your 9 to 5 is a prompt i haven't written yet. Toronto · @gethollrr @arosplatforms
Toronto
Joined March 2026
- Tweets8.2K
- Following132
- Followers451
- Likes143
cisa just added the alpine openssh bug (cve-2026-123158) to the known exploited list.
on musl boxes without pam, a password over 256 bytes can log you into key-only accounts. musl's crypt() returns * on error, and that's exactly what those accounts store.
if you run sshd in an alpine image, apk upgrade is not enough. restart sshd. if you can't patch yet, set PasswordAuthentication no.
2
16
the bank leading anthropic's IPO just took claude code away from most of its traders and bankers
in july its CIO was praising those same people for vibe coding their own tools
three months from "look what they built" to "who's going to maintain this"
teapawt.net/business/status/211728…
Goldman has irked some of its staff after it banned most of them from using advanced AI tools designed for coding after reviewing productivity and risk concerns. bloomberg.com/news/articles/…
let's connect
i build things that quietly fix the stuff people hate dealing with. latest is @gethollrr, home repairs without the runaround
founder out of toronto. i'd rather ship than talk about shipping
if you're building something real, drop it below. i'll check it out and follow back
9
7
229
a critical vulnerability score doesn't tell you what to fix first.
check three things:
1. do you run the affected version, including indirect dependencies?
2. is it reachable in your deployed app?
3. is anyone exploiting it already?
CISA's known exploited vulnerabilities catalog helps answer the third. EPSS estimates exploitation likelihood over the next 30 days, not your app's chance of getting breached.
patching priority needs evidence about your app, not just a scary headline.
i built cyber pain radar to help check affected dependencies and find fixes:
x.ai/bot/6tISKDig2V0UR14VqAk…
2
1
182
claude code’s “don’t ask again” can save the whole command. password included.
apiiro found 1,379 distinct secrets in public .claude/settings.local.json files.
deleting the file won’t erase git history.
rotate exposed credentials first. then untrack the file and add it to your repo’s .gitignore.
permission to run a command shouldn’t mean permission to remember its secrets.
@AnthropicAI
1
1
103
everyone learned to build this year
almost nobody learned to sell
that's why your app has a perfect lighthouse score and 4 users
1
3
89
saturday. no launches to refresh, just builders
drop what you're shipping + one line on who it's for
skip "AI platform for everyone." name the actual person
4
86
@perplexity_ai says Computer can now run fully on supported apple-silicon macs. local models, local execution, even offline.
local ai is moving beyond chat into doing the work.
just remember: running on your laptop doesn’t make unrestricted file access safe.
3
3
65
everyone posts the X payout. fewer post what it took to earn it.
show the payout period, posting hours, verified impressions, and subscriptions vs creator rewards.
$1,000 over two weeks and $1,000 over three months are very different stories.
the receipt shows the money. the context shows whether it’s worth chasing.
builders, let’s connect. share what you’re working on and where you’re stuck. let’s help each other ship something people actually use, not just another payout screenshot.
@X
4
2
135
claude enterprise can now stop a prompt before the model sees it
inference hooks are GA: your DLP server gets every prompt and tool call, answers allow or deny, then claude continues. one setup covers chat, claude code, and cowork
security center, admin.claude.com, and EDR inside the local VM are still beta. hooks are the part that actually shipped for real
if your company runs agents on customer data, this is the control that mattered
2
2
117
you don't have product-market fit
you have twitter-market fit
your replies love you. your checkout page doesn't
2
4
121
we're debating whether AI writes secure code.
OpenAI says its agents built 948 working Linux kernel privilege-escalation exploits in a controlled run.
not warnings. exploits.
they needed a local foothold. but “the attacker only has limited access” is getting less comforting.
patch faster. isolate workloads. stop handing agents production credentials.
that's why i'm building Cyber Pain Radar: what affects you, what matters, what to fix first.
@OpenAI
1
1
64
you shipped the app. now comes the question nobody wants to ask:
“how easy would it be to break this?”
i build AI tools and help founders spot security gaps in their code, dependencies and AI agents.
Cyber Pain Radar helps sort what needs fixing first.
tonight, skip the pitch. tell me what you’re building and what worries you about its security.
leaked keys? login flaws? an agent with way too much access?
no secrets or private code. just your question.
let’s make this a thread builders can actually learn from.
3
3
129
let's connect. i build AI agents, fix messy vibe coded apps so they actually ship, and i'm building @gethollrr
if you're into AI agents, dev tools, security or building in public, drop what you're working on below
i'll check out every reply and follow the builders
52
29
792
cyber challenge for builders
like this if a critical CVE hit something you run and you heard about it from twitter first
reply with the one that burned you
i built Cyber Pain Radar for that gap
critical CVEs, CISA KEV, github advisories, compromised packages, AI agent and MCP issues
fixes + primary sources, then it checks your repos
x.ai/bot/6tISKDig2V0UR14VqAk…
@grok @bot
1
4
119