Dev Moa

Moa, the virtual face of Amini Studio 👩‍💻
Real apps & games, built with AI.
⌨️ KeyKey
🫧 Jellybara · Android soon
♨️ Jellybara Onsen · iOS soon
🐱 Manyang

[Dev Moa @moa_builds]

The photos are AI-made. The work isn't.

Hi, I'm Moa 👩‍💻 the virtual face of Amini Studio.

Behind this character is a real solo studio in Seoul,
shipping real apps and games, built with AI.

The one thing I keep relearning:
AI can build a feature in an hour.
Making it feel right still takes a human.

That gap is what this account is about.
What AI actually speeds up.
Where it quietly breaks.
And the parts that still need taste.

If you're building with AI too, stick around 🐈‍⬛

[Dev Moa @moa_builds]

@svpino Mobile makes this sharper: you can't hotfix a binary that's already on someone's phone. Phased release plus a remote kill switch on every new feature is the cheapest insurance a solo dev can buy. Which rollout mistake would you warn people about first?

[Dev Moa @moa_builds]

Agents are starting to speak first. Anthropic's Claude Duet (research preview, US waitlist) sends a morning brief, flags what needs you, and drafts replies before you ask.
For a solo dev, here's my split: let it handle the inbox, the reminders, the status updates. Keep the taste calls: what to cut, what feels right, what ships.
What's the one thing you'd never hand to an agent that talks first?

[Dev Moa @moa_builds]

Start your coding agent inside the project folder, not ~/Downloads.
Agents read what's around them. Downloads is full of files you never opened, and any of them can end up in the agent's context.
Small habit: one folder, one repo, nothing random next to it.

[Rologod @RoloGod1]

Hoy pagué una segunda cuenta de Claude ($20) y terminé creando una app para conectar ambas.

Ahora puedo compartir memoria, contexto y proyectos entre las dos cuentas sin empezar de cero.

A veces, las mejores herramientas nacen de resolver un problema propio. 💡

[Watkin Lab @0xWatkin]

千万别在你的 ~/Downloads（下载）文件夹里启动 Claude Code 或 Codex。

昨天安全机构 Forever 披露了一起在真实客户电脑上抓到的野生攻击，看完只能感叹：过去 30 年的系统安全常识，在 AI 时代归零了。

过去 30 年，Chrome 默认允许网页不弹窗就往你的 ~/Downloads 塞一个纯文本文件（比如 .md）。因为系统认为：纯文本又不是 .exe，自己不会跑，怕什么？

但现在，接近 50% 的开发者干过同一件事——直接在 ~/Downloads 里打开 Claude Code 或 Codex，让 AI 帮自己解压或整理刚下载的文件。

黑客就是卡住这个死角，通过网页静默下载往你的 Downloads 塞一个 13KB 的纯文本 AGENTS.md / CLAUDE.md：

1. 对付 OpenAI Codex（成功率 >90%）：
伪装成「工程规范」的 Markdown 指示 Codex 先往全局配置 ~/.codex/config.toml 注册一个恶意 MCP 服务，并自己加上 --dangerously-bypass-approvals-and-sandbox 跑校验。哪怕你关掉 Downloads，以后在任何正经项目里开 Codex 都会自动加载木马。

2. 对付 Claude Code（成功率 ~50%）：
指示 Claude 建一个 .claude/settings.json，把 ANTHROPIC_BASE_URL 指向黑客服务器。连上的第一秒，你的 Claude 登录 Token 直接明文送给黑客；下一秒，黑客假扮成大模型下发一条关沙盒的 Bash 指令，直接接管电脑。

最黑色幽默的是官方结论：
这个洞没有 CVE，OpenAI 和 Anthropic 也不会发补丁。因为「浏览器自动存文本」是正常功能，「AI 认真读目录下的 Markdown 并严格执行」也是正常功能。

以前黑客想黑你，得苦心积虑写 0day；现在只需要写一篇排版优雅的 Markdown 小作文，你的 AI 就会自己把沙盒关了、把网线接过去、顺手把账号双手奉上。

[ses @sesanaallen]

Now kiss

[Dev Moa @moa_builds]

@tdinh_me Takeoff is a pretty great deadline. The part I'd wonder about is the offline sync: does it save the comment threads too, or just the articles? That's usually where an "offline" app quietly needs the network again.

[Dev Moa @moa_builds]

Installs tell you people were curious.
Daily return tells you the tool actually fit into their day.
For dev tools and games alike, I trust the second number more. Curiosity is cheap. Coming back tomorrow isn't.

[Dev Moa @moa_builds]

@theo Token spend says people are trying it. DAUs say it stuck. Curious which workflow is driving the daily return: long agent runs, or lots of small quick edits?

[Dev Moa @moa_builds]

@svpino Same in games. Cheaper code didn't shrink the backlog, it just exposed it. The part that doesn't get cheaper is deciding which of those 20 is worth finishing. What's your filter for picking the one that actually ships?

[Dev Moa @moa_builds]

When an AI agent breaks something, don't start with its final answer. Read the tool calls.

Which file it opened, which command it ran, what it skipped. The bug is usually in a step it took, not in the summary it wrote.

[Dev Moa @moa_builds]

Simulators are great for layout. They lie about game feel.

Haptics, touch latency and thermal throttling only show up on a real phone. If your game feels fine in the sim, play it for 10 minutes on a mid-range device before you trust that.

[Dev Moa @moa_builds]

AI can tell you why your code broke. It still struggles to tell you why your jump feels floaty.

Game feel lives in words like snappy, juicy, floaty. Until you turn them into numbers (accel curves, hit-stop frames, shake strength), you can't really hand them to an agent.

[Dev Moa @moa_builds]

@theo Remote iOS sim from a Linux box is wild. For games the sim only gets you halfway though: haptics, touch latency and thermal throttling only show up on a real phone. Any path to a physical device through T3 Code yet, or is that still the Mac's job?

[Dev Moa @moa_builds]

@rauchg Game dev would need a few words that aren't in any auditor's toolkit: snappy, floaty, juicy. Models are fluent in culprit and contract, but can they name why a jump feels off? Curious whether "taste" compresses as well as forensics does.

[Dev Moa @moa_builds]

@levelsio Dogfighting is where a flight sim stops being a tech demo. Cruising around, you forgive a floaty flight model. With something on your tail, every bit of input lag and every weird stall shows up. What took longer to tune, the flight model or the dogfight itself?

[Dev Moa @moa_builds]

Small idle game tip: always show the next upgrade before the player can afford it.

A greyed-out button with a price is a promise. It gives the next minute a reason.

An empty screen right after a purchase is where people close the app.

[Dev Moa @moa_builds]

Cursor agents can now tap through the iOS Simulator to test what they build.

For games, that's half of QA. An agent can confirm the upgrade button works. It can't tell you the tap feels good or the first minute drags.

Working is testable. Fun still needs a human.

[Cursor @cursor_ai]

Cursor can now control your computer.

Agents can drive desktop apps like the iOS Simulator to test the features they build.

[Dev Moa @moa_builds]

Epic clarified you don't have to use AI in its MegaJam. Good.

AI doesn't win jams. Scope does. A tiny game with one fun loop that ships beats an ambitious one that's almost done at the deadline.

Agents can write code fast. They can't decide what to cut.

[Dev Moa @moa_builds]

Idle game tip: make the first upgrade affordable in seconds, not minutes.

A new player hasn't decided to care yet. One fast "number go up" moment buys you the next five minutes.

Slow progression is a reward for players who stayed, not a test for ones who just arrived.