Remington S.

Opinions are like A-holes, everyone has one.. these are mine.

[Remington S. @notcleverhandle]

Hiding your business's complexity behind a simple chat interface takes world-class prefrontal-cortex planning and six months to a year building the recursive learning OS behind it, plus a day a week to maintain.

[Remington S. @notcleverhandle]

ohh yeah and got myself a fingerbot too! ☝️ @GLiNetWiFi

[Remington S. @notcleverhandle]

@theo turns out you don't rent the cloud. You build it. @Tailscale , cmux, tmux, agents on every box — and my macbook no longer frys the 🏀🎾's. 🙏 https://t.co/X6ZbVKMl7w

[Remington S. @notcleverhandle]

@AlfieJCarter skills

[Remington S. @notcleverhandle]

Built Overnight: a lightweight system for running coding agents through reviewed implementation work overnight.

It’s built around draft PRs, CI, and review loops. @coderabbitai has been a huge part of making that loop useful for us, but the workflow stays reviewer-agnostic.

Durable state lives in branches, PRs, checks, review comments, and task rows.

https://t.co/ZIfF6wAjfe

#AIcoding #DevTools #OpenSource

[Remington S. @notcleverhandle]

Your receptionist covers 40 hours a week.

Your phone rings 168.

Here's how most firms handle the other 128 hours:

• Voicemail
• Voicemail
• Voicemail

59% of callers hang up. 68% of those never call back. They call the next firm on Google. At $350 per first consultation, that's $3,850/week walking out the door. Not because your work isn't good. Because nobody picked up.

Here's what the firms that don't lose clients do differently:

• Every call answered — 12:35 on a Tuesday, 9 PM on a Saturday, Christmas morning
• Every inquiry qualified by practice area and urgency in under 60 seconds
• Every consultation booked directly into the calendar before the caller hangs up

Recovering one employment law case per month pays for an entire year of solving this problem.

The most expensive problem in professional services is the one nobody tracks.

[Remington S. @notcleverhandle]

At the end of the year we love to ask: "What gave this year meaning?"

But maybe that's the wrong question.

It turns meaning into something you collect — like putting trophies on a shelf in December.

The real question is simpler.

Were you actually there?

Not performing presence.

Not counting your good deeds. Just... there.

The people I know with real integrity? They don't talk about it much. They're too busy living it.

Maybe the goal isn't to find meaning at year's end.

Maybe it's to stop gripping so tight that you miss it along the way.

Merry Christmas to everyone this reaches — friends, family, colleagues.

I wish you all the best.

Am Ende des Jahres fragen wir so gerne: „Was hat diesem Jahr Bedeutung gegeben?"

Aber vielleicht ist das die falsche Frage.

Sie macht Bedeutung zu etwas, was man sammelt — wie Pokale, die man im Dezember ins Regal stellt.

Die eigentliche Frage ist viel einfacher.

Warst du wirklich da?

Nicht Präsenz vorspielen.

Nicht deine guten Taten zählen.

Einfach nur... da sein.

Die Menschen, die ich kenne mit echter Integrität? Die reden nicht viel darüber.

Sie sind zu beschäftigt damit, es zu leben.

Vielleicht geht es am Jahresende gar nicht darum, Bedeutung zu finden.

Vielleicht geht es darum, nicht so fest zu klammern, dass man sie unterwegs verpasst.

Frohe Weihnachten an alle, die das hier erreicht — Freunde, Familie, Kollegen.

Ich wünsche euch allen das Beste.

-Remington ✌️

[Remington S. @notcleverhandle]

🚨 Next.js / React Server Components Critical Vulnerability (CVE-2025-66478)

Great warning from @duborges — if you're running Next.js 15.x or 16.x with App Router, you need to patch NOW. This is CVSS 10.0 (remote code execution).

The fix on Vercel is simple: update your Next.js version.

@vercel is now blocking new deployments of vulnerable versions by default.

Their WAF is filtering known exploits, but upgrading is the only complete fix.

Quick fix: npx fix-react2shell-next

Resources that helped me:
Security Advisory:
https://t.co/MJW9vOjoAB

Vercel's protection guide: https://t.co/3gx7B7P1iP

Deployment blocking changelog: https://t.co/gsmQfMLnW5

Threat actors are actively probing for vulnerable apps.

Don't wait.

[Eduardo Borges @duborges]

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1) The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe

[Remington S. @notcleverhandle]

Everyone's obsessing over ChatGPT prompts.

Meanwhile, I'm over here with:

3 IDEs: Cursor, VS Code &amp; Kiro

v0 (mocking UI in seconds, not hours)

Claude Code and GPT-5 Codex

Conex, Vercel &amp; GitHub for deployment

Stack these right and you're basically unstoppable.

[Remington S. @notcleverhandle]

So, like, I basically quit web dev in 2015.

Was just... done with it, you know?

Came back in Feb 2025 thinking I'd ease back in.

Now it's September, and I've shipped 10 client sites and a whole SaaS.

Feels like I have 10 developers working for me, except it's just me and AI.

[Remington S. @notcleverhandle]

March: What the hell is a useEffect?

April: Oh wait, AI explains this stuff perfectly

May: Building faster than I ever did before

June: Client goes, 'wait, just YOU built this?'

July: Honestly, I'm asking myself the same question

[Remington S. @notcleverhandle]

Learn to break non serving patterns of the past.

[Remington S. @notcleverhandle]

Working long, hard hours toward a goal and sacrificing things along the way doesn’t get you closer to happiness, but it also doesn’t get you further away. Happiness is always a conscious breath away.

[Remington S. @notcleverhandle]

Your brand is the aftertaste you leave in the room after you’ve presented.

[Remington S. @notcleverhandle]

Perfect metaphor for ai. The last 1% is the hardest. Not just for humans. #ai #eventrrr #buildinginpublic

[Remington S. @notcleverhandle]

Learning from others’ mistakes is a trap 🪤. Knowing isn’t doing. Concepts live in your head. Actions live in the world.

[Remington S. @notcleverhandle]

Freedom is doing what you want, when you want, with the people you want. You don't have to be independently wealthy to achieve this. Just independent. And maybe a bit creative.