Pinned Tweet
Been working on Accessibility work with a new tool, evinced.com, for a few months. The tool's scans are comprehensive and clear. The team is quick to onboard and happy to assist with actual meetings. I could not recommend them enough for any company seeking a vendor for a11y scans. I have recommended that they allow independent devs to purchase this, but I understand them not wanting to.
Since Dec, I have been able to take a large corporate website from an arbitrary score of 45 (with 18,435 issues) to 94 in a matter of weeks.
And now I've gotten it to a score of 100 with zero critical, serious, or moderate issues thanks to the platform's ability to scan, group, and identify the solutions for each issue.
The tool helped identify some interestingly unique issues like old dead internal links, an actual looping URL bug (which is why the starting scan was nearly 2k pages), and understanding how large the actual size of the site is from a 500 ft view.
Very proud of this work result and I learned how to write much better semantic a11y code that will stick with me forever at this point. I used to write buttons with A tags as a habit born from the mid 2000s! Don't do this, people!
Joe Vans retweeted
Claude Code is a piece of shit. gist.github.com/flamerix-ai/β¦
Joe Vans retweeted
this might be my last normal tweet before biotech goes vertical
i'm not a whistleblower. I don't work at Lilly, Novo or any of the big labs
but there is a massive shift happening in human biology right now.
it's sitting in press releases and almost nobody reads them
the last 6 months alone:
- a once-daily pill roughly doubled median survival in metastatic pancreatic cancer (13.2 vs 6.6 months)
- a one-time gene editing infusion cut hereditary angioedema attacks 87%, and 62% of patients stayed attack-free and off all other prevention for 6 months
- a one-time gene edit for cholesterol dropped LDL up to 62%, and it held for over a year
- a personalized mrna vaccine beat keytruda alone in a 1,137 patient melanoma phase 3
- retatrutide hit ~28% weight loss in a phase 3
- an ai-designed drug entered phase 3
- a pill that regrows hair passed its second phase 3
- an immunotherapy that could let some rectal cancer patients skip surgery, chemo and radiation just got fda approved
- a man lived 271 days off dialysis on a pig kidney
- human cells were caught passing chromosome-sized chunks of DNA to their neighbors, and it changes how the neighbors behave
we are on the verge of an era where the human body is a software problem and the update cycle gets shorter everyday
stick around, it's going to get weird
bio/acc
Joe Vans retweeted
The future is wild
Yeah we should add this. @bot kick off a job on beebox with opus 5.5 to build this. Use my full stop skill
Joe Vans retweeted
No, WebMCP isn't replacing MCP.
MCP connects agents to your services.
WebMCP connects agents to your website while it's open and the user's in the loop.
Here's how they fit together ‡οΈ
Joe Vans retweeted
My saturday evening project: hacking my remarkable to see if Opus 5.5 can help me draw (and also animate cuz why not)
Someone needs to create a benchmark list of AI coding web frameworks and the amount tokens they generally use. I wonder if some frameworks are super heavy AI token users.
Joe Vans retweeted
Today we're launching cve.now π¨
Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?
cve.now aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.
cve.now
Joe Vans retweeted
Maybe important to repost this now that everyone is getting hacked
If you have a VPS, I recommend you to get if off the public internet and into a Tailscale network and Cloudflare Tunnel ASAP
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
There's 2 ways into a VPS:
- via your site/app (like the PHP exploit of this week with a file upload hack)
- via your server (like hacking into SSH or some open port)
The site/app side you put on a Cloudflare Tunnel and then with the default Free Plan it has WAF security enabled by default and they jump on new security exploits fast, it means that the only way to reach your website is via the Cloudflare Tunnel, your server does not respond to port 80 or 443 anymore
The server side you put on a Tailscale network which is like your own private network that nobody can access but your own devices (like your laptop, your phone and your VPS) kinda like a VPN
Then you switch off ANY regular access to your VPS on the firewall, in my case I use Hetzner and you create a new firewall then empty it and that blocks everything (test it)
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound. They make a tunnel to outside which sends and receives
Now you've reduced your attack vector to Tailscale and your Cloudflare Tunnel, much safer, not perfect btw, but nothing is
When I set up a new Hetzner VPS first thing I do install Tailscale and once I'm in via Tailscale lock down the firewall to only accept web traffic on HTTPS 443 for Cloudflare IPs and SSH 22 for Tailscale IP
That way nobody can get in
I know I keep repeating this but it should be basics of setting up a new VPS
So basic IMHO it should be part of any VPS service to default install Tailscale and enable it so it's the only way to get in
Why?
A VPS server is just like your laptop or destop computer but now imagine if it's connected to the entire internet with 8 billion people that can access it and try hack it
You want to only have it accessible to you
And if you want to host a website on your VPS (like I do), you should only let Cloudflare access your VPS so it can stand in front and block any hack attempts
Never expose a VPS to the world wide web which realistically is the world WILD web
Joe Vans retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Joe Vans retweeted
Vibecoders, π'πΊ π―π²π΄π΄πΆπ»π΄ ππΌπ, add these two lines to your AGENTS.md:
"Cut taglines, helper text and secondary labels. If a screen needs them to make sense, fix the layout."
"Make the best decision that will elevate all three: the user experience (UX), developer experience (DX), and agent experience (AX) always, without breaking anything."