alex retweeted
The problem with Mexico is that Mexicans are always yearning but something
…but never getting after it
…but never getting after it
7
5
46
1,880
alex retweeted
First of Kind: The @rauchg interview
Season 3 starts now. I sat down with Guillermo in San Francisco to talk about layout shift, random acts of AI, and a dragon painted in a single stroke.
00:00 Human Effort Is Still Underrated
00:44 Chief Executive, Chief Designer
02:33 Two Bets: Software and English
05:15 Gmail Was My Siren Call
11:06 Exposure Hours
14:49 Layout Shift / One Stroke Dragon
17:10 No Random Acts of AI
25:17 Can Agents Have Taste?
30:15 Software Factories and Manufacturing Agent Customers
34:59 Everything Is Communication
38:04 A New American Story
41:52 Lifemaxxing
Guillermo Rauch is the founder and CEO of @vercel. Growing up in Argentina, he taught himself English in order to teach himself programming, then went on to create @nextjs and other foundational technology for the real-time web.
In our conversation, Guillermo explains why he designed Vercel’s first command line before writing any code, why layout shift erodes trust, and why his company won’t commit any “random acts of AI.”
G is not just a chief executive. He’s a chief designer.
—
Guillermo Rauch: One Stroke Dragon
First of Kind, S3:E01 @firstofkind
Hosted by @soleio and produced with @room3nyc
Powered by our sponsors:
@framer @noondesign @bot @tryramp @vercel @meetgranola @profound x.com/firstofkind/st…
Season 3 starts now. I sat down with Guillermo in San Francisco to talk about layout shift, random acts of AI, and a dragon painted in a single stroke.
00:00 Human Effort Is Still Underrated
00:44 Chief Executive, Chief Designer
02:33 Two Bets: Software and English
05:15 Gmail Was My Siren Call
11:06 Exposure Hours
14:49 Layout Shift / One Stroke Dragon
17:10 No Random Acts of AI
25:17 Can Agents Have Taste?
30:15 Software Factories and Manufacturing Agent Customers
34:59 Everything Is Communication
38:04 A New American Story
41:52 Lifemaxxing
Guillermo Rauch is the founder and CEO of @vercel. Growing up in Argentina, he taught himself English in order to teach himself programming, then went on to create @nextjs and other foundational technology for the real-time web.
In our conversation, Guillermo explains why he designed Vercel’s first command line before writing any code, why layout shift erodes trust, and why his company won’t commit any “random acts of AI.”
G is not just a chief executive. He’s a chief designer.
—
Guillermo Rauch: One Stroke Dragon
First of Kind, S3:E01 @firstofkind
Hosted by @soleio and produced with @room3nyc
Powered by our sponsors:
@framer @noondesign @bot @tryramp @vercel @meetgranola @profound x.com/firstofkind/st…
42
57
579
75,307
ayer tuve llamada con cliente de showslink para resolver dudas y me sorprendió que le pide a claude que le llene toda la info.
literal crea el evento, los tickets, pone los precios, llena la información y hasta los flyers jaja.
necesito hacer la plataforma más agent friendly.
literal crea el evento, los tickets, pone los precios, llena la información y hasta los flyers jaja.
necesito hacer la plataforma más agent friendly.
5
0
61
1,667
alex retweeted
a MUST READ for founders who can build a product but can’t get anyone to buy it.
@rlakhnyuk's $25K/month playbook for making money with "boring" products in a crowded market.
@rlakhnyuk's $25K/month playbook for making money with "boring" products in a crowded market.
16
37
674
39,548
alex retweeted
Pasé los veranos de mi adolescencia trabajando en el negocio de mi familia.
El que tiene un comercio labura un montón, y casi siempre con sistemas viejos, caros y que no están pensados para comercios.
Por eso cofundé Cobrando. Hoy ya lo usan +330 comercios y se crean 40 cuentas brando:
→ Vendes y controlas la caja
→ Manejas stock y precios
→ Ves tus ganancias y reportes
→ Tenes tu catalogo online
→ Llevas cuentas corrientes
→ Facturas con ARCA
→ Lo usas desde cualquier compu o celular, sin instalar nada
Si tenes un kiosco, almacén, local de ropa, pet shop o cualquier comercio, probalo gratis en cobrando.app
El que tiene un comercio labura un montón, y casi siempre con sistemas viejos, caros y que no están pensados para comercios.
Por eso cofundé Cobrando. Hoy ya lo usan +330 comercios y se crean 40 cuentas brando:
→ Vendes y controlas la caja
→ Manejas stock y precios
→ Ves tus ganancias y reportes
→ Tenes tu catalogo online
→ Llevas cuentas corrientes
→ Facturas con ARCA
→ Lo usas desde cualquier compu o celular, sin instalar nada
Si tenes un kiosco, almacén, local de ropa, pet shop o cualquier comercio, probalo gratis en cobrando.app
4
7
58
2,323
alex retweeted
Solo queremos ir a nuestras chambas, ir a la escuela, estamos sobreviviendo a este puto sistema de mierda, viviendo al día. Y el puto gobierno de la ciudad y el puto obradorismo en 30 años no han podido darnos un metro decente.Chinguen a toda su puta madre
0
1
3
172
alex retweeted
Calma, los agentes no están "hackeando bancos" es más que...
(...) situations when an agent or AI assistant accesses a human's account with the user's permission and login credentials.
Es decir, el humano le dio el user y el password al agente.
Es malo, pero no "tan malo".
(...) situations when an agent or AI assistant accesses a human's account with the user's permission and login credentials.
Es decir, el humano le dio el user y el password al agente.
Es malo, pero no "tan malo".
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-…
0
4
21
1,598
alex retweeted
Just 1 month ago this number was $0.
Today: $570,000
@Shpigford's playbook for building FirstIndex.com
1. He realized he was good at SEO
2. He turned what he learned into Claude Skills to manage his sites' seo
3. On Sept 25, before wrapping up for the day, he threw for $1,000
4. He got customers!
5. he used his skill on clients' sites
6. He wrote code for stuff AI isn't reliable at (ex: checking facts against a truth doc and counting links.)
7. He tweets about what he's doing for clients' sites and his sites, which gets him more clients
8. The company is just him + the set of tools below.
His tools:
@github: a walled-off repo for every client that stores the work log, all the research (up to about 100 reference sources per article), Search Console numbers, and whether ChatGPT mentions the client
Claude Opus: does nearly every step, with a separate session for each task so no context carries between clients
Claude Code: runs it all from the terminal
@NotionHQ: holds each client's research docs with some cool automations
@SlackHQ: talking with clients and delivering work
Google Search Console: shows which pages need work
Python: keeps the work reliable and repeatable, like keeping facts straight across a thousand articles and counting links, plus a script that kicks off each client's daily tasks
@dataforseo: SEO data, about $100 a week for 30 clients
@Cloudflare: hosts tiny apps that use "APIs to make Slack and Notion talk to each other"
Mac mini: the machine in his office that runs it all He's bootstrapping a 1-person company.
Full interview below.
This is what's possible for a solo bootstrapper today. Spread the word.
Today: $570,000
@Shpigford's playbook for building FirstIndex.com
1. He realized he was good at SEO
2. He turned what he learned into Claude Skills to manage his sites' seo
3. On Sept 25, before wrapping up for the day, he threw for $1,000
4. He got customers!
5. he used his skill on clients' sites
6. He wrote code for stuff AI isn't reliable at (ex: checking facts against a truth doc and counting links.)
7. He tweets about what he's doing for clients' sites and his sites, which gets him more clients
8. The company is just him + the set of tools below.
His tools:
@github: a walled-off repo for every client that stores the work log, all the research (up to about 100 reference sources per article), Search Console numbers, and whether ChatGPT mentions the client
Claude Opus: does nearly every step, with a separate session for each task so no context carries between clients
Claude Code: runs it all from the terminal
@NotionHQ: holds each client's research docs with some cool automations
@SlackHQ: talking with clients and delivering work
Google Search Console: shows which pages need work
Python: keeps the work reliable and repeatable, like keeping facts straight across a thousand articles and counting links, plus a script that kicks off each client's daily tasks
@dataforseo: SEO data, about $100 a week for 30 clients
@Cloudflare: hosts tiny apps that use "APIs to make Slack and Notion talk to each other"
Mac mini: the machine in his office that runs it all He's bootstrapping a 1-person company.
Full interview below.
This is what's possible for a solo bootstrapper today. Spread the word.
26
6
145
11,954
bueno, ahora Oracle con Java.
por qué nadie me avisó que hoy es el día de hacer públicas las vulnerabilidades?
oracle.com/security-alert…
por qué nadie me avisó que hoy es el día de hacer públicas las vulnerabilidades?
oracle.com/security-alert…
1
0
20
1,202
JAJAJAJ quién escribió mi día a día?
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
0
0
0
246
alex retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
921
7,075
58,010
3,825,687
alex retweeted
October has been an absolute nightmare for software
> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident
At this point, the biggest security risk might not be the code we write, but the code we trust...
> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident
At this point, the biggest security risk might not be the code we write, but the code we trust...
180
842
5,105
569,881
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
0
0
3
375
buen resumen
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
0
0
0
340
alex retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
1,079
8,933
69,409
4,164,115
