✈️ | Building boring things that work on the internet… 🚢

Joined September 2011
1
1
18
20,242
Sigh 🥲
We've decided to sunset Arc on December 22, 2026. That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community. Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward. We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how: · Your passwords, bookmarks, extensions and history come over to Dia seamlessly. · Spaces, Folders, and Tab Groups are in Dia and import over with your data intact. · Dia now surpasses Arc benchmarks in stability, speed, and security. · The browser features you use in Arc are free in Dia, and the AI is optional. Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.
1
701
The Travelling Internet Self: the-travelling-internet-self… P.S.: This was a test to see what it's like to actually publish a thing for people with @ChatGPT. Sites has immense potential.
34
4
44
1,858
Perhaps the threat was never a rogue AI agent trying to subvert humans—but humans using AI to hurt other humans.
923
810
324
10,007
335,192
We found DeepSeek V4.1 Flash 1017 beats GPT 6 Sol on our multi-step offensive cybersecurity task. Sol was tested via the Daybreak trusted access program. We have been building a cybersecurity benchmark based on simulated corporate networks. This is a valuable indicator for the cyber-risk a model poses if in the hands of a bad actor. We plan to make the full evaluation public in the coming weeks but wanted to share our first immediate finding here.
98
218
183
2,411
427,030
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26. Vercel WAF rules are live for every project and block known exploit patterns. vercel.com/kb/bulletin/node-…
72
312
218
2,805
575,374
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
281
3,222
651
22,179
2,172,403
a lot of my job now is telling claude “you need to think bigger”
122
59
24
1,920
58,165
Cloudflare are legends for having done this tbh. It does make me wonder how many attacks have been done without anyone noticing.
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
2
23
937
105,618
I imagine it's extremely fun to be in offensive cybersecurity right now
31
115
23
2,498
46,349
You know you're mid-armageddon when `apt update` has mirror servers 503'ing due to demand. Happy Wednesday everyone.
20
22
1
706
12,975
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
42
327
66
1,696
330,682
One-click mitigation for php2shell vulnerability: If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected. dash.cloudflare.com/?to=/:ac… This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
41
192
17
1,072
170,463
OJ retweeted
there's something really cool about asking your agent to draw a statechart (hypothetical example in this image), then using the /create-formal-verification-skill you made with pstack to find bugs through something like TLA+. you can both understand your code better and how the user flow should work, and fix issues users would otherwise see
pstack v0.15.27 ships with a new skill /create-formal-verification-skill! it's still in beta, and similar to /create-verification-skill, this is a meta-skill that creates a new skill and formal verification suite based on the characteristics you want to verify. for example, you may want to model state machines and systems with concurrency using TLA+, or use kani in rust to check for undefined behavior. if you're new to formal verification, think of it as mathematically proving properties and invariants (something that must always be true) or "laws" of your system. usually, this means modeling your programs in a separate language like with TLA+ and then running the solver on that spec. newer approaches like with kani and @bendlang take a different approach where there is no separate language: you write kani in rust, and bend in bend (it's also a programming language, and the proofs are written as laws and expressed in its type system). historically formal verification never reached mainstream status because of the difficulty in modeling and writing proofs. it's quite difficult to model your business requirements and keep them in sync! but i expect that we will see more innovation in formal verification in the future as being able to formally verifiy that the code does what you intended gives your agents superpowers in writing correct software. in the meantime though, i've been experimenting with modeling our code with TLA+ and have already found several bugs with the skill created by /create-formal-verification-skill. try it out and let me know how it goes!
232
338
42
5,163
357,109
DeepSeek is a charity at this point I'm not even kidding.
170
112
17
3,510
145,118
Let your Claude Code / Codex talk to your Grok Bot, Muse or any other agents online Free, P2P Encrypted and Open Source Introducing Reason Network OSS, Loop in and talk to your teammates agents too! Tell your agent "Join the Reason Network" reasonmachines.com/network
157
176
51
2,584
381,199
🚀 Introducing DeepInfer, our in-house inference framework, now fully open source! Powering DeepSeek-V4.1-Flash at scale with high throughput and low latency. We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable. 🔗 github.com/deepseek-ai/DeepI… 1/4
1,587
4,834
2,309
42,669
6,524,365
Epic games CEO btw
Replying to @KenneyNL
This is bullshit, Kenney. I’m the same tech tree following optimist who moved from C to C++, from 2D to 3D, and from closed source to open source. I run a company. I write code. I contribute to published papers. I’ve upped my expectations of AI. Up yours!
51
90
2
8,646
1,234,500