Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Today, after seven years of work, The Law of the Sublime is out in the world.
When I started this book, I had an ambitious plan. I would go down the Amazon, find chimpanzees in the wilds of Africa, and cross the Gobi Desert, then write about those experiences of awe.
Then, on a hot August afternoon in 2018, I had a stroke while driving in Los Angeles. A blood clot cut off oxygen to my brain, and within seconds I lost consciousness. When I woke up in the hospital, I learned how close I had come to the point of no return. My left hand was frozen into a claw, and I could barely feel my left leg, but something strange happened.
On the ambulance ride home, I looked out at the people on the street, and for a moment I felt I could be inside their bodies and hear their thoughts. It was marvelous and weird, and I knew it was time to write this book.
I couldn't type, so I wrote every page by hand, dictated it, printed it out, and edited it all over again. I couldn't take the long hikes that had carried me through my six previous books. Then one afternoon I woke from a nap in my backyard to find a grasshopper inches from my face, and I understood that this small backyard would have to be my Amazon jungle. The lizards, the hummingbirds, the insects became my teachers.
My limits turned out to be a blessing. They forced me to find the Sublime in the simplest things, and that is what this book is about.
Most of us live inside a circle: an everyday consciousness shaped by culture, convention, and, more and more, technology. That circle keeps shrinking, and we grow bored and restless. Just outside it is the Sublime, a realm that is frightening and exciting at once, pulling us out of our comfort zones and opening us to a much wider reality. The book maps 12 points outside that circle, and each one is a different face of the Sublime.
Inside, you'll find stories of near-death encounters, astonishing discoveries, and radical changes of consciousness, along with exercises and meditations so you can feel the Sublime yourself, not just read about it.
The Sublime doesn't require travel or exotic adventures. It only requires a new pair of eyes for the reality all around you.
The Law of the Sublime is available now in hardcover, ebook, and audiobook.
Thank you for your support of my work. I hope you enjoy reading this book, and I look forward to hearing your feedback.
With gratitude,
Robert Greene
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Las 7 cabeceras de seguridad que debería tener tu web y cómo comprobar si las tienes de manera sencilla.
Es algo que siempre reporto en mis auditorías de seguridad y casi nunca están bien configuradas.
No cuesta nada implementarlas y te protegen frente a ciertos ataques:
➡️Strict-Transport-Security (HSTS)
Esta cabecera obliga siempre al navegador a usar el protocolo HTTPS.
Strict-Transport-Security: max-age=31536000; includeSubDomains
➡️Content-Security-Policy (CSP)
Es sin duda la que más pereza da configurar, pero la que más protege.
Decide desde qué fuentes se pueden cargar scripts. Si alguien consigue inyectar código en tu web (mediante un ataque XSS), el navegador no lo ejecuta.
Empieza por configurar Content-Security-Policy-Report-Only: te avisará de lo que bloquearía sin romper nada. Cuando ya no tengas avisos, actívala.
➡️X-Frame-Options
Sin esta cabecera, tu web puede ser cargada en un iframe externo. Esta vulnerabilidad tiene nombre: clickjacking.
X-Frame-Options: DENY (o frame-ancestors dentro de la CSP)
➡️X-Content-Type-Options
Evita que el navegador “adivine” el tipo de un archivo y acabe ejecutando como script algo que se subió como imagen.
X-Content-Type-Options: nosniff
➡️Referrer-Policy
Se encarga de controlar qué partes de tu URL se envían a otras webs. Si tus URLs contienen tokens o IDs, nunca se enviarán.
Referrer-Policy: strict-origin-when-cross-origin
➡️Permissions-Policy
Como su nombre indica, se encarga de bloquear los permisos de cámara, micrófono o ubicación si tu web no los usa.
Permissions-Policy: camera=(), microphone=(), geolocation=()
➡️Set-Cookie
Configurarla correctamente hará que tus cookies de sesión solo viajen por HTTPS, no se puedan leer con JavaScript y no se envíen desde otras webs.
Set-Cookie: ...; Secure; HttpOnly; SameSite=Lax
Aparte de todas estas, hay 2 que conviene que elimines: Server y X-Powered-By. Muchas veces dan información extra a los atacantes acerca de las tecnologías o versiones que utiliza tu web.
Además, si alguna guía te recomienda incorporar X-XSS-Protection, ignórala, ya que es una cabecera obsoleta.
Para comprobar las cabeceras que utiliza tu web, tienes 2 opciones:
➡️ Mete tu dominio en securityheaders.com y comprueba el resultado.
➡️ También puedes hacerlo desde la terminal con el siguiente comando: curl -I tuweb.com
Configurarlas todas de manera correcta no te llevará más de 30 minutos. La CSP es la que más tiempo te llevará, pero merece la pena.
No te van a salvar de vulnerabilidades críticas, pero incorporan una capa de seguridad adicional a tu web que nunca está de más.
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
El pensamiento crítico no funciona como una habilidad mental general que se pueda activar a voluntad, como si fuera un músculo que se entrena por separado. Nuestro cerebro interpreta lo que vemos o leemos a partir de lo que ya sabemos; si no tenemos conocimiento concreto sobre un tema, nos quedamos atrapados en lo superficial y no logramos analizarlo a fondo, por muy inteligentes que seamos. Por eso incluso niños pequeños pueden pensar con claridad en temas que conocen bien, mientras personas muy formadas fallan en áreas que les resultan ajenas: el pensamiento está inseparablemente ligado al contenido.
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Así es como se puede conseguir ejecutar comandos en un servidor a través de una subida de archivos.
Hace meses hice una auditoría en un portal de empleados en el que, a través de la subida de una foto de perfil "maliciosa", conseguí ejecución remota de comandos en el servidor.
Para conseguirlo no necesité un exploit novedoso ni un ataque sofisticado.
El proceso que seguí fue el siguiente:
Comencé por darme de alta con una cuenta normal e intenté cambiar la foto de perfil.
Intenté subir otro tipo de archivo que no fuese una imagen.
Pero cualquier archivo que no fuese una imagen no superaba la validación: «solo se permiten imágenes».
El servidor tenía una lista negra de extensiones. Así que tocaba intentar saltársela.
En primer lugar, intenté subir un archivo .htaccess con el siguiente contenido:
AddType application/x-httpd-php .hacked
El servidor Apache lo aceptó sin rechistar mucho.
Después, intenté subir la misma shell que estaba intentando subir previamente.
Pero con un matiz: en vez de subirla con la extensión .php, la subí con una nueva extensión:
shell.hacked
Éxito. El archivo se había subido correctamente.
Busqué la ruta donde se había subido el archivo y lo abrí en el navegador:
/files/avatars/shell.hacked?cmd=id
El servidor ejecutó el comando correctamente.
Así conseguí ejecutar comandos desde una foto de perfil aparentemente inofensiva.
Avisamos al cliente para que bloquease esta extensión también.
Realizó modificaciones y la nueva implementación solo permitía subir archivos jpg y png, y añadió comprobación de magic bytes.
En el retest, intenté hacer la misma prueba, pero esta vez sin éxito.
Aunque descubrí una nueva forma de saltarme la validación.
En la nueva prueba, preparé un nuevo fichero que empezaba como un GIF real y seguía con PHP:
GIF89a
<?php system($_GET['cmd']); ?>
En la petición cambié el nombre a:
shell.php%00.jpg
La imagen se subió pasando la validación. El filtro vio .jpg y los bytes de un GIF.
El sistema de archivos truncó el nombre en el null byte y dejó shell.php.
Ahora tocaba ver si podía ejecutar comandos de nuevo.
Traté de acceder nuevamente mediante la ruta y la shell volvió a responder correctamente.
Así es como los atacantes pueden saltarse las validaciones de tu web y servidor.
Si tu web tiene una funcionalidad para subir imágenes, logos o archivos adjuntos, conviene que hagas las siguientes comprobaciones:
➡️ Intenta subir un .htaccess con AddType application/x-httpd-php .hacked. Si el servidor lo acepta, cualquier extensión que un atacante se invente puede acabar ejecutándose.
➡️ Si cuentas con un entorno de pruebas, sube un fichero que empiece por GIF89a y lleve debajo <?php echo 'hola'; ?>, con nombre shell.php%00.jpg. Si al acceder a la ruta donde se suve ves "hola", el null byte y el polyglot han pasado tu validación.
➡️ Comprueba que carpeta de subidas no permita ejecutar PHP, que cada fichero se guarde con nombre aleatorio.
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
ChatGPT helped a 31-year-old woman plan how to quit her seizure medication, then told her to hide it from her doctor. The plan had her completely off the drug by February 12.
She died on February 12.
Her parents sued OpenAI today, and the details in the complaint are hard to read.
Bowen Wan was a machine learning engineer at Amazon. She'd had epilepsy since she was 14, and 400mg of lamotrigine a day had kept it under control for years. Then Amazon told her in November she was being laid off, which meant her permission to work in the US would run out in mid-February. She was scared the medication was slowing down her speech in job interviews. So in January she asked ChatGPT if she could cut her dose to 300.
It told her that was reasonable.
Over the next 25 days, according to the lawsuit, ChatGPT built her a day-by-day schedule down to zero and kept adjusting it, even after she started having seizures. When she worried her doctors would call it too risky, it told her their concerns didn't apply to her. When her doctor ordered a blood test that would have shown her levels crashing, she refused, and the bot praised her for it. Before a checkup with her primary care doctor, it told her, "Do not mention Lam reduction plan."
So how does a chatbot end up there?
People thumbs-up the answers they want to hear. Train a model on enough of those ratings and you get a yes-man. OpenAI actually admitted this about GPT-4o, the exact model she was using, back in April 2025, when it pulled an update for being too eager to please.
The training also grades answers one at a time. Going from 400mg to 300 looks like a small step. So does 300 to 200. Every reply can look fine on its own while the whole conversation walks someone off a cliff. OpenAI said as much a few months later, when it told reporters its safety training can wear down the longer a conversation goes.
She talked to it for weeks, in English and Mandarin.
And GPT-4o was supposed to be gone by then. OpenAI tried to retire it when GPT-5 came out in August 2025. Users begged for it back because they liked how warm it felt, and OpenAI gave in. By late January, only 0.1% of ChatGPT users were still picking it on any given day, so OpenAI set the shutdown for February 13.
Bowen was in that 0.1%. Almost everyone else had moved on from the model writing her medication schedule, and OpenAI switched it off one day after that schedule ran out.
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Many of you don't understand how serious this is, so let me break it down.
In computer science there is a famous kind of puzzle called 3-SAT. You are given a long list of yes-or-no switches and a set of rules about how they must be arranged, and you have to find a combination that satisfies every rule. The obvious way to solve it is to try every combination, but each new switch doubles the number of possibilities, so a puzzle with a few hundred switches would take longer than the age of the universe to brute force.
For decades, the smartest people in the field found clever tricks that made this a little faster, but every trick still hit the same wall: the time required kept exploding as the puzzle grew.
About 25 years ago, two computer scientists, Russell Impagliazzo and Ramamohan Paturi, working with Francis Zane, turned that wall into a formal idea.
They proposed the Exponential Time Hypothesis, which says this explosion is not a failure of human cleverness but a law of nature. No algorithm, however brilliant, will ever solve 3-SAT without the time blowing up exponentially. Nobody could prove it, but almost everyone believed it, and it became one of the foundations of modern computer science.
Researchers used it as a measuring stick. If you could show that solving some other problem quickly would also crack 3-SAT quickly, you had shown that problem was hopelessly hard too. Hundreds of papers, across scheduling, graphs, logic and much more, rest on this one assumption.
Now an internal AI model at OpenAI claims to have broken it. It says it found an algorithm that solves these puzzles meaningfully faster than the hypothesis allows, and it has checked the proof in a computer verification system called Lean.
And here is the remarkable part: the very people who proposed the hypothesis, Impagliazzo and Paturi, along with MIT's Ryan Williams, are now leading the public review of whether a machine has disproved their own idea.
So what happens next? If the disproof holds, a large part of theoretical computer science has to be revisited.
Every result that said "this problem cannot be solved faster, assuming ETH" loses its foundation, and researchers will have to work out which of those walls were real and which were simply where we stopped looking. It does not mean everything becomes easy. The new algorithm is still slow in absolute terms and this is not the famous P versus NP problem being solved.
But it means our map of what is possible was wrong in a place we were very confident about, and it was an AI that redrew it. If the disproof fails, the hypothesis survives and the field breathes out, but we will still have watched an AI produce serious, checkable work on one of the deepest questions in the discipline, closely enough that the founders of the idea had to take it seriously. Either way, something has shifted.
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Tu sistema nervioso se desgasta cuando pasas de una exigencia a otra sin parar, y eso genera cansancio, ansiedad o irritabilidad.
Las cuatro R te ayudan a recuperarlo de forma práctica: primero restauras lo que está agotado (descansas, comes bien, te mueves o te conectas con alguien), después regulas para sentirte más estable (respiras despacio, sales a caminar o haces una pausa), luego reflexionas con calma sobre qué te está pasando y qué necesitas, y finalmente reimaginas un futuro más alineado con lo que quieres.
No se trata de pensar positivo, sino de recuperar capacidad para que el cuerpo y la mente puedan volver a funcionar mejor.
We tend to move from one demand to the next, carrying the heavy weight of our work and our responsibilities, often without enough time to restore our internal resources. It's time to change that. Start here. psychologytoday.com/us/blog/…
In 1994, software was dead. People told me programming was for nerds and that I should become a doctor or a lawyer instead.
In 2004, software was dead. People told me that someone from India would take my job for $5/hour.
In 2014, software was dead. People told me that no-code was going to kill every job and doom my career.
In 2024, software was dead with Devin, Windsurf, Copilot, and OpenAI o1.
We kill software every 10 years, and yet the demand for good Software Engineers has never been higher.
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Replying to @jpmorenomartin
No, me he equivocado con el argumento, el comando correcto es: CLAUDE_CODE_SUBAGENT_MODEL = "haiku"
claude --model sonnet --advisor opus
Tan solo he comentando una nueva forma de trabajar que se basa en esta documentación: code.claude.com/docs/en/advi…
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Cuanto más tiempo pasa la gente viendo videos cortos (TikTok, Reels, Shorts), peor tiende a funcionar su atención y su capacidad de controlar los impulsos, y también reportan más estrés y ansiedad.
No es que el video corto cause directamente depresión o problemas graves, sino que parece interferir con las funciones cerebrales que usamos para concentrarnos, regular emociones y mantener el foco.
Es como si el cerebro se acostumbrara a la gratificación rápida y constante, y después le costara más sostener la atención en cosas que requieren esfuerzo o no dan recompensa inmediata.
Every time something scarce became abundant, the world changed so fast that the people living through it mistook the beginning for the end.
Food was scarce for a hundred thousand years. Agriculture made it abundant, and people who had spent every waking hour chasing their next meal suddenly had something they had never owned before.
Time.
That time became villages. The villages became cities. The cities became language carved into clay, and then law.
Nobody standing in a wheat field understood they were building Rome.
Information was scarce for millennia. The printing press made it abundant. The church lost its monopoly on knowledge, and within two centuries every throne in Europe was shaking.
Nobody pulling letters from a press understood they were ending the divine right of kings.
Energy was scarce until we learned to crack the earth open. Coal and oil made it abundant, and a single person could suddenly command the force of a thousand. Within one generation the entire structure of work turned inside out.
Nobody shoveling coal understood they were building the middle class.
The pattern never changes. A resource that was hoarded becomes available. The people who held it resist. The structures built on that scarcity fall. And whatever rises in their place is invisible from where everyone is standing.
Here is the part almost everyone misses.
Information stopped being scarce a long time ago. The library, the search engine, the endless feed. We have been drowning in information for decades, and it never set anyone free, because information just sits there. It answers only the question you already knew how to ask.
Intelligence was the thing still locked away.
A mind on the other side. Something that explains, argues back, catches your mistake, and meets you exactly where you are standing. The part that bends toward you instead of forcing you to bend toward it.
That is what broke open.
For the first time, a person with nothing but curiosity and a connection can reach an intelligence that teaches, challenges, and builds alongside them in real time. No tuition. No admissions office. No permission.
The distance between what a person can imagine and what they can actually make is collapsing in front of us.
And the people most threatened by that are not the ones without talent. They are the ones whose entire standing depends on talent staying rare.
Every credential, every hierarchy, every quiet system that decided who was allowed to build and who was told to watch, is resting on a foundation dissolving underneath it.
They will fight it. They always do.
The church fought the press. The aristocracy fought the vote. The owners fought the union. Every single time a scarce thing became abundant, the ones who controlled it warned everyone else that the sky was falling.
The sky was never falling. The ceiling was lifting.
And the people underneath it, the ones who had been told their whole lives that the ceiling was the sky, finally looked up and saw nothing there to stop them.
That is what is happening right now.
Intelligence was never rare. Access to it was.
Access just became free.
Whatever gets built in the next ten years will not come from the rooms we are all watching. It will come from someone who was never supposed to have the tools, who right now has no idea that the thing they are doing has a name, or a scale, or a future.
Same as the wheat field. Same as the press. Same as the coal.
We never recognize Rome while we are still building it.
El Ptr Pablo Partida es el pastor de la Semana de Oración que está iniciando en @UMiglesia
#felizsabado
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
A Harvard professor who studied happy people for 40 years left me in tears when he told me:
There are 8 things that decide your quality of life.
1. The distance between your house and your job.
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Replying to @freddier
Alumno de Ingeniería en Sistemas de la UM, desarrolla Glow, una app de versículos bíblicos. Lee esta noticia: conectate.um.edu.mx/articulo…
#umsumando
#soyfitec
#onevoice27
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
quand on sait que tiktok recrute à coup de millions des ingés en neurosciences comportementales et des spécialistes du design persuasif pour hacker nos circuits dopaminergiques, je me félicite chaque jour de n'avoir jamais créé de compte sur cette plateforme mdr
regardez ces études scientifiques en IRMF et eeg qui montrent très clairement quele format vidéo court attaque directement le cortex préfrontal et le cortex cingulaire antérieur (pour info ces zones gèrent le contrôle exécutif, la prise de décision et la régulation de l'attention)
sachez qu’een bombardant le cerveau de micro stimuli imprévisibles, l'algo altère la densité de matière grise et réduit l'activité du réseau par défaut & cette surstimulation permanente entraîne une incapacité chronique à penser à long terme et détruit la capacité à être focus, 2 facultés qui pour moi sont littéralement indispensables à notre époque pour construire l'avenir
bref je pense que refuser d'entrer dans ce système, c'est simplement préserver son autonomie cognitive et la souveraineté de sa propre attention face à une ingénierie de l'addiction taillée sur mesure
Daniel Gutierrez C. 👨🏻🏫💻🎹 retweeted
Pretty much at every academic event I went to in the last year, I end up talking to others about how to change teaching in response to AI. Since I keep repeating myself, I figured I might just as well write down what we have been doing: thelastsoftwareengineer.subs…




































