Lukáš Bauer

AI, software, Bitcoin.
Automatizuji procesy, zrychluju weby, hostuju s výkonem a osobně.

[Wise @trikcode]

visual studio code is not dying soon.

it is still a perfect place to set .env variables

[Will Eastcott @willeastcott]

💧 121 million Gaussians
📡 1.3GB of Streamed SOG data
🧊 11 million collision voxels
This scan of Vyšehrad is one of the largest 3D Gaussian splats ever. SuperSplat delivers it to your browser and @playcanvas renders it on WebGPU.
So big, I had to speed up the video 2.5x!
[1/2]

[Henrick Johansson @compliantvc]

Germany's latest data center is now open

35 high-speed megabytes of data will be processed through this facility each day in a carbon-neutral, environmentally-friendly data center in this park in Berlin

Europe owns the future of clean data

[Lukáš Bauer @CoolLamer]

@HatasLukas Napsal jsem pm

[@levelsio @levelsio]

Web4 is here 😂

[Lukáš Bauer @CoolLamer]

😂

[Aesther @AestherML]

This is a Zebrafish

It has the same amount of Synapses as Qwen 3.8 27B but lacks the ability to one-shot Minecraft in Three.js

Disappointing

[Andrej Karpathy @karpathy]

Weekend hack: HackerTube. I was annoyed with YouTube's recommendations so I had Claude filter down 43M comments over 20 years of HN to 6,454 videos that keep being recommended. *Significantly* better viewing experience, ~2 hours with Opus 5.5:
https://t.co/JIhXN7OSh1

- Excellent recs without any logins (state is kept in local browser session)
- Thumbnail is a representative frame from middle of the video instead of the super duper A/B test hyper-optimized user uploads
- Underlying data from the comment analysis as one zip file, point your Claude at it and ask for your own version
- HackerTube Longs ✊

A bit more on the process:
I use Claude Code (desktop app for Mac), Opus 5.5 on Medium effort as my default. I only talk to Claude and have it do everything, the only "manual work" I helped with in tandem was in the browser (reminiscent of MenuGen): 1) I had to create some kind of API key from Google Cloud UI to query YouTube for video metadata, 2) I booted up a VPS box for serving and 3) I bought the domain name. Once the box was up I gave Claude the IP and told it update, secure, harden, deploy and optimize the code, and it did the whole thing.

Many awesome projects that would have normally taken weeks/months even can now be few-shotted for breakfast. What else are we not thinking of.

[Lukáš Bauer @CoolLamer]

@steidacz @TerezAnarchy Takhle se vznikají elektrikáři!

[Matt Corallo 🟠 @TheBlueMatt]

If you run lnd (or any services in Go) and accept connections from the internet, shut down your node *now* until you can patch your kernel or disable MPTCP.

Same goes for any internet-connected service but Go is one of the very few that turns on MPTCP by default.

[Lukáš Bauer @CoolLamer]

😂

[ThePrimeagen @ThePrimeagen]

There must exists an app with PHP, deployed on Railway, with calls to cURL, with other services written in node that use Brotli compression running on a couple day old Linux, with their code self managed on GitLab

They are having a hell of a week

[⁵⁄₉ @fiveoutofnine]

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and https://t.co/QlOXb3COq3 went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms.

PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.

CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".

Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.

PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.

[Lukáš Bauer @CoolLamer]

@RoundtableSpace My TV doesn't need Claude Code to remove bloatware. There is no bloatware. It runs Arch. btw.

[iamstillhere @iamstillhe65874]

Ještě jednou k vibe codingu. A tentokrát trochu osobněji.

Můj předchozí příspěvek vyvolal poměrně živou diskusi. Někteří souhlasí, někteří nesouhlasí, někteří si to vzali osobně a někteří mi rovnou nadávají do boomerů nebo ještě hůře. To poslední mě docela pobavilo.

V IT se pohybuji 27 let. Začínal jsem jako tester, pracoval jako developer, QA manager a posledních dvacet let se živím projektovým managementem. Testování a technických věcí jsem se přitom nikdy úplně nevzdal.

Jako dítě jsem ještě zažil děrné štítky, učil se programovat v BASICu, prošel dot-com boomem a zažil i bankrot společnosti, kterou jsme dokázali dostat do konkurzu s dluhem 20 milionů dolarů. Zažil jsem technologické revoluce, slepé uličky, geniální nápady i katastrofální rozhodnutí.

Zkrátka jsem toho v IT viděl, zažil a občas i protrpěl docela dost.

A teď přišla AI.

Poprvé v historii máme prakticky všichni v kapse celý IT tým. Analytika, vývojáře, testera, architekta, bezpečnostního specialistu. Alespoň na papíře.

Je to fascinující. Sám AI denně používám, píšu s ní kód, automatizuji práci a zkouším věci, které by mi ještě před několika lety zabraly týdny.

Jenže je tu jeden zásadní problém.

To, že vám AI dokáže vytvořit aplikaci, ještě neznamená, že dokážete posoudit, co vlastně vytvořila.

Bez základních znalostí a zkušeností to může být trochu jako dát dítěti krabičku sirek. Fascinující hračka, dokud nezačne hořet barák.

Nikomu nezakazuji používat vibe coding, instalovat aplikace vytvořené pomocí AI ani experimentovat. Dělejte si, co chcete. Ostatně já sám experimentuji prakticky neustále.

Ale pokud jste ještě před měsícem netušili, co znamená sandbox, API klíč, oprávnění aplikace nebo bezpečnostní zranitelnost, opravdu si dvakrát rozmyslete, co si pouštíte do počítače, na server nebo k vlastním datům.

AI totiž nemá žádný vrozený pud sebezáchovy ani automatickou záruku bezpečného kódu. Dokáže napsat funkční aplikaci a současně do ní zanést bezpečnostní chyby, kterých si bez potřebných znalostí vůbec nevšimnete. A když se jí zeptáte, zda je všechno bezpečné, může vám s naprostou sebejistotou odpovědět, že ano.

A právě ta sebejistota bývá někdy nejnebezpečnější.

Domů si také nepustíte úplně cizího člověka jen proto, že vám sebevědomě tvrdí, že je instalatér. Zajímá vás, kdo to je a co vám tam bude dělat.

Proč bychom měli u softwaru, kterému svěříme své soubory, hesla nebo přístup k dalším systémům, uvažovat jinak?

Nejsem proti vibe codingu. Jsem proti slepé důvěře.

AI demokratizuje vývoj softwaru. To je fantastická věc. Ale demokratizace vývoje automaticky neznamená demokratizaci znalostí, zkušeností a odpovědnosti.

A jestli je upozorňování na rizika po 27 letech v IT známkou boomerství, pak jsem asi boomer.

Raději boomer se zdravou dávkou nedůvěry než nadšený začátečník s produkční databází otevřenou do internetu.

[Alessandro Palombo @thealepalombo]

Asia's most livable cities, at $86K/y foreign income, at local tax rates.

And here's the explanation of why everyone went to Asia

[Alessandro Palombo @thealepalombo]

Europe's most livable cities, at median local salaries and cost of life, after tax.

Vienna is always at the top, one way or another

[Alessandro Palombo @thealepalombo]

Life is hard but nothing -- I mean nothing -- beats Valencia, Porto and Split.

Jokes aside, for what these charts are worth, I'd not overlook this quadrant

[Alessandro Palombo @thealepalombo]

World's most livable cities, when earning $86,000, at local tax rates.

New York: “If I can make it there, I’ll make it anywhere.”

[Jameson Lopp @lopp]

open source everything
https://t.co/vfPZgrJvti