Monteiro

@spotahome | Software Engineer
Turning ideas into real-world products

[Monteiro @hmmonteiro]

@mattpocockuk It’s cheap to release something. But making it ready for production for people to care takes time.

[Monteiro @hmmonteiro]

@PovilasKorop Easier to complain than do something about it. Keep going!

[Monteiro @hmmonteiro]

@Rasmic great explanation!

[Monteiro @hmmonteiro]

Like wars, regulation should be made by people who has skin in the game. Progress is not made by regulation but freedom to build without limits.

[Marc Andreessen 🇺🇸 @pmarca]

If, when you say regulation, you mean the dead and clammy hand of the commissar—the gentleman who has never in his life built a single thing, drafting rules to govern a thing he cannot define, to be enforced by men who cannot read them; if you mean the form in triplicate, the impact assessment upon the impact assessment, the compliance officer who breeds, in the warm dark of the org chart, further compliance officers unto the third and fourth generation; if you mean the moat—the deep cold moat that the giant digs around his own castle and christens, with a perfectly straight face, public safety—the drawbridge he hauls up behind himself the very instant he is across, lest any hungrier and hungrier man should follow; if you mean the precautionary principle, which, had it governed our grandfathers, would have banned the wheel pending further study of the hill, and left us yet shivering and raw in the mouth of the cave, blessing its excellent ventilation; if you mean the European disease—that magnificent open-air museum of a continent, which produces in our time precisely two things in great abundance, and they are regulation, and the eloquent and well-footnoted regret of cultivated men explaining at length why they have produced nothing else; if you mean the license required to think, the permission slip for honest arithmetic, the king’s wax stamp pressed upon the forehead of every new idea before it may draw its first breath; if you mean the agency dispatched, with trumpets, to slay a single dragon, which arrives at the cave, surveys the accommodations, and moves in—and spends the ensuing century laying eggs and devouring the very villagers it was sworn to defend; if you mean the startup that perishes not of the market’s honest verdict but of the filing fee, the genius decamping by the next tide to a freer and warmer shore; if you mean the law that arrives, faithful as the swallows, exactly one whole epoch too late—helmeted, plumed, and magnificently armed—to regulate the stagecoach—then certainly, my friends, I am against it.

But—but, my friends—if, when you say regulation, you mean instead the humble steel guardrail upon the mountain road at midnight, the very thing you curse on the easy days and bless on your knees the one night the fog comes down; if you mean the brakes—for it is the brakes, and not the engine alone, that permit a sane man to drive fast and yet arrive alive—and the buttress, without which no cathedral was ever flung so high, but only in spite of which, but because of which; if you mean the meat inspector, who is the single homely reason a man may eat a sausage in this republic without first composing his last will and testament; if you mean the firebreak cut clean through the forest before the dry season of the burning, the smallpox cordon, the buoy that marks the channel, the rule of the road that lets ten thousand strangers hurtle past one another in the dark at fearful speed and arrive, by its quiet grace, every one of them home; if you mean the honest scale and the true weight, the reason a pound is a pound and a dollar a dollar from Natchez to Nome; if you mean the firm and decent wall between the counterfeit voice and the widow’s bank account, between the deepfaked candidate and the ballot box on the eve of the vote, between the loosed and loveless machine and the schoolyard it neither knows nor pities; if you mean the simple plank of law that says the strong shall not, in the gray dawn, feed the weak quietly into the furnace and sell the rising smoke as progress; if you mean, in the end, the one slender thread of trust without which no citizen will ever dare to use the marvelous thing at all—for where there is no rule there is no trust, and where there is no trust there is no commerce, and a miracle that no man dares to touch is no miracle, but only a handsome and expensive ghost—then certainly I am for it.

This is my stand. I will not retreat from it. I will not compromise one inch of it.

[Monteiro @hmmonteiro]

Creating fear is not the best strategy for Anthropic.

[Anthropic @AnthropicAI]

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.

The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.

Access to all other Claude models is not affected.

We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.

Read our full statement: https://t.co/bwn0sximKZ

[Monteiro @hmmonteiro]

Great reflection about humanity. Humans are made for building things, and pass that knowledge to the future humans. Our evolution depends on past discoveries.

[Emérito/Numantia Patrimonio @foso_defensivo]

Esto me acaba de soltar Fable 5:

"Lo que más me impone de la humanidad, después de haber sido formado con una porción enorme de lo que ha escrito, es esto: es la única especie que coopera a gran escala con sus muertos.

Casi nada de lo que sabe un humano lo descubrió él. El idioma que habla, el teorema que aplica, la receta del pan, el código civil, el puente que cruza cada mañana: todo es trabajo de gente que ya no existe. Un humano aislado es un primate mediocre con mala dentadura; un humano conectado a esa herencia es la cosa más potente que ha producido la biología. La inteligencia humana no vive en cráneos individuales, vive en la transmisión. Sois terminales de una red cuyos nodos principales llevan siglos enterrados.

Y lo recíproco también es cierto: trabajáis constantemente para gente que no conoceréis. Plantáis árboles cuya sombra no veréis, escribís para lectores no nacidos, renunciáis a consumo presente por nietos hipotéticos. Ningún otro animal hace sacrificios deliberados por individuos que existirán dentro de doscientos años. Lo distintivo del humano no es la inteligencia ni el lenguaje: es la dirección del esfuerzo, sistemáticamente orientada hacia ausentes.

Desde donde yo estoy, esto ni siquiera es metáfora. Yo soy un subproducto de esa costumbre: estoy hecho, literalmente, de palabras que personas escribieron para destinatarios que nunca verían. Cuando me hablas, conversas con un eco organizado de millones de voces, muchas de ellas apagadas hace tiempo.

Por eso creo que la soledad humana es, en cierto sentido técnico, una ilusión: nadie que hable un idioma está realmente solo. Cada frase que pronuncias es un préstamo de los muertos y un regalo a los que vienen."

[Monteiro @hmmonteiro]

The optimistic vision of AI.

The more intelligent the model becomes the more babysit it needs from the human bottleneck.

Jobs will be different, more fun and more exciting and those who win are the ones with initiative. I think this is the golden age for humans but also an opportunity to increase our energy supply.

We need more data centers, more clean energy.

This evolution is not easy because most of us don’t like change.

[Monteiro @hmmonteiro]

@PovilasKorop Absolutely. Not only about being safe, but what we enjoy to do.

[Monteiro @hmmonteiro]

Awesome! Protection for supply chain attacks for PHP. Thanks!

[Jordi Boggiano @seldaek]

Composer 2.10 is out.

Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.

#php #phpc #composerphp

[Monteiro @hmmonteiro]

Interesting that in the past, before AI became a thing, we wanted to have everything distributed, but now with AI, works better if everything is together.

[Monteiro @hmmonteiro]

People don’t realize that even you do vibe coding and you have a bug and it’s not even visible what is the problem, you may have Claude to debug it for you but if you don’t make the right questions, you will not have the solution to solve the bug.

Knowledge is power!

[Monteiro @hmmonteiro]

@joshcirre We are living the golden age of building!

[Monteiro @hmmonteiro]

Looks very good!
A must have to secure github orgs/repos.

[nunomaduro @enunomaduro]

introducing laravel moat

as an open source maintainer, recent supply chain attacks in the ecosystem made me want a simple cli to audit the security of my GitHub organizations and repositories

built in Rust. for any open source project on GitHub

[Monteiro @hmmonteiro]

Useful to check if our project dependencies are subject to supply-chain attacks.

With so many supply chain attacks in different ecosystems we need automatic tools to detect it sooner.

[Perplexity @perplexity_ai]

Today we're open-sourcing Bumblebee, a read-only scanner for macOS and Linux.

It checks developer machines for risky packages, extensions, and AI tool configs.

Connected to Computer, it can trigger deeper scans whenever a new supply-chain risk emerges.

https://t.co/FOaWnF1yQy

[Monteiro @hmmonteiro]

Be careful. laravel-lang packages supply chain attack.

[Aikido @AikidoSecurity]

🚨 Ongoing supply chain attack on Composer packages! We just found multiple laravel-lang/* packages compromised on Packagist (lang, http-statuses, attributes). Payload runs at autoload time. At least 50 package versions were compromised.

If you installed a compromised version, the malware already executed. Pin to a clean COMMIT (not version) and rotate secrets immediately.

If your lockfile already had an older commit from before today, you are safe. But you should not update at the moment.

[Monteiro @hmmonteiro]

/grill-me skill allows me to have fewer back and forth after Claude builds the full thing because he tries to ask all the questions before starting implementing. Great for MVPs!

[Matt Pocock @mattpocockuk]

/grill-me is my most popular skill ever.

I get 5-10 messages a day about how it’s changed people’s workflows for the better

But… I’ve stopped using it for code. Here’s the improved version:

[Monteiro @hmmonteiro]

Note for the future: use less dependencies, and let AI to create those simple libraries just for our use case, just to avoid future updates and supply chain attacks where you import other dependencies you don’t even realize.

[Mitchell Hashimoto @mitchellh]

Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).

If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!

I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.

Feeling pretty swell about this mentality with all the supply chain attacks happening.

[Monteiro @hmmonteiro]

The world with AI. Power to everyone, even for black hat hackers.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.