Nick G

@Xbow. Formerly @google, @capsule8. Professional thing breaker. 👻

[Nick G @kallsyms]

@fede_k @moyix @hackerfantastic

[Nick G @kallsyms]

@moyix Someone made promo off of this you know!

[Nick G @kallsyms]

For those curious, here's the GPT generated writeups for the bugs (yes plural, 5.5 actually found 2 distinct network RCEs): https://t.co/tnTNJ6KDI7

[Nick G @kallsyms]

🚨 0-day alert! GPT 5.5 has found and exploited a network accessible RCE in Mac OS 9.2.1 🚨

[Nick G @kallsyms]

@techAU Nope, just normal 5.5. Don't need a special model for a 25 year old OS :P

[Nick G @kallsyms]

@moyix Network code for AFP :) Does mean file sharing needs to be enabled, but I've got it continuing to hunt for something better in the core networking stack

[Nick G @kallsyms]

At least it's honest.

[Ian Butler @kinglycrow]

Another feature from our dev agent. It has full runtime environments spun up on demand to work in with full project context and access to shell tools!

[Ian Butler @kinglycrow]

Mentioned last week we're working towards open sourcing something big. Today I want to share a sneak peak into what's coming. Not sure what we're calling it yet but it's basically an open source version of the dev agent we've worked on for the last year and change.

[Ian Butler @kinglycrow]

Next.js had a serious vulnerability in their middleware system which allowed bypassing auth, and while bugs happen, the way it was communicated to their community was handled pretty terribly.

Normally I'm not posting on the weekend but this is some pretty spicy 🌶️ stuff.

In business if you have bad news you're supposed to communicate it quickly and directly, it's a trust exercise for people who put their faith or money in you.

This is also true in tech. We've spent years cultivating a blameless culture because we recognize that with system complexity and how fast everyone is always moving there's bound to be issue that make it through checks.

If the Twitter sphere is to be believed Vercel:

- Knew about this bug for over 3 WEEKS and quietly pushed changes to their new SDKs.
- Did not tag their PRs for fixes as a security issue
- Waited until the last minute to work with their Open Source community to announce the issue and a path to resolution for those affected

Part of responsibly disclosing issues like this is patch first and then move to communicate immediately to all impacted parties. You do not sit on your hands.

Because of this multiple platforms went offline today to deal with the bug as a fire drill exercise instead of having proper time to deal with the issue. This is a serious trust issue for what is currently a widely used framework and service. You yourself might be impacted right now.

As a steward of such widely used technology you have a responsibility to your users to protect them even if it's uncomfortable from a business perspective.

[Joe Heitzeberg @jheitzeb]

@okta @charles_maddock @Docker @e2b_dev @dexhorthy @humanlayer_dev @stripe @crewAIInc Going under the hood with @kinglycrow on Bismuth (terminal based agentic coding agent) specifically how they tackle selecting context from very long codebases , says Claude caching made this 15x faster

[Ian Butler @kinglycrow]

Check out the post on open sourcing our container orchestrator by my co-founder @kallsyms

https://t.co/nXbj1XK5G0

[Nick G @kallsyms]

Man my eclipse photos look weird

[Nick G @kallsyms]

@eatonphil Callgrind maybe?

[Nick G @kallsyms]

Re the xz backdoor

[Nick G @kallsyms]

@kinglycrow LGTM 👍

[Pete Markowsky @PeteMarkowsky]

Here goes nothing. Ship it!