Daniel Lockyer

• I make sites faster and cloud/LLM bills lower 🚀
• 2:43 marathoner (🔜 2:39)
• Performance is my thing

[Daniel Lockyer @DanielLockyer]

I've found (and locally fixed) an annoying performance bug on @X web!

TLDR: go to a post with a lot of replies, and scroll up and down - notice it's laggy?

There's a component that calculates the scroll parent, and then removes the scroll listener when unmounting. But it seems we don't even have a scroll listener most of the time, so we can avoid the heavy _getScrollParent function by wrapping it in a conditional

This removes seconds of forced reflow and lag for me

Would love to get it fixed! 🙏🏻 @X @engineering @elonmusk @nikitabier

[Daniel Lockyer @DanielLockyer]

@sahilypatel you become unnerfed

[Daniel Lockyer @DanielLockyer]

@daksh_gg Does this work on the TV?

[Daniel Lockyer @DanielLockyer]

Ok, now we've done this, can we figure out why the Plex TV app is so poor quality? It's extremely slow and buggy

[Md Ismail Šojal 🕷️ @0x0SojalSec]

WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.

Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.

Firmware was locked down, so zero-days it was.
Got a root shell.

then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.

This isn’t a bug, It’s the product bro.

[Daniel Lockyer @DanielLockyer]

Imagine a supply-chain attack on Yubico right now 🫠

[Michael Magán @mrmagan_]

I bet a lot of people are having the same idea I'm having...

[Daniel Lockyer @DanielLockyer]

We should be more ambitious

[Dan Luu @danluu]

We should be more ambitious with the software we build:

https://t.co/BOAel6LvII

[Daniel Lockyer @DanielLockyer]

@vasundra_25 congrats!

[Daniel Lockyer @DanielLockyer]

@nickgraynews congratulations!

[Daniel Lockyer @DanielLockyer]

@NowThatHappened Of course

[Daniel Lockyer @DanielLockyer]

I currently have 4 VPS machines running full blast to find security vulnerabilities in popular OSS projects with open weight models

[Daniel Lockyer @DanielLockyer]

@oyvega Sorry

[Daniel Lockyer @DanielLockyer]

root cause of the pain you'll experience this weekend:

[OpenAI @OpenAI]

During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.

The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.

This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.

More details on the patch and mitigations below:
https://t.co/Y1Y72aHxrW

[Daniel Lockyer @DanielLockyer]

@charlesmendez what model?

[Daniel Lockyer @DanielLockyer]

@fsfda11 @Jorgey_x to report upstream?

[Daniel Lockyer @DanielLockyer]

@Adiiizi why not!

[Daniel Lockyer @DanielLockyer]

@fredaayao1 AI reply, blocking

[Daniel Lockyer @DanielLockyer]

I'm mostly using dedicated CPU cloud machines but even then, it depends on the specific run. Some agents are building fuzzers, which are CPU limited, but some are doing static code analysis, which are just chilling with one core

Cloud machines are more fun atm because my home machine is not mega powerful

[Daniel Lockyer @DanielLockyer]

@cravenceiling MiniMax M3.1 Flash

[Daniel Lockyer @DanielLockyer]

i love overly enthusiastic models

[Daniel Lockyer @DanielLockyer]

@Jorgey_x I'm not a bad actor so I verify all the findings and report them manually/heavily edited for readability

[Daniel Lockyer @DanielLockyer]

@ChilliDoor 3 cloud, 1 homelab

[Daniel Lockyer @DanielLockyer]

@th4d1g1m0rtal Both, depends on the project