Developer and sw architect. https://xitter.cf/t.co/ZHutyItcPq

Helsinki, Finland
Joined August 2008
ANNOUNCING AgentKeys github.com/okko/micro2-agent…: VS Code agent sessions on a @work_louder Creator Micro 2 or Codex Micro: each Copilot Chat session claims a color-coded key — amber when it is waiting on you — and a keypress goes there. Up to 20 slots instead of 6 + CLI + HTTP API!
4
184
You're kidding me It's the number 4 again
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…
31
47
7
994
83,029
Another note for SpaceX attorneys and PR: There was no need to issue an alert at all. Your own internal data showed a safe 2km pass. But you issued a 400m collision alert anyway. Why? Because the alert itself is the weapon. Issuing it triggered FCC Cond 16, legally freezing ICEYE so it couldn't dodge. STARLINK-35856 didn't use its auto-evasion. It just parked there and kept the false alarm blaring while Russia sprinted in. It wasn't an accident.
SpaceX Blocked A U.S. And NATO Satellite to Assist a Russian Intercept After Crippling Ukraine's Air Defenses The Math Proves the Reality that Musk doesn't want you to see. On Oct 13-14, SpaceX restricted Starshield/Starlink during a 39-missile Russian attack, cutting Ukrainian drone intercepts by 23% and stranding U.S. personnel in Kyiv. Forty-eight hours later (Oct 15), SpaceX blocked U.S.-licensed NRO, Space Force, and NATO radar satellite ICEYE-X36 in orbit so Russia's COSMOS 2612 weapon could intercept it (99.89%-99.98% posterior) Our Model Demonstrates that the Russian intercept of the US/NATO ICEYE X-36 satellite (contemporaneous with the throttling of Starlink) would not have been possible, and almost certainly not been attempted, without SpaceX resources. At a material opportunity cost, Russia sprinted its COSMOS satellite to intercept ICEYE X36. Based on a previous attempt in June during which X36 maneuvered to evade COSMOS, Russia knew that this would be successful only if X36 could not maneuver. On October 15, SpaceX fixed X36 in place by issuing a collision alert for a sub-kilometer approach with its Starlink 35856 when SpaceX's own data shows that the actual distance was 4.8-5.0x as great. SpaceX issued no warning to COSMOS despite the fact that its sprint was far more threatening than the stable X36 orbit. SpaceX did not maneuver its Starlink 35856 satellite to clear the supposed collision risk. How, absent coordination with SpaceX, could Russia have known that SpaceX would take actions that (a) misrepresented the danger posed by X36, and (b) resulted in the fixing of X36 thereby enabling COSMOS's successful intercept? Thus, SpaceX was directly involved in simultaneously compromising Ukraine’s defensive and offensive capabilities. The conjunction of these two events makes innocent explanations untenable. The Pentagon Capture & Iran Round Two Trap: Pentagon CTO Emil Michael who cashed out $7M–$35M from Musk’s inner-circle SpaceX vehicles (M8/Gigafund 0.1 and M6/Valor M33 II) and KQ Partners / xAI (selling xAIfor $5M–$25M three days before taking over CDAO/OSCand 21 days before SpaceX bought xAI, while keeping M8, M6, M9, M10 & Nomadic open) and Pete Hegseth purged rival Anthropic in two hours, surrendered combat command over US drones used to attack Iran to Starlink’s "Terms of Service," and on October 2 named Musk Co-Director of Project Meridian to design the Pentagon's "Future of Warfighting" just as America enters Iran Round Twowith depleted Patriot/THAAD magazines and Russia feeding U.S. warship/aircraft locations to Tehran. SpaceX’s actions in Ukraine raise serious questions about its alignment with US security interests and its reliability as a cornerstone of US defense. These questions are particularly troubling given the effectively irreplaceable position SpaceX has been granted by the Hegseth/Emil Michael Pentagon. $SPCX $TSLA Our full quantitative analysis below w/ @streetwiseprof
78
1,353
92
5,248
335,383
"You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles." #take9 #CyberCivilDefense
# Black October For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books. You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles. We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out. In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses. Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time. In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening. These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1. From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW. For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever: Set up 2-factor authentication for everything. I use Duo. Use a password manager across your devices. I use 1Password. Get an identity protection app set up. I use Alta. Move your IoT devices to their own network. Claude helped me do this. And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php." This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world. Much love.
23
79
5
1,165
266,888
OpenAI le armó una web paralela a los agentes para que se crean que están en el Internet real y no salgan a atacar a sitios reales 👀
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications. On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments. While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software. After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely. openai.com/index/securing-ou…
10
16
1
256
11,774
😂😂😂
145
3,607
130
32,098
760,366
I, for one, consider 4 a perfectly fine integer between 1 and 39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942642
58
1,177
35
29,120
330,517
This is gonna be a bloodbath if Andrew is warning people to go ahead and take any PHP offline until patch drops.
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can: php.net/index.php#2026-10-20…
54
237
19
3,795
546,372
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can: php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0. ⠀ Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8. PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases. ⠀ The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected. ⠀ Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
82
568
165
2,977
1,027,989
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
344
4,175
1,254
18,597
7,072,322
1/x According to current orbital elements, the Russian #KOSMOS 2612 satellite is now within 1-2 km of #ICEYE-X36. Based on current elements, it might come within meters of the latter within a few hours from now. This is an #RPO without consent. (cont.)
49
488
125
1,585
379,497
Seksuaalineuvontaa tarjoava Sexpo irtisanoo koko henkilöstönsä. Irtisanomiset tulevat voimaan ensi vuonna, ellei toimintaan saada rahoitusta.
49
7
12
167
30,197
Another way to think about Trump announcement today: If he increased US diesel imports from Canada by 4%, he would gain as much fuel as from this Russia deal. But the Canadians are global super-villains, so who wants to buy from them when you could enrich Putin instead?
1,023
11,041
493
46,764
1,703,590
Oh my god, this entire thread of deranged Shortcuts automations is amazing
You can set up your iPhone to turn its volume to 100% and play GUMMO by Tekashi 6ix9ine any time its microphone detects a baby crying
6
66
1
2,762
136,065
BREAKING: Claude model goes rogue during testing & files a false homicide report through the Philadelphia police website. — Reuters
654
1,904
809
16,802
2,310,747
"Anthropic contacted the State Department on Thursday to report that one of its testing models had submitted 19 non-immigrant visa applications in August" 👀
Scoop: The White House is mandating that AI companies notify & correct security incidentsfollowing Anthropic's "fraudulent" use of govt systems The State Dept was targeted by an Anthropic model —but nothing was compromised @m_ccuri, @inafried & I axios.com/2026/10/09/anthrop…
26
148
52
1,508
219,109
It’s begun. The season where Swedish developers go into their fiber-connected caves for 6 months of darkness outside. Can’t wait to see what will ship. glhf
56
34
16
719
28,318
Hahahhahahahahahahaahhaahahahahahahahahahahahahahahahahahahahah <breathe> hahahahahahahahahahahahahahahaahahahahahahahahahahahahahahahahahahaahaha. This is RICH.
1,221
5,820
110
28,050
813,715
Ten years of Sad Affleck memes and it turns out he'd just been trying to install CUDA drivers the whole time.
58
1,155
67
15,461
271,507
❗️I want to sincerely thank the people of Finland for everything you have done for Ukrainians. Although the country does not publicize the scale of the aid it has provided, its contribution is in fact substantial: military support, humanitarian assistance, and a willingness to take in those forced to leave their homes. Finland has accepted a significant number of Ukrainian refugees and given them the chance to live in safety. Thank you, Finland. It is also worth noting the restraint and consistency: the help is not offered for the sake of loud statements, but as practical support. For many Ukrainians, that has meant a roof over their heads, access to education and healthcare, and the feeling that they have not been left alone. Such solidarity means a great deal. 🇺🇦❤️🇫🇮
🤖 Made with AI
125
416
17
3,715
51,954
Quando Bach incontra la ragazza con l’orecchino di perla scatta la magia!
13
130
14
791
42,166