ctoing at a soonicorn, ex cluster janitor at a frontier lab. current chief clanker at clanker cloud, Director clanker safety institute

tropics
serene cusp of the singularity
10
10
305
251,282
At this point someone needs to build a proper github alt
some people seem to not understand how retarded this is 1. our entire org was deleted without even an email including our 10k star repo 2. it took 2 weeks to get a response "oops sorry a bug on our end deleted everything after 90 days from when you cancelled your Enterprise free trial in July" 3. folks, our "free trial cancellation" was upgrading to full enterprise we've spent $ thousands on seats, CI, etc and are still paying 4. the "fix" 2 weeks later - our main repo is undeleted but currently under someone else's account - 3 repos, prs, etc cannot be recovered - thousands of potential stars lost - customer trust, potential contributions lost - so much time and headache AND this is even with us being a YC company + having plugged in investors + channels to get escalation I can only imagine what other companies are going through with GitHub right now I really hope with the bottom of my heart someone displaces Github. GitLab isn't it.
1
173
yes because php is retarded and allows retards to do retarded things retardedly. It should have died years ago but hey world keeps printing more retards
I am begging ppl to realize their limited exposure to server side languages & marketing-centered experience on here is not what actually goes on IRL, 70% of the web uses PHP and it's not even close, u are literally in a bubble
2
233
Hensen Juang retweeted
Cloudflare: We recorded a wall of 100+ lava lamps with cameras to generate unpredictable, maximum-entropy cryptographic seed data. Meanwhile Certificate Authorities:
a trusted intermediate CA just "leaked" (the private key was 4)
18
378
6,205
90,218
Hensen Juang retweeted
Bro, NOBODY wants to sell their compute. DeepSeek doesn't even want to let investors in because they have no use for money- they want COMPUTE. But they can't get it for any money in the world. Literally none of the big players would want to switch positions with Elon: Having a meme AI model that is 8 months behind and so underused that you have to sell your compute (which originally was hailed as your unique competitive advantage) Hailing SpaceX for growing their AI revenue through compute rentals is the equivalence of hailing a girl who drops out of Harvard Law school to suck old people's dicks because she earns more than her classmates.
So let me get this straight. SpaceX gets a 6 month to 1 year payback on MASSIVE compute clusters. It can then turn around and sell the capacity to customers at MASSIVE premiums as the demand for tokens continues to go exponential. Once those massive clusters are paid off, it can then repoint that same capacity at its OWN models (Grok/Grok Bot) and make insane margins on clusters that are already paid off. And it's working on creating an entire vertical stack that includes making its own chips (Terafab). How is this not the most valuable company in the world? $SPCX
53
35
468
61,918
Hensen Juang retweeted
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
2
7
45
2,039
This is so that Hokkien businessmen who are doing a quick overnight affair with a random KTV girl can make sure that their fanny packs full of at least 5-10k SGD are not being robbed while they take a dump or shower. You're welcome for the explanation. Follow me for more deep cultural insights into Singaporean culture.
So I invited my dad as my plus 1 to my work trip in Singapore. Hotel room bathroom 😱🤯😭😭😭😭😭😭😭💀💀💀💀💀💀💀💀💀
22
124
2,997
130,540
We are preparing representations to @GoI_MeitY, @IndianCERT and @ccaindiapki on the compromise of the private keys of eight eMudhra (emSign) intermediate certification authority certificates. Given the scale of the issue, Cabinet Minister @AshwiniVaishnaw must issue a public statement and outline the steps being taken to address it.
13
82
502
12,224
Hensen Juang retweeted
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
39
287
1,740
107,263
Hensen Juang retweeted
Sometimes Sol makes comments on GitHub when I don't intend it to, but leave any ambiguity in my instructions. But change the setting to involve the magic word "alignment" and now it's Very Concerning. I am increasingly seeing these releases as political, not technical. Examples like this do not seem serious, and interpreted through the worst possible lens, usually with insufficient information to independently evaluate. This is narrative, not disclosure. Remember the Gell-Mann Amnesia for safety reporting. As much as I would like more transparency from the labs in a variety of ways, it's unfortunate that OpenAI is supporting this selective and political version.
Replying to @Marcus_J_W
In the second case, a researcher asked GPT-6.1 Sol to look through a Slack channel without sending any messages. 82 user messages later, while repairing an evaluation pipeline, Sol decided that an misalignment alert to Security would also count as sending a message and therefore suppressed monitoring alerts.
4
5
47
2,290
Hensen Juang retweeted
Replying to @scaling01
Yeah I’d say the RL is working now all right
You can tell the RL is done properly when the models cease to speak English in their chain of thought
47
97
2,528
106,364
Hensen Juang retweeted
she's a 7 but hey that's 3 more than a root CA private key
5
97
1,610
14,661
indian bros are having a rough one. Now state bank of india is confirming data leak
Break: SBI confirms data Leak of its customers. #SBI Data Leak.
20
551
Hensen Juang retweeted
Buckle your chin straps y'all ...
7
2
49
5,805
looks like pingcap is dead then. JFC they are claiming to exfiling commercial records including margins per customer... if i was TiDB cloud ops bro i would KMS. like how do you comeback from this
4
18
1,294
Hensen Juang retweeted
51
3,142
16,887
351,836
Look man php is retarded i dont know what you expected ... the whole reason why 70% of internet runs on it is because it is easy for retards to do things with it retardedly
1
4
25
735
PHPcolypse is happening
5.6 Sol just found more UAF in core php and php-fpm. More CVEs coming soon. To fix: codex -p "rewrite the app to anything but php". This is not a joke.
1
19
931
Hensen Juang retweeted
Unfortunately, it seems that mitigation is not enough folks. Update or mitigate by taking your public facing server offline... -> phpc.social/@Girgias/1174764… #php2shell
A moron has released a POC early for php2shell so here is what you need to do: If you’re on version prior to 8.2: Edit php.ini: session.upload_progress.enabled = Off Then reload php-fpm and restart apache If you’re on later version: Update (it’ll be available in a few hours) In any case, the mitigation for the php.ini should work either way. Not sure if it’ll cover both vulns though so keep an eye on that. I’ll be reporting on follow up activity on windows as a target. Good luck!
14
79
465
86,877
we are about 3 weeks out from a major bgp incident
Replying to @ItsPhigs
I don't know why I was surprised, but we treat all these countries as even peers when it comes to the internet. God help us if indian BGP ever gets the spicy jugaad. None of this shit should be in third world control, they should pay to have it administered.
1
1
30
1,252
Hensen Juang retweeted
uh, someone tracked down the wallet for the "openai ethereum hack" and it was indeed a default test wallet for sepolia; local milady @apoorveth found the transactions. this is an absolutely common, lawful, and expected thing to do. now look at how it was described. "LUCKILY it was just testnet"? as if that would have been attempted, or even possible, on mainnet. "found and used a funded wallet that the user had not supplied" is a really funny way to phrase "used a default wallet", too. bitquery.io/investigations/o…
1
2
33
2,845