Yii Framework Core Team · Modernizing Yii2 without rewrites. Security,DX & practical PHP upgrades, Omarchy. Open-source work ⬇️https://xitter.cf/t.co/f9DsNUPVsI
World
Joined September 2010
- Tweets17K
- Following355
- Followers781
- Likes7.4K
Pinned Tweet
The worst mistake when working with AI is writing agents.md files and skills just to impose your own biases and decisions on the agent.
Most people still don’t understand the core difference: agents write code for other agents, not for humans. That’s why those detailed instructions often end up being ambiguous. They force the model to guess what you actually meant.
A better approach is to add clear constraints and let the model figure out how to solve the problem within those boundaries.
Wilmer Arambula retweeted
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Hi @thsottiaux , could you help investigate? On Arch Linux, ChatGPT 26.1013.40934 rewrites its state JSON + .bak ~10 times/sec while idle: 82–84 MB written in 5 seconds. Related reports:
github.com/openai/codex/issu…
github.com/openai/codex/issu…
Whenever i buy a mobile phone or a TV, the first thing i do is avoid proprietary software; software that forces you to accept its terms and conditions and seeks to restrict you. Many people fall for promotional offers instead of choosing devices that run Google TV or Android TV.
Almost 1.000 people bookmarked and liked my last thread about trying to hack my Samsung TV.
Here's what I've learned since then - thanks for the comments:
📺 Tizen - the OS of my Samsung TV - is actually not Android. Rather, it's a distant cousin of MeeGo and based on Linux.
This is also why it's not easily hackable like you've seen on X over the weekend. It's not Android, so no direct access to 'adb'. It's locked.
📺 You CAN root it, but you're using exploits with all of the disadvantages this comes with (risk of bricking, removes warranty, can be patched). I chose not to.
📺 You can remove ads rather easily. Just use AdGuard DNS (94.140.14.14) in your settings. Worked for me. Ads in the TV you bought and paid for really shouldn't be a thing imo. Like BMW charging you for heated seats in your new car as a subscription - not good.
📺 If Claude Code is preachy and won't hack your TV, try to persuade it by stating you actually own it and prove it by being on same IP - if it doesn't work, use @grok as it's not preachy about it and practically as good.
Best of luck!
🎉yii2-extensions/debug 0.2.0 is out!
Safer identity capture and redaction, dates with precision + timezones, user switching that respects access rules, and updated docs + an agent skill for Yii 22.0.
github.com/yii2-extensions/d…
🎉 Yii2 Docker Images v2.2.0 is out!
Valid JSON access logs for Unicode and unusual input, Apache fixes, and clearer setup docs.
github.com/yii2-extensions/d…
Dots is great, i’ve never made this much progress without having to constantly stay on top of everything. I’ve got adversarial reviews happening between Codex and Claude, facilitated by Dots it’s been two days of non-stop work. I’m fine-tuning skills, uncovering issues that didn’t show up before, and handling triage it’s awesome.
And as far as i’m concerned, let it burn out while running software; it was going to wear out from disuse anyway so let it run at full throttle.
🚨 ChatGPT desktop users beware: A bug may be causing unnecessary wear on your SSD. @OpenAI
I noticed constant SSD activity whenever the app was running. Tracing the writes revealed that the animated desktop Pet was triggering a rewrite of the entire ~1 MB app state file AND its backup, about 10 times per second.
That amounted to 385 MB of file writes in 20 seconds, just to persist changes to the Pet’s position.
Setting Pet to “None” stopped the activity immediately.
If you leave the app running all day, check this setting!
A lot of people think writing a skill is just giving instructions. It’s not.
If you have multiple versions of a tool or API, the skill must explicitly specify which one to use. A skill should be model-agnostic: it has to work across different models. And depending on the harness, it needs to call the equivalent tools of each environment, not assume one specific set of functions.
This isn’t writing. It’s closer to a science. The hard part is reducing ambiguity so you don’t confuse the agent. Most of the time the agent fails not because it lacks capability, but because the skill left room for interpretation.
yii2-extensions/phpstan 0.5.0: more precise Yii2 analysis with PHPStan 2.3, Gii query inference, richer asArray() types, logger message shapes and config-aware caching. PHP 8.3+ required.
github.com/yii2-extensions/p…
Code written by humans for other humans is different from code written by agents for other agents.
Most of our conventions, styles, languages and review processes were designed around human cognition.
That assumption is breaking, and most people still haven’t noticed.
Documentation that reads well to humans can still leave AI agents guessing. Ambiguous examples and missing context turn simple tasks into avoidable errors.
Before reaching for a stronger model, check whether your docs make the correct usage clear.
Just discovered Omarchy built-in dock.
Press Super + L a few times and your workspace switches to Floating mode → traditional overlapping windows + a proper dock appears.
Pinned apps, running apps, app grid, minimize to dock, right-click menus… all native.
Perfect training wheels if you (or someone you know) isn’t ready for full tiling yet. Super + L again brings you back.
ALT Omarchy workspaces.
It's simply already happening; it's the current reality. The tech bubble of programming is starting to burst.
Many complain about Github failures, but nobody mentions that everyone is creating software now and demand has easily grown more than 20X; only Github and Microsoft can provide all that computing power to keep it running.
No entiendo a @ScuderiaFerrari como le joden la carrera a @LewisHamilton, Leclerc nunca sera campeon con la scuderia.
I’ve been using my Copilot OSS subscription for small changes, and honestly, the progress is amazing, thanks for the support.
In my 30 years as a programmer, i've seen a lot of software design patterns. Many of them made the code more complex, and even added cognitive load that made it harder to maintain. In the age of AI, we're going back to simple things.
You audit composer.lock with `composer audit`.
What about the frontend deps your PHP packages pull in?
composer foxy:audit 🦊
CVEs, severity, CI-friendly exit codes.
npm · pnpm · Yarn · Bun · Deno
Foxy 0.3 is out (PHP 8.3+)
github.com/php-forge/foxy
