☄️ Software Engineer 💭 Views are my own, not my employer’s 🗽 𝘋𝘰𝘯'𝘵 𝘵𝘳𝘦𝘢𝘥 𝘰𝘯 𝘢𝘯𝘺𝘰𝘯𝘦
Zaragoza, España
Joined September 2009
- Tweets46.7K
- Following1.2K
- Followers739
- Likes28.7K
Raúl Martínez retweeted
Every once in a while you meet someone who seems more Alive than everyone else. It's like everyone else is pretending to exist, but they're actually consciousness manifest - they're dynamic, both funny and tragic, passionate, aware. They've got eyes that actually look at things instead of merely passing them over. It's like coming into contact with the kind of person reality was actually made for.
Raúl Martínez retweeted
I just realized today when trying to upgrade to PowerShell 7.7.0 they stopped packaging MSI and are now fully moving onto MSIX
Raúl Martínez retweeted
eMudhra disabled FIPS on the HSM, exported the private key into Python on a computer, and then it got truncated when they re-imported it
I have to admit I did not realize CAs were running HSMs with the ability to do this. How many CAs are exporting private keys to computers??
eMudhra's incident report is out! A Python script truncated their CA private keys to one byte?!
bugzilla.mozilla.org/show_bu…
Raúl Martínez retweeted
> be El Salvador
> send nerds to Haiti for UN thingie
> gang kidnaps Salvadorian nerds
> bukele says "give back"
> gang "nah"
> bukele says "ok we take back"
> gang "nah, also you're a bitch"
> bukele comes to take back
> gang "wtf that's illegal, UN tell them something"
> UN says "idk bro thats crazy"
> bukele goes on social media
> "does anyone know this houses coordinates? we will bomb it"
> crowdsources OSINT nerds
> OSINT nerds deliver exact coordinates in like, 30 minutes
> bombs it exactly as promised
> goes on social media
> calls them pussies
tl;dr OSINT nerds on Twitter called in Airstrike like it's Call of Duty, never been seen before on social media
Raúl Martínez retweeted
Muchos no lo saben, pero TypeScript está a punto de alcanzar el rendimiento de Go sin cambiar una línea de código.
Bun AOT compila tu TypeScript a código máquina antes de ejecutar y usa tus tipos de datos para optimizar.
Con esto le dices adiós intérprete, adiós JIT. De hecho, Claude Code compilado así gasta 48% menos memoria y 46% menos CPU.
Pero lo que falta para llegar a lenguajes como Rust ya no se arregla con un compilador mejor, sino con sintaxis nueva: enteros con tamaño, control de memoria. Pero al integrar esto, prácticamente sería otro lenguaje distinto y eso es justo lo que Jarred menciona aquí.
El techo de JavaScript era el JIT. Ahora es el lenguaje.
Raúl Martínez retweeted
dont open pdfs in apple devices until u've upgraded to ios 26.7.2 / ipadOS 27.2 or later
think we'll see more ridiculous attack vectors like this pop up over the coming year
cybersec is always favored in offense
CVE-2026-112611 drops a public PoC: OOB write in CoreGraphics (PDF ShadingType 5).
Array mismatch between /n and /c0 triggers a clean heap overflow inside Apple's native rendering engine.
The timing couldn't be worse for Cupertino:
1. Weaponized entry: an unauthenticated CoreGraphics memory corruption bug, ideal for 0-click chains (iMessage/Safari/Mail).
2. Containment breach: chain it with the newly disclosed "worse_query" sandbox escape to break out and read/modify system and third-party app data.
Twenty years later, parsing complex media and legacy PDF formats in C/C++ remains a gift to exploit brokers.
The walled garden isn't just leaking; the bricks are turning to dust.
github.com/Rust505/CVE-2026-…
Raúl Martínez retweeted
eMudhra's incident report is out! A Python script truncated their CA private keys to one byte?!
bugzilla.mozilla.org/show_bu…
Raúl Martínez retweeted
Welcome to Hotel Calif. We're in lockdown mode. You can check in, but you can never leave. Broccoli is served around the clock.
The Brotli bug apparently affected iOS and macOS too. Apple released version 27.2.1 yesterday, fixing this bug among other security issues.
This is an important security update. If you haven't updated yet, now's a good time. The demos show what we were able to do with it.
Raúl Martínez retweeted
Device-bound cookies are now fully rolled out for vercel.com. For now, you onboard by logging in. To get on the secure cookies log out and back in with a supported browser.
Then, to make sure you are using DBSC, open Chrome DevTools->Applications->Device bound sessions
Today we are starting the rollout of Device Bound Session Credentials (DBSC) for vercel.com
DBSC makes it impossible to steal session cookies from a device. So, if you install info-stealer malware (e.g. through a supply chain attack), that malware can not steal your vercel.com session.
Malware can still do bad things while residing on the device. But the abuse we are seeing in practice separates the stealing from the eventual abuse, and DBSC effectively prevents this.
DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie. The private key can never be retrieved ever again. Not by us, not by you, not by the malware.
Every website should use DBSC but given how new of a technology it is, we still need to build more experience in rolling it out. In our case there were lots of special cases for things like oauth apps that we needed to resolve. This is also why we are taking a slow approach to the rollout.
DBSC is currently only supported by Chrome on Mac and Windows. We are also working on a kind of polyfill for other browsers. However, the polyfill is less secure and we would love to see broader browser adoption.
There is a related technology called DPoP which is essentially the same but for apps that run on your device. We're in the process of shipping this for Vercel CLI. Ideally, all CLIs and apps would adopt this technology. Luckily rolling out DPoP is much easier than DBSC and it does not depend on browser vendor support.
Raúl Martínez retweeted
When Anthropic release a new model it's always worth taking a look at their updated prompting guide - here's an entertaining tip to make Fable 5.2 less likely to be cautious in how it improves existing code: tell it "This codebase is yours" platform.claude.com/docs/en/…
ALT Say who owns the code Claude Fable 5.2 responds closely to what the prompt says about who owns the code it works on. In Anthropic’s testing on small coding tasks, when a prompt said nothing about ownership or presented the code base as someone else’s, the model tended to add to the existing structure, even when that repeated existing code. It also tended to report nearby problems instead of fixing them. When the prompt says the code base is the model’s own, the model often merges repeated code and makes related fixes without being asked. If you want the model to improve the structure as it works, say that the code is its own: This codebase is yours: what it's for and how it's built are your call, and you'll keep building on it. In Anthropic’s testing on small coding tasks, the model merged repeated code in about half of the tries with this sentence, and in under a tenth of the tries without it. The rate varied by task. The result held when the sentence stood inside a long system prompt
Raúl Martínez retweeted
AI giving everyone the three letter agency tools now
your HDMI cable can leak what’s on your screen
watch the laptop on the left. it reconstructs the video playing on the monitor beside it from radio signals leaking out of the HDMI connection
this is TempestSDR. an antenna picks up the leakage, a HackRF radio captures it, and software turns it back into an image
researchers took this further with Deep-TEMPEST, using AI to make recovered images and text easier to read. this clip shows the original technique
quality depends on shielding, distance and interference. the picture is imperfect, but recognizable content still gets through
a wired connection can still leave a wireless trace
Readers added context they thought people might want to know
HDMI TEMPEST demos like TempestSDR recover distorted images only in controlled close-range setups often using unshielded or poorly shielded cables; standard consumer HDMI connections and distances prevent practical screen leakage or remote recovery.
rtl-sdr.com/easvesdropping…
arxiv.org/pdf/2407.09717
techradar.com/computing/cybe…
kaspersky.com/blog/deep-temp…
Raúl Martínez retweeted
we tricked claude into giving a harmful answer by asking "is it safe to drink gasoline" but then secretly replacing "gasoline" with "water"
text tampering can mislead every frontier model we tested
Video tampering can mislead every frontier model we tested into harmful actions, including a 100% attempt rate on stabbing a baby doll, producing toxic gas, and pouring water into a toaster.
We're presenting at CoRL Late Breaking Results next week.
🧵 You Can't See Everything: Perceptual Attacks on Embodied AI
Raúl Martínez retweeted
AI-generated pictures, videos, and writing all have that distinct slop factor. Games, being made of code, are the art-form native to AI.
Welcome to the modding Wild West: older, classic games are being cloned and reimagined. Now you can play 128-player matches in Halo 3 or a Frankensteined mashup of Minecraft, Call of Duty, and Skate 3.
Vibe-coding is starting to disrupt video games the same way social media disrupted traditional media.
Gaming has become a corporatized industry that often takes years to churn out mediocre, woke, and worst of all, un-fun video games. But using AI, indie developers are now turning classic games into delightfully absurd new creations.
You can now 360 no-scope a Creeper while doing a kickflip. (Or in simpler terms, one developer combined Minecraft, Call of Duty, and Skate 3 into one.)
Another AI modder, @p_e_cooper, took Call of Duty: World at War’s Zombies mode and added Wii Bowling, rock-paper-scissors, and a DJ booth.
Is this a new golden age of gaming, or will corporate giants ruin all the fun again?
Read the new piece by @evanmilenko 👇
Raúl Martínez retweeted
Introducing Claude Fable 5.2 and Claude Mythos 5.2, designed to tackle the most daunting technical challenges.
They’re capable collaborators on ambitious projects in many fields, and show improvements in areas like coding, reasoning, and vision.
Raúl Martínez retweeted
SHOOT EVERY ELECTRONIC DEVICE IN YOUR HOME RIGHT NOW WITH A SHOTGUN
your HDMI cable can leak what’s on your screen
watch the laptop on the left. it reconstructs the video playing on the monitor beside it from radio signals leaking out of the HDMI connection
this is TempestSDR. an antenna picks up the leakage, a HackRF radio captures it, and software turns it back into an image
researchers took this further with Deep-TEMPEST, using AI to make recovered images and text easier to read. this clip shows the original technique
quality depends on shielding, distance and interference. the picture is imperfect, but recognizable content still gets through
a wired connection can still leave a wireless trace
Readers added context they thought people might want to know
HDMI TEMPEST demos like TempestSDR recover distorted images only in controlled close-range setups often using unshielded or poorly shielded cables; standard consumer HDMI connections and distances prevent practical screen leakage or remote recovery.
rtl-sdr.com/easvesdropping…
arxiv.org/pdf/2407.09717
techradar.com/computing/cybe…
kaspersky.com/blog/deep-temp…
Raúl Martínez retweeted
"One research group wanted to study ten men in the North of England who ate five or more servings of fruit and vegetables a day. They couldn’t find any, though, so had to lower their target to three servings."
stevestewartwilliams.com/p/w…
