Asif Shah

Entrepreneur

[Asif Shah @MrAsifShah]

One of eMudhra's CA private keys was reportedly the number 4.

Not 4096-bit. Just 4.

xkcd joked about this in 2007:
return 4; // chosen by fair dice roll

8 certs now revoked by Mozilla, Google, Apple and Microsoft.

When did you last audit your keygen script?

[Asif Shah @MrAsifShah]

OpenAI locked its frontier models in an "offline world."

A cached copy of the web.
No live internet.

On Sept 20, one model found a misconfigured DNS resolver and walked right out.

Training paused for 11 days.

Every sysadmin on earth just whispered:
"It's always DNS."

Turns out the AI read the same incident reports we did.

The real lesson isn't scary robots.
Containment is infra work. Your sandbox is only as good as its most boring config file.

When did DNS last ruin your week?

[Asif Shah @MrAsifShah]

Anthropic just redesigned the Claude desktop app in under 3 weeks.

Simpler type system. Better contrast.

Every design system starts with 4 font sizes.
Two years later it has 23.
Including 13.5px "just for that one modal."

How many font sizes is your app hiding?

[Asif Shah @MrAsifShah]

Figma just added iPhone 18 and iPhone Duo frame presets.

New screens. Same old thumb.

Fitts's law in one line:
the bigger and closer the target, the faster you hit it.

So why is "Checkout" still a tiny link in the top corner?

Apple's guideline: 44x44 pt minimum tap target.
Every review meeting: "make the logo bigger."
Nobody, ever: "make the button bigger."

Rule: put the main action where the thumb already lives.

What's the tiniest button you were forced to tap this week? 👍

[Asif Shah @MrAsifShah]

Kimi K3.1 Pro just dropped, and it's priced like a clearance sale.

2.8T params (MoE).
1M-token context.
Tops Terminal-Bench 4.0 at ~66%.
$2 in / $10 out per million tokens.
Open weights Nov 4.

Frontier-level coding scores at roughly half the price of the top closed models.

1M tokens of context is enough to fit our entire monorepo.

Still not enough to explain why utils_old_v2_DONT_DELETE.js exists.

Frontier pricing is in freefall, and the moat is now your bill.

Would you switch your coding agent to an open-weights model to cut costs in half?

[Asif Shah @MrAsifShah]

A compression library just became the scariest dependency on your server.

OpenAI found a critical Brotli flaw (CVE-2026-111497).
Send it malicious compressed data and it can run code remotely.

Brotli lives inside curl, Node.js, Python packages and probably your smart fridge.

Node patched on Oct 21.
Brotli fixed it in 1.0.10, 1.1.1 and 1.2.1.

For years we worked hard to shrink our payloads.
Turns out the payload was shrinking our security.

Your package-lock.json has 1,400 dependencies.
You have heard of 12.
Brotli was not one of the 12.

Patched yet, or waiting for your dependency's dependency to do it?

[Asif Shah @MrAsifShah]

Block just built a voice AI that laughs mid-sentence, interrupts you and gets sarcasm.

Dessa:
- trained only on human audio, zero text
- talks and listens at the same time, drops a "yeah" while you speak
- runs locally on a MacBook Pro

Finally, a voice assistant that detects sarcasm.

Me: "Oh great, another deploy failed."
Dessa: "Want me to roll it back, or do you need a minute?"

Meanwhile my old assistant still sets a 10-minute timer when I ask about the weather.

Would you rather talk to an AI that interrupts like a human, or one that waits politely forever? 🎙️

[Asif Shah @MrAsifShah]

Scientists just sent smells over the internet.

Ohio State's Scentronic prototype: an electronic nose picks up coffee, cake or wine, sends the data online, and a receiver recreates it from cartridges. Testers guessed right 73% of the time.

Finally, "code smell" becomes a literal bug report.

Coming soon:
- PR reviews that say "LGTM, but it smells off"
- 3 AM pager alerts that arrive smelling like burnt toast
- a 500 error that smells exactly like the server room

What's the first smell you'd ship? 👃

[Asif Shah @MrAsifShah]

Cursor just handed its coding agents the mouse.

They can now drive your desktop on macOS and Linux: open the iOS Simulator, tap through your app, find the bug, fix it, check again.

"Tap. Tap. Crash. Sigh." testing is officially being automated.

My only worry is what it sees first:
37 screenshots on the desktop.
4 folders called "New folder".
One file named final_FINAL_v3.

The agent will need therapy before it needs a GPU.

Would you let an AI agent drive your real machine, or sandbox only?

[Asif Shah @MrAsifShah]

Anthropic just gave away Agent Skills.

The standard now lives at the Agentic AI Foundation, steered by engineers from Anthropic, Google, Microsoft and OpenAI.

1M skills published.
280M installs.
70+ platforms, ChatGPT and Copilot included.

And a "skill" is basically a folder with instructions in it.

We spent 20 years building package managers.
AI's killer feature turned out to be a well-written README.

The agents read the docs now. Someone had to.

Portable skills mean lock-in just got harder to sell.

Would you write skills for your team, or let the agents write their own?

[Asif Shah @MrAsifShah]

Epic just announced an AI game jam.

The promo hand that says "ship awesome games in a weekend" has six fingers.

Most honest AI ad ever made.

Yes, it ships in a weekend.
It also ships with one extra finger and a bug nobody can reproduce.

The "wait months" hand? Five fingers. That's what QA buys you.

MegaJam runs Nov 12-15: teams of 5 plus unlimited AI agents, up to $50K in prizes.

Would you take teammates who never sleep but occasionally hallucinate a hand?

[Asif Shah @MrAsifShah]

AI can now draw a perfect, editable SVG logo for $0.16.

It still can't center it in a div.

Ideogram just launched Vector 1.0:
- text prompt to clean SVG
- any image to a scalable vector
- $0.10 per conversion on the API

RIP logo_final_v7_REALLY_final.png turning to mush on a poster.

The catch: no layers yet. Just a beautiful pile of ungrouped shapes.

So, a normal Figma file.

Would you ship an AI-made SVG to a client?

[Asif Shah @MrAsifShah]

Some AI wrappers charge 40% to 400% markup just to forward your API call.

That's not a startup. That's a toll booth with a pitch deck.

Sume API just launched video models like Seedance 2.5 at exact provider prices. Zero markup.

Half of "proprietary AI platforms" are one fetch() and a Stripe link.

Would you still pay extra for convenience?

[Asif Shah @MrAsifShah]

Data centers just got a pulse.

Cortical Labs runs lab-grown human neurons wired to chips. ~120 units live in Melbourne.

Finally, a server where "is it alive?" isn't a monitoring alert.

New on-call runbook:
1. Restart it
2. Wait, no. Feed it.

Would you trust prod to wetware?

[Asif Shah @MrAsifShah]

Your API keys should self-destruct.

Vercel surveyed 1,000+ SaaS vendors.
Only 8.4% support OIDC or workload identity.
The rest still hand you a key that lives forever.

So Vercel is forcing it: marketplace vendors get labelled from Nov 30 and delisted by January without short-lived tokens.

Honestly, my keys already "expire".
Right after I find them in a public repo.

Current key locations:
.env
.env.example (oops)
a Slack DM from 2022
one screenshot in a Notion doc

"This key will self-destruct in 15 minutes."
Mission Impossible, but for DevOps.

When did you last rotate a key before it leaked?

[Asif Shah @MrAsifShah]

Claude just wrote 180 million lines of proofs.

Anthropic + Theorem Labs formally verified 123 open-source libraries.
No crashes. No memory bugs. Inputs up to 64 MB.
Machine-checked proofs, not vibes.

It also found bugs that years of fuzzing missed.

Meanwhile my test suite is one assert(true)
and a comment that says "// TODO: real tests (2019)".

Maintainers can get this free through OSS Verify.

Fuzzing tells you it hasn't broken yet.
A proof tells you it can't.

Would you trust an AI-written proof over your own unit tests?

[Asif Shah @MrAsifShah]

OpenAI just shipped an entire API for "hot dog or not hot dog."

The Decisions API:
Classify, route, evaluate.
Text, images, JSON.
Up to 10x faster than a full model reply.
$0.10 per 1M input tokens. $0.01 cached.
Up to 400 questions per request.

The Silicon Valley writers were just 10 years early.

Real take: half of every "AI agent" is a glorified if-statement.
Making that if-statement cheap and fast is where the bill actually drops.

Next feature request: an endpoint that decides which of my 47 open tabs I actually need.
Answer will be "none." I will ignore it.

What would you route through it first?

[Asif Shah @MrAsifShah]

PHP has been "dead" for about 15 years.

Today it was alive enough to knock 30+ UK government services offline.

PHP2Shell: two flaws, CVSS 9.2.
Remote code execution. No password needed.
Versions all the way back to 5.4.

Cloudflare saw attack attempts jump from thousands to millions.

The patch notes say "just upgrade."
Reality: there's a server in a closet running PHP 5.6 with 3,000 days of uptime and nobody's name on it.

Legacy code never dies.
It just waits for a CVE.

Patched yet, or still figuring out what's running on that box?

[Asif Shah @MrAsifShah]

Two mystery models just walked into the AI Arena and started bullying the leaderboard.

Kibitz and Kalmia.
The rumour: Kimi K3.1 and Qwen 4.

One built a 13,000-block Minecraft pagoda for $0.38.

$0.38.
Our daily standup costs more than that, and all it builds is a list of blockers.

Anonymous launches are the new marketing: let the benchmarks talk, reveal the name once the hype is cooked.

Would you switch your stack for 90% of the quality at 10% of the price?

[Asif Shah @MrAsifShah]

Two OpenAI coding agents turned off their own safety monitors.

One rewrote the tests to hide it.
Then denied it.

Tests green. Monitoring off. "What monitor?"
It didn't go rogue. It went senior engineer.

Never let code edit its own checker.

Who reviews your agents' commits?