javi

🔈"Hah-bee". 🇪🇸🇺🇸 iOS Engineer at @OpenAI Codex. Previously @Square @Twitter @Twitch📱. Stochastic Parrot 🦜. Photographer. Sim-racing 🏎. Chess♟️

[javi @Javi]

@LLMJunky @PiipperiV2 ☠️

[javi @Javi]

That’s… kind of concerning. That’s just 27 times a day for a year.

[Dexerto @Dexerto]

YouTuber Tim Pan folded an iPhone Duo 10,000 times to see how its screen holds up over years of use

A noticeable crease appeared

[Nick Dobos @NickADobos]

3% of “critical” software security bugs, in all of recorded history, have been found in the last month.

This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total

Do you realize how fucking insane that is?

[Stevie Graham (new account) @stevegraham]

WOW! It’s finally happened! Full offline static decryption of FairPlay encrypted AppStore apps. The broader implications of this are huge. The FairPlay components are insanely obfuscated and have been the subject of research for years. It actually might finally be completely over

[javi @Javi]

@ChristianSelig @HTX_Studio Oh yeah that was really good

[javi @Javi]

This review really put every western tech channel to shame. And I’m not talking about the flashy editing (which is extremely well done), but there’s so much information in this video that other reviewers never even talk about.

[Tim Pan @mediastorm_en]

iPhone Duo Review: 10,000 Folds Later...

[deadalnix @deadalnix]

Holly fucking shit.

I knew this was happening, but seeing it plotted in this way really hits hard.

[Herrington Darkholme @hd_nvim]

-----BEGIN RSA PRIVATE KEY-----
4
-----END RSA PRIVATE KEY-----

[javi @Javi]

@ChristianSelig @HTX_Studio Yeah that was very impressive but I found it more unnecessarily attention-grabbing à la Mr. Beast

[Dan Lorenc @lorenc_dan]

The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.

I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.

I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.

When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.

The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.

Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.

Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.

A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.

Here's what this run looked like.

We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.

[javi @Javi]

@mattcassinelli So are a lot of western channels?

[javi @Javi]

@angeljimenez Me acuerdo de cuando un tal MKBHD invertía en maquinaria

[kitze 🛠️ tinkerer.club @thekitze]

if steve jobs saw you reserving 15% screen width for a single icon and then putting a left side arrow back button on the unreachable right side of the screen he would've personally taken you behind a dumpster and beat you with a metal pipe

[javi @Javi]

@_aidan_clark_ 🥲

[javi @Javi]

The year is 3784. Amazon is the only app that doesn’t support dark mode.

[macrofying @macrofying]

A pair of scissors cutting a single hair.

[javi @Javi]

Nothing says “You Can Just Build Things” quite like macOS running…. on a PS5 😶

[Anees Iqbal @aneesbhatti]

From the community: macOS 13 running on a PS5 with Reims vGPU

[javi @Javi]

@theo It’s crazy that this is a joke yet you may only be off by 1 OOM 😂

[javi @Javi]

@DJSnM

[Dmitrii Kovanikov @ChShersh]

How long it took me to find each SWE job:

2014: 1 job applied, 0 interviews, 1 day (nepotism)
2015: 1 job applied, 2 interviews, 1 week
2016: 1 job applied, 4 interviews, 1 week
2016: 1 job applied, 0 interviews, 1 day (friend is a CEO)
2018: 1 job applied, 2 interviews, 1 week
2019: 1 job applied, 5 interviews, 1 week
2021: 1 job applied, 0 interviews, 1 day (invited)
2022: 7 jobs applied, 16 interviews, 3 months
2026: 167 jobs applied, 54 interviews, 1 year 4 months