Philo Hermans retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:acā¦
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Philo Hermans retweeted
At the 2025 Shopify conference, everyone I met was really positive about how their app was doing. At the same event this year, several people admitted to me that they're no longer growing.
I wanted to know if this is backed by data so I did the research and discovered that things have got harder. The problem is the number of apps is growing more than the amount of new stores, so app companies aren't benefitting from Shopify's success.
Read more here: barn2.com/blog/shopify-app-sā¦
Philo Hermans retweeted
Our goal for 2026 was to 3x Laravel Cloud revenue. Already done. On pace to 5x. āØ
I know some companies are growing a lot faster or a lot slower, but here are some of my learnings so far.
Focus on making the product decisively the best in its category. Easy to be distracted from this, and there are no gimmicks or tricks to get around it. The product is either the best option in the space or it's not. Being the "best" is a blend of a lot of factors - technical superiority, features, price, design, and more. Striking the right balance across all of them gets tricky when your customer base or community is really varied (long-tail community users vs. large scaled companies).
A lot of what goes into the above isn't always visible to end users or even other people in the organization. We spent months getting our scale-to-zero tech for app compute and managed queues really dialed in. Can be hard to explain to non-engineering roles why we spent months on this - and even hard to explain to more technical folks why something doesn't ship for months. But the work is hard and it has to be done right. Now it's one of our biggest differentiators and contributes heavily to "decisively being the best product."
I used to think all meetings were dumb. Most still are, to be honest, but a few are helpful - particularly quick pulse checks on the state of projects. Does anything need to be unblocked? What's the goal today / this week? Maintaining urgency and speed in a remote company is really challenging and takes intentional effort every single day.
I spend a lot of time just sitting and thinking about everything. A lot of frantic energy online and nothing of substance or value ever ships. I'd rather make a few really thoughtful moves than throw a bunch of slop at the wall.
X is an even bigger bubble than I realized. On here it feels like everyone is just building devtools for other devs to build more devtools. None of our largest customers are really on X, none are in SF, and none are devtool related. We have a wide variety of really interesting customers building things to solve all sorts of problems you'd never expect, all around the world.
Anyway, back to work. Still a lot to build. š«”
Philo Hermans retweeted
I need your help: The @stateoflaravel is going spectacular BAD this year. After 2 weeks we don't even have 1k participants.
Please share it (again) if you can.
And please subscribe to be notified the next years. Currently, there are only 300 on the list for the next years...
The State Of Laravel 2026 survey has started!
You can now participate to identify how the ecosystem changed over the past 12 months! This year with a few AI questions: How are others using AI?
Please RT for reach ā¤ļø
stateoflaravel.com/?ref=2026
Philo Hermans retweeted
š Stable versions on Packagist are now immutable. Once published, the commit a version points to can no longer change. Retags are blocked, deletions are tracked with a reason and recoverable, and everything is recorded on the public transparency log.
#php #phpc #composerphp
Philo Hermans retweeted
Shopify is still not punishing bad actors.
Just look at this case. This developer (Hoppy apps) removed their banner after getting called out. Their reviews growth flattened out. Then they readded the banner again but this time they outsmarted Shopify compliance by hiding the banner for the development stores and collaborator accounts.
One community forum member (Ollie_autoblogger) noticed this and reported to Shopify again with all the evidence. And guess what, all of their apps are still active and ranking high, with all of their reviews intact. All they had to do is remove the banner again. Until they find a new way to trick the system, I guess.
I'm afraid ignorance from Shopify could lead to app developers taking action themselves which would turn into fake 1-star review wars and App Store losing its' credibility.
We deeply care about App Store and the current state of it is very unsettling, I know a lot of folks in the community feel this way as well.
cc @liam_at_shopify @atleeclark @eytanseidman
How to get rich in Shopify App Store in 6 months:
1. Create a single-feature free Shopify app (feel free to copy some popular app).
2. Use only keywords for your app name, no branding.
3. Farm reviews in the most shady way possible (see attached screenshot for inspiration).
4. Get the Built for Shopify badge somehow anyway.
5. Once the app reaches the top of the rankings, introduce pricing.
6. If executed correctly, $10K MRR is bare minimum.
Apparently the worst thing that could happen, app gets delisted for couple of weeks and you're told to get rid of these tactics, but by that time you will probably have hundreds of 5-star reviews and great ranking in the App Store which gets you organic growth and you can work it from there.
This company has been doing this among all of their 8 apps since February and their reviews/rankings skyrocketed. I'm pretty sure they're getting thousands of installs every month now. They already rank #1 for some keywords so I'm sure monetization is just around the corner š
@ShopifyDevs @liam_at_shopify @atleeclark I think it's becoming very clear that we need much stricter policies, especially with hundreds new apps published every week. š¤·š»āāļø
Philo Hermans retweeted
Composer 2.10 is out.
Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.
#php #phpc #composerphp
Philo Hermans retweeted
Stanford paid 35,000 people to quit Facebook and Instagram for 6 weeks
Depression dropped. Anxiety dropped. Happiness went up. Women under 25 on Instagram saw the biggest gains
That was 6 weeks. I'm going a full year.
Philo Hermans retweeted
A bespoke software revolution? I don't buy it.
It'll exist. It already exists. Small consultants and big consulting firms have made custom software for years. It almost always sucks. Itās bloated, confusing, and because the client pays, itās built wrong in all the ways.
Whoās excited about bespoke software? Software makers! Of course they're excited about building bespoke software ā that's what they do. X is full of them. Your feed is full of people who love making software talking about making software. Of course theyāre excited about the revolution. Echo, echo, echo...
Most people donāt like computers. Nobody in tech wants to say that out loud. People tolerate computers. They use them because they have to. Given the choice, most would rather not think about them at all.
So when someone suggests that AI means everyone will build their own custom tools, ask who "everyone" is. The three-person accounting firm drowning in client paperwork? They want the paperwork gone, not a new system to maintain. The regional logistics company with 40 trucks? They want the routes optimized, not Joe spouting off about this new system heās been messing around with. The law firm billing 70-hour weeks? They want leverage on their time, not a software project to design.
They donāt hate technology. But building and maintaining their own critical systems isnāt their wheelhouse, regardless of how much faster and easier itās become. It's another job on top of the job.
Will these people use AI? Absolutely, for all sorts of things. Will some outliers go deep and build real custom systems? Sure, but they're almost always people who already had some pull toward software. The curiosity was already there. They were dabblers before.
Giving everyone access to software building tools doesn't mean everyone becomes a builder. A powerful excavator doesn't turn a homeowner into a contractor. Most people just want the hole dug by someone else. They donāt want the responsibility either.
Philo Hermans retweeted
Got a lot of great responses on this, and I see many people have signed up to stay notified.
A popular request was to also support this for Shopify's App Bridge, so I launched that as well!
š¤ Hopefully Shopify solves this themselves so I donāt have to renew these domains š
Shopify is pushing developers to use Polaris web components instead of React. Which is fine, but they no longer provide versioned releases, causing things to break at random when they release a new version and you have no clue when something changed. So I'm launching this little unofficial changelog website where AI tries to figure out what changed. Link below š
Is Traditional Software Engineering Dead?
āDoes this mean that traditional software engineering is dead? Absolutely not. Software engineersāeven the ones who are not necessarily tuning or training AI modelsāthese are now among the most leveraged people on earth. Sure, the guys who are training and tuning models are even more leveraged because theyāre building the tool set that software engineers are using.
But software engineers still have two massive advantages on you. First, they think in code, so they actually know whatās going on underneath. And all abstractions are leaky. So when you have a computer programming for youāwhen you have Claude Code or equivalent programming for youāitās going to make mistakes.
Itās going to have bugs. Itās going to have suboptimal architecture. So itās not going to be quite right. And someone who understands whatās going on underneath will be able to plug the leaks as they occur.
So if you want to build a well-architected application, if you want to be able to even specify a well-architected application, if you want to be able to make it run at high performance, if you want it to do its best, if you want to catch the bugs early, then youāre going to want to have a software engineering background.
The traditional software engineer is going to be able to use these tools much better. And there are still many kinds of problems in software engineering that are out of scope for these AI programs today. The easiest way to think about those is problems that are outside of their data distribution.
For example, if they need to do a binary sort or reverse a linked list, theyāve seen countless examples of that, so theyāre extremely good at it. But when you start getting out of their domaināwhere you have to write very high-performance code, when youāre running on architectures that are novel or brand new, when youāre actually creating new things or solving new problems, then you still need to get in there and hand code it.
At least until either there are so many of those examples that new models can be trained on them, or until these models can sufficiently reason at even higher levels of abstraction and crack it on their ownā¦
And remember: there is no demand for average. The average appānobody wants it, at least as long as itās not filling some niche that is filled by a superior app. The app that is better will win essentially a hundred percent of the market. Maybe thereās some small percentage that will bleed off to the second-best app because it does some little niche feature better than the main app, or itās cheaper, or something of the sort.
But generally speaking, people only want the best of anything. So the bad news is thereās no point in being number two or number threeālike in the famous Glengarry Glen Ross scene where Alec Baldwin says, āFirst place gets a Cadillac Eldorado, second place gets a set of steak knives, and third place youāre fired.ā
Thatās absolutely true in these winner-take-all markets. Thatās the bad news: You have to be the best at something if you want to win.
However, the set of things you can be best at is infinite. You can always find some niche that is perfect for you, and you can be the best at that thing. This goes back to an old tweet of mine where I said, āBecome the best in the world at what you do. Keep redefining what you do until this is true.ā
And I think that still applies in this age of AI.ā
Philo Hermans retweeted
I've been building Solo for several months, and it's out today!
It's a desktop app that manages your entire dev stack.
Add a project, Solo detects your processes, and you can start everything with one click.
It's free! Try it today: soloterm.com
Philo Hermans retweeted
Demoed @steipete's Openclaw on one of the biggest Dutch talkshows last night. We created a demo-restaurant and tasked an agent to book a table for us, and be persistent.
While covering the risks associated with tech like this, we thought it was important to bring this to a mainstream audience, because tools like Openclaw are coming for everyone, not just people on AI Twitter.
The segment was AI-translated to English ā full clip below.
Philo Hermans retweeted
We spent the last several months prepping this Laracasts series - and it's out now!
3 hours of AI techniques, tips, and demystifications for working developers.
And I'm so happy to say that it's completely, entirely, unconditionally FREE to watch.
laracasts.com/series/leveragā¦
Philo Hermans retweeted
Livewire 4 is FINALLY HERE ā”ā”ā”
It's insane to me what can be achieved without writing a single line of JavaScript.
We did it ā¤ļø
Philo Hermans retweeted
I've never felt this much behind as a programmer. The profession is being dramatically refactored as the bits contributed by the programmer are increasingly sparse and between. I have a sense that I could be 10X more powerful if I just properly string together what has become available over the last ~year and a failure to claim the boost feels decidedly like skill issue. There's a new programmable layer of abstraction to master (in addition to the usual layers below) involving agents, subagents, their prompts, contexts, memory, modes, permissions, tools, plugins, skills, hooks, MCP, LSP, slash commands, workflows, IDE integrations, and a need to build an all-encompassing mental model for strengths and pitfalls of fundamentally stochastic, fallible, unintelligible and changing entities suddenly intermingled with what used to be good old fashioned engineering. Clearly some powerful alien tool was handed around except it comes with no manual and everyone has to figure out how to hold it and operate it, while the resulting magnitude 9 earthquake is rocking the profession. Roll up your sleeves to not fall behind.
Philo Hermans retweeted
I see a lot of complaints about untested AI slop in pull requests. Submitting those is a dereliction of duty as a software engineer: Your job is to deliver code you have proven to work simonwillison.net/2025/Dec/1ā¦
Philo Hermans retweeted
2.5 years of AI progress
xitter.cf/minchoi/status/1996238ā¦
Philo Hermans retweeted
Black Friday Deals are now live!
30% discount on Wire Elements Pro and Observer using discount code: BLACKFRIDAY
Links below š
































