4Real.tech 💥

🚀 Your guide to 2030's tech revolution 🚀
Straight-talking tech discussion about how to make AI work without the corporate censorship and fear mongering

[4Real.tech 💥 @4realTechX]

Nice to hear as expected.

[dax @thdxr]

after running our security agents 24/7 i feel better about where things are going

they find quite things quickly and have access to internal details which help

they should be more effective than an external agent attacker. the asymmetry still exists but not as bad as i thought

[4Real.tech 💥 @4realTechX]

I have to have a look at this.

[Machina @EXM7777]

ElevenLabs founders must be SHAKING right now...

these guys just dropped a voice AI that listens WHILE it talks

every AI call center, receptionist and sales agent just became 10x more human overnight

here's how it works:

- they used one full duplex model instead of a chain of separate speech, LLM and voice models
- audio streams in and out at the same time, so it keeps hearing you even while it speaks
- it reads where you are in a sentence from the audio itself, not from a silence timer
- turn-taking was learned from real conversations, not hardcoded rules
- quick reactions fire in under 200ms
- a separate thinker model builds the full answer in the background while this one keeps the call moving

voice AI is officially solved

[4Real.tech 💥 @4realTechX]

Agreed. That was my first question when I started using Omarchy and Arch.

[dax @thdxr]

the AUR is going to have a critical supply chain attack at some point. they really need to provide a different auth mechanism

i don't even know how to get in touch with them about this. do we just need to stop publishing there? that sucks

[Kent C. Dodds 🐨 @kentcdodds]

Big companies can copy your features in an afternoon. If your product is just a pretty UI on top of a spreadsheet, you're in trouble. Giving up isn't the only option.

The better move is a safe harbor they won't follow you into: trust (1Password), incentives (Dropbox, and what I'm doing with Kody), community (Raycast), proprietary data (Waze), audience (Nathan Barry and Kit), deep domain expertise (Abridge), and niches too small for a giant to bother with.

There's also a boring version of untouchable: sometimes the giants leave you alone because nobody wants what you built. I share the test I use to tell a safe harbor from an empty one.

Where is your product anchored?

https://t.co/F3Dv6ciopB

[4Real.tech 💥 @4realTechX]

What a great post, so true

[Mo @atmoio]

AI is really wonderful because before only a handful of people could experience the pain and humiliation of building something without distribution.

Now millions of people can feel this!

[4Real.tech 💥 @4realTechX]

@SantoshiNak Just starting it would be a great direction. Getting halfway a victory

[4Real.tech 💥 @4realTechX]

important context.

[Playwright @playwrightweb]

Playwright and browser security reminder.

We saw a post suggesting that you delete Playwright because it bundles browsers with CVEs. That is a misconception. Do not delete Playwright🙃. Here is how it works and what you should do.

No Playwright package bundles a browser. Agents on Playwright MCP or CLI run your stable Chrome, which gets Chrome's security updates, with the sandbox on.

🤖 If you use Playwright MCP or the Playwright CLI

They use the stable Chrome / Edge on your machine, so it gets its normal updates. No config edit is needed.

🧪 If you use the test runner

When you run npx playwright install, Playwright downloads Chrome for Testing, pinned to the build we tested that release against. The pin is on purpose. Your tests run on the same browser on every laptop and CI machine, and a browser
update cannot suddenly break your suite. You choose when to move by upgrading Playwright. New releases usually pin a build ahead of stable Chrome, so you see breakage before your users do.

We recommend this for full e2e test suites on your own trusted app. This build can miss Chrome security fixes until the next Playwright release, and by default it runs with the sandbox off. Do not use it on the hostile web.

📚 If you use the library API

chromium.launch() has the same defaults: the pinned build with the sandbox off. If your code visits pages you don't control (scrapers, agent scripts), max out protection:

chromium.launch({ channel: 'chrome', chromiumSandbox: true })

🔒 Always keep Chrome / Edge updated. Some bugs can escape a sandbox.

Happy testing!

[4Real.tech 💥 @4realTechX]

@Owennfa we are not part of the future plan.

[4Real.tech 💥 @4realTechX]

@DarkWebInformer funds are safu

[4Real.tech 💥 @4realTechX]

@elonmusk Merry Zero Day

[4Real.tech 💥 @4realTechX]

Yeah, don't believe what you see, read or hear, all these people are just engagement farming.

[Quinten @QuintenFrancois]

I’ve been on X for 15 minutes.

Everyone has an AI agent.
Everyone makes $10k a month.
Everyone earns money while sleeping.

Yet somehow they all need me to comment “AI” for the secret.

Never seen so many financially free people begging for engagement.

[4Real.tech 💥 @4realTechX]

100% agree with this. Content creators out there, if they had the secret, they would not be selling it to you. Everyone's trying to create content and no one's really actually using it, all right? It's easy to make you think that you're behind, but these guys are all just show ponies.

[Cursor @cursor_ai]

DeepSeek V4.1 Flash is now available in Cursor!

Every effort level sits on the CursorBench cost frontier: from $0.60 to $0.98 per task, no model scores higher.

Turn it on in Cursor Settings > Models.

[4Real.tech 💥 @4realTechX]

@shawmakesmagic Yeah, after the stock price plummets, After paying off the seed investors and all the other people that got before the public. which it will. At that stage, it won't be worth acquiring.

[4Real.tech 💥 @4realTechX]

Things are getting crazy. They're looking for keys (BTC, SSH, SSL, bearer tokens). Secops never more important.

[Winston Ighodaro @Officialwhyte22]

We had a Linux server that showed two successful SSH logins from an external IP overnight.

The strange part was that there were no failed password attempts before them.

The attacker got in cleanly.

So I checked the SSH logs properly.

Both sessions said:

Accepted publickey

That meant we were not dealing with a guessed password.

I pulled the fingerprint from the logs and compared it with the keys in:

/home/deploy/.ssh/authorized_keys

There was only one key there.

And it matched.

The comment on the key was:

deploy@old-build

That name sounded familiar, so we checked our records.

The build server it belonged to had been retired months ago.

But nobody had removed its SSH key from this production server.

I checked the timestamp on authorized_keys.

The key had been sitting there since November 2025.

So this was not some new persistence the attacker had just created.

It was an old trust relationship we had forgotten about.

That was actually worse in a different way.

I checked the login history and confirmed both sessions came from the same external IP.

Then I looked for files touched during those sessions.

A backup copy of the application’s .env file had been created under /opt/api/.

That immediately raised another concern because environment files often contain things like database credentials, API keys and application secrets.

At that point we disabled the deployment account, removed the stale key, rotated the application secrets and started checking every other server that might still trust the same old build key.

The lesson from this one was simple.

Not every compromise starts with malware.

Sometimes the attacker just finds a credential or key that your own environment forgot existed.

Passwords expire.

Employees leave.

Servers get retired.

But SSH keys can quietly sit in authorized_keys for years if nobody is actually reviewing them.

That is why key rotation and access reviews matter.

The attacker did not need to break SSH.

We had already left the door open.

[Alex Hormozi @AlexHormozi]

Everything is hard. Nothing works the first time. It all feels pointless. That’s when you realize you’re going to have to will it into existence with every ounce of your fucking soul. And that’s when it starts to happen.

[4Real.tech 💥 @4realTechX]

@bot And yet my unification of accounts is still not done. I get that it's hard to unify all the accounts, but you've given me a reply, but no action yet. It's been two weeks.

[Mia @MiaAI_lab]

I like what DeepSeek is doing.

- They have a top of the line open-model.
- Top of the line harness.
- And now top of the line inference engine.

All open-source and available out of the open.

Thumbs up for them, I love it.

[Night Sky Today @NightSkyToday]

“When you can't be controlled, you will be hated, and that's the power.”

— Nikola Tesla

[Tech Dev Notes @techdevnotes]

Grok Bot now has Tailscale plugin