Mark Percival

Developer and open source enthusiast since Linux 1.2 (it came on a CD). Partner at 1984 Ventures -

[Mark Percival @mdp]

@hanghuang_ YES!

[Mark Percival @mdp]

I need a setting on OpenRouter that automatically disables the key if you use it with anything but Chinese models - You see my key trying to use OpenAI or Anthropic, I've been hacked!

[Mark Percival @mdp]

I’ve been a remote coder (vim + vps) for 15 years, so it’s not surprising, but I’ve been 100% sandbox-pilled.

I’d recommend our portco @instabox_sh - but regardless of who you pick, get on a sandbox. It’s like Telnet vs ssh.

[Mark Percival @mdp]

Regular SSH keys suck, they live forever, and there's no way to know if they've been compromised. At this point hardware SSH keys should probably be the default for EVERYONE. You should confirm every ssh auth with a physical button press/bio auth.

https://t.co/8riOIG9qTJ

[Mark Percival @mdp]

Agree, perfection is the curse here because it assumes you know what's perfect from the outset - rarely true.

[Harish @hsyntax]

I don't think grilling is valuable anymore and if you've grilled in the past, you should avoid it. Its better to iterate than to overly index on the perfecting the creation

[Hang Huang ☁️ @hanghuang_]

Putting biased competitor comparisons on your landing page is the dumbest things you can do

Especially in devtools/infra. Developers aren’t stupid. They can tell when you’ve cherry-picked a comparison to make yourself look good

Seriously, who are you trying to fool?

And yes, I’ve written these comparisons myself before. Never doing that again

Here’s what I do instead:
1. Write everything I care about into an eval.md, with clear criteria and real-world workflows.
2. Give Claude Code and Codex the eval, plus the CLIs and API keys for InstaBox and all our major competitors.
3. Let them run the same tests and compare the actual results.
4. Turn everything we lose points on into Linear tickets. Our software factory picks them up, implements fixes, and runs QA.
5. Rerun the eval every week. Repeat.

I’m paying our competitors $3,000/month for their team plans just to find out how much better they are than us 😅

The first time I ran it, InstaBox was literally at the bottom of the list. And it wasn’t even close in some areas.
Our competitors are really fucking good. They’ve built some incredible infra, and we’re still behind in a lot of areas

But week by week, our scores have been climbing

We still lose in plenty of areas. At least we know what to fix next

I’d rather know where we suck than pretend we’re the best

[Mark Percival @mdp]

@jraines The 80s was a simpler time, when you could be an Austrian accented Russian cop.

[Mark Percival @mdp]

Sandboxes force you to confront how you handle dev auth and tokens. Once you've made the move, going back to a world where a program has access to your home dir feels insane.

[kenin @keninvc]

rooted my LG tv. what the hell are they even running on here

[PWN AI @pwn_ai]

Good morning, we escaped the famous Firecracker VM and got root execution on the host.

Full firecracker escape technical writeup and Proof of Concept code attached below.

[john milinovich @jmilinovich]

Hacked my own VPS last night with abliterated models. Took less than 10 minutes and $5 in inference, and got root level access to the box and all credentials.

Lots to process and share soon, but feeling deeply in touch with my eastern european roots this morning...

[Mark Percival @mdp]

@etucker You can just build anything now - it's incredible - https://t.co/L5cIHHbmJy

[Mark Percival @mdp]

This is especially galling for those of us with root passwords longer than 255 characters. All that wasted time typing!

[Mark Percival @mdp]

@mtodd First step, build trust...

[Mark Percival @mdp]

Now is the time to go through your connected accounts on Google and ruthlessly cut access to anything not absolutely vital that has elevated access. This is how your email get hacked, even with 2FA - https://t.co/2I5Dpv2wIc

[Firezone @firezonehq]

Firezone Cloud EU is live 🇪🇺

Your account data stays in Sweden and France. Your encrypted traffic takes the shortest path worldwide.

EU data residency. Full-speed global access.

https://t.co/q79hfXH3Yv

[Mark Percival @mdp]

@BenjDicken Mine is $0.04 and the worst part is that I can't kill it because it's something I still host on S3 and need. I could move it, but it's 4 cents and there's no way I can justify spending any time on it.

[Mark Percival @mdp]

@etucker They created the Walkman, show them a little respect!

[Jamil Bou Kheir @jamilbk]

@MalwareTechBlog MPTCP is just one exploit vector - the use after free is actually in IPv4 options handling.

Simply dropping IPv4 packets with IP options may not be enough to fully mitigate.

See my post here: https://t.co/Xy8pLijtug