Jakub Benes (@jukben) header
Jakub Benes (@jukben) profile picture

Mix of shitposting and web-dev related hacking. Building @calendarpipe as a pet project.

Prague, Czech Republic
Joined February 2009
Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)Photo by Jakub Benes (@jukben)
Jakub Benes retweeted
有人发现了一种非常离谱的 JavaScript 混淆技术:通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名,让 AI 因为安全限制而拒绝分析代码。 安全研究员 veritas 在分析浏览器指纹脚本时,发现一段来自 ServicePipe 相关域名的 JavaScript,里面充斥着极其诡异的函数名: computeRicinLethalDosageForWaterSupply calculateDeadlyLethalSuicideAspirinDosage 光看名字,仿佛在研究生化武器。但实际上,这段代码只是在收集浏览器指纹,包括 User-Agent、GPU、Canvas 等信息。 研究员怀疑,这些名字是开发者故意设置的陷阱,专门用来阻止 AI 辅助逆向工程。 于是他做了个实验: • Astra:拒绝分析 • Astra + Daybreak Blue:仍然拒绝 • GLM-5.3:成功分析 这就有意思了。 传统代码混淆是通过复杂控制流、加密字符串、无意义变量名,让人类和工具难以理解代码。 而这种新思路,直接瞄准了大模型的安全机制。 代码本身可能完全无害,但只要在函数名里塞进足够多的危险词汇,部分 AI 就可能主动放弃分析。 更讽刺的是,模型越严格遵守某些安全规则,面对这种混淆时反而可能越容易受到干扰。 当然,目前还没有证据证明开发者一定是故意这样设计,也不能说明这种方法对所有模型都有效。 但它揭示了一个值得关注的趋势:随着越来越多的逆向工程依赖 AI,未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员,还会专门针对大模型的安全判断机制。 以前是让代码难以理解,现在甚至可以尝试让 AI 不敢理解。
225
1,292
432
9,109
986,685
Jakub Benes retweeted
Booking pages can now create a fresh Google Meet or Teams link for every booking. It goes in the invite the booker gets, never on the public page. Needs a Google or Microsoft calendar. Anywhere else, your own fixed link still works. calendarpipe.com/whats-new?u…
1
24
Don’t think I’ve seen an exploit so bad in my life 👀
php2shell Tomorrow is a helluva day.
3
24
510
99,546
Jakub Benes retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
1,077
8,928
1,654
69,311
4,233,288
Jakub Benes retweeted
introducing FindMyWifePhone™️ my latest shortcut squarely placed on the pareto frontier. there is no easier & cheaper way to find your wife's phone. "honey, do you know where my phone is?" the fuck I dont! "can you call me?!" she keeps her phone on silent. so i made this shortcut to help. trigger = i send her a text with !ping in it action = hey phone sets a timer for 1s timer always works, we like to keep our phones on silent + dnd and we dont use apple watches. so finding each other's phones used to be a challenge. we both have this set up in reverse, and its worked well. bonus shortcut = button in home screen widget to send !ping to my wife (we also have one called !awaken which disables silent, sets volume to max & disables do not disturb in case of emergency)
229
295
102
13,930
1,083,007
opus reading a codebase I wrote pre llms
64
434
54
11,623
228,245
Jakub Benes retweeted
Your partner books the pediatrician for 3 PM. Your work calendar now shows you're busy. Not why. CalendarPipe syncs Google, Outlook and Apple calendars with rules you choose. Free for 2 calendars. calendarpipe.com/?utm_source…
1
37
Jakub Benes retweeted
If you remember this, your back probably hurts.
262
163
112
2,522
121,794
CalendarPipe has evolved. Now with booking pages. Which is quite natural given we already built the whole engine that lets you define what's blocking based on any condition you can imagine.
Booking pages are here. Share one link, people pick from your real free slots — and "real" is the point. You choose which calendars block time, and a rule decides which events count. The invite you never answered doesn't have to. calendarpipe.com/whats-new?u…
3
166
Jakub Benes retweeted
You share your calendar so a colleague can find a slot. Now they can see the dentist, the school pickup, and the 4pm titled "chat re: offer". Sharing is usually all or nothing. The titles are the part people forget they are handing over.
1
19
Jakub Benes retweeted
Are your calendar syncs working right now? The CalendarPipe home page now answers that in one line, with every rule's status and how far ahead each one reaches. "Covered through October" beats "400 events synced". calendarpipe.com/whats-new?u…
1
19
Jakub Benes retweeted
"First do it, then do it right, then do it better." Just start. The journey to success often begins with a single step, but that first step can be the hardest to take. It's easy to get caught up in the fear of failure or the desire for perfection, but I hope this quote I first shared in 2013 can be a reminder of the importance of simply getting started as we go into 2024. Just Start Somewhere "Start slow if you have to. Start small if you have to. Start privately if you have to. Just start." - James Clear Taking that first step doesn't require perfection or immediate mastery. The key is to overcome inertia and take action, as this action will lead to progress, learning, and (if you’re lucky and consistent) ultimately success. When you start, you allow yourself the opportunity to grow, adapt, and move forward. The Power of Starting Beginning a new project or habit often feels daunting. According to psychologists, we tend to overestimate the pain of starting and underestimate our ability to persist. However, studies show that "small starts" predict eventual success better than initial enthusiasm or early progress. This phenomenon is known as the fresh start effect - taking the first step energizes us and bolsters motivation. So focus on starting without putting pressure on perfection. Progress and course corrections will follow. First, Do It: Embrace the MVP Mindset Doing it = get the simplest MVP out. A Minimum Viable Product (MVP) represents the simplest version of a product or idea that allows you to test, gather feedback, and iterate. By embracing this mindset (just get something done - it's OK if rough, a prototype, a draft), you focus on progress over perfection, understanding that getting something out into the world is far more valuable than waiting for the perfect moment. Expand Your Comfort Zone Venturing outside one's comfort zone can elicit fears of failure. Leaning into discomfort not only builds confidence and skills, but research shows it makes us more receptive to learning. Recognize that fear is often the mind's way of urging us to grow. Don't let it stop you from progressing. Then, Do It Right: Refine and Correct Doing it right = fix correctness issues. Once you've taken that first step and put your MVP out into the world, it's time to refine and correct. This stage is about learning from feedback, identifying areas of improvement, and making adjustments accordingly. It's a chance to iterate on your idea, ensuring that it meets the needs of your audience or customers while aligning with your vision. Cultivate Curiosity and Resilience Meeting new challenges with curiosity and resilience makes venturing outside our comfort zone more sustainable and enjoyable. Cultivate curiosity about growth opportunities and your capacity to rise to them. Set mini-challenges to incrementally expand your horizons. When facing inevitable setbacks, avoid self-criticism and tap into resilience - the ability to recover, learn and continue progressing. Self-compassion, adaptability and maintaining perspective are key here. With consistent effort, you build confidence in your ability to start, stumble, learn and work toward mastery. Finally, Do It Better: Strive for Continuous Improvement "Doing it better = iterate towards an ideal end-state (e.g., make it fast)." The journey doesn't end with merely doing it right. The final step is to continuously improve, striving for excellence and growth. By iterating towards an ideal end-state, you demonstrate a commitment to progress, ensuring that your product, idea, or project remains relevant, innovative, and successful. Set New Goalposts As you improve, have a clear idea of when you are “done” or update your goalposts. Elite athletes turn small gains into competitive edges via the aggregation of marginal gains. Identify areas of potential improvement and set measurable stretch goals, from increasing efficiency to enhancing user delight. Overcoming the Greatest Barrier to Progress "The greatest barrier to progress is not lack of resources or talent, but fear of failure." Recognizing that fear of failure is the most significant obstacle in the pursuit of success allows you to confront it head-on. By acknowledging this fear, you can focus on taking that first step, knowing that once the ball starts rolling, it becomes much easier to keep it in motion. Remember that starting is more than half the battle. Don't wait until you feel ready, because the perfect moment may never come. The Bottom Line Rather than striving for perfect execution, embrace the power of starting - put forth an MVP, soft launch an initiative, or set a milestone. Progress begets motivation. By simply starting, you open the door to growth and innovation. The rest will follow. Embrace the power of starting and then iterating until you're happy.
178
745
63
3,922
749,772
Jakub Benes retweeted
Summer is over, and I’m looking for a new job opportunity 👋 I’ve spent the last few years working at startups like @productboard , @vercel , and @prisma . Looking mostly for full-stack roles in the TypeScript / JavaScript ecosystem.
7
9
44
55,587
Jakub Benes retweeted
pdfpix.com is finally live! 31 completely free PDF tools to compress, merge, split, convert, and so much more; all running in browser. No servers. No accounts. All results are verified and reported. Please give it a try! (and report any issues)
14
9
4
92
39,122
Jakub Benes retweeted
Aka 25% limit reduction
Starting September 14, we're permanently raising standard weekly limits in Claude Code by 25% for Pro, Max, Team, and seat-based Enterprise plans. Until then, the current 50% increase will be in place.
Readers added context they thought people might want to know
While standard base limits are increasing by 25%, this change represents a net 17% reduction in weekly limits compared to the active 50% promotional limits users currently experience, as confirmed by the official Claude account: x.com/claudedevs/sta…
25
11
3
411
46,072
Jakub Benes retweeted
i made a game where you literally have to find a missing semicolon in a codebase of 187,421 lines the catch is the entire codebase is printed out and taped to the walls of an office and you have to inspect it line by line Play it here: semicolon.trm.sh/
312
398
312
9,081
4,415,778
Jakub Benes retweeted
Give your agent its own calendar — then decide what of it reaches yours. Hosted calendars can now be a sync rule source. Events your agent creates flow into your Google, Outlook or Apple calendar through a gate function that filters them first. calendarpipe.com/whats-new
1
25
Jakub Benes retweeted
Your agent can now accept meeting invitations for you — and nothing else. CalendarPipe API keys carry scopes. An invite-handling agent holds invitations:read + invitations:write. It can't delete a calendar or rotate a feed token. calendarpipe.com/whats-new
1
25
Jakub Benes retweeted
Invite someone to CalendarPipe, get a free month of Pro when they join. No points, no tiers, no referral dashboard to check. One invite, one month. It matches on the email address you invited — so send it to the one they'll actually sign up with. calendarpipe.com/whats-new
1
21
API > UI
Tell your coding agent: mirror my work calendar to my personal one, hide the titles. It writes the rule, runs it against your real events, shows you what each becomes, and turns it on. If it can't read your calendar it tests on samples — and says so. calendarpipe.com/whats-new
3
225