (rsi, moving average, trend, sinyal, dll)
- financial statement, earnings
- berita, sentimen
- screeners
- ALL ABOVE 100% FREE
agent-native, colok langsung ke agent lewat cli atau mcp server (ex: claude, hermes) langsung bisa buat query data dan analisa IHSG, composed buat scripting bash dan python juga
link di bio
Awesome kid retweeted
Things to learn before starting your own agentic workflow:
- âAI Model
- âHarness
- âAgent / Bot
- âMulti-Model Routing
- âSkills & Tool Calling
- âProgrammatic Execution
- âMCP (Model Context Protocol)
- âState & Memory
- âEvaluation & Benchmarks
Anything else?
Awesome kid retweeted
Introducing GLM-Legal
Built on GLM-5.3-Flash, GLM-Legal matches frontier models on mainstream legal benchmarks.
Designed for real legal workflows: contract review, evidence analysis, compliance, and more.
Tech Blog: z.ai/blog/glm-legal
Apply for API Access: z.ai/consultation/legal
Try AutoClaw: autoclaw.z.ai
Awesome kid retweeted
siang-siang acrobat dengan WayangOS @dalangcloud @papanberjalan demi bisa pasang nouride.com nya bang @gading_coder disupport Orvix nya mas @algonacci
semua serba minimalis, karna saya suka yg mini-miniđ
Awesome kid retweeted
Orvix Coding Plan, now in OpenCode, Pi, and omp.
3 official plugins. 1 API key. 1 shared balance.
60M generous coding tokens for Rp150.000, prepaid for 30 days.
Code in the agent you love. Bill it to Orvix Coding.
platform.orvix.id/coding
introducing Orvix Coding Plan
60M cost-normalized coding tokens. Rp150.000. prepaid for 30 days
separated from chat tokens. built for agentic coding
Kamui recommended. OpenCode and pi.dev allowed
platform.orvix.id/coding