Founder. CISO. Shipped AI to 100K+ users and identity for $400M+ in fintech. Writing on AI agents, Elixir, and Omarchy → https://xitter.cf/t.co/uzSTLotAm3
California
Joined January 2013
- Tweets11.2K
- Following2.4K
- Followers11.5K
- Likes67K
Jared Smith retweeted
Omarchy QA, using nightly builds, is now kicking off every morning at 8am
granted there is only one test, but that one test is beautiful :)
Should have 50 tests here soon
Jared Smith retweeted
I recommend everyone upgrade Ruby immediately. This is a DoS and RCE vector if you accept user input into Regexp.new() ruby-lang.org/en/news/2026/1…
Jared Smith retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?
Jared Smith retweeted
A few days ago this was a mockup. Tonight it's running in @Omarchy: live NEXRAD radar in the weather panel, looping through a storm that’s currently passing over Grants, NM right now.
Jared Smith retweeted
🚨 BREAKING: LINUX IS NOW FACING TWO CRITICAL SECURITY VULNERABILITIES, AND THERE ARE NO OFFICIAL KERNEL FIXES YET.
Both rated 9.0/10 in severity.
One could allow hackers to take control of vulnerable servers WITHOUT EVEN LOGGING IN.
And the most alarming part? The flaws were made PUBLIC before patches were ready.
Here's what's happening:
→ TWO CRITICAL RCE FLAWS: Both affect KSMBD, Linux's built-in SMB file server.
→ NO PASSWORD REQUIRED: One vulnerability could allow unauthenticated attackers to execute malicious code on vulnerable servers.
→ KERNEL-LEVEL ACCESS: Successful exploitation could potentially give attackers control within the Linux kernel itself.
→ NO MAINLINE PATCH YET: Both vulnerabilities were publicly disclosed before official kernel fixes were available.
→ DISCOVERED BY AI: Trend Micro's AI-powered security scanner identified the flaws.
→ SERVERS AT RISK: Linux systems running the vulnerable KSMBD service need immediate attention, especially if port 445 is exposed.
First PHP. Then Node.js. Then GitLab. Then Python.
NOW LINUX.
And this time, the vulnerabilities are PUBLIC before the fixes are ready.
If you manage Linux servers, CHECK YOUR EXPOSURE NOW.
🚨 BREAKING: IT JUST KEEPS GETTING WORSE. NOW PYTHON IS FACING A MASSIVE SECURITY EMERGENCY.
Python's security team has issued an URGENT warning after a certificate authority compromise put Python's HTTPS security at risk.
→ 8 CERTIFICATE AUTHORITY KEYS COMPROMISED. Some were so weak they could be cracked almost INSTANTLY.
→ FAKE TRUSTED WEBSITES: Attackers could potentially impersonate Python.org, PyPI and other websites during intercepted connections.
→ MALICIOUS DOWNLOADS: Vulnerable environments could be tricked into downloading software from attacker-controlled servers.
→ YOUR OS PATCH MAY NOT PROTECT YOU: Older versions of pip can STILL trust compromised certificates even after system updates.
→ EMERGENCY UPDATES: Python developers are being told to immediately update pip, certifi, uv and other affected tools.
→ DOCKER USERS AT RISK: Existing container images may retain vulnerable certificate stores and need rebuilding.
First PHP. Then Node.js. Then GitLab. Then LiteLLM.
NOW PYTHON.
The very systems developers rely on to establish TRUST online are becoming the attack surface.
If you use Python, PATCH NOW.
Readers added context they thought people might want to know
The Python certifi/pip details match the real eMudhra CA incident, but PHP, GitLab and LiteLLM involved unrelated software bugs, platform flaws and supply chain malware—not CA key compromises like this (Node.js patched concurrently for the same CA issue).
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
github.com/advisories/GHS…
docs.litellm.ai/blog/security-…
snyk.io/blog/php-patch…
Readers added context they thought people might want to know
KSMBD is a rarely used optional in-kernel SMB server distinct from the common Samba implementation; it is not enabled or shipped by default on major distributions like RHEL, and the flaws affect only systems explicitly running it with port 445 exposed.
thehackernews.com/2026/10/two-cv…
threatlandscape.io/blog/ksmbd-zdi…
Jared Smith retweeted
OmarchyTV: your Android TV home screen, in Omarchy's look. 📺
Marco Porro released it in beta today, and DHH already asked: "We can fix smart TVs too?!"
What you get:
▸ Workspaces 1–5 and a Waybar-style bar, like Hyprland
▸ Your streaming apps in one row, plus a Walker-style menu
▸ All 23 Omarchy themes and a terminal-style screensaver
▸ Pair your Omarchy PC with a 6-digit code to push themes and share your screen
Try it: install the APK over adb, set OmarchyTV as the home app, then pair from "Connect Omarchy Linux".
It's beta, tested on one Sony TV and the emulator. One press switches back to the stock launcher.
Link, install guide and credits are in the first reply.
Which screen in your house still doesn't run Omarchy?
Jared Smith retweeted
We need a slang term for developers who don't use PHP but are suddenly experts on PHP vulnerabilities.
What are we calling them?
Jared Smith retweeted
There must exists an app with PHP, deployed on Railway, with calls to cURL, with other services written in node that use Brotli compression running on a couple day old Linux, with their code self managed on GitLab
They are having a hell of a week
Jared Smith retweeted
OmarchyTV is out in beta
An #Omarchy style launcher for Android TV: themes, Waybar style bar, live stats and a terminal-style screensaver.
It comes with the omarchy-tv plugin, so your Omarchy PC can push themes and share its screen to the TV.
Based on tv-vibehack by @gathint. Built for Omarchy by @dhh ❤️
It's on GitLab for now (my GitHub account is still stuck in review):
gitlab.com/piermark/omarchyt…
Wallpaper: Liftoff by @tcballard
Jared Smith retweeted
The Basecamp plugin is now available in ChatGPT 🎉 chatgpt.com/plugins/plugin_a…
Jared Smith retweeted
After yesterday’s avalanche of vulnerabilities, I have a much better grasp on why frontier AI models have internal tripwires for cybersecurity prompts.
Software of the past has more holes than Swiss cheese and this transitionary period of finding them and patching them will be a very painful one.
Jared Smith retweeted
Thanks to the excitement about my local AI and Omarchy Linux on Apple Silicon work, I am approaching the impressions to join the content rewards program which would help fund my tokens.
Y’all often ask how you can support my work - please encourage folks to follow and reply.
Jared Smith retweeted
This looks like the path forward. TDD is great, but agent-written tests are so cheap that many devs skip the review process. PDD might just be what is needed to increase clarity and specificity.
How do you _guarantee_ your agent's code is correct? You prove it.
Introducing Proof Driven Development Kit (PDD Kit) from @MSFTResearch.
PDD Kit helps turn your plan into a formal spec, then proves the agent's code meets that spec for every input. No vibe verification. PDD Kit is integrated with @GitHubNext's Chopin, so you can plan as a team.
PDD Kit takes an app's login flow from intent to a verified pull request:
It discusses your code, infers your intent as it goes, and proposes a formal spec in Verus, a proof language for Rust.
Once you approve the spec, the Verus verifier automatically proves the code meets it.
Where proof isn't possible, it falls back to empirical verification with tests and computer-use agents (CUAs).
It works on Rust today. No new language, no change in how you produce the underlying code, making formal methods more accessible.
The goal is a verified software factory, where engineers review specifications instead of code.
Come see it in action at GitHub Universe, Oct 28–29. Swing by the Speakeasy and ask for GitHub Next!
Jared Smith retweeted
Friendly PSA: when working with agents, they’ll often prioritize “house style” and “consistency” over what makes sense long term.
Sometimes existing patterns in a codebase are the problem. That’s why we must use good judgement when reviewing agent-proposed solutions in legacy codebases.
Jared Smith retweeted
Omarchy just got faster ways to change how it looks. ⌨️
These were merged after the 4.5 RC, so they arrive in the next build.
Why it's useful:
▸ Themes and backgrounds are one chord away, not two menus deep
▸ Network gets its own spot on the keyboard
▸ Appearance becomes a top-level menu, so look-and-feel lives in one place
What's coming:
▸ Super + Ctrl + T: open themes
▸ Super + Ctrl + W: open backgrounds
▸ Super + Ctrl + N: network (it moves here from Super + Ctrl + W)
▸ Super + Ctrl + Alt + C: keyboard screenshot
Heads-up: Nightlight loses Super + Ctrl + N. It stays in the toggle menu on Super + Ctrl + O.
Merged on GitHub, Oct 20. Not in a release yet: expect them in the next 4.5 build.
PR links are in the first reply.
Which do you change more often: your theme or your background?