Guillaume Béranger

Senior Android Lead dev @Meerophoto, ex @BeReal_App, AuraCare, @happn_app, @Parrot

[bobby giangeruso @_bgian]

we're hiring our first ever brand owner in nyc

beside is a phone that understands, captures, and acts

we're cooking a lot crazy stuff rn -- what you can do when you own the phone number (carrier-grade) with agents running at the core is endless

help bring beside to the world🌎

[Guillaume Béranger @Da_Beber]

@hasen_95dx Heard of LLMs ? 😂

[Beside @withbeside]

Beside is now live on Android 🌎

The real economy doesn’t stop at iOS. We’ve expanded our coverage to Android to further power individuals & teams across the US.

[Guillaume Béranger @Da_Beber]

@Zhuinden haha yeah can't agree more on that!

[Guillaume Béranger @Da_Beber]

@Zhuinden yeah of course, but since it's in the official repo, people will think it's good practice😅

[Guillaume Béranger @Da_Beber]

@industrieapps @Zhuinden Sorry, had trouble linking your first post to the rest. I've always use reactive state management to compute the content of a given screen, not what screen to show (user flow). Your online banking app is showing the transactions screen, but it's computing the wrong state for it.

[Guillaume Béranger @Da_Beber]

@industrieapps @Zhuinden but how do you modelize the loading state of lets say screen 2a ? In your schema, how do you decide if you need to go to screen 2a or screen 2b ? Isn't it the same as computing a state ? (sorry if I'm missing your point)

[Guillaume Béranger @Da_Beber]

@industrieapps @Zhuinden Well that's the point of reactive state management, you just observe the flow and compute some state. Quite natural on the contrary. What you're experiencing with your bank app is just really bad development (probably vibe coded, since it seems it's all about it now)

[Guillaume Béranger @Da_Beber]

@forloopcodes How is that crazy? May I suggest thinking before tweeting

[Guillaume Béranger @Da_Beber]

@peja_1616 @Zhuinden @raamcosta @VasiliyZukanov Haha yeah^^ skill issues...
Discussion kinda drifted obviously 😬

[Guillaume Béranger @Da_Beber]

@Zhuinden @peja_1616 @raamcosta @VasiliyZukanov Yeah. I guess the topic has already been addressed more than enough. Stateflow with an acknowledgement mechanism is the only way to go!

https://t.co/kSYvtH0poX

(First Google response)

[Guillaume Béranger @Da_Beber]

@peja_1616 @Zhuinden @raamcosta @VasiliyZukanov Yeah but with sharedflows you can miss some events...(As already stated, we can do that again if you want😅)

[Guillaume Béranger @Da_Beber]

@peja_1616 @Zhuinden @raamcosta @VasiliyZukanov Yeah it's the price to pay if you don't want to miss some events... But to be honest it's not that hard to setup (quite straightforward on the contrary, even without any id, just an acknowledgement callback is enough)

[Guillaume Béranger @Da_Beber]

@peja_1616 @Zhuinden @raamcosta @VasiliyZukanov Same end-user message doesn't mean it's the same view state, the basic way to tackle that is to always provide a unique id to one event, that you can acknowledge. You need to display the same message twice? Well the view is not aware of that, it has to be 2 different states

[Guillaume Béranger @Da_Beber]

@Zhuinden @raamcosta @VasiliyZukanov Like everything modelled as state, but why would it be a problem? It doesn't "necessarily" get notified for a reason

[Guillaume Béranger @Da_Beber]

@Zhuinden @raamcosta @VasiliyZukanov Yeah but even with that, how can you want to emit same state if not changed?

[Guillaume Béranger @Da_Beber]

@Zhuinden @arpadietoth @VasiliyZukanov Yeah and the good ol BehaviorSubject.... Miss these days^^

[Guillaume Béranger @Da_Beber]

Beautiful

[Peter Girnus 🦅 @gothburz]

Last quarter I rolled out Microsoft Copilot to 4,000 employees.

$30 per seat per month.

$1.4 million annually.

I called it "digital transformation."

The board loved that phrase.

They approved it in eleven minutes.

No one asked what it would actually do.

Including me.

I told everyone it would "10x productivity."

That's not a real number.

But it sounds like one.

HR asked how we'd measure the 10x.

I said we'd "leverage analytics dashboards."

They stopped asking.

Three months later I checked the usage reports.

47 people had opened it.

12 had used it more than once.

One of them was me.

I used it to summarize an email I could have read in 30 seconds.

It took 45 seconds.

Plus the time it took to fix the hallucinations.

But I called it a "pilot success."

Success means the pilot didn't visibly fail.

The CFO asked about ROI.

I showed him a graph.

The graph went up and to the right.

It measured "AI enablement."

I made that metric up.

He nodded approvingly.

We're "AI-enabled" now.

I don't know what that means.

But it's in our investor deck.

A senior developer asked why we didn't use Claude or ChatGPT.

I said we needed "enterprise-grade security."

He asked what that meant.

I said "compliance."

He asked which compliance.

I said "all of them."

He looked skeptical.

I scheduled him for a "career development conversation."

He stopped asking questions.

Microsoft sent a case study team.

They wanted to feature us as a success story.

I told them we "saved 40,000 hours."

I calculated that number by multiplying employees by a number I made up.

They didn't verify it.

They never do.

Now we're on Microsoft's website.

"Global enterprise achieves 40,000 hours of productivity gains with Copilot."

The CEO shared it on LinkedIn.

He got 3,000 likes.

He's never used Copilot.

None of the executives have.

We have an exemption.

"Strategic focus requires minimal digital distraction."

I wrote that policy.

The licenses renew next month.

I'm requesting an expansion.

5,000 more seats.

We haven't used the first 4,000.

But this time we'll "drive adoption."

Adoption means mandatory training.

Training means a 45-minute webinar no one watches.

But completion will be tracked.

Completion is a metric.

Metrics go in dashboards.

Dashboards go in board presentations.

Board presentations get me promoted.

I'll be SVP by Q3.

I still don't know what Copilot does.

But I know what it's for.

It's for showing we're "investing in AI."

Investment means spending.

Spending means commitment.

Commitment means we're serious about the future.

The future is whatever I say it is.

As long as the graph goes up and to the right.

[Eduardo Borges @duborges]

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1) The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe