Share Tips AI, SWE and Work Culture | Business Inq on [email protected] | @SpaceXAI Ambassador | @open_ai Codex Ambassador | Build https://xitter.cf/t.co/J62lghozl7
Jakarta Selatan, DKI Jakarta
Joined December 2011
- Tweets91K
- Following3.9K
- Followers19.2K
- Likes11K
Pinned Tweet
Hosted our first Grok Bot Meetup Jakarta on October 4 at Ganara Art FX Sudirman!
94 check-ins on Luma, plus 10 walk-ins. Thanks to everyone who spent their Sunday with us.
We focused on using Grok Bot as a personal assistant for everyday life and work. A few things we explored:
- Planning and organizing daily tasks.
- Researching information and helping with writing.
- Automating repeatable daily workflows.
- Using a scout bot to find public profiles from a name, handle, company, or link and build a shortlist.
We used a phone-first format so people could follow the demos from their own phones.
For the scout bot, I still check the results before reaching out. Getting a shortlist is one step; verifying the right person is another.
Big news for open source. Agent Skills is no longer Anthropic's.
On Oct 22, Anthropic donated the Agent Skills standard to the Agentic AI Foundation under the Linux Foundation. Same home as MCP and AGENTS.md.
Why does it matter? A standard owned by one company can change whenever that company wants. Now it's maintained by engineers from Anthropic, Google, OpenAI and others, under neutral governance.
And it's already big. 70+ platforms read skills, from ChatGPT and Cursor to GitHub Copilot and VS Code. Around 1 million skills published and nearly 280 million installs, per Anthropic.
What it means for the community:
- Skills you write stop being tied to one vendor's roadmap. Switch tools, keep the playbook.
- Versioned releases are on the proposed roadmap, so fewer "works in tool A, breaks in tool B" surprises.
- Security guidance is coming too. Badly needed, since a skill can ship scripts your agent will run.
How does this relate to us? I keep my own skills in a plain git repo and load them into more than one agent. That only works because the format is boring. A folder and a markdown file.
The part nobody can standardize is what goes inside. Your team's process, what good output looks like, how to check it. That still has to come from us.
Udah jadi lead, jadi data2an, menteri keuangan, perencanaan dan pembangunan juga.
Banyak juga kerjaan istriku ini 😂😂
Bye fridaaaay, welcome weekend🙃
My current life is berkutat dgn data lagi haha. Project sblm nya data warehouse pake clickhouse, skrg lakehouse di atas iceberg. Yeaa ada microservice juga, but my focus is on data📊
Jujur ini project terbesar yg pernah dihandle, high responsibility sekaliiii hueheheuu. Aku nerapin T-shaped skills disini agar senantiasa tetap waras leading this project lolllzzz banyak bgt scope & lesson learned-nya, banyaaaaak. Ga cuma technical, tapi juga dari sisi soft skill, how to manage internal team and ofc client expectations & requests.
Tiap minggu tiada hari yg ga pusing wkwkw bcs AI not really helpful ketika di ranah soft skill handle clients & manage team haha, soalnya butuh tacit knowledge yg cuma bisa didapet dari experience lgsg sama orang2nya😂🫣😬
Oalah ni.. Menarik.
I strongly believe a part of why so many critical vulnerabilities are happening all over the proliferation of "abliterated" models, or models with safeguards removed.
You can access an abliterated GLM 5.3, a near frontier AI model, on @abliteration_ai today. And it's a world class penetration tester for like $10.
Twitter itu bubble.
Di timeline rasanya semua orang udah pakai AI Agent. Padahal klo ngobrol sama orang di luar, banyak yg baru nyobain ChatGPT atau Meta AI di WhatsApp.
Data e-Conomy SEA 2026 dari Google, Temasek dan Bain juga nunjukin hal yg sama. GenAI tumbuh cepat, tapi pemakaiannya belum merata.
Adopsi GenAI di Asia Tenggara
- 58% penduduk usia kerja di 6 negara SEA, sekitar 243 juta orang, udah pakai GenAI. Butuh kurang dari 3 tahun, sementara internet butuh lebih dari 10 tahun.
- Di Singapura, 70% pakai dan 26% pakai tiap hari.
- Di Indonesia, 54% pakai, tapi yg pakai tiap hari baru 16%.
- Usage AI per user (personal account) di Indonesia kira2 7x di bawah Singapura.
Siapa yang Pakai dan Untuk Apa
- Di Indonesia, sekitar 80% usage AI datang dari consumer. Enterprise baru 15-20%, sedangkan di Singapura udah 55-60%.
- Sekitar 70% usage consumer itu buat kerja dan belajar, lewat personal account. Artinya AI di kantor masih inisiatif masing2, belum jadi tools resmi perusahaan.
- Orang Indonesia juga banyak pakai AI buat image generation. 32% query Gemini di Indonesia itu buat image generation, sekitar 9 juta gambar per hari, paling tinggi di SEA.
Siapa yang Bayar
- Yg bayar dikit banget. Cuma 1-2% penduduk SEA yg punya paid account AI, dan itu personal account.
- Usage enterprise di Indonesia baru 15-20%. Jadi AI yg dibayar masih kebanyakan inisiatif individu.
Angka 54% tadi juga belum ngitung Meta AI di WhatsApp. Jadi yg baru nyobain Meta AI di WA malah belum masuk hitungan.
Jadi yg ngerasa ketinggalan karena baru mulai pakai AI Agent, santai aja. Kamu udah di depan kebanyakan orang.
AI personal sama AI buat kerja itu 2 hal beda.
AI personal:
belajar dari percakapan, kehidupan, kerjaan kamu. Bisa pakai Grok Bot, Dot, Hermes, OpenClaw. Nanti kelihatan bisa dipakai buat apa aja:
- inbox
- baca error Sentry
- baca docs di Drive/Confluence
- Pro aktif
Soal bisa baca dokumen,data, secara teknis tinggal colok MCP/CLI.
AI buat kerja:
AI personal yang hand off kerjaan ke sini. Bisa manual, bisa otomatis.
- Otomatis: AI personal langsung jalanin. Misal Grok Bot ke Cursor cloud agent, Hermes run Codex CLI di VPS.
- Manual: copas report dari AI personal ke Codex.
Kenapa dipisah? Context dan token.
AI personal kontennya berat:
skills, MCP, memori. Coding butuh context yang bersih, ambil yang perlu aja. Makanya AI coding jalan sendiri.
Contoh pakek Dot
Your Next.js frontend has to talk to a bunch of microservices. Call them straight from the browser, proxy through Next.js, or put a gateway in front?
This came up on Threads, and there isn't just one right answer.
Calling services straight from the browser is the messiest option. The browser learns every service URL, you configure CORS one by one, and HttpOnly cookies get awkward across origins.
The first answer is to route everything through Next.js
- rewrites() for plain JSON requests is light. What actually strains the container is big uploads and streaming
- Upload straight to storage with a presigned URL
- Keep one adapter per service in a server module. Server Components read, Server Actions mutate
It's simple and you only deploy one thing. The cost is that rate limiting and auth spread across routes, and Next carries all your API traffic.
The second answer is Nginx or a gateway in front
- One entry point that handles TLS, rate limiting and the auth check
- / goes to Next.js for the UI, /api/* goes straight to the services
- Uploads still use presigned URLs
You get central control. The cost is one more component to maintain, and each service still has to verify tokens itself.
With only a few services, start with Next.js. Move to a gateway once the service count grows or you need rate limiting and auth in one place.
Bukti pemerintah masih gagal soal lapangan kerja.
- Akses ke tempat kerja bisa lebih dari 2 jam PP.
- Penegakan aturan lemah, masih ada yg digaji di bawah UMP.
- Infrastruktur ga merata, jadi orang harus nyari kerja jauh dari rumah.
- Transportasi umum ke kawasan kerja kayak PIK masih minim, stasiun terdekat aja jauh.
Terlepas dari itu, kasus ini banyak masalahnya.
- 6 jam PP x 6 hari = 36 jam seminggu di jalan. Itu kayak seminggu kerja tambahan yg ga dibayar.
- Sebulan kira2 156 jam di jalan. Klo dihitung 8 jam sehari, setara hampir 20 hari kerja.
- PIK 1 masuk Jakarta Utara. UMP Jakarta 2026 itu Rp5.729.876, jadi 4,5 juta itu di bawah UMP. Emang boleh? Ga boleh, kecuali usaha mikro dan kecil.
Klo kepaksa banget ambil, cari kos murah di kampung sekitar PIK kayak Penjaringan, Dadap atau Cengkareng. Yg cuman buat tidur ada di 600 ribu - 1 jutaan, biasanya kamar mandi luar. Sisanya sekitar 3,5 juta buat makan dll, usahakan tetep nabung 500 ribu - 1 juta.
Menurut aku, jgn sampai PP sehari lebih dari 2-4 jam. Bener2 capek, weekday ga bisa ngapa2in.
Jadi klo kepepet, ngekos. Klo ga, cari kerjaan lain.
Ini referensinya klo mau baca lebih lengkap.
jakarta.go.id/siaran-pers/63…
λL-D1 | AI for Buzzer 🍉 retweeted
Karna pas gw share loker rame, temen gw sampe ada yang nitip dishare di akun gw. Yang ini full time, senior position, dan lebih ke data analytics
Monggo smrtr.io/CtzKg
coba munculin
@grok
1. Twit pertamaku
2. Twit paling banyak viewersnya
3. Twit paling banyak komentarnya
4. Twit paling banyak likenya
5. Twit yang paling banyak hujatan
6. Twit paling rame tapi cuma yapping
Sent ke @bot juga – at Bantargebang, Indonesia
coba munculin
@grok
1. Twit pertamaku
2. Twit paling banyak viewersnya
3. Twit paling banyak komentarnya
4. Twit paling banyak likenya
5. Twit yang paling banyak hujatan
6. Twit paling rame tapi cuma yapping
Security recap from the last 24 hours that actually matters.
- PHP, 2 CVEs
- Node.js, 10 CVEs
- SSL, 8 eMudhra intermediate certificates compromised
- GitLab self-managed, 1 CVE rated 10.0
What's the problem?
PHP
- CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2
- Unauthenticated remote code execution in the PHP runtime itself
- Every PHP site serving web requests is affected, so WordPress, Laravel and Drupal too
- Exploit attempts are already being reported
Fixing PHP
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fix.
Node.js
- 4 High, 3 Medium, 3 Low
- A brotli decoder bug that can lead to remote code execution
- TLS hostname checks that can be bypassed with oddly written IP addresses
- dns.resolve breaking on names with null bytes
Fixing Node.js
Upgrade to 22.23.4, 24.22.1 or 26.12.1. EOL versions stay vulnerable.
eMudhra
- 8 intermediate certificates from this CA were compromised
- That means someone could forge HTTPS certificates
- Browsers already block them, but Node apps, containers, VPNs and CI keep trusting them until you update
Fixing eMudhra
Update Node, Go, your OS CA bundle and your container base images. If your site uses an emSign certificate, get a new one.
GitLab self-managed
- CVE-2026-110264, CVSS 10.0, unauthenticated remote code execution
- Fix is 19.5.1 plus backports. GitLab.com is already patched.
So, have you upgraded and patched?
If not, better talk to your team today. These are serious because the impact can be
- Attackers running code on your server without logging in
- Leaked user data and secrets
- Fake HTTPS certificates silently accepted by your backend services
Yuk Ikut Free Workshop bikin Saas AI buat Enterprise!
xitter.cf/F2aldi/status/21051904…
Halo guys, aku mau bikin webinar online soal gimana bikin tools AI atau aplikasi yg terintegrasi dgn AI.
Webinar/workshop ini lebih ke arah gimana nanti bikin aplikasi buat dijual ke perusahaan, supaya bisa jawab pertanyaan kyk:
- data customer kami aman?
- biaya per bulan berapa?
- kalau AI salah jawab, siapa yg cek?
- API key disimpan di mana?
Goalnya kita bisa bikin aplikasi yg bisa dipakai di level enterprise, karena yg mereka perlu itu sistem yg bisa dipercaya.
Nanti kita bakal coba bikin aplikasi sambil bahas:
- map fitur dari masalah perusahaan sampai alur data
- request API pertama ke AstraFlow
- hitung token, estimasi biaya, dan pricing buat klien enterprise
- security dasar: API key di server, proteksi data, error logging, human review
Mau kerja di luar negeri lewat LPK Jepang atau Ausbildung Jerman? Dua jalur ini beda banget, dari requirement sampai end result-nya.
Pahamin dulu kalau di Jepang:
- Mulai 1 April 2027, program technical intern diganti sistem baru namanya Ikusei Shuro. Training 3 tahun di sektor yg kekurangan tenaga, target-nya setara Tokutei Ginou (SSW) 1
- Language requirement lebih ringan di awal, level basic (A1) sebelum mulai kerja, lalu naik ke A2
- Status kamu worker, jadi digaji sebagai pekerja, dan ada career path lanjut ke SSW
- Daftar LPK skrng? Tanya programnya masih skema lama atau udah siap Ikusei Shuro
Kalau di Jerman:
- Ausbildung itu vocational training sambil kerja, 2 sampai 3,5 tahun, ujungnya exam dan certificate
- Bahasa Jerman B1 bersertifikat (Goethe, telc, TestDaF) wajib buat visa, tapi IHK bilang B2 jauh lebih aman
- Gaji minimum 2026 itu €724 per bulan (gross) di tahun pertama, naik sampai €1.014 di tahun ke-4
- Visa minta minimal €1.048 gross per bulan. Kurangnya ditutup pakai Sperrkonto (blocked account)
- Ijazah SMA/SMK harus di-recognize dulu di Jerman, dan itu ada biayanya
Kasarnya, Jepang lebih cepat berangkat modal basic language. Jerman prep-nya lebih panjang dan butuh savings, tapi ujungnya kamu pegang certificate vokasi Jerman.
Apapun pilihannya, cek LPK atau agent-nya terdaftar resmi dan jangan bayar lunas sebelum kontraknya jelas.
Jadi, honest dlu sama diri sendiri. Kamu sanggup yg mana? Bikin pros and cons versi kamu sendiri, dan riset juga ya.
wkwkwk ngapain dilimit komentarnya?
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
#Ad · Partnered with ImagineArt
I made a UGC ad for a running shoe that doesn't exist.
1. One clean hero shot of the shoe
2. Used it as the reference for every "customer" photo
3. Wrote the text like a real buyer would type it on TikTok
No product, no camera, no model. The brand is fictional too.
Made in ImagineArt @ImagineArt_X @ImagineArt_Creo
URGENT. Klo web kamu pakai PHP, segera update hari ini.
Ini zero-day. Cara nyerangnya bocor duluan sebelum patch keluar. NSA sampai bilang, klo belum bisa update, matiin sistemnya sekarang.
69% website di dunia jalan pakai PHP. Web pemerintah, bank, kampus, toko online, web kantor kamu.
Ini kenapa?
- Ada 2 bug kritis di PHP, skornya 9.2 dari 10
- Detailnya udah bocor ke publik
- Attacker tinggal cari web yg blm update
Penyebabnya apa?
- Attacker cukup kirim 1 form atau upload file yg udah diakalin
- PHP salah ngurus memory pas request itu diproses
- Dari situ attacker bisa jalanin perintah apa aja di server kamu
- Ga perlu login, ga perlu password
Risiko klo ga update?
- Attacker masuk dan pegang server kamu
- Akses langsung ke file dan database
- Data user, password, data transaksi dicuri
- Web dirusak, ditanam backdoor, dijadiin lapak judol
Siapa aja yg kena?
- Semua PHP di bawah 8.5.12, 8.4.27, 8.3.36, 8.2.35
- PHP 8.1 ke bawah ga dapat patch sama sekali
Apa yg harus dilakukan sekarang?
- Update PHP di server hari ini, update WordPress aja ga cukup
- Belum bisa update? Matiin dulu sistemnya sampai aman
- Cek versi pakai php -v atau di panel hosting
- Pakai shared hosting? Tagih hosting kamu hari ini juga
- Masih PHP 8.1 ke bawah? Upgrade sekarang
Jangan tunggu besok. Jangan anggap remeh zero-day.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Recap 24 Jam Security
xitter.cf/F2aldi/status/21131814…
Security recap from the last 24 hours that actually matters.
- PHP, 2 CVEs
- Node.js, 10 CVEs
- SSL, 8 eMudhra intermediate certificates compromised
- GitLab self-managed, 1 CVE rated 10.0
What's the problem?
PHP
- CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2
- Unauthenticated remote code execution in the PHP runtime itself
- Every PHP site serving web requests is affected, so WordPress, Laravel and Drupal too
- Exploit attempts are already being reported
Fixing PHP
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fix.
Node.js
- 4 High, 3 Medium, 3 Low
- A brotli decoder bug that can lead to remote code execution
- TLS hostname checks that can be bypassed with oddly written IP addresses
- dns.resolve breaking on names with null bytes
Fixing Node.js
Upgrade to 22.23.4, 24.22.1 or 26.12.1. EOL versions stay vulnerable.
eMudhra
- 8 intermediate certificates from this CA were compromised
- That means someone could forge HTTPS certificates
- Browsers already block them, but Node apps, containers, VPNs and CI keep trusting them until you update
Fixing eMudhra
Update Node, Go, your OS CA bundle and your container base images. If your site uses an emSign certificate, get a new one.
GitLab self-managed
- CVE-2026-110264, CVSS 10.0, unauthenticated remote code execution
- Fix is 19.5.1 plus backports. GitLab.com is already patched.
So, have you upgraded and patched?
If not, better talk to your team today. These are serious because the impact can be
- Attackers running code on your server without logging in
- Leaked user data and secrets
- Fake HTTPS certificates silently accepted by your backend services
