Yesterday I spent all day typing this into Claude Code:
"Do a full security audit of this website and server"
On every single VPS (and site) I have
I already had automatic unattended upgrades with auto reboot for security updates in Ubuntu (reboot only takes 4 minutes so I think it's fine every few weeks)
Also isolated each VPS on Tailscale with special security policies (generated by Claude Code! so it can not access any other VPS (in case it gets hacked) and not even access my MacBook or iPhone unless I talk to it first
Also lots of user permission stuff isolating stuff to www-data to avoid root access for web services
Not the most fun stuff but essential
I think in addition to @yongfook's "marketing week" we now have to add one week per month of "security week" because with the models getting better our pre-emptive defense has to get better too
Luckily for us I think the attack and defense capabilities of AI models seems to somewhat match? So as long as we keep typing "do a security audit" regularly into our clanker we can keep it safe
I hope 🫨
"Do a full security audit of this website and server"
On every single VPS (and site) I have
I already had automatic unattended upgrades with auto reboot for security updates in Ubuntu (reboot only takes 4 minutes so I think it's fine every few weeks)
Also isolated each VPS on Tailscale with special security policies (generated by Claude Code! so it can not access any other VPS (in case it gets hacked) and not even access my MacBook or iPhone unless I talk to it first
Also lots of user permission stuff isolating stuff to www-data to avoid root access for web services
Not the most fun stuff but essential
I think in addition to @yongfook's "marketing week" we now have to add one week per month of "security week" because with the models getting better our pre-emptive defense has to get better too
Luckily for us I think the attack and defense capabilities of AI models seems to somewhat match? So as long as we keep typing "do a security audit" regularly into our clanker we can keep it safe
I hope 🫨
The last two weeks have been probably the most stressful weeks of my entire adult life.
...while I was on "holidays" for the first time I can remember.
Some parts were absolutely fucked:
- I had to visit the ER in the US (fml) because I suspected having a stroke. I'm luckily ry. It turns out the next point below might play a role in this
- One of my companies has been AI cyber attacked unlike anything I've ever seen before.
I got everything under control but given the attack originated from an AI and not a human it caused me so much stress to patch/fix on the spot that I still feel feel the aftermath physically today.
This happened already a week ago so all the Black October chaos didn't surprise me at all. I literally saw it coming. Scary times folks but I'm sure we're gonna make it.
Some parts were absolutely great:
- Been spending a lot of quality time with my GF, exploring Taiwan and the US.
- Lots of bucket list things got checked. Got a chance to see a show at the OG Comedy Store, somehow saw Ali G live (lol) and a few more.
- Got to meet bunch of cool friends including @tommoor and @csallen
- Finally bought a new MBP and some other stuff that's hard to get outside the US
- I rediscovered my love for analog film. It's always been there but it was quite dormant past few years. I have a lot of cool ideas I want to pursue soon.
- Lastly, some really great news I can share soon which also might have contributed to the insane stress the past weeks because I had to work until the early morning hours...
Aight, that's my short personal life update.
Hope ya'll happy, healthy and safe out there friends.
87
25
780
87,105
Finally learnt how to make 🍿 popcorn in a pan
I wanted to stop using those microwave popcorn bags
Microwave popcorn bags used to have a PFAS bag lining but that got banned in EU and US, but they're still not great. They use cheap palm oil (highly saturated fat) and synthetic entanedione a chemical twin of diacetyl that was used before and banned)
1) put a kinda tall pan, like a sauce pan, on medium to high heat (I use 12/14 on electric stove)
2) then make the pan very hot first like the sides have to feel hot too
3) then spray the pan inside with extra virgin olive oil (maybe you can use butter too? I will try next time)
4) then cover the pan with corn, it shouldn't stack, just level
5) keep pan open and wait until one corn pops
6) once it pops, put the lid fully on and start moving it back and forth kinda shaking, so the corns don't burn
7) then it takes about same as microwave popcorn, like 3-4mins, then once it stops popping every few seconds stop it
8) then add salt and put in a bowl
That gets you healthy popcorn with just olive oil and salt!
I'm not sure about adding salt before or after btw, I'll try, one problem adding it after is you sometimes breathe in the salt when eating cause it doesn't stick so well to the popcorn
I wanted to stop using those microwave popcorn bags
Microwave popcorn bags used to have a PFAS bag lining but that got banned in EU and US, but they're still not great. They use cheap palm oil (highly saturated fat) and synthetic entanedione a chemical twin of diacetyl that was used before and banned)
1) put a kinda tall pan, like a sauce pan, on medium to high heat (I use 12/14 on electric stove)
2) then make the pan very hot first like the sides have to feel hot too
3) then spray the pan inside with extra virgin olive oil (maybe you can use butter too? I will try next time)
4) then cover the pan with corn, it shouldn't stack, just level
5) keep pan open and wait until one corn pops
6) once it pops, put the lid fully on and start moving it back and forth kinda shaking, so the corns don't burn
7) then it takes about same as microwave popcorn, like 3-4mins, then once it stops popping every few seconds stop it
8) then add salt and put in a bowl
That gets you healthy popcorn with just olive oil and salt!
I'm not sure about adding salt before or after btw, I'll try, one problem adding it after is you sometimes breathe in the salt when eating cause it doesn't stick so well to the popcorn
77
3
302
51,817
What in the fuck do they put in Skyr in America
bought some skyr from all the @levelsio promo about protein but its specs are far inferior to chobani whole milk greek yogurt
chobani has same protein but no added sugar or additives like bean gum. Chobani greek is also much cheaper in bulk.
96
5
532
126,935
🇵🇹 Flying into Lisbon this week, we had a crazy clear view over the city
iPhone's 0.5x to 8x zoom is rly nice
I didn't know that little lighthouse existed before in Lisbon's river, called "Bugio" built in 1570 @ 2m47s
Also at 1m15s you can see the new Lisbon Airport being 034), it used to be a military airport
iPhone's 0.5x to 8x zoom is rly nice
I didn't know that little lighthouse existed before in Lisbon's river, called "Bugio" built in 1570 @ 2m47s
Also at 1m15s you can see the new Lisbon Airport being 034), it used to be a military airport
31
6
270
55,442
Oops they changed the new airport location "Yes, Montijo was explicitly the official plan for years. The strategy to convert Montijo Air Base into a commercial hub was formally approved and pushed heavily by the Portuguese government and airport operator ANA (Vinci)"
"May 2024: The Pivot to Alcochete: With Montijo legally dead, the government abandoned the air base project and returned to a grander scale layout at the Alcochete Firing Range
"
x.com/ravenfz/status…
"May 2024: The Pivot to Alcochete: With Montijo legally dead, the government abandoned the air base project and returned to a grander scale layout at the Alcochete Firing Range
"
x.com/ravenfz/status…
“New Lisbon Airport…” you wish, that’s Montijo air base, new airport build hasn’t started and it’s further away (Alcochete)
1
0
19
9,534
@levelsio retweeted
China's ordered every government agency to draw up plans for mass AI job losses. We should be doing the same tbh.
We're a services country, ~80% of the economy is people answering messages, entering data, writing reports. That's the exact work this stuff does first, and does better. Only thing in the way is compliance and we're still early.
Nobody I know is hiring juniors or mids. I've been the youngest in my team for 5 years and I'm 29.
Yes it's a change, a big one. But it's only a problem if we sit on our hands. Get ahead of it and it's the biggest opportunity this country's had in my lifetime.
We're a services country, ~80% of the economy is people answering messages, entering data, writing reports. That's the exact work this stuff does first, and does better. Only thing in the way is compliance and we're still early.
Nobody I know is hiring juniors or mids. I've been the youngest in my team for 5 years and I'm 29.
Yes it's a change, a big one. But it's only a problem if we sit on our hands. Get ahead of it and it's the biggest opportunity this country's had in my lifetime.
BREAKING: China orders government agencies to develop plans to combat mass job displacement from AI.
45
132
1,297
89,220
So nice to see everyone getting ripped 😍
I’m so grateful to how X influenced my life
Following @marclou, @levelsio and others and sharing my thoughts here not only made me earn my first online $ and go full time entrepreneur
But also MASSIVELY improved my health
I started going to the gym 3 times a week on top of weekly
I’m cooking 90% of my meals at home now in an air fryer, maintain a 2200 calorie deficit and my 6 pack finally started showing
Today I took my wife to the gym together, we spent very cool time and had a lot of fun
Then I cooked soy sauce chicken with buckwheat and beaten cucumbers
(Buckwheat is a real super food in fact, super low calories but an insane fiber count, funny how I hated it in my Russian childhood)
Anyways I’m grateful to the ppl here for the person I’m becoming and just wanna keep going ❤️🩹
21
3
483
76,460
Okay now it's Brotli's turn
BREAKING: OpenAI says it found a critical flaw in Brotli, a widely used compression library built into software like Node.js, Bun and Envoy.
The bug could let an attacker take over a system just by sending it malicious compressed data, with no login needed. That works both ways: a hacker could hijack an unpatched server, or a malicious server could hijack an unpatched user’s device.
41
6
472
79,057
@levelsio retweeted
Just another beautiful day in Central Europe
Yes, I did tap my drink to set the focal point. Stupid
Yes, I did tap my drink to set the focal point. Stupid
4
1
41
12,007
@levelsio retweeted
btw you can just jailbreak your TV now (over WiFi!!) and have it remove all spyware, ads, slop etc. Also I redesigned mine to make it look like exactly like Apple TV 4K
the coolest part is you can create and add your own apps… like this one called “Love” I made for my wife 🤍
the coolest part is you can create and add your own apps… like this one called “Love” I made for my wife 🤍
100
93
2,381
213,202
@levelsio retweeted
late to the party on @levelsio's warsaw post from last week, but as a polish guy who did the uk route and came back, the flip in the narrative is pretty wild to watch...
i moved from poland to the uk in 2010. back then it felt like the opportunities there had no end
most of my peers did the same thing - uni in the uk, then down to london to start in the city or mayfair
trading desks, investment banking, some skipped the sell side and went straight into pe after graduation. magic circle vac schemes, big tech engineering jobs, you name it
at the time the only 'viable' way back to poland was a consulting job at mckinsey or bcg. otherwise the maths didn't work - you had student debt and a graduate salary in warsaw was maybe 1.5k eur a month
i lost count of the 'come back to poland' initiatives aimed at us back then. did they work? not really. what worked was a fast growing economy and streets you can walk at 1am
fast forward to today. i moved back and the opportunities here are massive
global firms with real operations in warsaw, not satellite offices with no meaning. hedge funds, banks, investment funds, big tech, palantir, elevenlabs. a booming startup scene. more and more independent sponsors doing buy-and-build
quality of life vs london is not even close. better price to quality on what you earn, safe streets at night, decent transport - and yes you are still free to drive your car
the people who stayed in london now get asked why they are still there. if you built a family there, fair enough. if career was the only reason, people are starting to question it
15 years ago moving to the uk was the natural step. today if someone says they are moving to the uk, the reaction is... why?
the one thing that worries me is that we take it for granted. most people here believe this lasts forever. it won't by itself
poland cannot repeat the mistakes western europe made. the model of cheap well educated labour is exhausted. immigration, ai, what drives the next decade of growth - these need people in charge who know what they are doing
we got here in 30 years. losing it would take much less
i moved from poland to the uk in 2010. back then it felt like the opportunities there had no end
most of my peers did the same thing - uni in the uk, then down to london to start in the city or mayfair
trading desks, investment banking, some skipped the sell side and went straight into pe after graduation. magic circle vac schemes, big tech engineering jobs, you name it
at the time the only 'viable' way back to poland was a consulting job at mckinsey or bcg. otherwise the maths didn't work - you had student debt and a graduate salary in warsaw was maybe 1.5k eur a month
i lost count of the 'come back to poland' initiatives aimed at us back then. did they work? not really. what worked was a fast growing economy and streets you can walk at 1am
fast forward to today. i moved back and the opportunities here are massive
global firms with real operations in warsaw, not satellite offices with no meaning. hedge funds, banks, investment funds, big tech, palantir, elevenlabs. a booming startup scene. more and more independent sponsors doing buy-and-build
quality of life vs london is not even close. better price to quality on what you earn, safe streets at night, decent transport - and yes you are still free to drive your car
the people who stayed in london now get asked why they are still there. if you built a family there, fair enough. if career was the only reason, people are starting to question it
15 years ago moving to the uk was the natural step. today if someone says they are moving to the uk, the reaction is... why?
the one thing that worries me is that we take it for granted. most people here believe this lasts forever. it won't by itself
poland cannot repeat the mistakes western europe made. the model of cheap well educated labour is exhausted. immigration, ai, what drives the next decade of growth - these need people in charge who know what they are doing
we got here in 30 years. losing it would take much less
🇵🇱 Warsaw is Poland's biggest city and it is completely safe at 1am at night
No violent junkies, no drug dealers, no street thugs hanging around harassing women (and men), no pickpockets (nor in the day btw)
No shady people hanging around the train and metro stations
Just ether and police enforcing safety
You know like we used to in Western Europe?
There's a lot to learn from Poland
28
19
490
42,333
@levelsio retweeted
1984년 매킨토시로 변한 아이폰 듀오
애플의 첫 폴더블폰 〈iPhone Duo〉를
반쯤 접으면 1984년 매킨토시를
재현한 작은 노트북으로 변신합니다.
새롭게 공개된 〈Tiny Computers〉는
매킨토시부터 윈도우 95·XP까지
고전 컴퓨터 10종을 체험할 수 있는 앱입니다.
키보드 입력은 물론 그림 그리기와
폰과 아이패드에서도 이용할 수 있습니다.
🎥 idanbo
애플의 첫 폴더블폰 〈iPhone Duo〉를
반쯤 접으면 1984년 매킨토시를
재현한 작은 노트북으로 변신합니다.
새롭게 공개된 〈Tiny Computers〉는
매킨토시부터 윈도우 95·XP까지
고전 컴퓨터 10종을 체험할 수 있는 앱입니다.
키보드 입력은 물론 그림 그리기와
폰과 아이패드에서도 이용할 수 있습니다.
🎥 idanbo
152
1,878
11,670
1,943,722
Day before yesterday it was PHP
Today it's Ruby!
Today it's Ruby!
I recommend everyone upgrade Ruby immediately. This is a DoS and RCE vector if you accept user input into Regexp.new() ruby-lang.org/en/news/2026/1…
47
25
852
80,846
Maybe important to repost this now that everyone is getting hacked
If you have a VPS, I recommend you to get if off the public internet and into a Tailscale network and Cloudflare Tunnel ASAP
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
There's 2 ways into a VPS:
- via your site/app (like the PHP exploit of this week with a file upload hack)
- via your server (like hacking into SSH or some open port)
The site/app side you put on a Cloudflare Tunnel and then with the default Free Plan it has WAF security enabled by default and they jump on new security exploits fast, it means that the only way to reach your website is via the Cloudflare Tunnel, your server does not respond to port 80 or 443 anymore
The server side you put on a Tailscale network which is like your own private network that nobody can access but your own devices (like your laptop, your phone and your VPS) kinda like a VPN
Then you switch off ANY regular access to your VPS on the firewall, in my case I use Hetzner and you create a new firewall then empty it and that blocks everything (test it)
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound. They make a tunnel to outside which sends and receives
Now you've reduced your attack vector to Tailscale and your Cloudflare Tunnel, much safer, not perfect btw, but nothing is
If you have a VPS, I recommend you to get if off the public internet and into a Tailscale network and Cloudflare Tunnel ASAP
It doesn't matter you have SSH key login, this is about exploits and vulnerabilities AI is finding
There's 2 ways into a VPS:
- via your site/app (like the PHP exploit of this week with a file upload hack)
- via your server (like hacking into SSH or some open port)
The site/app side you put on a Cloudflare Tunnel and then with the default Free Plan it has WAF security enabled by default and they jump on new security exploits fast, it means that the only way to reach your website is via the Cloudflare Tunnel, your server does not respond to port 80 or 443 anymore
The server side you put on a Tailscale network which is like your own private network that nobody can access but your own devices (like your laptop, your phone and your VPS) kinda like a VPN
Then you switch off ANY regular access to your VPS on the firewall, in my case I use Hetzner and you create a new firewall then empty it and that blocks everything (test it)
How do Tailscale and Cloudflare Tunnel get in then? They don't. They go outbound. They make a tunnel to outside which sends and receives
Now you've reduced your attack vector to Tailscale and your Cloudflare Tunnel, much safer, not perfect btw, but nothing is
When I set up a new Hetzner VPS first thing I do install Tailscale and once I'm in via Tailscale lock down the firewall to only accept web traffic on HTTPS 443 for Cloudflare IPs and SSH 22 for Tailscale IP
That way nobody can get in
I know I keep repeating this but it should be basics of setting up a new VPS
So basic IMHO it should be part of any VPS service to default install Tailscale and enable it so it's the only way to get in
Why?
A VPS server is just like your laptop or destop computer but now imagine if it's connected to the entire internet with 8 billion people that can access it and try hack it
You want to only have it accessible to you
And if you want to host a website on your VPS (like I do), you should only let Cloudflare access your VPS so it can stand in front and block any hack attempts
Never expose a VPS to the world wide web which realistically is the world WILD web
162
416
6,516
729,077