Muhammad Khalid

Building next-gen interfaces @

[Muhammad Khalid @MKhalidTaher]

Okay very cool! But I still think what bend 2.0 is proposing in simple words: prompt should always generate code + tests, and all code written must have associated tests. For that you don’t need a new language! All you need is a small light weight harness that verifies code always comes with tests!

[Muhammad Khalid @MKhalidTaher]

@danellisona Of course NOT!

[Muhammad Khalid @MKhalidTaher]

@itsalicesoul Not if you have a verification layer!

[Muhammad Khalid @MKhalidTaher]

@jonathan_wilke Already tried!! It’s amazing!!

[Muhammad Khalid @MKhalidTaher]

@meet244 What’s the link? And what’s your app about?

[Muhammad Khalid @MKhalidTaher]

@ash_twtz They do, you just don’t know how to access one!

[Muhammad Khalid @MKhalidTaher]

@poteto @VictorTaelin @github @cassidoo @poteto Did you try bend 2.0?

[Muhammad Khalid @MKhalidTaher]

@FIFI_BA0 Let’s connect! I’m building https://t.co/xTDoIqwH7n

[Muhammad Khalid @MKhalidTaher]

@Charvikasliwal_ Let’s connect

[Muhammad Khalid @MKhalidTaher]

@nikkuv5787 Let’s connect

[Muhammad Khalid @MKhalidTaher]

@vovudebosh It’s not good!! Tried explee. Exactly zero leads after 30 dollars.

[Muhammad Khalid @MKhalidTaher]

@itsalicesoul Just resolved a security incident with it

[Muhammad Khalid @MKhalidTaher]

Our API kept restarting and I was ready to blame a memory leak.

Then I opened the Postgres container. Dozens of Monero miner processes, running as the database user. Load sitting around 67. All 8 GB of RAM used. OOM kills. That was the “leak.”

How they got in: Postgres was open to the internet. The DB user was a superuser. Password was 8 characters. Someone logged in from outside around Sep 17 and started mining.

Fix was ugly and boring. Stopped the miners and their restart scripts. Deleted the binaries, including copies that had parked in the DB volume. Dropped an extra superuser role named “so” and an empty table that shouldn’t have been there. Bound the database ports to localhost only and recreated the containers. Confirmed closed from outside. Load is ~0.5 now and there’s about 5.3 GB free again.

They never got root on the host. SSH is still key-only. No miner cron or service on the machine. Still treating that database as readable since mid-September, and the passwords are getting rotated before I joke about this again.

If you’ve ever chased an outage that turned out to be someone else’s electricity bill on your CPU, drop the war story. I’ll read every one.

[Muhammad Khalid @MKhalidTaher]

@itsalicesoul Started using yesterday!! It is very impressive and fast!

[Muhammad Khalid @MKhalidTaher]

Our API kept restarting and I was ready to blame a memory leak.

Then I opened the Postgres container. Dozens of Monero miner processes, running as the database user. Load sitting around 67. All 8 GB of RAM used. OOM kills. That was the “leak.”

How they got in: Postgres was open to the internet. The DB user was a superuser. Password was 8 characters. Someone logged in from outside around Sep 17 and started mining.

Fix was ugly and boring. Stopped the miners and their restart scripts. Deleted the binaries, including copies that had parked in the DB volume. Dropped an extra superuser role named “so” and an empty table that shouldn’t have been there. Bound the database ports to localhost only and recreated the containers. Confirmed closed from outside. Load is ~0.5 now and there’s about 5.3 GB free again.

They never got root on the host. SSH is still key-only. No miner cron or service on the machine. Still treating that database as readable since mid-September, and the passwords are getting rotated before I joke about this again.

If you’ve ever chased an outage that turned out to be someone else’s electricity bill on your CPU, drop the war story. I’ll read every one.

[Muhammad Khalid @MKhalidTaher]

@poteto Loved Thursday arena!!!

[Muhammad Khalid @MKhalidTaher]

@vavanessadev Thanks. Also from the other post just incase you missed it, I’ve already dm’d you.

[Muhammad Khalid @MKhalidTaher]

@zakonweb Mubarak sir!

[Muhammad Khalid @MKhalidTaher]

Shipped a new homepage line for the Call me now button. 😂 🚀

Context: Friday night someone found VoiceAgent’s callback demo and tried to melt it.

Thousands of calls. Different numbers. All over the world. Late.

Spent the weekend putting security checks and a spam filter in front of it. Blocking about 99% of the junk now. Aiming at 99.99%.

The polite copy can wait. The filter ships first.

If you run a public call-me / callback demo, what actually stops the dial before it goes out?