Former gifted kid with ADHD, autism, low IQ, diminished penile volume, erectile dysfunction, body odor.
San Francisco, CA
Joined May 2026
- Tweets7.7K
- Following411
- Followers1.7K
- Likes19.6K
Linus Mixson retweeted
Employees are running thousands of simultaneous agents but Claude Code is still missing basic features which have bene in Codex, OpenCode, and OMP for months.
Really wonder how bad the AI psychosis is inside of Anthropic.
I asked @bcherny how many Claude agents he's running right now as he sat next to me.
"A few thousand."
Boris (creator of Claude Code) came back to my Stanford course ๐ง๐ต๐ฒ ๐ ๐ผ๐ฑ๐ฒ๐ฟ๐ป ๐ฆ๐ผ๐ณ๐๐๐ฎ๐ฟ๐ฒ ๐๐ฒ๐๐ฒ๐น๐ผ๐ฝ๐ฒ๐ฟ last Thursday. His main takeaways:
- ๐๐๐๐ผ๐บ๐ฎ๐๐ฒ ๐๐ผ๐๐ฟ ๐ฏ๐ผ๐๐๐น๐ฒ๐ป๐ฒ๐ฐ๐ธ: Claude has written 100% of his team's code since November and output is up ~10x per engineer. So much code shipped that people stopped reading it carefully and started skimming, so they automated code review. Approvals are next. The team identified the main things impeding their development velocity and built systems to unblock themselves.
- ๐๐๐ถ๐น๐ฑ ๐ณ๐ผ๐ฟ ๐๐ต๐ฒ ๐บ๐ผ๐ฑ๐ฒ๐น ๐ฒ ๐บ๐ผ๐ป๐๐ต๐ ๐ผ๐๐: early Claude Code revenue was flat for months because the model wasn't smart enough yet. Then Opus 4 came out and growth became astronomic. His method is to read your agent transcripts and see where the model fails. That's where it will improve in the next model release.
- ๐ฆ๐บ๐ฎ๐น๐น ๐๐ฒ๐ฎ๐บ๐ ๐ด๐ผ ๐ณ๐ฎ๐๐๐ฒ๐ฟ: for months Claude Code was basically just him. With AI, one or two people can outship a team 100 times their size. Constraints breed creativity.
- ๐ง๐ต๐ถ๐ป๐ธ ๐ถ๐ป ๐น๐ผ๐ผ๐ฝ๐: his grandpa programmed punch cards in the Soviet Union. Boris writes loops that run for days or weeks and spawn many agents. He expects that typing code by hand is heading where punch cards went.
- ๐๐ผ๐บ๐ฎ๐ถ๐ป-๐๐ฝ๐ฒ๐ฐ๐ถ๐ณ๐ถ๐ฐ ๐ฏ๐๐ถ๐น๐ฑ๐ฒ๐ฟ๐ ๐ฎ๐ฟ๐ฒ ๐๐ต๐ฒ ๐ณ๐๐๐๐ฟ๐ฒ: he expects the best accounting software of 2027 to be built by an accountant. When code is cheap, knowing the problem deeply is the only alpha
In the 50 years after the printing press, Europe produced more literature than in the previous 1,000. He thinks coding is about to undergo a similar explosion of creation.
Linus Mixson retweeted
Updating this from weekly to daily. Iโll make one more prediction: within five years, the โopenโ internet, which has been increasingly enclosed by all of these corporations, will vanish entirely. We are moving into the age of private walled gardens. It was nice while it lasted.
Linus Mixson retweeted
If I were a male gynecologist I would keep a couple of bits and gags in the chamber to keep my female patients at ease, considering the obvious. Like in order to lighten the mood before starting my examination, I would say something like โNow itโs time to take a look under the hood!โ Or, if I could tell she was a little stressed during the exam by the level of her cervical tension (doctor term I coined), I would stop and cup my hands to my mouth and go โHELLOOOO โฆ.. helloo โฆ.. hello โฆโฆ. helloโ like an echo effect was coming from her cavernous sex. And if we go through the entire exam and we see everything down there is up to snuff or sniff , I would relay the good news by telling them: โYour pussy is BUSSINโ, queen!โ then send her on her way with a lollipop in the shape of a vag. Also Iโd only see patients who are under the age of 30.
Linus Mixson retweeted
It's honestly getting kind of boring waiting for the moronic AI hypebeast hivemind of X to catch up to the consensus of the Wall Street credit analysts who are 10x more diligent and legit than they are.
Linus Mixson retweeted
i have more employees than most startups. none of them sleep.
maple: my chief of staff!
dr eggbot: constantly making my bots better than more efficient
realtor: finds homes worth touring
inbox: triages my email
package pal: tracks every package and return
disk doctor: took my mac from 2gb free to 235gb
token accountant: warns me before i hit my limits and updates my bots to be more token efficient
travel: plans and books my trips
finance: answers my money questions based on my financial data
claude desk: runs claude code on my mac from my phone
x: analyzes my growth on here
tell me your most annoying weekly task and i'll tell you which bot to build ๐
Linus Mixson retweeted
I know many people despairing over AI because their job is now being a meat proxy for AIs, or their intellectual project is now unnecessary.
The promised compensation for this loss is UBI, i.e. you will be on welfare forever.
Linus Mixson retweeted
I think it's funny to see people blaming AI for the current security issues.
The issues were already there and made by humans. It's a bit like blaming a doctor because you got a positive cancer screen. The cancer was there.
Linus Mixson retweeted
The fact that randos are using deepseek swarms to exploit the php vulnerability just to update that sideโs php version so its not vulnerable has given me immense hope for humanity
Linus Mixson retweeted
๊ทผ๋ ๋ณธ ์ฅ์ผ๋ก ์กฐ๊ฐํ ์ํ ์ค ๊ฐ์ฅ ์ธ์์ ์ด์๋ ์ค๊ตญ์ ๋ฐฑ์ฅ๊ฒ็ฝ็่น. ํฐ ์ฅ์ ๊น์์ ๋ฏผ๋ฌผ๊ฒ๋ฅผ ๋ง๋ค์ด๋จ๋๋ฐ ์ ๊ตํจ์ด ์ ๋ง ๋๋๋ค. ๋ฏผ๋ฌผ๊ฒ๋ ๋ฐ์์์ๅคง็ฒ่น๋ผ๊ณ ํด์ ์ํ์ด, ํญ์ ์ฐ, ์ค์ ์ฐ ๋ฑ ์ค๊ตญ ๋จ๋ถ์ง์ญ์์ ์ธ๊ธฐ์ธ ์์ฌ๋ฃ. 18์ธ๊ธฐ ์ฒญๆทธ๋๋ผ ์๋ ์ํ. ์ผ๋ณธ ๋์ฟ๊ตญ๋ฆฝ๋ฐ๋ฌผ๊ด ๋์๊ด ์์ฅ.
Linus Mixson retweeted
Tested all 12 compromised eMudhra certificate chains (where an intermediate CA private key was literally 4) across macOS, mobile browsers, Go, Node, Python, and Java today.
Here is what is actually safe, what is still exposed, and two gaps in the current macOS workarounds.
1. What is already safe (don't panic)
โข Desktop browsers: Chrome, Safari, Edge, Brave, and Firefox (158.0.1+) are safe.
โข iOS & Android in-app browsers: X on iOS (SFSafariViewController) and updated Chrome Custom Tabs on Android enforce Certificate Transparency (requiring >= 2 valid SCTs). Since zero fraudulent certs were logged to CT, they reject all 8 keys automatically.
โข Mobile exceptions:
- Firefox on Android < 158.0.2 had a startup bug (Bug 2084311) where OneCRL didn't sync. Update to 158.0.2 (out today).
- Android 13 and older don't get Google Play system CA updates, so apps using raw Android WebView (where CT is off by default) still trust the roots unless you disable `emSign` and `Comodo AAA Services` under Settings -> Security -> Encryption & credentials -> Trusted credentials.
2. Two gaps we found on macOS today (even after running the official workaround)
Safari is safe because it enforces CT. Non-browser tools on macOS (`curl`, `git`, `python3`, `nscurl`, and `Go < 1.27.3`) do not enforce CT.
When testing all 12 chains on an updated Mac today, 9 were blocked, but all 3 `G3B` chains (`dv-g3b`, `ov-g3b`, `ev-g3b`, private keys 156, 155, 115) still returned HTTP 200:
โข Why: Apple's Valid DB set `checkOCSP = 1` instead of removing the `emSign ECC Root CA - G3` root. `ocsp-c.emsign.com` (`G3C`) is up and returns `revoked`, so `G3C` is blocked. `ocsp-b.emsign.com` (`G3B`) is currently down returning `HTTP 503`, so macOS `Security.framework` soft-fails open and trusts `G3B`.
โข Why the `/etc/ssl/cert.pem` workaround still returns HTTP 200 on `G3B`: Apple's `/usr/lib/libcrypto.46.dylib` (`X509_verify_cert`) links `TrustEvaluationAgent.framework`. When a cert isn't in `/etc/ssl/cert.pem`, Apple's LibreSSL falls back to `Security.framework`, hits the 503 on `ocsp-b.emsign.com`, and approves the cert anyway.
Fix on macOS (also works without sudo on MDM-locked work Macs):
1. Strip the 2 roots into a clean bundle:
awk '/^(###|===) /{skip=0} /^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1} !skip' /etc/ssl/cert.pem > ~/.ca-cert.pem
2. Disable Apple's TrustEvaluationAgent fallback and point CLI tools to the clean bundle in `~/.zshrc`:
export OPENSSL_X509_TEA_DISABLE=1
export SSL_CERT_FILE="$HOME/.ca-cert.pem"
export CURL_CA_BUNDLE="$HOME/.ca-cert.pem"
export GIT_SSL_CAINFO="$HOME/.ca-cert.pem"
3. Backend runtimes (bundle their own CA stores and ignore OS updates)
โข Node.js: Update to v22.23.4, v24.22.1, or v26.12.1.
โข Go: Update to Go 1.27.3 or 1.26.10 and recompile binaries (hardcodes SPKI blocklist in `crypto/x509`, bypassing the macOS 503 soft-fail).
โข Python: Update inside every virtualenv (`pip install -U "certifi>=2026.10.19" "pip>=26.2.2"` and `uv >= 0.13.4`).
โข Rust: Rebuild with `webpki-roots >= 1.0.10` / `rustls-webpki >= 0.103.16` (`rustup >= 1.29.2`).
โข Java (OpenJDK / Oracle): No upstream release yet. Delete both roots from `cacerts`:
keytool -cacerts -storepass changeit -noprompt -delete -alias emsigneccrootcag3
keytool -cacerts -storepass changeit -noprompt -delete -alias comodoaaaca
โข Linux / Docker: Update `ca-certificates` (Ubuntu `20260816ubuntu0.24.04.1`, Debian `20250419+deb13u1`, Alpine `20261020-r0`, Fedora `2026.2.92_v9.0.319`, Arch `3.131.1-1`) and rebuild base images.
Verify any CLI or runtime with:
curl dv-g3b-emudhra.we-have-a-proโฆ
(TLS error = safe. HTTP 200 = still exposed.)
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
โข Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
โข Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
โข 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-proโฆ
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
โข Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
โข Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
โข Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
โข App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
โข Only PHP 8.2โ8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
โข Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Linus Mixson retweeted
New un-disprovable conspiracy theory just dropped
Expect to hear this kind of thing forever, no matter what happens.
Linus Mixson retweeted
I'm not much of a comics guy, but I've always found myself enthralled by Mystique from X-Men. A woman who could change her appearance completely at will would open up a world of possibilities for me, and I can't help but wonder what it would be like if my wife had such abilities.
The only limiting factor would be my own imagination, and finally I would not be constrained by the her aging flesh. She would of course indulge me in my most imaginative fantasies, altering contour, texture, and shape to appease my every desire.
I imagine the anticipation building as she leans in close to my ear, whispering of exotic and otherworldly appearances that she yearns to try on for me. An infinite wardrobe of possibilities tailored to fulfil my deepest appetites. I lock eyes and gaze into her, hoping to catch a glimpse of that burning spark the moment it gutters and dies out as it has a thousand times before, as I tell her yet again to make herself look like her sister.
Linus Mixson retweeted
Americans have a "revealed preference" for doing less of basically everything except going online and I have serious doubts that this is making us happier.
slowboring.com/p/americans-nโฆ
