Burned out 2x while in the corporate world. Now I work on my own terms and help other devs do the same.
Portugal
Joined May 2013
- Tweets11.9K
- Following319
- Followers917
- Likes13.8K
What's even worse is the amount of crappy immigration we have, that provide zero value to the country...
And then we reject someone with a proven track record that want to choose our country to invest their time/life in.
I think our govs do this on purpose.
So let me get this straight, we decide that our students leave the country because our salaries are low and cost of living is increasing
Across an engineering fields our industry is lacking.
People like me, were faced with a decision go away to find a better job both in salary and in the magnitude of the problems we get to work on
James is a good friend, an amazing engineer and manager. We are trying to get a good pipeline for young software engineer students to intern with us every year
And we decided that he does not have the qualifications?
Two years ago I made a decision either leave the country or Cloudflare, Cloudflare took me in, I have a wonderful job where I get to work with people like James and on problems where the scale is global things that I only dared to dream about when I was in university
I don't understand, I am very disappointed with my country yet again, you steal our dreams and don't want those who enabled them here
This whole story is one of the reasons AI usage concerns me.
Someone just tried hacking Josh and blamed it on their harnesses.
Kinda like shooting someone and blaming it on the gun.
Hey @Railway, is there a reason employee's of yours are trying to breach my infrastructure?
Your employee Jake Runzer, just attempted to tonight.
The amount of crap seen here about AI breaking things and finding nonsense vulns even in your vibrator is nuts
Although I value everyone for trying to put out software and building their own things, this post shows exactly why people spend years learning their craft.
There are so many wrong things here, but bypassing the only permissions you have on a live environment with 35k people is crazy to my eyes.
I know AI can help, it can improve everyone's systems. But it'll only help if you're aware of what you're even trying to secure. The "secure this app, make no mistakes" prompt is utter crap.
Regardless, props to Max for being honest and trying to help others avoid this mistake. All the best 🙏
My app got hacked last night and 35,000 profiles were wiped. Here’s what happened / how to prevent it:
I bypassed RLS with a view so users could see each other's profiles, and didn't revoke Supabase's default anon permissions, so the public key could delete everyone through it (a truly awful rookie mistake from me).
Here’s a prompt so this NEVER happens to you:
Audit my Supabase project for security holes. Assume the anon key is public and anyone can call my REST API with it, logged out or with a free account. Check and fix:
1. Every table in public has RLS enabled, and every policy scopes rows to auth.uid(). Flag any policy that is just "true", especially on INSERT, UPDATE or DELETE.
2. Every view: is it security_invoker = true? Can anon or authenticated INSERT, UPDATE or DELETE through it? Revoke write grants on all views.
3. Revoke delete and truncate on all tables from anon, and set alter default privileges so new tables don't get them.
4. List every ON DELETE CASCADE from user tables and confirm that nothing a client can delete cascades into data it shouldn't.
5. Every security definer function: who can execute it, and does it trust a user id passed as a parameter instead of auth.uid()?
6. Every profile column that grants access (pro flags, trial dates, roles, admin) can only be changed by the server. Add a trigger that ignores client writes to those columns.
7. Every API route: it reads the user from the verified JWT, never from the request body, and checks ownership before reading or writing.
8. Crons and webhooks fail closed when their secret is missing, and webhooks verify signatures.
9. No temporary auth bypasses, hardcoded keys or guessable passwords.
10. Add a safety net: limit deletes per request on key tables, keep an audit copy of deleted rows, alert when row counts drop, and confirm backups work.
For each finding, show the exact SQL or code fix and explain what an attacker could do today. Then run Supabase Security Advisor and fix everything it reports.
Well that's the whole point of buying an unmanaged vps... You're responsible for managing it, even on your vacation
Did anyone expect @GoDaddy to do right during the PHP2Shell crisis?
A client who manages their own VPS but is on vacation just got this message.
GoDaddy refuses to install the patch for them.
Despicable.
Readers added context they thought people might want to know
GoDaddy requires self-managed VPS customers to install their own patches including PHP updates per their policies while handling managed plans themselves. The message shown matches this guidance for unmanaged VPS.
godaddy.com/help/patch-my-…
godaddy.com/help/statement…
x.com/GoDaddyPro/sta…
State of the internet nowadays - being pointed out for something utterly disgusting in terms of security and you say there's "scrutiny out of proportion" and quit.
Amazing...
Leonardo Freire retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Everyone should deploy a website/web app on a VPS at least once in their life
Leonardo Freire retweeted
The most underrated business model is the quiet one.
10 clients. $2k a month. No employees. No office. No investors. You take Fridays off and nobody notices because nobody's watching.
It won't get you featured on Forbes.
But it will give you on helluva life.
This 100%.
AI is very cool, it's a tool that can help everybody (good and bad) work faster. But please let's not overreact and make it a life ending technology.
AI is cool and badass. I like it.
No, it's not the end of the world. We can "contain" it.
Now I will rant for a moment about what I dislike about AI.
I strongly dislike when large corporations try to inject AI into every product, essentially forcing us to use AI.
I also strongly dislike when people use AI for every small little thing in their life, such as leaving comments on websites like Xitter, YouTube, Reddit, etc. It defeats the entire purpose of leaving a comment on something... you're supposed to share YOUR thoughts, not an AI agents generated string output. It's goofy.
I also strongly dislike the nonsense blabbering of AI propaganda, how it will destroy the world, or how companies need to "contain it", essentially acting as means to corner the AI model market, trying to strip it away from individuals who may want to host it locally. It's a facade of "Only WE can do AI, not YOU", whilst charging absurd fees for usage.
I also dislike AI nerds who try to tell me to use AI to do things I do simply because I enjoy doing them. Yes, maybe an AI agent could reverse engineer faster than me, or code faster than me, but I do it because I enjoy it.
AI is an excellent tool to enhance work flows, or learn (assuming it doesn't hallucinate).
Okay, that's all I want to say about AI for today.
LLM's can be great at documenting code if you explicitly ask for it on certain functions/flows that can be particularly hard to understand at first.
But, the amount of stupid/unnecessary comments they write while working on features is crazy.
AppSec conferences are actually very interesting, but talking to people and make connections will never be topped
People really underestimate the power you have while working for yourself or being a top decision maker in an organisation.
Having the capability to fire both employees and clients is one of the biggest advantages you have for your business (and mental health tbh).
