Prince John Wesley (@PrinceJWesley) header
Prince John Wesley (@PrinceJWesley) profile picture

Built a time travel, distributed, forkable, cross platform file system called mountOS.

Chennai, India
Joined June 2010
Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)Photo by Prince John Wesley (@PrinceJWesley)
Prince John Wesley retweeted
- They pulled credentials from inside their app's container and used them to request every secret on the platform: ours and every other customer's. - They tried our cloud provider's metadata endpoint, the standard way to steal credentials for the host a container runs on. - They asked the cluster what those stolen credentials were allowed to do. - They went looking for our databases and caches by guessing their internal names. - They port-scanned our whole internal network, all 65,536 addresses, twice. - It was about 24 commands over 15 minutes, done on purpose and scripted. No app was ever run. - Every attempt was blocked. Nothing was accessed.
159
191
89
4,557
357,720
Prince John Wesley retweeted
Hey @Railway, is there a reason employee's of yours are trying to breach my infrastructure? Your employee Jake Runzer, just attempted to tonight.
198
245
209
7,272
2,151,725
Prince John Wesley retweeted
Your agentic testing platform is to try and probe for security leaks?
55
44
41
3,465
307,748
Prince John Wesley retweeted
WorkOS got hacked. Seemed like it was using ARTEX. Very no bueno
7
16
14
166
50,596
‼️ Apps built with the AI app-maker Lovable left passport numbers, payment information and 200,000 chat messages open to anyone, no login needed. German security firm Crissy Field scanned 159,041 Lovable projects and found databases with email addresses readable on 7,403 sites. Lovable promises no coding skills are needed. Its terms make customers responsible for their apps and data. Lovable told German business daily Handelsblatt the problem is industry-wide.
126
281
229
2,225
299,537
Prince John Wesley retweeted
🚨 PoC RELEASED: CVE-2026-112487 (macOS Storage) A path handling flaw lets an app already on a Mac gain root privileges. Public exploit code from a credited researcher appeared on 31 Oct. Fixed: Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2 (26 Oct) 
Status: no NVD score yet, not in CISA KEV, no known in-the-wild attacks Action: update macOS now. threatwire.tech/news/update-… #macOS #CyberSecurity #poc
5
30
4
156
23,212
Prince John Wesley retweeted
There has been a security incident at Trigger. We have emailed the owners of all impacted accounts. We’ll be providing more information but for now the focus is on giving the impacted account owners what they need to mitigate. trigger.dev/blog/security-in…
13
16
29
187
62,100
Prince John Wesley retweeted
This is in very bad faith Yuvraj. You are a good cricketer, you are a strong human, a cancer survivor. But you are an absolute health and science illiterate. People like you and your business of bad science deeply damages science literacy and public health in our society. It is a pathetic. You can be powerful allies for cancer patients and oncology societies and use your voice to educate people on evidence-based preventative care and direct cancer patients towards science-based care for improved survival outcomes. But instead, you chose to team up with unethical businessmen - some with long degrees, lengthy certifications and in high positions without any functioning brain cell - and among them, one of the worst "health" influencers on the internet right now, the so-called cancer surgeon Arpit Bansal who is a pseudoscience sympathizer, an Ayurveda apologist and quite similar to Luke Coutinho, but with actual medical degrees wasted. Know this first: Cancer patients who use alternative medicine die sooner, study finds - nbcnews.com/health/health-ne… Now coming to your product - P32 Among the 32 listed ingredients with 35+ distinct compounds in them, 13 carry documented risks of organ toxicity, mineral toxicity, capable of causing/promoting atherosclerosis inducing toxin generation, and with high rates of toxic environmental contamination. Four ingredients - Ashwagandha, Bacopa, Curcumin and Boswellia are among the most frequently implicated botanicals in liver injury in LiverTox registries. When they come together, it is going to be disastrous. medpagetoday.com/gastroenter… - The person who designed this complex formulation is really a clown. Nearly all 30 active ingredients in this 32-ingredient supplement lack solid scientific proof for the health benefits promised on the label. First, the company's own chart admits that eight ingredients have no gold-standard human trials behind them - two are just inactive fillers, and six rely on weaker data or are added only for safety, yet are still marketed as multi-organ boosters. At least 11 ingredients are "fairy-dusted," meaning the sachet contains only a tiny fraction of the daily dose actually proven to work in human studies. High-level clinical and translational evidence demonstrates that several components in this sachet can actually increase cancer risk or accelerate tumor progression in healthy adults: Vitamin E (prostate cancer), combined folic acid+B12 (lung and colon cancer) and NAC, Vit E, Vit C, Astaxanthin (increase risk of cancer spread). See this paper: Supplement Use and Increased Risks of Cancer: Unveiling the Other Side of the Coin - pmc.ncbi.nlm.nih.gov/article… Finally, the product stretches basic science by assuming that because a nutrient deficiency harms certain organs, taking extra amounts will supercharge those same organs in healthy adults who already get enough nutrients. Your product is absolute BS just like the whole of herbal and dietary supplement industry is. Have some shame selling this nonsense to public and people with cancer. I hope nobody accepts your stupid invite.
My second innings starts now. In 2011, I played the World Cup with cancer. Nobody knew. Neither did I. Now I take my daily health very seriously. So should entire India. Most Indians who take supplements take one, two or three. That isn’t enough to run the body. So we built Protocol32: 32 FSSAI-approved supplements, in the right quantities for an average Indian, working together to run 13 chains in the body. One sachet a day, mixed in water or milk. Co-formulated with Dr. Anurag Agrawal and Dr. Arpit Bansal. Built with Prashant Pitti and Prasad C P. Made in Bangalore. Swipe through to see every supplement, every dose and every chain. Protocol32 is invite only. The first batch is only a few hundred people, and we’re starting with fitness, health and nutrition creators, doctors, dietitians, entrepreneurs and celebrities. Apply at protocol32.com @P32wellness
154
1,388
36
7,230
606,935
Prince John Wesley retweeted
Fuck around and find out. When Railway was breached on 21 Oct, Northflank dunked on them and urged people to migrate over to them because of that breach. 9 days they got hacked, the same way. Zero sympathy: instead of securing you were busy dunking
Northflank, a K8s fleet management & deployment system has been hacked. They power @sentry @Upwork @figma @CoreWeave and apparently many other companies. status.northflank.com/cmvv0r…
87
90
31
1,725
176,933
Prince John Wesley retweeted
BREAKING: France just voted to tax the internet. French lawmakers approved a tax of €0.055 (5.5 cents) for every gigabyte of data that companies like Netflix and YouTube send to French users. It’s a tax on the companies, not users directly, but the cost could get passed on to subscribers. The vote was 11 to 10, with only 35 of 577 lawmakers present. Supporters say it could raise up to €10 billion a year. The French government opposed it, warning it would hit smaller French companies hardest; VLC says it would cost it over €1 million a year.
Readers added context they thought people might want to know
This amendment to France's 2027 budget bill was narrowly adopted 11-10 in the National Assembly (35 voters present) but is not yet law, faces government opposition, and must still clear further Assembly/Senate steps. assemblee-nationale.fr/dyn/17/comptes… assemblee-nationale.fr/dyn/17/amendem… capital.fr/economie-polit… stephanelarue.com/taxe-au-gigaoc…
817
757
498
7,762
1,279,163
Prince John Wesley retweeted
🔴 ClickHouse: remote code execution in database server (CVE-2026-116366) An unauthenticated attacker on the network could run arbitrary code on the server under certain conditions. Patch → 26.3.62.3-lts, 26.8.36.3-lts and more cve.now/CVE-2026-116366?utm_…
11
65
30
1,042
402,143
‼️ WARNING: Updating the poisoned Claude Code extension won't remove its backdoor, Kevin Beaumont says. Cursor, which served the bad build to up to 5,000 users, warns that even uninstalling it may not be enough. The backdoor never lived only in the extension. On loading, it planted the attacker's SSH key and its own startup scripts, which keep trying to open a tunnel to the attacker every 60 seconds or so. An update swaps the extension's files but leaves the key and the scripts in place.
45
132
20
897
79,289
Prince John Wesley retweeted
Fun watching performance optimizations propagate across the data infra ecosystem. — June 2025: @TimescaleDB implements Bloom filter folding. — March 2026: @ApacheArrow-rs adopts the approach, inspired by TimescaleDB. — Sept 2026: @ClickHouseDB picks it up from arrow-rs. And the cycle continues!
How we improved bloom filters in parquet-rs [1], now adopted by ClickHouse [2]: pydantic.dev/articles/bloom-… [1]: github.com/apache/arrow-rs/p… [2]: github.com/ClickHouse/ClickH…
4
11
2
155
9,373
Prince John Wesley retweeted
BREAKING: Binance's founder Changpeng Zhao says that it appears the company has been hacked.
98
510
169
2,333
337,004
Prince John Wesley retweeted
Three years ago, I earned $500k/year in tech. Today, I’m homeless, living in my car. 28 years of experience. Three technical books. AI engineer since the 1990s. And I can’t find a job. My story is a warning about the future of work. medium.com/effortless-progra… #AI #FutureOfWork
434
342
191
2,231
2,756,329
Prince John Wesley retweeted
Planned to drop a macOS 0day at OffensiveCon 2026 in Berlin 5 months ago. Submitted it to Apple 3 years ago, and Apple confirmed the vulnerability but closed the report. it's a universal method to bypass many security protections on macOS and you can fully bypass TCC and gain other privileged access as you want, easilly weaponized. Although I mentioned the impact multiple times, there were no updates for the next 2 years until my presentation was accepted by OffensiveCon26 Berlin. Apple asked me to hold off on disclosure and not disclose the vulnerability at OffensiveCon26 Berlin, saying a patch would be released in macOS 27 in Fall 2026. They also mentioned "bounty" multiple times. Honestly, I did have some complaints because their workflow was really bad. No updates at all until disclosure was about to happen. But as long as they decided to patch it, I was willing to wait, even without a bug bounty, for user safety. If Apple wasn't going to release a patch for 3 years, I'd disclose the vulnerability so EDR vendors could protect users too. But in September, when the vulnerability was patched, there was no cve, no credit, and no bounty. I really don't get why apple chose to handle it in such a dishonest and underhanded way, a cheat. Even if they had never mentioned a bounty, I still would have held off on disclosure because they were going to publish a security bulletin. this is a huge disappointment in my experience with the Apple Security Bounty program. never thought I'd encounter something like this. As i said on my blog a few years ago, my experience with ASB had been positive. that's why I was willing to wait for the patch even without a bounty, but not to be cheated like this
68
155
8
2,950
209,244
Prince John Wesley retweeted
BREAKING: 39 people dead after two trains collide in Spain
160
871
185
8,398
1,964,722
‼️ The git, curl and python3 in macOS still trust compromised eMudhra certificates, 11 days after Apple was told. Anyone can recover their keys, so an attacker on your network could pose as GitHub and feed you code. Researchers say macOS 27.2 even wiped fixes applied by hand.
46
188
60
1,491
138,004
Difficult times!
AI is making it unsafe to ship even just a binary to your customers. Over the past 6 weeks, we've had multiple users attempt to reverse-engineer the Archil client as well as try to infer different behaviors about the Archil client from the strings present inside of it. I don't know how this ends, but this is definitely making it challenging to distribute software to customers. In my previous life, I wouldn't have wanted to give customers tools that would be confusing or lead them to the wrong conclusions about how services work (like the strings to a binary). In this new world, maybe you just have to open-source everything?
1
28
Just ₹41.5 😂
This quoted post is unavailable.
19