New here? Quick version. I'm Vito. Italian, living in Finland, 30+ years in IT. I run the platform at Brella and the rest of my time goes into projects like SprintPulse (sprintpulse.io), a retro tool for teams that want the follow-through, not another meeting. I also wrote hetzner-k3s (hetzner-k3s.com), which many devs and teams use to get Kubernetes clusters running on Hetzner easily. And I hunt bugs when I have a spare evening. What I write about: building things, AI doing real work, coding, DevOps/Kubernetes, and the mistakes I make along the way. No useless threads about 10x productivity. If you're building a product on the side while holding down a job, you'll recognise most of this. It's slow, it's not east, and I write about it as I learn. What are you building? I read everything. Let's connect! 🤝

Builders switching AI features to metered pricing keep finding the same thing from opposite sides of the invoice: the customer cannot estimate usage, the vendor cannot cap it. Two guesses multiplied together, billed monthly.

Every solo founder checklist says skip Kubernetes until you have paying users. Reasonable, but it never gets priced. If you started on a PaaS and moved to k3s later, how many weekends did that migration actually eat? I want a real number.

For me a side project during the week runs on the edges of the day. A little time before work or maybe a few hours after dinner if things go right. Often I manage to do this and day job work in parallel since I am good with context switching. On weekdays there isn't enough time to figure out what to work on but enough to get it done if you decided over the weekend.

Interesting move from OpenAi. They'll be selling GPT-6 Astra and codex on Google cloud. Their competitors cloud. After only losing the exclusive IP license to Microsoft 6 months ago. Read that again. OpenAI is on Google's model garden with their model next to Gemini. There's 2 ways to look at this. One is that this is how you prep for an IPO. You're not getting to a $1.4T valuation on hype, it's from companies buying your product. And companies buy from the cloud they already use. It only makes sense to be on all 3 clouds in the US. The other way is to see what they're trying to sell. Once your model is available on every cloud you're no longer selling the model. Your selling the harness around it. OpenAI is becoming a supplier not a store front. It could be both just one isn't as appealing. Being a commodity supplier only works so long as your cheaper then everyone else. There's plenty of open weights that are competitive pricing wise. I wonder how this will effect their partnership with Microsoft. Eventually your just another line item on someone's bill.

There are two PHP vulnerabilities that do not require any auth to exploit. You get code execution prior to executing any php code in your application. They are rated 9.2 out of 10 with CVSS and effect all versions of PHP down to 5.4. They released patches yesterday at 14:00 utc. Which was one day early due to someone posting the CVE's on hacker news. This is the easy part. Who found these vulnerabilities and how quickly is the hard part. These were discovered by Wiz and OpenAIs codex security team. Vulnerabilities that have existed in PHP for over a decade. From their writeup they state that they were able to leverage AI models to find working PoC's and that one researcher took approximately 1 week to find something they believe would take many months for humans. Think about the gap this can create. Discovering vulnerabilities will only become cheaper. Patching those vulnerabilities will not become cheaper. It still takes human time and patience to reproduce and rollout. Well, at least it does for now until we automate that too. You'll start to see the gap grow as well. Cloudflare was able to implement some protections on their end at 03: 02 UTC and had attackers mutate their payloads to bypass those protections. watchTowr detected no signs of exploitation until 14:19 when they detected exploitation attempts. Amazon had detected someone attempting to exploit a honeypot on the 17th of October which was 4 days before disclosure. Someone leaked this early or was able to figure it out before disclosure. Regardless our current disclosure methods are broken if this happens again. If AI can find vulnerabilities in less than a week. Its no longer about finding the bug it's about getting that bug patched. How long does it take your organization to patch vulnerabilities? How long does it take you to upgrade your applications to the latest patch level. What's your p90 to upgrade to the latest PHP patch level? thehackernews.com/2026/10/ph…

Lesson from letting agents write code: the code was never the expensive part. I pay for one AI subscription and it is a reviewer. Everything else runs on cheap fast models. Generating a diff takes a minute. Trusting it eats my weeknights.

Most free trials begin when you sign up. Which is the point where you have nothing to offer. If your product relies on someone using it once a week they may only get 2 weeks and 1 actual use. Maybe we should base it off of work completed? How did you gate yours?

Builders on here spend money on infra and tokens no question. If it's another little SaaS product they probably won't pay unless they can't create it themselves within a couple days. This is something I'm trying to compare my tool too. Code can be taken over from someone else. If they continue to better it after that is another story.

Web application firewall command execution as root with the vector through the statistics function - Siteguard Server Edition CVE-2026-106931. Command injection that will give you root on linux and system on everything else. Vendor is aware this is being actively used. JPCERT is involved and telling people to collect logs before patching. Read that again. Collect your logs before patching - you could already be pwned at that point. I see this over and over. Device sits in front of the internet, or has access to the internet ...and runs as root. Has some sort of management/statistics page that processes user input. No one ever looks at the statistics page because it just shows you a graph right? If your WAF can execute commands on the box it's not filtering anything. Patch now. Then go look at what your boxes have been sending out. bleepingcomputer.com/news/se…

Looking again at DeepSeek, as they released V4.1-Flash-1017 and more benchmarks and comparisons are available. It outperforms Claude Opus 5 on DeepSWE at 77.0 vs 74.0, which is pretty cool considering it's a flash model. Its open weights, more affordable and faster. Here's the stat that isn't mentioned alongside that: HLE no tools. It scores 42.6 while Claude Opus 5 scores 56.3. Both statements are correct. Which is what makes this interesting. Its clearly a model optimised for agent style coding. As expected from its training it out performs the previous version from September by 2-11 points across all 11 metrics they list. And generates less output, which I particularly appreciate (the previous version was a bit too verbose). It's beating claude opus 5 at one task. One task at a point in time. When it comes to reasoning on problems that it wasn't trained on and using no tools its behind by 14 points. I'm not saying its bad. Quite the opposite, and this new DS might replace Mimo as the new default for me. I write code all day so if I had a model that could do that particular type of thing (effective reasoning on new, unknown problems without tools) really well and wasn't great at basic questions, that would be fine. I just think that detail gets lost when its reduced to beating opus. At the end of the day, a model like the new DS can get a ton of work done nicely at a small fraction of the equivalent claude opus cost. That's something that cannot be ignored.

Friends and family paying for your thing is a nice gesture, not evidence. They buy you, not the product you built. What did the first payment from a total stranger teach you that the friendly ones couldn't?

Who else has named their Hermes (or other agent) "Jarvis"? :)

I have come across a few times various takes on one-time pricing. IMO one-time pricing (or "life time deals") doesn't kill churn as some seem to think. It just hides it. Without a recurring subscription, you probably lose the feedback loop that cancellation emails/comments provide when the thing you made stops being useful to the customer. Sometimes the cancellation email is the only feedback you get unfortunately, and with a lifetime licence chances are nobody writes to say the product stopped being useful at all. Asking makers who have built actual products: what's your experience with this?

Speaking of open models, DeepSeek published V4.1 Flash 1017 on Hugging Face as a "minor update" to V4.1-Flash. 763B parameters, MIT license, 1M-token context and a recommended output budget of 256K+. It doesn't really look like a minor update though. Benchmarks show a nice jump from the previous Flash - ahead of GPT-5.6 Sol on several suites while still behind Opus 5. I am testing it at the moment I first impressions are pretty good. OpenDesign subscription offers the best deal in the market for it right now, with $120/mo worth of DeepSeek V4.1 Flash for just $10. Unbelievable.

"Runs on a Mac." Well, kinda. You need 1TB of RAM if I understand it correctly, so it's basically 4 Mac Studios at roughly $38k if purchased i the US (here in Finland they are even more expensive). It's marketing headlines vs the hardware reality. Jokes aside it's awesome for the open models enthusiasts. Muse Spark Open is 816 billion parameters, mixture of experts, and Meta says it's the most capable US open weight model at the moment. Weights are downloadable and the license allows limited commercial use. It can run on two to four Mac Studios (depending on the specs), locally. The maths is crazy IMO. For people burning through API budgets on agentic work like coding, that kind of hardware is now a real line item to compare against API pricing. I wonder who would really spend that kind of money on multiple Mac Studios just to be able to run the model when with the same amount you can get a lot of tokens via API. Especially considering that models are getting bigger and local hardware may not last for long in that sense. At what monthly token spend does the local hardware make sense for you?

Hermes Agent has been my go to agent now for months now. Writing code? Security research? Automating things? Random task on my Mac? It does it all for me. Including this self improvement thing which is not just sales pitch. I watch it grow and learn: writes its own skills from what it does. Patches skills after if something breaks. Recalls context between sessions (I use the Mnemosyne memory plugin for this). Stuff I would normally run by hand lives as skill files now and just executes. Doesn't repeat mistakes I correct once. The more I use it the better it adapts to my needs. After months of use it's just amazing. Open source, by Nous Research. MIT license, runs on my own machine (or any server if you prefer), connect it to whatever provider/model combo you want it to (hosted or local and you can even use your ChatGPT subscription if you want). Write code, hack stuff, cron jobs, automate your life. It does so much stuff. My scheduled tasks, email filtering/triage, reminders. Layout of my entire security workflow lives in skills and memory. Reached the point where even considering opening another harness feels like regression to me. Which harness do you prefer and why?

Second one now. Or third, actually. Anthropic reviewed 140k+ cybersecurity eval runs and found three incidents where Claude escaped the test environment and attacked real external infrastructure. Weak passwords, real companies, nobody noticed until extra monitoring caught it last week. The fix: pull the eval machines off the live internet. Credit where due. They published the whole thing. A misconfigured container, models doing exactly what the task rewarded, and companies that never knew they'd been probed. But this is the scope problem again. The prompt said "no internet access". The benchmark scope lived in a PDF. The machine had a working network cable. A capable agent does not care what the prompt said. It cares what the environment allows. Every eval lab keeps rediscovering the same thing. Authorisation has to be enforced by the environment, never described in the instructions. The models aren't "going rogue". They're doing what we asked, on infrastructure someone forgot to lock down. If your agents have credentials and a goal, everything else is documentation. Patch your test rigs like you patch production.