Jack retweeted
So @Ubuntu still hasn't patched this open hole on any Ubuntu server on the public internet that lets anyone take it over
We might just have to switch all our servers over to Debian in this new post-AGI time of rapid cybersecurity hacks which require just as rapid patching
Slowpokes will be left behind
chalmovsky.com/posts/wtf-ubu…
This is why I said you want your VPS ports all closed
Then only let it be accessible inside your Tailscale for SSH and via a Cloudflare Tunnel to receive web traffic
Any Linux box can be taken over with just a single TCP port exposed to the internet now
A stop gap is disabling MPTCP on your VPS now but even better is not having any public ports exposed!
Jack retweeted
Using the right words can drastically improve the results you get from your agents, which is why I built a vocabulary of 244 terms for aiforui.dev.
If a term is used in a lesson, it gets a dotted underline. You can hover to see its definition or click to see a demo.
Jack retweeted
After I posted about failing at Vercel, I got a lot of questions about how I even got the interview.
The recipe is simple:
Create good work, package it nicely, share it with others.
Packaging is the important part. You need to know how to make people care about your work.
Jack retweeted
Maybe important to repost this now that everyone is getting hacked
If you have a VPS, I recommend you to get if off the public internet and into a Tailscale network and Cloudflare Tunnel ASAP
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
There's 2 ways into a VPS:
- via your site/app (like the PHP exploit of this week with a file upload hack)
- via your server (like hacking into SSH or some open port)
The site/app side you put on a Cloudflare Tunnel and then with the default Free Plan it has WAF security enabled by default and they jump on new security exploits fast, it means that the only way to reach your website is via the Cloudflare Tunnel, your server does not respond to port 80 or 443 anymore
The server side you put on a Tailscale network which is like your own private network that nobody can access but your own devices (like your laptop, your phone and your VPS) kinda like a VPN
Then you switch off ANY regular access to your VPS on the firewall, in my case I use Hetzner and you create a new firewall then empty it and that blocks everything (test it)
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound. They make a tunnel to outside which sends and receives
Now you've reduced your attack vector to Tailscale and your Cloudflare Tunnel, much safer, not perfect btw, but nothing is
When I set up a new Hetzner VPS first thing I do install Tailscale and once I'm in via Tailscale lock down the firewall to only accept web traffic on HTTPS 443 for Cloudflare IPs and SSH 22 for Tailscale IP
That way nobody can get in
I know I keep repeating this but it should be basics of setting up a new VPS
So basic IMHO it should be part of any VPS service to default install Tailscale and enable it so it's the only way to get in
Why?
A VPS server is just like your laptop or destop computer but now imagine if it's connected to the entire internet with 8 billion people that can access it and try hack it
You want to only have it accessible to you
And if you want to host a website on your VPS (like I do), you should only let Cloudflare access your VPS so it can stand in front and block any hack attempts
Never expose a VPS to the world wide web which realistically is the world WILD web
Jack retweeted
Every once in a while, some unsuspecting country's domain economy goes vertical 😂
.𝚌𝚘 → Colombia
.𝚒𝚘 → I/O → Island Ocean
.𝚖𝚍 → Markdown → Moldova
.𝚛𝚜 → Rust → Serbia
.𝚊𝚒 → AI → Anguilla
.𝚜𝚒 → SI → Slovenia
This is what you get when you sell out to Pepsi and big food.
Pepsi paid $2bn for Poppi and now says it won't pay the $300m earnout. Everyone's acting surprised.
What happens when a giant buys a challenger brand, with the receipts:
- Honest Tea, Odwalla, Zico: all bought by Coke, all discontinued. Zico's founder bought it back.
- Bai: Dr Pepper paid $1.7bn, wrote most of it down.
- Bodyarmor: Coke paid $5.6bn, took a $760m impairment three years later.
- Rockstar: Pepsi paid $3.85bn, has lost share every year since.
- Freshly: Nestlé paid $1.5bn, shut it within three years.
- Dollar Shave Club: Unilever paid $1bn, sold it for a fraction seven years later.
- Bonobos: Walmart paid $310m, sold for $75m.
- Mirror: Lululemon paid $500m, wrote it off and shut it.
- Ballast Point: Constellation paid $1bn, sold for pocket change four years on.
- Reebok: Adidas paid $3.8bn, sold for $2.5bn fifteen years later.
- Snapple: Quaker paid $1.7bn in 1994, sold for $300m in 1997. The original.
The pattern isn't bad luck. The brand was bought to protect the original and core portfolio, not to grow. Once it's off the market, the job is done.
If you ever sell to one of these: the cash on day one is the price. Everything else is a promise from someone who is incentivized is not to keep it.
Jack retweeted
When you sell your business, never ever agree on an earn out
Always get it in cash!
I know lots of horror stories of earn outs and have always rejected them
Poppi's founders just learned the most expensive lesson in M&A!
When they sold to PepsiCo, the deal was for $1.9B plus a $300M earnout (a future contingent payment based on the performance of the brand for some period after closing).
And PepsiCo just announced that it is valuing that $300M at a “paltry” $12M.
That stings!
I've negotiated a lot of earnouts in my career. Here's what most sellers don't understand until it's too late:
1. An earnout is a future bet on a business you no longer control.
After closing, the buyer sets budget, pricing, hiring, marketing, etc. Every lever behind whether or not you get your earnout belongs to someone else.
2. The incentives can flip the day you close if you’re not careful.
As a seller, you want to do everything to hit the targets. But as the buyer, you pay less if they're missed.
Ideally, the earnout is structured so that both parties win or lose together.
If performance tanks, the buyer earns less overall so it pays less to the seller.
If performance improves, the buyer earns more so it pays more to the seller.
Incentives are aligned.
What you absolutely cannot allow to happen is an earnout structured so that performance can improve allowing the buyer to earn more, but still pay less to the seller.
How on earth could that happen?
I'm so glad you asked...
3. The accounting decides the outcome.
How you define "revenue", "EBITDA" or any other measurement metric used to determine the earnout is what ultimately drives the payout.
So things like how corporate overhead gets allocated or what happens when the Seller’s product is folded into a larger brand with competing products becomes unbelievably important.
Again, remember the incentives.
With a poorly structured earnout, a company like PepsiCo could be incentivized to buy a brand like Poppi and purposely underinvest in the brand in order to eliminate a key competitor to its other products.
So PepsiCo could earn more by driving more revenue to products other than Poppi, while simultaneously reducing the earnout payable to Poppi because Poppi's direct performance declines.
PepsiCo wins -> Poppi loses.
Sellers have to be very careful about how the accounting for the earnout is defined and whether it causes misaligned incentives.
4. The reasons above are why earnouts are among the most litigated terms in M&A.
Sellers often sue buyers claiming the buyer sandbagged performance. And Buyers defend by saying “The contract gave us full discretion."
Courts will generally enforce whatever terms the parties agreed to in writing, so an argument that Buyer acted in “bad faith" rarely saves a seller who didn't negotiate adequate protections.
5. If you agree to an earnout, protect it at all costs!
> Tie it to metrics like revenue, which are subject to less manipulation than metrics like Adjusted EBITDA.
> Include strict operating covenants around things like required budget, sales support, and no diverting customers to other products or business lines.
> Push for audit rights and a dispute mechanism.
> Demand acceleration of the earnout if the buyer or product line is sold, merged, shut down, or deprioritized.
> Keep the measurement period short! The longer the period, the more opportunity it gives a Buyer to game the system.
To be transparent, I don’t have any background into what happened here. I have no idea if the earnout was poorly structured or if PepsiCo acted in a way to purposely reduce the earnout.
That's not the point of this post.
What I do know is that a $300M earnout that is written down to $12M is a tale as old as time and almost certainly to end up in litigation.
And even if not the case in this particular instance, in most cases where this happens, there's often things that could have been done in the transaction documents to avoid it.
My advice to every seller I represent who is considering agreeing to an earnout is simple:
Value the deal based on cash at close and treat the earnout as a bonus. If you get it, great. But don’t count on it!
Time to build a cybersecurity branch of my company.
We have released a free open source tool 'Zero Breach' - that can identify whether a recent Israeli spyware campaign left traces on your PC - the one Citizen Lab exposed, where Israeli ad-tech was used to infect journalists through 'no-click' ordinary ads.
It needs Python installed (python.org — tick "Add python.exe to PATH" during setup). Then open PowerShell in the folder where you saved it and run:
python -X utf8 zero-breach.py
It takes about 15 minutes. It only reads - it changes nothing, needs no admin, and never connects to the internet. It checks for 338 indicators and tells you if one of your browsers interacted with one of the infected ads in the past. (It also checks for Candiru infection)
Download it here: github.com/interplains/zero-…
You can also check whether your browser or device already blocks these kinds of ads, without downloading anything, here:
archivegenocide.com/scan/
You are looking for a green result ✅ - if not, fix your browser settings, install an ad blocker / DNS resolver.
For phones: Tens of thousands of apps show these ads, so we suggest you set up a DNS resolver (NextDNS, AdGuard, or a router/Pi-hole blocklist) so your phone blocks all of them automatically.
We also publish ready-made blocklists you can subscribe to as well. Use them.
Pease report any issues in our telegram linked in bio
God bless.
Very good time to learn more about security, as spyware and hacking abilities are growing at an exponential rate.
Jack retweeted
Last night, a swarm of Opus 5.5 agents working for 9 hours and burning 254.2 million output tokens were able to fully reverse engineer and decompile the Linux source code
Full source archive available here kernel.org
Grab it before they take it down
Jack retweeted
My mind is blown by how far ahead Apple is with local LLMs. The new Mac Studio M5 Ultra will have a 512 GB model for around 15-20k. You can chain 6 of them together using thunderbolt 5 and this have over 3 TB of ram and a massive amount of CPU and GPU cores. This means you can run a frontier model with over 2 trillion parameters locally for around 100kish. Nivida is around 500k for the same capability.
Jack retweeted
Higgsfield promised to open-source their entire platform. They didn’t.
Let's help them.
For the next two weeks, Comfy and our partners are putting up $25,000 in prizes for the best open-source builds on the Comfy Developer Platform.
Partners: @NVIDIAAI, @runpod, @MiniMax_AI, @ltx_io, @bfl_ai
→ $10K grand prize
→ RTX 5090: Most Innovative
→ RTX 5090: Most Viral
→ RTX 5090: Open Weights Only
→ 10 runners-up: $250 in Comfy credits
Jack retweeted
Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel.
- Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all.
- Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract.
- Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code.
- And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while.
The funnel is driven by a combination of factors:
1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel.
2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel.
3. Access. Free-tier, paid-tier, internal.
So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.
Judging by my tl there is a growing gap in understanding of AI capability.
The first issue I think is around recency and tier of use. I think a lot of people tried the free tier of ChatGPT somewhere last year and allowed it to inform their views on AI a little too much. This is a group of reactions laughing at various quirks of the models, hallucinations, etc. Yes I also saw the viral videos of OpenAI's Advanced Voice mode fumbling simple queries like "should I drive or walk to the carwash". The thing is that these free and old/deprecated models don't reflect the capability in the latest round of state of the art agentic models of this year, especially OpenAI Codex and Claude Code.
But that brings me to the second issue. Even if people paid $200/month to use the state of the art models, a lot of the capabilities are relatively "peaky" in highly technical areas. Typical queries around search, writing, advice, etc. are *not* the domain that has made the most noticeable and dramatic strides in capability. Partly, this is due to the technical details of reinforcement learning and its use of verifiable rewards. But partly, it's also because these use cases are not sufficiently prioritized by the companies in their hillclimbing because they don't lead to as much $$$ value. The goldmines are elsewhere, and the focus comes along.
So that brings me to the second group of people, who *both* 1) pay for and use the state of the art frontier agentic models (OpenAI Codex / Claude Code) and 2) do so professionally in technical domains like programming, math and research. This group of people is subject to the highest amount of "AI Psychosis" because the recent improvements in these domains as of this year have been nothing short of staggering. When you hand a computer terminal to one of these models, you can now watch them melt programming problems that you'd normally expect to take days/weeks of work. It's this second group of people that assigns a much greater gravity to the capabilities, their slope, and various cyber-related repercussions.
TLDR the people in these two groups are speaking past each other. It really is simultaneously the case that OpenAI's free and I think slightly orphaned (?) "Advanced Voice Mode" will fumble the dumbest questions in your Instagram's reels and *at the same time*, OpenAI's highest-tier and paid Codex model will go off for 1 hour to coherently restructure an entire code base, or find and exploit vulnerabilities in computer systems. This part really works and has made dramatic strides because 2 properties: 1) these domains offer explicit reward functions that are verifiable meaning they are easily amenable to reinforcement learning training (e.g. unit tests passed yes or no, in contrast to writing, which is much harder to explicitly judge), but also 2) they are a lot more valuable in b2b settings, meaning that the biggest fraction of the team is focused on improving them. So here we are.