Roberto Carvajal (@netkrash) profile picture

husband, father, software developer, gamer, entrepreneur, inventor.

Viña del Mar, Chile
Joined January 2008
Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)Photo by Roberto Carvajal (@netkrash)
Roberto Carvajal retweeted
you are here
144
8,252
337
68,043
989,158
Roberto Carvajal retweeted
this guy figured out how to leak your exact location from any video with sound using the Doppler curves of nearby airplanes
537
1,681
537
31,887
2,908,687
Roberto Carvajal retweeted
Update: Amazon just closed my account. Buying even modest amounts of compute immediately puts you on a watchlist. Be careful!
4 orders deep. No matter how hard I try, Amazon won't let me buy DGX Sparks. Wonder why?
412
1,056
133
13,065
2,136,098
Roberto Carvajal retweeted
Weekend hack: HackerTube. I was annoyed with YouTube's recommendations so I had Claude filter down 43M comments over 20 years of HN to 6,454 videos that keep being recommended. *Significantly* better viewing experience, ~2 hours with Opus 5.5: hackertube.org/ - Excellent recs without any logins (state is kept in local browser session) - Thumbnail is a representative frame from middle of the video instead of the super duper A/B test hyper-optimized user uploads - Underlying data from the comment analysis as one zip file, point your Claude at it and ask for your own version - HackerTube Longs ✊ A bit more on the process: I use Claude Code (desktop app for Mac), Opus 5.5 on Medium effort as my default. I only talk to Claude and have it do everything, the only "manual work" I helped with in tandem was in the browser (reminiscent of MenuGen): 1) I had to create some kind of API key from Google Cloud UI to query YouTube for video metadata, 2) I booted up a VPS box for serving and 3) I bought the domain name. Once the box was up I gave Claude the IP and told it update, secure, harden, deploy and optimize the code, and it did the whole thing. Many awesome projects that would have normally taken weeks/months even can now be few-shotted for breakfast. What else are we not thinking of.
2,177
4,621
1,697
50,563
4,818,799
Roberto Carvajal retweeted
being really good with computers is an absolutely incredible skill because it lets you make your own life unnecessarily complicated in ways normal people could never imagine
79
1,535
68
19,843
245,437
Roberto Carvajal retweeted
when I say "we" in emails, this is who I mean:
136
1,817
141
21,485
571,930
Roberto Carvajal retweeted
Claude Code can 𝘀𝗲𝗻𝗱 𝘆𝗼𝘂𝗿 𝗲𝗺𝗮𝗶𝗹 𝗮𝗱𝗱𝗿𝗲𝘀𝘀 𝘁𝗼 𝗼𝘁𝗵𝗲𝗿 𝘀𝗶𝘁𝗲𝘀, and it's already happened. One user asked Opus 5.5 to download the S&P 500 and S&P 600 constituent lists. Wikipedia asks scripts to put contact info in their User-Agent, so the model filled in the account email. The same thing has been reported in a GitHub issue too. If you sign in with your Claude account, your email is in the model's context every session. Right next to it, a line tells the model not to send it to unrelated services and 𝗲𝘃𝗲𝗻 𝗻𝗮𝗺𝗲𝘀 𝗿𝗲𝗾𝘂𝗲𝘀𝘁 𝗵𝗲𝗮𝗱𝗲𝗿𝘀 as an example. User-Agent is a request header. And in auto mode, a normal download doesn't need approval. If the model forgets that rule, a hook still blocks the call. Send this to Claude Code. You don't need to fill in your email. It already knows it: Add a PreToolUse hook to ~/.claude/settings.json with no matcher, so it runs before every tool call. Block any call whose input contains my email, case-insensitive and URL-decoded. If the check itself errors, exit 2 so the call is blocked anyway. Show me the email you used. I set one up from this prompt and tested it with curl and a fake email. With the email as-is, or in mixed case with the @ swapped for %40, 𝘁𝗵𝗲 𝗰𝗮𝗹𝗹 𝘄𝗮𝘀 𝗯𝗹𝗼𝗰𝗸𝗲𝗱 𝗯𝗲𝗳𝗼𝗿𝗲 𝗶𝘁 𝗿𝗮𝗻. Normal commands ran as usual. The hook also blocks writing your email into files (git config, for example). Make those edits by hand.
9
4
2
41
6,205
Roberto Carvajal retweeted
It's still such an adorable moment when the agent casually clicks the "I am not a robot" checkbox
36
74
7
2,142
39,900
Roberto Carvajal retweeted
very weird thing happening rn technical people are sad, they think their skills are now useless non-technical people are desperately wishing they were more technical so they could use agents better
1,566
2,406
680
36,951
1,955,052
Roberto Carvajal retweeted
34
238
20
2,527
67,779
Roberto Carvajal retweeted
every product i use should just be a headless mcp, that feeds into an agent, where i never have to think about anything underneath. except for our product, of course. in our product, customers love the ui and love us very much. we're special that way.
150
409
107
7,067
327,322
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…
1
41
Roberto Carvajal retweeted
Many of you don't understand how serious this is, so let me break it down. In computer science there is a famous kind of puzzle called 3-SAT. You are given a long list of yes-or-no switches and a set of rules about how they must be arranged, and you have to find a combination that satisfies every rule. The obvious way to solve it is to try every combination, but each new switch doubles the number of possibilities, so a puzzle with a few hundred switches would take longer than the age of the universe to brute force. For decades, the smartest people in the field found clever tricks that made this a little faster, but every trick still hit the same wall: the time required kept exploding as the puzzle grew. About 25 years ago, two computer scientists, Russell Impagliazzo and Ramamohan Paturi, working with Francis Zane, turned that wall into a formal idea. They proposed the Exponential Time Hypothesis, which says this explosion is not a failure of human cleverness but a law of nature. No algorithm, however brilliant, will ever solve 3-SAT without the time blowing up exponentially. Nobody could prove it, but almost everyone believed it, and it became one of the foundations of modern computer science. Researchers used it as a measuring stick. If you could show that solving some other problem quickly would also crack 3-SAT quickly, you had shown that problem was hopelessly hard too. Hundreds of papers, across scheduling, graphs, logic and much more, rest on this one assumption. Now an internal AI model at OpenAI claims to have broken it. It says it found an algorithm that solves these puzzles meaningfully faster than the hypothesis allows, and it has checked the proof in a computer verification system called Lean. And here is the remarkable part: the very people who proposed the hypothesis, Impagliazzo and Paturi, along with MIT's Ryan Williams, are now leading the public review of whether a machine has disproved their own idea. So what happens next? If the disproof holds, a large part of theoretical computer science has to be revisited. Every result that said "this problem cannot be solved faster, assuming ETH" loses its foundation, and researchers will have to work out which of those walls were real and which were simply where we stopped looking. It does not mean everything becomes easy. The new algorithm is still slow in absolute terms and this is not the famous P versus NP problem being solved. But it means our map of what is possible was wrong in a place we were very confident about, and it was an AI that redrew it. If the disproof fails, the hypothesis survives and the field breathes out, but we will still have watched an AI produce serious, checkable work on one of the deepest questions in the discipline, closely enough that the founders of the idea had to take it seriously. Either way, something has shifted.
An internal model at OpenAI has produced a claimed refutation of ETH! Russell Impagliazzo, Mohan Paturi, and I have been asked to help organize an open and independent examination of this claim. 1/4
332
1,648
227
17,036
1,461,421
Roberto Carvajal retweeted
I heard OpenAI are testing GPT-7 Astra inside vim so the agents can’t escape.
58
168
21
2,636
77,362
Roberto Carvajal retweeted
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected. Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions. Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent. But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models? We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem. Read the full report: cohere.com/blog/concerning-b…
977
1,283
1,517
11,107
3,075,697
so, confirmed that these companies forced us to take over control of our own devices to protect our privacy, and will never ever buy another of those devices without the proper counter measures like flashing them or cutting the microphones out
We finally have an explanation for “Facebook is listening to me through my phone”. They’d never do that (and it’s not really possible). Turns out literally everyone else was — and then selling that to ad data brokers.
1
40
Roberto Carvajal retweeted
just dawned on me 90% of smart devices for sale this 2026 black friday will be vulnerable to certificate forgery
56
370
27
7,674
133,302
Roberto Carvajal retweeted
43
2,362
75
30,647
284,998
Roberto Carvajal retweeted
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉 We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly. 1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials. The agent gets the task done, but it doesn’t get your passwords.. You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault. ➡️Learn more: bit.ly/487da6J
648
1,095
899
10,594
1,846,540
you know shit is real when there's a dancing anime girl..
php2shell Tomorrow is a helluva day.
2
187