Co-founder and CPTO at Punto (https://xitter.cf/t.co/CKbn4w162W). Teaching product at Escuela Escribano. Previously: Founder and CPO at Ontruck and Touristeye.

Madrid, Spain
Joined November 2007
Mucha AI, pero gana hacer esta manualidad con mi hija. Guiarla, observarla, enseñarla y luego disfrutar de cómo lo enseña a los abuelos y la clase :) Ahora con la AI es muy fácil encontrar ideas adaptadas para cada edad y temática.
1
227
Javier Escribano retweeted
Many of you don't understand how serious this is, so let me break it down. In computer science there is a famous kind of puzzle called 3-SAT. You are given a long list of yes-or-no switches and a set of rules about how they must be arranged, and you have to find a combination that satisfies every rule. The obvious way to solve it is to try every combination, but each new switch doubles the number of possibilities, so a puzzle with a few hundred switches would take longer than the age of the universe to brute force. For decades, the smartest people in the field found clever tricks that made this a little faster, but every trick still hit the same wall: the time required kept exploding as the puzzle grew. About 25 years ago, two computer scientists, Russell Impagliazzo and Ramamohan Paturi, working with Francis Zane, turned that wall into a formal idea. They proposed the Exponential Time Hypothesis, which says this explosion is not a failure of human cleverness but a law of nature. No algorithm, however brilliant, will ever solve 3-SAT without the time blowing up exponentially. Nobody could prove it, but almost everyone believed it, and it became one of the foundations of modern computer science. Researchers used it as a measuring stick. If you could show that solving some other problem quickly would also crack 3-SAT quickly, you had shown that problem was hopelessly hard too. Hundreds of papers, across scheduling, graphs, logic and much more, rest on this one assumption. Now an internal AI model at OpenAI claims to have broken it. It says it found an algorithm that solves these puzzles meaningfully faster than the hypothesis allows, and it has checked the proof in a computer verification system called Lean. And here is the remarkable part: the very people who proposed the hypothesis, Impagliazzo and Paturi, along with MIT's Ryan Williams, are now leading the public review of whether a machine has disproved their own idea. So what happens next? If the disproof holds, a large part of theoretical computer science has to be revisited. Every result that said "this problem cannot be solved faster, assuming ETH" loses its foundation, and researchers will have to work out which of those walls were real and which were simply where we stopped looking. It does not mean everything becomes easy. The new algorithm is still slow in absolute terms and this is not the famous P versus NP problem being solved. But it means our map of what is possible was wrong in a place we were very confident about, and it was an AI that redrew it. If the disproof fails, the hypothesis survives and the field breathes out, but we will still have watched an AI produce serious, checkable work on one of the deepest questions in the discipline, closely enough that the founders of the idea had to take it seriously. Either way, something has shifted.
An internal model at OpenAI has produced a claimed refutation of ETH! Russell Impagliazzo, Mohan Paturi, and I have been asked to help organize an open and independent examination of this claim. 1/4
260
1,164
158
12,571
984,640
Javier Escribano retweeted
OpenAI just dropped four huge results from its secret internal AI model. 1. Math: It solved the Kakeya conjecture in every dimension. Mathematicians had only cracked small pieces before (2D in 2019, 3D in 2025). 2. Computer science: It proved the Exponential Time Hypothesis is false. Hundreds of research papers assumed it was true. Some really hard problems might be solvable much faster than thought. 3. Physics: It proved the theory of the strong force (QCD)—the force holding atoms' insides together—actually works mathematically. Same for a unified version of the Standard Model. 4. Yang–Mills: Along the way, it proved Yang–Mills existence, part of a $1 million Millennium Prize problem. The math, computer science, and Yang–Mills proofs were all computer double-checked. Top experts are now reviewing everything, including the researchers who proposed the disproved hypothesis and a Nobel Prize winner. OpenAI says it doesn't want academic credit. The model still isn't public 👀
94
356
57
4,104
338,263
Muy necesario volver en parte al respeto que había antes. Es increíble que aún siendo urgente, no se pueda aplicar hasta septiembre del año que viene. La lentitud en cambiar las leyes es un tema a revisar.
👩‍🏫 La @ComunidadMadrid dará más capacidad a los docentes para actuar de manera inmediata ante faltas de respeto o problemas de convivencia en las aulas 👨‍🏫Eliminará los trámites burocráticos que retrasan y dificultan la adopción de medidas disciplinarias c.madrid/c76pm
4
931
Javier Escribano retweeted
10500 expedientes en el consulado de Buenos Aires. provincia gobernada por Kicillof, amigo muy amigo de Pedro Sánchez. de 10500, cero reunían los requisitos. CERO. LES HEMOS REGALADO LA NACIONALIDAD POR LA CARA BONITA
De 10500 expedientes en el consulado de Buenos Aires de nacionalizados por la Ley de Nietos, 0 cumplían los requisitos. Cero. Está gente que ha intentando montar una estafa electoral a gran escala solo puede acabar en la cárcel. La primera de ellos, Gutancita, que fue la mano ejecutora del pucherazo.
89
2,919
45
5,099
35,111
Javier Escribano retweeted
Any form of security through obscurity is fully over. This barely worked as a method with humans, but just simply is over in a world of autonomous systems that will look through every crevice and try every permutation of attack possible. As a result, years and years of legacy enterprise infrastructure will need to be upgraded, security practices modernized, data pipelines cleaned up, access controls better managed, and much more. Agents will help on the defensive side because they can both accelerate this work and equally simulate the risk vectors. But there’s a long road ahead to prepare for this future. This is also partially why diffusion timelines will take longer than some realize.
a lot of old software was protected by “exploiting this would be an unreasonable amount of work” we have invented a machine that does unreasonable amounts of work anyway how’s the patch backlog
111
58
14
622
77,894
Javier Escribano retweeted
I suspect the real reason eMudhra is exiting the SSL business is Google indicated it is most likely going to drop eMudhra from being trusted by Chrome AT ALL, after observing inexplicable incompetence in how they mis-generated their private key for the CA certificate.
BREAKING: eMudhra exits SSL/TLS certificate business, blames social media instead of incompetence for the same
111
528
31
7,385
251,017
Javier Escribano retweeted
If you wanted to know all the jobs that AI will produce, look no further than cybersecurity. This is going to become one of the biggest investment areas for enterprises going forward. And even as the work becomes more agentic and autonomous you will need more talent to point the agents at the most critical work, review findings, patch systems, respond to incidents, and more. Lots of opportunity right now for the systems that protect data and enterprises, as well as the professionals that are deploying them and protecting organizations. It’s going to only get more wild out there.
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
138
99
40
1,049
187,669
Javier Escribano retweeted
Trump: I called Google Maps to change the name of the Atlantic Ocean to Trump Ocean. Sundar said, “No, no, no. This time I'm not doing it.” He said, “Oceans are different, sir. They cover a lot of countries. Please don't ask us to do that.” So we'll probably pass. Let's keep it the Atlantic Ocean.
634
1,205
622
16,894
3,635,989
Javier Escribano retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
289
3,275
673
22,653
2,267,616
Javier Escribano retweeted
La primera ministra de Japón está advirtiendo de la severidad de las vulnerabilidades críticas de ciberseguridad anunciadas hoy. Está pidiendo a todo país que actualice urgentemente o desconecte los sistemas afectados. Mientras tanto, el ministro español de Transformación Digital está hablando de Feijóo, Ayuso y Milei. Y casi que mejor, porque seguramente no tiene ni la menor idea de lo que está pasando.
皆様に、今夜に対応して頂きたい大至急のお願いです。   多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な2件の脆弱性に関する注意喚起を行っています。   公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時(日本時間)に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。   修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。   国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。 国家サイバー統括室(注意・警戒情報)(@cyber_forecast) / X
40
1,017
23
2,850
143,373
Javier Escribano retweeted
Hasta que no haya una SOLUCIÓN real a la vulnerabilidad #php2shell, muchos tendrán que literalmente apagar sus sitios web. Lo que veremos hoy es el equivalente a lanzar una bomba nuclear sobre el ecosistema web. Los que todavía corran PHP legacy se la van a ver fea, bien fea. NOTA: la mayoría de sitios gubernamentales a lo largo del planeta son los más vulnerables ahora.
‼️ PHP UPDATE: The Dutch parliament, the Dutch national cyber agency and Finland's central government have pulled websites offline ahead of the PHP patch. Finland's state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down. In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments. The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland's Haaga-Helia have taken services down too. Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well. Valtori says its shutdown is a precaution, not the result of an attack or breach. PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page PHP's fix is due at 14:00 UTC today.
9
54
2
190
27,989
Ya tenemos entretenimiento para los próximos findes
HOW TO GET CLAUDE CODE TO "VIBEHACK" ANY SMART DEVICE IN YOUR HOUSE (its actually much easier than i thought): 1. open Claude Code on a laptop that's on your home wifi 2. ask it to "scan my network, list every device with its make and model, and tell me all the possibilities of what you could fix, edit, or control on each one" 3. pick one and let it cook (it'll ask you if it needs you to press a button or plug something in) for example...one guy added AirPlay to their 15-year-old TV. another turned an old Kindle into a family dashboard with the day's schedule and incoming deliveries. another got their washer and dryer to announce out loud when the laundry's done. there's way more possible than you'd think, so let Claude show you what your own stuff can do. just run it on your own network, and read the commands before you approve them.
3
539
Javier Escribano retweeted
Tengo una entrada para la @tarugoconf . Me gustaría regalarla a algún estudiante o alguien esté en el paro y no se lo pueda permitir. Que nunca haya ido. Pero que vaya a ir. Sé que es muy justo. Es este jueves/viernes. Es un evento muy especial y ya que puedo acudir me gustaría
7
53
3
49
14,132
Javier Escribano retweeted
¡Hola, Region of Madrid! 🇪🇸 We’re thrilled to announce that we’re coming to Spain, beginning with Madrid. This will be our first region in Spain and second in the European Union. We plan to launch fully autonomous ride-hailing in Madrid in 2027. Sign up for future updates: waymo.com/waymo-in-spain ¡Hola, Comunidad de Madrid! 🇪🇸 Nos emociona anunciar que llegamos a España, empezando por Madrid. Esta será nuestra primera región en España y la segunda en la Unión Europea. Planeamos lanzar nuestro servicio de ride-hailing totalmente autónomo en la Comunidad en 2027.
123
403
382
3,047
701,045
Me gustaría hablar con funcionarios que trabajan en áreas técnicas. Quiero entender la realidad interna. Desde @wearepunto estamos teniendo cada vez más relación, tanto por las diversas integraciones como por posibles oportunidades de aportar valor al estado.
3
1
5
1,110
Automatizamos trámites de diversos Ministerios, AEAT, comunidades autónomas, diputaciones, municipios y de otros organismos como puede ser DGT o IDAE. Me interesa entender su realidad actual, y si puedo aportar ideas, bienvenido sea. ¿Conocéis a alguien?
1
2
239
Javier Escribano retweeted
Anthropic gave me $30,000 in Claude credits to research my own tumor I wrote what I built since March. I’m looking for someone who can manufacture a personalized vaccine, and a hospital that can give it
121
967
74
3,432
185,618
La solución es echar al alumno de la clase y que los padres se busquen la vida.
Antes a nadie se le ocurría romper un parte delante del profesor, o llevarle la contraria o mandarlo al carajo. Eso ahora pasa DIARIAMENTE. Con el respeto y la autoridad de antes también doy yo clase a 30 alumnos.
6
948
Javier Escribano retweeted
Las pensiones son el auténtico elefante en la habitación. El agujero de la SS alcanzó en 2025 la cifra histórica de €116.000M (8%+ vs 2024) Para haceros una idea, ese agujero (que se tiene que tapar con transferencias del Estado) es 10 veces superior al presupuesto de vivienda del Estado (y luego alguno se pregunta por qué no hay vivienda pública) y prácticamente igual al presupuesto de educación (y luego alguno se pregunta por qué PISA nos pinta la cara). El sacrificio (vía incremento de impuestos sobre sus nóminas) que tienen (y van a tener) que hacer los jóvenes de hoy para cobrar unas pensiones de mañana (que van a ser muy inferiores a las de los jubilados actuales) es (y va a ser) brutal. Porque si el Gobierno (actual o futuro) no solo no se atreve a tocar un solo euro de la partida de gasto (pensiones), sino que va a seguir incrementándolo (revalorización con IPC), el ritmo de crecimiento del agujero sólo se ralentizará a base de incrementar la partida de ingresos (las cotizaciones = impuestos sobre las nóminas de los trabajadores). Y hay que empezar a decir las cosas por su nombre: el jubilado actual que no reconoce que hay que reformar el sistema sólo está pensando en su interés personal y es insolidario con las generaciones futuras. Por mucho que haya cotizado (como también cotizan y cotizarán los jóvenes actuales, para acabar recibiendo un trato muy distinto). Algunos dicen incluso que son socialistas, que, según se dice, es “tener muy poco y estar dispuesto a dar mucho”. Pero, como nos ha demostrado la experiencia, cuando llega el momento de “dar”, ningún socialista es un ser de luz y todos acaban pensando exclusivamente en su bolsillo.
29
134
19
283
10,131