working on @slashapp | formerly @wrathbots
San Francisco, CA
Joined October 2020
- Tweets1.9K
- Following424
- Followers61.6K
- Likes1.3K
jason retweeted
Tomo is partnering with 1Password because you’d be surprised how often consumers just rawdog yeet their plaintext passwords to the agent over text
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
jason retweeted
It’s time to kill “static credentials”.
Attacks and breaches can happen. But imagine if thieves could only steal “self-destructing keys” to your data and tokens.
The industry once came together to deliver “green locks” encryption for every site (TLS). Let’s do it for OIDC! 💪
It's time to retire long-lived static credentials.
We surveyed 1,000+ SaaS vendors and found only 8.4% support secure auth. This is our call to action and how we're doing our part.
vercel.com/blog/death-to-lon…
jason retweeted
My clients are on track for $376M in card spend this month with no new growth (impossible 😉).
Distribution, experience & nickbruhman are a moat.
Next: $500M/month single-handedly by Q4’s end while ensuring my team outperform sales teams of 100+ people at competing banks.
lol @tiktok_us has had an exploit for days now where malicious ads are able to inject native looking overlays within your app.
they even do it on a timeout so it happens after you exit of the initial popup 🤯
jason retweeted
next friday we’re hosting the 2nd annual sneaker twitter reunion in san francisco!
unicorn founders, hypergrowth startups, and some of the most cracked people from sneaker twitter + adjacent industries.
160+ already going.
RSVP if you haven’t: luma.com/slash-lefy
we're launching payment approvals & ach authorization policies @slashapp! this feature allows you to granularly control access around money movement out of your account, and ensures you always have an audit trail of your finances.
live in your dashboard today! (if you don't have an account yet, feel free to bother @nickbruhman and he will get you onboarded)
jason retweeted
Prompting is temporary. We believe the future of computer use is completely unprompted.
Introducing our latest research: a browser agent that predicts your next action from only the current page and your recent history.
jason retweeted
Beware people obsessed with outcomes instead of building outcome machines. Its worse than ever with AI, but these people existed before. Short term results above all else, etc. Don't fall into the trap. Invest in building strong fundamentals, invisible supports, and outcomes flow like water. An outcome machine.
jason retweeted
The "whiteboard defense:" I should be able to pull you aside at any moment and ask you to explain any customer-facing system you've shipped. You should be able to clearly explain how it works and defend the decisions you made. This is my benchmark for responsible AI usage.
I don't expect line-level familiarity with the code. I don't care if you remember the exact function name or implementation detail. You may not even know it. I don't care.
But if I ask "why did you do X instead of Y?", "what happens if this actor behaves maliciously?", "what data structure did you use here and why?", or "where does this fail?" you should be able to answer confidently.
For PoCs, demos, experiments, whatever: I don't care. Generate 100% of it and understand none of it. Speed over quality every time in those specific scenarios.
But if you're shipping customer-facing work, you can't be shipping things you don't understand at a high level.
RT @skvrah: At one point, Footsites implemented nearly their entire release control plane in Fastly’s VCL layer, including waiting rooms, r…
This quoted post is unavailable.
One of the funnier engineering stories involving Wrath:
Back in late 2021, we were starting to lose dominance on Shopify, as the flows were more or less the same across top bots. The flow looked something like this (quite similar to how a human interacted with a site; great job @jmwind)
Add to cart (0.5s) -> Load checkout (1s) -> Calculating taxes (1s) -> Submit payment (1s)
Given this, there weren't many places to optimize. We realized we could skip the "Calculating taxes" stage by sending an empty total price when placing order (forcing Shopify to do the calculation themselves), and this was an optimization we used for a bit.
In the Shopify REST API described in @offline 's tweet, there was also an endpoint that allowed you to combine the "Add to cart" and "Load checkout" stages, into one "Update checkout" stage that took ~0.5s, shaving an additional 1s off the checkout time.
Excitedly, we decided to run beta builds with this new flow:
Update checkout (0.5s) -> Submit payment (1s)
However, every single task got blocked by bot protection. Unconfirmed, but I suspect that Shopify tracked antibot violations as a heuristic score (i.e. because we did 2 "suspicious" actions, updating the checkout via an API a human wouldn't usually hit, and omitting the total price, they blocked us).
Seeing this, we decided to look for other ways to optimize. Ultimately, the total price is something that should be relatively predictable given the price of the item/shipping rate & the user's billing address. We hacked together a function to predict it, and this evaded antibot while retaining the skipped "Calculating taxes" stage. (screenshot below - we had to handle edge cases for certain states that are tax exempt up to a threshold, etc.)
We launched this to users and saw major success. However, I happened to be from Michigan, and I would always test with a flat 6% tax rate. This would make shoe amounts come out relatively cleanly (e.g. 190 * 1.06 = $201.40, so no rounding was needed).
Unfortunately, NYC has a tax rate of 8.875%, meaning that 190 * 1.08875 = $206.8625. No matter how long we tried, we couldn't figure out a deterministic direction Shopify's internal API would round (sometimes this would come out to $206.86, sometimes $206.87)...
We didn't really have a solution to this so we ultimately accepted that you'd have a lower chance of buying a shoe depending on if your local sales tax rate was more digits. I'm sorry 😂
Probably the hackiest "bypasses" I've ever pulled off in botting:
The Shopify REST API was for a long time the best and fastest way to checkout on Shopify. High rate limits, no captchas, no checkpoint and easy to work with. This is what gave Cyber the edge at the very start in 2018 (Dashe days)
The Shopify team (with @jmwind at the helm) spent years plugging the holes to make sure it wasn't used during drops.
Around 2020, Shopify released Shopify Pay, which allowed you to expedite checkouts on all stores by linking your details to a phone number. Turned out the payment tokens generated through there allowed you to use the payments API as you could 2 years back.
We generated around 3k Shop Pay accounts with randomised details, load balanced them across Cyber tasks (as rate limits were per account) and dominated every single release (...until it got patched).
We called it Fast2.
3 years later I noticed that the payments API could still be used with Shopify mobile apps using Apple Pay. Turns out you could still send the users' tokenised credit card data in the request and that would take precedence - and as long as a valid signed Apple Pay token generated in the last 2 minutes was also in the request data, the payment request would go through and bypass captcha and checkpoint.
Generating those Apple Pay tokens was the challenge, and reversing iOS frameworks was not an option. So I repurposed an old iPhone with a custom sideloaded Apple Pay app that would submit the token to our servers when the flow completed. And by combining accessibility macros, developer sandbox mode to prevent using real credit cards, a voice activation trigger and a old pair of earphones taped onto the microphone - a makeshift Apple Pay token server was born and Fast2 (or was it Fast3?) was back.
@jmwind thank you for providing me with the longest, most multi faceted puzzle ever.
if you're ex-sneaker twitter / want to build out of our office pull thru tonight! free coffee & wrath keys will be provided ..
(p.s. @skvrah from nyte is giving free autographs)
