Founder @ https://xitter.gq/t.co/tyIFPd1czQ
Joined November 2021
- Tweets1.5K
- Following809
- Followers604
- Likes6.9K
Rick retweeted
With the recent wave of vulnerability disclosures, it’s a good time to take a closer look at your own code.
Turn your coding agent into a team of security auditors with the open-source skill that seeded Cloudflare’s vulnerability discovery harness.
The 6 phase approach:
1. Map the codebase
2. Hunt for vulnerabilities
3. Challenge each candidate
4. Record the findings
5. Verify the findings
6. Report what’s confirmed, rejected, or still needs validation
Start your hunt here:
github.com/cloudflare/securi…
Rick retweeted
REA (reverse engineer anything) - F*CKED by chinese student...
solo dev just dropped protection for your app & site & game from reverse-engineering and AI hackers, for free
REA not dangerous anymore.
here's how to use and setup BLA (Blind LLM Agents):
first understand how it works:
• REA opens your app in 1 command, BLA hides traps inside it before you ship
• fake keys and decoy code for AI to chase, plus files built to blow past REA's own limits
• AI burns tokens on dead ends, your users get the exact same app
here's how to set it up for FREE:
1 → open Claude Code in the folder of your app, site or game
2 → say: " install Node.js 24 if I don't have it, build my project, then run npx bla-agents setup and npx bla-agents harden"
3 → it finds your build itself: dist, build, Electron .asar, .wasm, Python, native binaries
4 → it plants fake keys and decoy code, then checks every protected file still runs the same
5 → the step everyone skips: ship the files from the new .bla-hardened folder, not your old build
6 → for sites it protects the JS your site sends to browsers, your server code never leaves your server anyway
7 → want proof? run: npx bla-agents benchmark - before vs after on 14 test apps
paste link on repo below as soon as possible:
If I tell my agent to read and this and mute them
X gonna ban the hell out of my ass the moment it type in X.com
the ai slop posters list is now fully synced with @ryanvogel’s list - we’re up to ~780 identified accounts making this app worse.
if you haven’t yet, point your agent at the list and have it mute and block the accounts on it daily
xitter.gq/i/lists/21166591768940…
24
Previously, we have ghosts who do painting at mid night
Now, we have Microsoft Paint that can be draws remotely
28
> me days ago
> "this bike suck, what if I put its ECU on steroid ?"
> "should be ezpz"
> me now
> having to learn how data transits works through electric cables so I can workaround initialization sequence at 2 AM💀
1
50
Rick retweeted
Don't delete Playwright. Paste this into Claude Code instead:
"Find every Playwright/Puppeteer browser cache on this machine and delete the Chromium builds older than 156.0.8078.73. Then edit the Playwright MCP config to add --browser chrome --sandbox so it uses my auto-updated system Chrome. Also grep every Electron app in AppData for its Chrome/ Electron/ version string and tell me which ones are below Electron 43.8.6 / 44.10.1 / 45.2.1."
Took 10 min. Found 3 vulnerable Chromiums, a dead Puppeteer cache, and an EOL Electron in Cursor.
Rick retweeted
Applications are now open for the Anthropic Residency, a paid, fixed-term research program for academics, technical founders, and staff-level engineers who want to make AI safe and beneficial for everyone. No ML background is required.
Apply by November 22: alignment.anthropic.com/2026…
Lol
The seller:
"In 2020, I was making $220k a year as a program engineer.
Good job, nice house, but I was tired of working for the man. I wanted financial freedom.
So I attended a real estate syndication seminar.
The guy on stage owned 10,000 apartment units, drove a Lamborghini, and apparently hadn't worked a day in years.
I paid $40,000 to join his mastermind.
That's where I met my future partners. A dentist, a software engineer, a mortgage broker, and a guy who'd sold his HVAC business.
None of us had ever owned an apartment building, but between us, we had something like 70 years of business experience. How hard could it be?
Six months later, we were buying a 977-unit apartment complex in Atlanta.
$120 million valuation. Huge value-add opportunity.
The broker said rents were 30% below market, and our Excel model showed a 25% IRR.
We raised millions from friends, colleagues, a few dentists, and some other accredited investors. Everyone loved the presentation.
The first year was amazing.
I got invited to speak at two syndication conferences. Our mastermind even featured us as a success story.
I was thinking about quitting my IT job.
Then we started having some issues with the property.
First, the management company quit.
The replacement company quit too, after the on-site maintenance guy was shot at.
At some point, someone stole the security gates.
Then our lender called about something called a rate cap that had expired.
I have no idea what that is, but our mortgage payments doubled.
We sent investors an update explaining that we were strategically preserving liquidity while repositioning the asset.
That bought us a few months.
Eventually, we stopped sending updates altogether. One of my partners moved to Australia. I haven't heard from him since March.
Anyway, last week we agreed to sell the property for $73 million.
On a brighter note, I've decided to launch a coaching program for aspiring syndicators.
$40,000 for the mastermind.
After everything I've been through, I feel like I have a lot to teach."
1
43
Rick retweeted
When you torrent, you join a swarm. Every peer in that swarm can see every other peer’s IP address, that’s how the protocol works. It has to know where to send the pieces.
Anti-piracy firms join swarms for popular titles and log every IP that connects, with a timestamp. It’s automated, which is why it took just two days.
The firm sends starlink the IP and timestamp. Starlink checks which customer had that address at that moment and forwards the notice. Resellers like sasktel say they don’t hand your identity to the rights holder unless a court orders it. starlink’s policy says repeat violations can lead to “service-related consequences.”
Piracy or not your ISP can see:
Every domain you connect to (DNS lookups, and the site name in the HTTPS handshake)
every IP you talk to
when you’re online and how much data you move
what kind of traffic it is. Bittorrent has a recognisable pattern even when it’s encrypted
HTTPS hides the page and what’s on it.
Yes use a VPN but it doesn’t make you invisible it only changes who can see you. Your ISP sees one encrypted tunnel to a VPN server. The swarm sees the VPN’s IP. The VPN provider now sees everything your ISP used to see. you’ve swapped who you trust.
Your ISP has always had the logs. Paramount just showed you they get used.
Rick retweeted
I am totally shocked
Nobody could've foreseen this happening with a product vibecoded by high schoolers, there was just no way to know something like this would happen
In other news, software engineering is solved
‼️ Apps built with the AI app-maker Lovable left passport numbers, payment information and 200,000 chat messages open to anyone, no login needed.
German security firm Crissy Field scanned 159,041 Lovable projects and found databases with email addresses readable on 7,403 sites.
Lovable promises no coding skills are needed. Its terms make customers responsible for their apps and data.
Lovable told German business daily Handelsblatt the problem is industry-wide.
Rick retweeted
thank you Chinese forums leaking bootloader unlock methods + DeepSeek running on my MacBook + T3 Code, now my Redmagic 10 Pro runs LineageOS with native AirPods support AND can switch to playing games on SteamOS running on FEX on the fly with the gaming slider on the side of the phone
Rick retweeted
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math.
It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training.
We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵
Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math.
rikiyat.github.io/blog/weight-sp…
github.com/RikiyaT/lm_und…
huggingface.co/Qwen/Qwen3.5-0…
huggingface.co/RikiyaT/Qwen3.…
Rick retweeted
Astra, my model is shit. Please fix.
Make no mistakes.
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math.
It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training.
We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵
Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math.
rikiyat.github.io/blog/weight-sp…
github.com/RikiyaT/lm_und…
huggingface.co/Qwen/Qwen3.5-0…
huggingface.co/RikiyaT/Qwen3.…
Rick retweeted
> Railway gets caught hacking competitor's infra
> “sorry, my agents accidentally did it”
This is insane
Hey @Railway, is there a reason employee's of yours are trying to breach my infrastructure?
Your employee Jake Runzer, just attempted to tonight.
Rick retweeted
October in a nutshell:
- PHP got hacked
- Railway got hacked
- OpenCode got hacked
- Binance got hacked
- Polymarket got hacked
- GitHub Actions got hacked
- SoftBank got hacked
- Cursor marketplace got hacked
- Coinbase vendor got hacked
- Fireworks AI got hacked
- LiteLLM got hacked
- Capcom got hacked
- npm packages got hacked
- TiDB Cloud got hacked
- Warp's vendor got hacked
happy cybersecurity awareness month
