Probably hacking on a Rails app. 🏋🏻♂️🎸☕️💻 @GetRewardful, @Podia, @Granify, @FotoJournal (🪦) and more.
Edmonton, Alberta, Canada
Joined June 2007
- Tweets35.3K
- Following617
- Followers3.3K
- Likes18.6K
Kyle Fox retweeted
Being a founder means being the most optimistic person in the room and the most pessimistic person in the room. At the same time. About the same company.
Erased my MacBook Pro and reinstalled macOS.
My goal is to ship products faster than ever without installing any dev tooling locally: homebrew, mise, databases, dev servers, IDEs — none of that.
It's going to be ChatGPT/Claude desktop apps + cloud environments.
Is it possible?
Kyle Fox retweeted
every product i use should just be a headless mcp, that feeds into an agent, where i never have to think about anything underneath.
except for our product, of course.
in our product, customers love the ui and love us very much.
we're special that way.
Kyle Fox retweeted
My wife just released a HUGE update to her open source cybersecurity skills repo 👀
Now's the time for everyone to be on top of their game
Give these skills to your agent to do a sweep or create a Grok Bot CISO
github.com/briiirussell/cybe…
Kyle Fox retweeted
Caring is the moat, you should feel visceral pain when things are bad or broken and stop at nothing to fix them
SaaS isn't dead, it's just overpriced.
4 months ago I cloned Airtable for a client in 5 days because they refused to pay Airtable $500/mo
months later, I’m still maintaining it
every two weeks it’s another edge case, a UI tweak, or a "quick 10-minute request." They’ve easily spent 10x more in headaches than the $2,000 they would’ve paid Airtable
just proving that SaaS isn't dead. Cloning isn't enough, if you want it to be same quality as original it becomes a full time job
and at this point isn't it easier to just pay?
Kyle Fox retweeted
This is probably the most persuasive argument for why NOT to trust people who are vibe coding tools. Perhaps the best analogy for cybersecurity is health and safety in the real world.
Let's take an example of a grocery store. My father in law used to be in health and safety and a supermarket chain here in Ireland. He explained to me that a lot of the processes that from the outside seem innocuous are there to legally protect the business.
One such example is the signature sheet on the back of the door of a public bathroom at the supermarket. It's not only so the manager can hold people accountable for cleaning the toilets. It's also in case someone slipped and fell in there. There aren't any cameras, so if there is a signature sheet saying Emmet cleaned the toilets at 1:20pm and the person says they fell at 2:15pm, we can reduce our liability somewhat because we can show we weren't totally negligent, we implemented some best practices by having someone regularly putting eyes on the toilets.
For data protection a lot of the controls you need to have in place are similar. Sure there are technical controls, like SSL, etc, but there are also organizational controls like training policies (that are enforced), etc.
A lot of this is theatre, but a lot of it is practical things that do protect your customers data. @marclou is an entertaining/inspiring creator/indiehacker, but he has shown mild disdain for some of these types of things in the past when queried about Datafast and ShipFast. This is common across pretty much everyone advocating for vibecoding taking over the world. Vibecoding doesn't absolve you of your responsibilities to your customers and their data.
I saw a guy on LinkedIn last week announcing his vibecoded project that helps you recover lost revenue from failed payments on Stripe. He literally declared it was vibecoded, and then in the next sentence said that it connects to your Stripe account. Nobody should trust that, it's craziness.
Be careful out there!
congrats, you vibe-coded your own software. you’re also the head of security now
yesterday, Railway was breached and thousands of vibe-coders (and companies) spent the day rotating every API key / password / token they had stored on there
then had to audit their entire tech stack and assess their exposure (i.e. maybe they weren’t exposed directly, but vendor A they use was)
same day, PHP (the language behind ~70% of websites) patched two bugs that could let a stranger take over your server without a password
if you are building your own software, all of that is on you:
> you need to stay up to date on the latest cybersecurity news
> you need to routinely audit and update your tech stack
> you need to spring into action to reduce exposure on days like yesterday
> you’re responsible and liable for your (and your customers’) data
or rather than vibe-coding your own storefront, you could pay shopify $39/mo and let 7,600 experts handle payments, fraud, PCI compliance, and all of the above for you
rather than vibe-coding your own newsletter platform, you could pay @beehiiv $49/mo and let 130 specialists handle deliverability, security, uptime, and everything else
AI made it easier to build your own software… but it also made it easier to break into it. there will be many more p0 exploits like yesterday moving forward
SaaS isn’t invulnerable, but at least those companies are staffed with senior engineering teams and security experts who handle issues like this for a living
Kyle Fox retweeted
congrats, you vibe-coded your own software. you’re also the head of security now
yesterday, Railway was breached and thousands of vibe-coders (and companies) spent the day rotating every API key / password / token they had stored on there
then had to audit their entire tech stack and assess their exposure (i.e. maybe they weren’t exposed directly, but vendor A they use was)
same day, PHP (the language behind ~70% of websites) patched two bugs that could let a stranger take over your server without a password
if you are building your own software, all of that is on you:
> you need to stay up to date on the latest cybersecurity news
> you need to routinely audit and update your tech stack
> you need to spring into action to reduce exposure on days like yesterday
> you’re responsible and liable for your (and your customers’) data
or rather than vibe-coding your own storefront, you could pay shopify $39/mo and let 7,600 experts handle payments, fraud, PCI compliance, and all of the above for you
rather than vibe-coding your own newsletter platform, you could pay @beehiiv $49/mo and let 130 specialists handle deliverability, security, uptime, and everything else
AI made it easier to build your own software… but it also made it easier to break into it. there will be many more p0 exploits like yesterday moving forward
SaaS isn’t invulnerable, but at least those companies are staffed with senior engineering teams and security experts who handle issues like this for a living
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Nailed it:
"You don't have enough eyeballs for the amount of code being written so your focus needs to be on product intent, risk assessment and evaluating evidence rather than reviewing code."
Give your agent a way to verify its work. This can dramatically improve the quality of output.
With this process in place, Claude Code was able to write 90%+ of its code itself. When generating software at a faster rate than you can review it, the bottleneck shifts to proving that it works. @bcherny and team invested enough in verification, we've been able to move fast while maintaining stability.
Code reviews aren't going away, but you need to think of it differently. One human reading through line-by-line is no longer going to work as a gate, it needs to evolve into a multi-layered verification system, built with fast deterministic feedback loops for your agents.
This is where e2e tests, feature maps (as @poteto has been advocating), property tests and multi-agent adversarial reviews come in. These all provide opportunities to catch errors early and fix them before things get out of hand.
You don't have enough eyeballs for the amount of code being written so your focus needs to be on product intent, risk assessment and evaluating evidence rather than reviewing code. Delegate the code checking work to your automated tests, scale your approvals based on risk, and turn your test failures into living evaluations. This approach helps maintain speed without losing reliability.
Let the agents do what they do best and let you focus on what makes you irreplaceable: judgement, direction, and ownership. We tried to capture how we handle code review and verification in this writeup. Hopefully it's helpful.
Call me old-fashioned but I'll take the Porsche over the Tesla all day long. This car is an absolute work of art!
