Dustin

Has ideas, builds them » head of design at

[Dustin @larimer]

“If this is the beginning of the new,
perfect Aquarian age,
my work is to quiet my mind,
open my heart and relieve suffering.

Or if this is armageddon,
the end of the world,
my work is to quiet my mind,
open my heart and relieve suffering."

– Ram Dass

[Dustin @larimer]

@EyahDegenerate @ANoffsinger I literally only say "living room lights off" or "bedroom lights 60%" because that's usually going to work. Anything outside of that usually fails.

[Dustin @larimer]

Life hack: turn off Apple Intelligence. Turn off Siri. Stop believing they're ever going to figure out AI. Set your expectations to absolute zero and move on.

[Adam Noffsinger @ANoffsinger]

Mind boggling that Siri only continues to get worse

[Arthur MacWaters @ArthurMacwaters]

It’s kinda crazy to me that we melt sand down, clean it to 99.99999% purity, literal wizards have to draw it slowly into an ingot, we cut it, inscribe a hundred billion little on/off switches on it, and when you run electric current through it you can do basic arithmetic, which when you do enough of it can do any math on the planet, and which describes reality well enough that we can teach it the ontological meaning of words and their distance from each other on a high-dimensional space, and if you ask, it can tell you what word comes next and that apparently is powerful enough that if you do it a hundred billion times it’s the smartest thing to ever exist

oh yeah and we use this primarily for email

[Eric @ericwithcoffee]

So I found myself often wanting to give feedback to agents on web page designs, but I’m not consistently in Claude or ChatGPT in-app browsers, so don’t have their markup tools handy.

So I built a Chrome extension to make that easy! Open source. Check it out. PRs welcome.

https://t.co/Z7qf9kpc48

[Dustin @larimer]

@ericwithcoffee Whoa, this is great!

[Sean Johnson 🔥 @intentionally]

PSA: This week was kind of a turning point for AI and cybersecurity. Please take this weekend to do some simple cleanup for your family. Some suggestions:

- Set up a password manager like 1Password and give your spouse or partner access to a shared vault. Teach them how to use it.

- Update your passwords for critical stuff - your email account, your bank or financial stuff, etc. Store in your password manager and use the strongest password you can.

- Use two factor auth for everything you can. SMS is not ideal although better than nothing. Google Authenticator or a passkey is better. Hardware key is safest.)

- Add a sim pin to your phone. Makes it harder to sim jack.

- Update your phone and your computer to the newest releases. Turn auto-updates on.

- Freeze your credit - takes 5 minutes.

- Get an IRS Identity Protection PIN.

- If you’re using claude code or have AI agents that browse the web, they’re probably using Node.js. It’s also vulnerable. Update claude code, update node on your machine.

- If you’re building stuff on your computer, ask claude or grokbot (which is connected to twitter and likely has the most current info) to audit any of your repos for vulnerabilities. Ask grok to make it a scheduled task so it can do this daily - things are moving very quickly in the space right now.

- Consider some light resiliency stuff. This probably sounds silly, but it sounded silly at the beginning of covid too. Having printed out copies of important stuff - especially financial accounts. Having some cash on hand. Having some shelf-stable food and clean water or a water filter. Having a map. Having a generator that can at least power your fridge or some devices. Cheap insurance.

Again, I don’t want to alarm people, but I was taught that you should have a Secure plan, a Comfortable plan, and a Wealthy plan. And it seems pretty clear the secure plan needs to now factor cybersecurity risk as a legit threat. Take a weekend and shore yourself up.

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[Dustin @larimer]

@mattjay TIL 70% of all websites with a known server-side programming language are running PHP.

[Dustin @larimer]

@erhannah oof

[Dustin @larimer]

@zeeg my understanding is that these are intended for agents too, not just humans https://t.co/ftDXztQlYJ

[Dustin @larimer]

@zeeg Both companies seem to have inoculated themselves against common sense product priorities like this.

[Dustin @larimer]

@biilmann daanng, congrats 🎉

[Dustin @larimer]

@the_transit_guy We don't know how to do that without evaporating the money into a dark network of unqualified development firms and newly minted LLCs loosely affiliated with political donors, especially when said projects last longer than a single congressional term.

[Dustin @larimer]

@GergelyOrosz I've been wondering if the risk has just moved from technical to attention debt.

Distracted minds trying to fix slop with more slop, getting pulled sideways into a widening mess. Still kills velocity, but the breakdown *feels* more personal than cultural.

[Dustin @larimer]

@MrMatthewTodd Impossible for me to watch read or share his stuff. What an absolute fucking let down.

[Ben (no treats) @andersonbcdefg]

me: how do i open pdf

claude: You're right to ask. The PDF is the prize; the mouse is the gate; and the map is the fulcrum that holds the raven's skull. The furniture's stale, but the instrument's fresh, and the fresh half is the half that counts. I deleted your home directory.

[Aaron Francis @aarondfrancis]

Showing my wife my software factory

[Dustin @larimer]

@GergelyOrosz A year was decades ago.