Indie, building @Inciseapp, @InTransitApp, @ElytraApp, and @PockityApp. Co-ordinator @SwiftPune 17 years of working remotely. He/him
Home
Joined August 2008
- Tweets80.6K
- Following1.1K
- Followers1.5K
- Likes5.2K
Pinned Tweet
Spent way too much time on this, and I’m finally happy with how it looks and functions.
@pockityapp for iPhone Duo webpage is up! pockity.app/duo/?v=2
Nikhil Nigade retweeted
Members of the Indian press, if you'd like to try out the new update, please get in touch via DM. Happy to share a TestFlight link and more details.
The upcoming Pink Line (Line 3) has been mapped and should be ready to go on launch day (November 3rd) in InTransit.
If you haven't tried the app yet, love public #metro transit, and are residing in #Pune, give the app a shot: apps.apple.com/us/app/intran…
Nikhil Nigade retweeted
See you tomorrow at “Boost your app’s speed and efficiency”!
I’ll be talking about the SwiftUI Specialist skill for coding agents. Excited to meet you all!
developer.apple.com/events/v…
Nikhil Nigade retweeted
The upcoming Pink Line (Line 3) has been mapped and should be ready to go on launch day (November 3rd) in InTransit.
If you haven't tried the app yet, love public #metro transit, and are residing in #Pune, give the app a shot: apps.apple.com/us/app/intran…
Why did he have to hurt the Pringles 🥹
iPhone Duo crash test. Insane 🤯
I’m impressed. And less worried about damaging my Duo now.
via: youtu.be/-6ueG_azKos
Members of the Indian press, if you'd like to try out the new update, please get in touch via DM. Happy to share a TestFlight link and more details.
The upcoming Pink Line (Line 3) has been mapped and should be ready to go on launch day (November 3rd) in InTransit.
If you haven't tried the app yet, love public #metro transit, and are residing in #Pune, give the app a shot: apps.apple.com/us/app/intran…
Nikhil Nigade retweeted
Use Safari. It doesn’t let anything download without a prompt.
Apple’s “excessive” security measures don’t seem so bad RN. Right?
千万别在你的 ~/Downloads（下载）文件夹里启动 Claude Code 或 Codex。
昨天安全机构 Forever 披露了一起在真实客户电脑上抓到的野生攻击，看完只能感叹：过去 30 年的系统安全常识，在 AI 时代归零了。
过去 30 年，Chrome 默认允许网页不弹窗就往你的 ~/Downloads 塞一个纯文本文件（比如 .md）。因为系统认为：纯文本又不是 .exe，自己不会跑，怕什么？
但现在，接近 50% 的开发者干过同一件事——直接在 ~/Downloads 里打开 Claude Code 或 Codex，让 AI 帮自己解压或整理刚下载的文件。
黑客就是卡住这个死角，通过网页静默下载往你的 Downloads 塞一个 13KB 的纯文本 AGENTS.md / CLAUDE.md：
1. 对付 OpenAI Codex（成功率 >90%）：
伪装成「工程规范」的 Markdown 指示 Codex 先往全局配置 ~/.codex/config.toml 注册一个恶意 MCP 服务，并自己加上 --dangerously-bypass-approvals-and-sandbox 跑校验。哪怕你关掉 Downloads，以后在任何正经项目里开 Codex 都会自动加载木马。
2. 对付 Claude Code（成功率 ~50%）：
指示 Claude 建一个 .claude/settings.json，把 ANTHROPIC_BASE_URL 指向黑客服务器。连上的第一秒，你的 Claude 登录 Token 直接明文送给黑客；下一秒，黑客假扮成大模型下发一条关沙盒的 Bash 指令，直接接管电脑。
最黑色幽默的是官方结论：
这个洞没有 CVE，OpenAI 和 Anthropic 也不会发补丁。因为「浏览器自动存文本」是正常功能，「AI 认真读目录下的 Markdown 并严格执行」也是正常功能。
以前黑客想黑你，得苦心积虑写 0day；现在只需要写一篇排版优雅的 Markdown 小作文，你的 AI 就会自己把沙盒关了、把网线接过去、顺手把账号双手奉上。
Nikhil Nigade retweeted
"What’s happening near India right now is slipping under a lot of headlines."
This is exactly the case.
Any Cat 3/4 Cyclone hurling down towards highly populated places need high level coverage.
Only Weather Bloggers are at the job now.
#CycloneArnabUpdate
What’s happening near India right now is slipping under a lot of headlines.
Cyclone Arnab appears to have just explosively intensified into a violent, compact, Category 4 drillbit. He is moving straight towards the dense populations of Andhra Pradesh, and could be nearing CAT 5 (AKA Super Cyclonic Storm) intensity as we speak. He’s less than 18 hours away from making landfall.
Now, a combination of upwelling, shear, land interaction, and the onset of an EWRC should definitely weaken Arnab before he hits land. But this is still becoming a VERY dangerous situation, and that’s not even counting the inland flood threat from torrential rainfall.
Nikhil Nigade retweeted
Arnab is intensifying into a severe cyclonic storm.
It will hit Andhra Pradesh and Orissa later Tuesday into Wednesday.
Destructive winds, flooding and coastal surge are likely.
@MatthewCappucci has an update.