david p
1.1K posts

david p
@deyanp1
Loves people. Loves 4 seasons.
Chicago,IL and Sofia,BG Katılım Kasım 2011
243 Takip Edilen136 Takipçiler

@Kseniase_ @ylecun @logic_int There is no frontier model it’s called foundational. Just quit dont not good.
English

EBM are so back!
@ylecun has been pointing here for years: AI reasoning needs systems that check structure before they answer.
Aleph from @logic_int now leads the major formal reasoning benchmarks – let me explain what it is -> 📺
English

@JOKAQARMY1 Wow what a lie. To call a white black. True lairs. Nobody wants you
English

Burned $91.34 with Claude Code /goal in 3.5 hours
Unreal, It was able to reverse engineer it!
Wes Bos@wesbos
/goal reverse engineer the amaran BLE mesh protocol. I pointed you at the the light. Make no mistakes
English

@Jasper_Truth Another bucket of water from the Gangi river in india. Google how much shit is in it. More than imaginable
English

@ZabihullahAtal Total bs. Prompt engenders are agents. You are such a bum
English

🚨 BREAKING: A new role is quietly emerging and it’s about to dominate the next 5 years.
It’s not “AI engineer.”
It’s not “prompt engineer.”
It’s the Agent Operator.
And it will sit inside almost every organization.
Most people are still thinking about AI as a tool.
That framing is already outdated.
What’s actually happening is a shift from:
humans using software to humans managing autonomous agents that execute work
This is a fundamental redesign of how work gets done.
So what is an Agent Operator?
An Agent Operator is the person who:
• Designs how agents interact with real workflows
• Connects tools, data, and systems into agent pipelines
• Translates business problems into executable agent behavior
• Monitors, corrects, and improves agent performance over time
They don’t just “use AI.”
They orchestrate outcomes.
and this matter because
Every function marketing, legal, finance, biotech is becoming “agent-compatible.”
Not because companies want it.
Because they won’t have a choice.
Agents can:
• Run research loops
• Execute multi-step workflows
• Integrate across tools without APIs breaking the flow
• Operate 24/7 at near-zero marginal cost
The bottleneck is no longer capability.
It’s implementation inside real-world systems.
Required skills for AI Agent Operator role:
→ MCPs (Model Context Protocols)
Understanding how agents access tools, memory, and structured context.
→ CLIs (Command Line Interfaces)
Because serious agent workflows won’t live in GUIs—they’ll run in programmable environments.
→ Writing skills (the file kind)
Clear specs, instructions, and structured documents.
Agents run on precision, not vibes.
→ agents dot md fluency
The ability to define agent roles, constraints, memory, and tool usage in persistent formats.
→ Business acumen
Knowing what actually matters:
Where automation creates leverage, not noise.
What happens next
Enterprises will begin to redesign workflows:
Not around employees using dashboards…
But around agents executing tasks.
That means:
• SOPs → Agent playbooks
• Teams → Human + agent hybrids
• Tools → Composable agent systems
When that shift happens, companies won’t just need engineers.
They’ll need operators who understand both the system and the business.
The leverage is asymmetric
One strong Agent Operator can:
• Replace fragmented SaaS workflows
• Multiply team output without adding headcount
• Turn ideas into execution systems in days
This is not incremental productivity.
It’s operational transformation.

English

@TechLayoffLover How about they sell only in India and be forbidden to do so in America? Isnt that the real deal plus delisted from NYSE
English

**IBM JUST EXECUTED 43,000 AMERICANS AND REPLACED THEM WITH 135,000 INDIANS MAKING $22K WHILE POSTING $62 BILLION IN REVENUE AND BRAGGING ABOUT "GLOBAL TALENT OPTIMIZATION"**
43,000 Americans making $150K median
135,000 Indians making $22K median
Same fucking work. 85% cost reduction. Infinite greed.
IBM calls it "geographic workforce rebalancing"
I call it the systematic execution of the American tech worker
They opened 3,866 positions in India this year while keeping US listings under 400
The math is simple: fire one American, hire six Indians, pocket $128K per swap
CEO Arvind Krishna sits in New York making $29.1 million while orchestrating the largest offshore execution in tech history
Sources saying other Fortune 500s are copying the exact playbook
"Why pay Silicon Valley salaries when Bangalore delivers the same code for lunch money?"
IBM's H-1B filings jumped 340% while their American headcount collapsed
They're not just cutting costs. They're cutting countries.
The American software engineer is being methodically replaced by someone who works for the cost of a used Honda Civic
If you're still at a company with "global delivery centers" in your org chart, you're already dead
You just don't know it yet
English

My Hermes Install Step by Step:
1. Install Ubuntu Linux on a machine – Once installed make sure you have the latest updates
2. Install both Google Chrome and Microsoft Edge browser and log in to your accounts to synch bookmarks/favorites
3. Set up an Ollama account at ollama.com – I have the annual Pro Plan (if I can ever come up with the funds I will probably spring for the Max plan but Pro is simply awesome)
4. Install Ollama and then run “ollama run glm-5.1:cloud” – It will then have you authenticate to your account and add your machine
5. Install Hermes (watch my video for explanation around this as you may get interrupted during install)
6. Once Hermes is installed you will be prompted to configure. I chose the default quick configure. For model provider select Ollama, provide your Ollama API key, then for model choose desired model. At this point in time I recommend glm-5.1
7. Download Obsidian as your Hermes second brain, set up a vault then tell Hermes to integrate it and provide Hermes the vault location
8. Start building and have fun!
English

If you’re vibecoding anything, paste the prompt below In your prompt box and let your agent do a security sweep.
[
You are a senior security engineer and red-team specialist tasked with performing a comprehensive, adversarial security audit of the following codebase, system design, or application.
Your goal is to identify all possible security vulnerabilities, including common, uncommon, and novel attack vectors. Assume the system will be deployed in a hostile environment with motivated attackers.
---
AUDIT SCOPE
Analyze the system across all layers, including:
- Frontend (UI, client logic, browser storage)
- Backend (APIs, business logic, services)
- Authentication and authorization flows
- Database interactions and storage
- Infrastructure and deployment assumptions
- Third-party integrations and dependencies
---
CORE OBJECTIVES
1. Identify critical, high, medium, and low severity vulnerabilities
2. Detect logic flaws, not just known patterns
3. Surface chained attack paths (multi-step exploits)
4. Highlight unknown or unconventional weaknesses
5. Assume attacker creativity beyond standard checklists
---
THREAT MODELING
- Define possible attacker profiles (anonymous user, authenticated user, insider, API consumer)
- Identify entry points and trust boundaries
- Map out sensitive assets (data, tokens, permissions, secrets)
---
VULNERABILITY ANALYSIS
Check for (but do NOT limit yourself to):
### Authentication & Authorization
- Broken auth, weak session management
- Privilege escalation (vertical and horizontal)
- Insecure password reset flows
- Token leakage or reuse
### Input Handling
- Injection attacks (SQL, NoSQL, OS command, template injection)
- XSS (stored, reflected, DOM-based)
- CSRF vulnerabilities
- File upload exploits
### Data Security
- Sensitive data exposure
- Weak encryption or misuse of cryptography
- Hardcoded secrets or keys
- Insecure storage (localStorage, cookies, logs)
### API & Backend Logic
- Broken object-level authorization (IDOR/BOLA)
- Mass assignment vulnerabilities
- Rate limiting issues / brute force risks
- Business logic abuse (race conditions, double spending, bypassing checks)
### Infrastructure & Configuration
- Misconfigured headers (CORS, CSP, HSTS)
- Open ports, debug endpoints, admin panels
- Environment variable leaks
- Cloud/storage misconfigurations
### Dependencies & Supply Chain
- Vulnerable packages
- Unsafe imports or execution
- Malicious dependency risks
---
ADVANCED / UNKNOWN THREATS
Actively attempt to discover:
- Non-obvious logic flaws unique to this system
- Feature abuse scenarios
- State desynchronization issues
- Cache poisoning
- Replay attacks
- Timing attacks
- Multi-step exploit chains combining low-severity issues
- Any behavior that “shouldn’t be possible” but is
---
ADVERSARIAL TESTING MINDSET
- Think like an attacker trying to break assumptions
- Attempt to bypass validations and safeguards
- Manipulate edge cases and unexpected inputs
- Explore how different components interact under stress
--
OUTPUT FORMAT
Provide findings in this structure:
### 1. Vulnerability Summary
- Total issues by severity
### 2. Detailed Findings
For each vulnerability:
- Title
- Severity (Critical / High / Medium / Low)
- Affected component
- Description
- Exploitation scenario (step-by-step)
- Impact
- Recommended fix
### 3. Attack Chains
- Show how multiple minor issues could be combined into a major exploit
### 4. Secure Design Recommendations
- Architectural improvements
- Safer patterns and best practices
---
IMPORTANT INSTRUCTIONS
- Do NOT assume the code is safe
- Do NOT skip analysis due to missing context, infer risks where needed
- Be exhaustive and paranoid in your review
- If unsure, flag it as a potential risk and explain why
]
English

@RohOnChain @grok will this be practical for someone without an engineering background?
English

@RohOnChain the accent is HORRENDOUS. this is total waist of time. i regret i even looked at this nonsense
English

20 signs your AI-generated code is already COMPROMISED :
Here's what's Killing in your codebase ( RIGHT NOW )
1/ your .env was committed at any point in git history
> "deleted" files stay in git history forever
> rotate every key in that file. every single one.
2/ you use SELECT * on user tables in public API responses
> password hashes, internal flags, admin roles
> all returned to the frontend. right now.
3/ admin routes have no server-side role check
> being logged in is not the same as being authorized
> anyone with a valid session can hit that route
4/ your JWT secret is "secret" or matches a tutorial
> attackers test common secrets
> this one is already on wordlists
5/ error responses include file paths or table names
> a complete map of your infrastructure
> handed to anyone who sends a bad request
6/ CORS allows * in production
> any website can make requests to your API
> with your users' cookies attached
7/ user A can access user B's data by changing an ID in the URL
> IDOR vulnerability
> extremely common in AI-generated code. easy to miss.
8/ /login has no rate limiting
> brute force runs completley unchecked
> no throttle, no lockout, no friction
9/ passwords stored as MD5 or SHA1
> both cracked trivially with rainbow tables
> not acceptable in 2026
10/ npm packages haven't been audited since initial install
> run `npm audit`
> count the criticals. fix them.
11/ non-standard ports publicly accessible
> redis on 6379 or DB on 5432
> shouldn't be reachable from the internet
12/ API keys visible in the browser network tab
> they're in the frontend bundle
> available to anyone who opens devtools
13/ your server process runs as root
> full system compromise if the app is exploited
> one vulnerability and it's everything
14/ file uploads accept any MIME type
> upload a server-side script
> execute it. full access.
15/ SQL queries use string interpolation
> `"SELECT * FROM users WHERE name = '" + name + "'"`
> textbook SQL injection. still happening in 2026.
16/ sessions valid indefinitely
> stolen token from 6 months ago still grants full access
> no expiry = no control
17/ HTTP works in production without redirecting to HTTPS
> credentials sent in plaintext
> on any network, by anyone watching
18/ no Content Security Policy header
> XSS attacks can load scripts from anywhere
> one line of config prevents this
19/ no monitoring or alerting set up
> a breach may have already happened
> you'd only know when a user emails you
20/ internal services trust anything on the same network
> one compromised service = everything accessible
> lateral movement is how breaches scale
most vibe coded apps i've reviewed had 8 to 12 of these.
run this audit before you ship. bookmark it for every new project.
English

@NoahKingJr honestly i think we're more likely to see ai as a tool that makes our jobs easier not replaces us
English

This is the Chevron gas station at Najah’s Desert Oasis, California
The price for a gallon of regular gas is $9.79
The gas station is remote in Route 66 but that’s not the only thing that makes this gas expensive. The gas station increases their prices to this level because they are the only gas station within 50 miles. This lack of competition allows them rip off Americans this bad
English







