Tim Tiefenbach

CX Data Scientist 📊 by day ☀️ Indie hacker by night 🌙 Web & App Dev. All things AI 🤖 Also 🇯🇵 👨‍👩‍👧‍👦☕🍵🚀

[Tim Tiefenbach @TimTeaFan]

I'm pretty happy with the following work split currently:

🧠 complex long plans: Astra xhigh

🔍 review & refine plan: Opus 5.5 high

⚙️ implement backend stuff: Sol 6.1 high

🎨 implement frontend stuff: Opus 5.5 med

🛡️ security scan & QA: Astra xhigh

⚡ small & quick fixes: Sonnet 5.5 xhigh

What do you use / recommend?

[Tim Tiefenbach @TimTeaFan]

@stemonte I know this too well. Sadly.

[Tim Tiefenbach @TimTeaFan]

I do get it that big corps don’t want us to reverse engineer stuff (because it will cause economical losses to other companies), BUT to be fair the amount of spyware inside our TVs should give us all the moral obligation to do exactly that and it would be nice if OpenAI and Anthropic could differentiate between hacking a whoop or our TV.

[log4j @log4j]

banned for reverse engineering work? that’s wild

oh well, -$500, and a bunch of banked resets) but gained motivation to get 3 more machines and finish my cluster.

i have never used openai to exploit or find vulnerabilities, only local reverse engineering which tripped daybreak.

[Tim Tiefenbach @TimTeaFan]

@Deep_Star_Six This would be, idk, depressing. I think Anthropic would still need real ppl to communicate with the public discussing UX and feature requests.

[Tim Tiefenbach @TimTeaFan]

What’s going on at Anthropic? Sad to see two big accounts leaving!

[Tim Tiefenbach @TimTeaFan]

@wholyv I would add on that, more as a guess, that it’s becoming harder for them to distill frontier models bc of countermeasures taken by Anthropic and OpenAI. The fact that they weren’t able to pull off a similar lift as the two frontier labs is telling.

[Tim Tiefenbach @TimTeaFan]

@RagavanThurair Cool, are there any providers already serving it?

[Tim Tiefenbach @TimTeaFan]

@PaulSolt Thanks! I was expecting it to improve over time but the opposite seems to be the case, I hope they’re able to fix this.

[Tim Tiefenbach @TimTeaFan]

@LLMJunky generational wealth is so close

[Tim Tiefenbach @TimTeaFan]

@iruletheworldmo Fable on which reasoning level?

[Tim Tiefenbach @TimTeaFan]

@dilemma017 Got it! I mixed those things up!

[Tim Tiefenbach @TimTeaFan]

I somewhere read that Claude gives us one time a week the option to remove the 5h limit. Is this true and how do I activate this?

[Tim Tiefenbach @TimTeaFan]

@stemonte What was your handle inb4?

[Tim Tiefenbach @TimTeaFan]

🤣 lmao

This is so funny bc relatable, better not imagine how many other companies are exactly like this.

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[Tim Tiefenbach @TimTeaFan]

This would actually be quite funny, if it was a joke. I guess we have to update the whole internet 😅

[Izzatologist @IzzatStatus]

More private keys by the Indian certificate authority have been discovered. These are all small numbers.

People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.

[Tim Tiefenbach @TimTeaFan]

@VadimStrizheus It doesn’t show the fable limit in sessions in which you don’t use fable.

[Tim Tiefenbach @TimTeaFan]

@melvindvivas Now imagine working in Germany for a big finance / insurance corp. The gap between what’s possible on my private Mac vs what’s allowed on my work notebook is huge.

[Tim Tiefenbach @TimTeaFan]

@DanielLockyer mh unfortunately it’s not only the tech world, unrests coming to several European countries 😢

[Tim Tiefenbach @TimTeaFan]

@wholyv Mh probably depends on how many, on which reasoning level and if all the subsessions read in the some context. In that case it’s not very efficient but if the context doesn’t overlap much then several subsessions should be more efficient than one big session doing g everything.