javi retweeted
Updated my Duo “Lock when closed” automation so if an app is on screen, it won’t lock. But if you’re on the Home Screen and close iPhone Duo, it locks automatically
javi retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?
javi retweeted
WOW! It’s finally happened! Full offline static decryption of FairPlay encrypted AppStore apps. The broader implications of this are huge. The FairPlay components are insanely obfuscated and have been the subject of research for years. It actually might finally be completely over
HOLY SHIT?!! github.com/EthanArbuckle/fai…
javi retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
javi retweeted
if steve jobs saw you reserving 15% screen width for a single icon and then putting a left side arrow back button on the unreachable right side of the screen he would've personally taken you behind a dumpster and beat you with a metal pipe
javi retweeted
How long it took me to find each SWE job:
2014: 1 job applied, 0 interviews, 1 day (nepotism)
2015: 1 job applied, 2 interviews, 1 week
2016: 1 job applied, 4 interviews, 1 week
2016: 1 job applied, 0 interviews, 1 day (friend is a CEO)
2018: 1 job applied, 2 interviews, 1 week
2019: 1 job applied, 5 interviews, 1 week
2021: 1 job applied, 0 interviews, 1 day (invited)
2022: 7 jobs applied, 16 interviews, 3 months
2026: 167 jobs applied, 54 interviews, 1 year 4 months
javi retweeted
A consequential choice will be made soon by government and companies as they are increasingly flooded with agentic AI inquiries that overcome the frictions that gated access (see the graphs - it has already started!)
Two options: do you make services worse or better as a result?
javi retweeted
Where computational irreducibility makes particle kinetics infeasible, it gifts us fluid mechanics to compensate.
Where it makes neurophysiology infeasible, it gifts us psychology to compensate.
Mechanistic interpretability is infeasible. What have we been gifted to compensate?
Some of y’all have not studied the implications of computational irreducibility, and it shows…
Local determinism wrt nontrivially interacting rule sets does not help predict the “long term” behavior of a computationally irreducible system, and when it comes to AI the iterative frequency is such that “long term” is not actually that long from the human reference frame.
This is as true of our current neural nets as it is of the initial cellular automata in which computational irreducibility was first discovered and studied.
It’s also what Anthropic was (re)discovering wrt their escape cone diagrams wrt agentic unpredictability over long-horizon work—especially work with somewhat ambiguous constraints and success metrics.
Except that they got the cone geometry wrong, as the region of an agent’s potential state space trajectory looks more like an exponential horn.
javi retweeted
@Nintendo your 30-year-old Mario 64 mystery is solved.
The blurry plaque in Peach's courtyard isn't "L is real 2401."
It says: "Eternal Star / We hope so."
Adobe Palatino Bold Italic, 1990. Cracked with Grok + Opus 5.5.
You hoped Mario would be a star forever. He is. 🌟
javi retweeted
I'm so excited for this.
Working inside Apple, you're not allowed to publish your own apps to the App Store. There's very good legal/ethical reasons for that. But it means that most Apple engineers have very little personal experience with shipping apps on the App Store. When I left Apple, my knowledge of that was 12 years out of date.
So when Apple engineers talk about the "end-to-end developer experience" at WWDC, they're really just talking about writing, testing, and merging your code, because that's what "end-to-end" means to most of them. It's a different department's responsibility to run the App Store.
Our goal with Bitrig is to create a *real* end-to-end developer tool: brainstorm, code, test, merge, iterate, refine, and yes, *ship*! Working with App Store Connect and making sure you have a great App Store listing is a critical and time-consuming part of that, and deserves great tooling.
You can now edit and preview your full App Store listing right in Bitrig.
Update your listing, preview your product page, and prepare iPhone Duo screenshots. When you're ready, submit your app directly to App Review.
bitrig.link/blog/preview-you…
