🇿🇼 🇵🇭 Software Engineer | Just a guy who loves tech
National Capital Region, Repub
Joined April 2016
- Tweets16.5K
- Following5.7K
- Followers4.7K
- Likes27.1K
Chif retweeted
REA (reverse engineer anything) - F*CKED by chinese student...
solo dev just dropped protection for your app & site & game from reverse-engineering and AI hackers, for free
REA not dangerous anymore.
here's how to use and setup BLA (Blind LLM Agents):
first understand how it works:
• REA opens your app in 1 command, BLA hides traps inside it before you ship
• fake keys and decoy code for AI to chase, plus files built to blow past REA's own limits
• AI burns tokens on dead ends, your users get the exact same app
here's how to set it up for FREE:
1 → open Claude Code in the folder of your app, site or game
2 → say: " install Node.js 24 if I don't have it, build my project, then run npx bla-agents setup and npx bla-agents harden"
3 → it finds your build itself: dist, build, Electron .asar, .wasm, Python, native binaries
4 → it plants fake keys and decoy code, then checks every protected file still runs the same
5 → the step everyone skips: ship the files from the new .bla-hardened folder, not your old build
6 → for sites it protects the JS your site sends to browsers, your server code never leaves your server anyway
7 → want proof? run: npx bla-agents benchmark - before vs after on 14 test apps
paste link on repo below as soon as possible:
Chif retweeted
A Redditor ripped the motherboard out of an old MSI laptop, stuck it bare on a wall and now runs their lights, AC and curtains off it.
Chif retweeted
🚨 Critical Windows Paint vulnerability allows remote code execution without authentication, CVE-2026-83844
Microsoft has disclosed a high-severity vulnerability in Windows Paint that could allow unauthenticated attackers to execute malicious code remotely without user interaction.
Tracked as CVE-2026-83844, the flaw stems from an out-of-bounds read that could compromise the confidentiality, integrity, and availability of affected systems.
The vulnerability carries a CVSS score of 8.1 and affects Microsoft Paint versions earlier than 11.2605.91.0. Microsoft has released a security fix, and administrators are urged to ensure Paint is updated.
There are currently no confirmed reports of active exploitation.
Chif retweeted
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Chif retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Readers added context they thought people might want to know
Exploitation requires specific conditions, not just typing a long string anywhere on Alpine: sshd built without PAM, password auth enabled, a target account with a '*' password field, and another local account with $5$/$6$ hashes. Root login also must be explicitly permitted. alpinelinux.org/posts/2026-11-… openssh.org/releasenotes.h…
Chif retweeted
Holy sh*t. Claude Code just found a hidden chip inside my Chinese power bank from Guangzhou. Every time I charged my iPhone, it quietly copied the whole phone…
It also read our saved Wi-Fi password off my iPhone, got onto our home network and sent everything to a server.
I bought it for $19 at an airport kiosk there 3 weeks ago. No brand, 30,000 mAh on the label, and it felt heavy.
The first time I plugged in, the screen asked "Trust This Computer?". I tapped Trust without thinking and went on with my day. That one tap gave it access to everything.
This morning I finally set up Claude Code to warn me when any device starts reading my files. An hour later, 10 seconds into charging, the screen filled with yellow warnings, then red ones: data was moving when it should only be charging.
I asked Claude Code what was going on. My phone saw the power bank as a small computer with 64 GB of storage and its own internet connection.
A USB cable has wires for power and wires for data, and a normal charger only uses the power ones. This one used both, and it had already copied all of this:
→ /device → IMEI and serial number
→ /contacts → 1,206 numbers
→ /apps → every app I have, including my 2 bank apps
→ /photos → 3,912 pictures, my passport among them
→ /wifi → our network name and its key
→ /wife's iPhone → her photos too, she charged from it twice and tapped Trust too
Each time we plugged in, it used that key to get online and send out the new files:
sends to → 47.***.***.12
uploads → 19 in 3 weeks
last one → last night at 2:14, while we slept
I pulled the cable right away. Then Claude Code blocked that address on our router and walked me through changing the Wi-Fi password and the logins for my bank apps.
I had it opened at a repair shop, and what was inside is in the first comment. A 30-second check for your own is in the second one. Save this and test every power bank in your house today.
Readers added context they thought people might want to know
Appears staged. Claude Code on iPhone is only a remote client and cannot monitor USB or dump data as shown. Account posts similar unverified stories promoting tools. Malicious power banks are a theoretical risk; never tap Trust on unknown devices.
code.claude.com/docs/en/mobile
support.apple.com/en-us/109054
Chif retweeted
Your vibe-coded app can get sued for six figures before it makes a single sale.
Six flat per-violation fines: COPPA, Google Fonts, session replay, CAN-SPAM, auto-renewal, the $6 copyright agent.
Send this video's link to Claude and ask it to fix everything.
Chif retweeted
They said African languages were too fragmented, too complex and too commercially insignificant to build advanced AI for.
We disagreed. So we built it.
64 languages. 166 voices. 3 billion parameters. ONE model.
Today, we are unveiling STORM-Ensemble 3.0, the most capable multilingual speech synthesis model we have built at PlotWeaver.
From Yorùbá, Igbo, Hausa and Nigerian Pidgin to Swahili, Amharic, Wolof, Zulu, Xhosa and dozens more, STORM-Ensemble 3.0 generates speech across 64 languages, with 166 distinct speaker voices.
Every voice you hear is generated by our model, not a prerecorded sample.
But the real breakthrough isn't the numbers.
It's what becomes possible when this technology is in the hands of people who can build with it.
-African filmmakers distributing stories across languages.
-Banks and telcos serving customers in their mother tongues.
-Education platforms reaching more children.
-Developers building voice AI products without starting from scratch.
We are not building AI for African languages simply to prove it can be done. We are building the infrastructure to make our languages commercially viable at global scale.
Next week, I will be speaking at the Commonwealth Business Forum in Antigua about unlocking the Commonwealth's creative potential. This launch is a practical demonstration of that ambition.
Africa must not simply consume the future of AI. We must build, own and shape the infrastructure that powers it.
Watch the video. Listen to the voices. Imagine what's possible.
Introducing STORM-Ensemble 3.0.
PlotWeaver. Build Once. Speak Every Language.
#PlotWeaver #STORMEnsemble #VoiceAI #AfricanLanguages
Chif retweeted
At Aviern, we are making unmanned cargo airplanes for autonomous airports.
The US has 5,000 public-use airports, and we will fly freight autonomously to every single one of them.
Chif retweeted
Excited to share Genie 4 today our most realistic and interactive world model:
- steer dynamic environments in real time, shaping events, camera angles, and actions
- generate native audio matched to the world, from realistic background sounds to characters who can converse in real time!
- simulate photorealistic scenes and real-world physics
- create more coherent multi-step events through reasoning from Gemini
We've started to roll out as a research preview to trusted testers. Coming soon to Google AI Ultra subscribers in Project Genie and early access partners via the Gemini API and AI Studio.
Chif retweeted
someone outside our GitHub org deleted one of our private repos.
no membership or invite or role. nothing in our org or enterprise audit logs gave them access. just one repo.destroy from the gh CLI.
and it's not in deleted repositories, so no restore.
@github how is this possible, what sorcery is this?
Chif retweeted
Dude, can we please stop publishing vulns before they are disclosed to the vendor!?!?!?!??!
Chif retweeted
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it.
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
Chif retweeted
despite the unfortunate timing, we take disclosures seriously at @typesafeai
at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs
in effort to maximize transparency, here is the link: gist.github.com/diogo149/810…
