I help regular people learn programming and personal finance • YouTuber (views are mine)
Houston, TX
Joined March 2011
- Tweets13.5K
- Following1.3K
- Followers1.4K
- Likes23K
Rhett Reisman retweeted
Almost everyone misunderstands how political realignments work. This is how they actually play out in real life.
When a true realignment election happens, the entire country shifts Left or Right. But the real story lies with a specific bloc of voters that moves much further than everyone else.
The realignment is about them, a particular group rejecting the previous political order and attaching itself to a new coalition. The rest of the country drifts in that direction too, but that specific group is in open revolt against the old order.
But realignments never move in a straight line. When there's a huge shift in one direction, there's almost always a snapback in the next midterm or even the next presidential cycle, when that same bloc partially reverts to its old voting habits.
This is the political equivalent of a dead cat bounce in the marketplace. The reversion never brings that bloc back to the same level of support it previously held for the party it's revolting against.
There are two clear examples I think of here, and both help us understand whether we're in the midst of seeing a new realignment playing out today.
The first happened in the South.
In 1968 and 1972, Richard Nixon cracked the Democratic “Solid South.” White Southern voters who hadn’t backed a Republican presidential candidate in generations suddenly did. The entire region became a political battlefield for only the second time in American history (the first was a failed GOP inroad in the South in the 1920s, which was totally reversed following the Depression).
So what happened in 1970 and 1974?
Southerners voted overwhelmingly Democrat, but not quite as Democrat as they had back in the early 1900s.
The same thing happened with Reagan.
In 1980, he won a landslide, and the South went majority Republican at the presidential level for only the second time since Reconstruction.
In 1982, there was a snapback. In 1984, Reagan won an even bigger landslide, and in 1986, the Democrats rebounded yet again in the South.
Meanwhile, Democrats continued to dominate Southern state legislatures and governorships well into the 1990s and even 2000s. Arkansas had a Democrat-controlled legislature all the way until 2012.
Could you imagine Democrats controlling the Arkansas General Assembly today?
This is what realignments look like. The Presidential vote moves first, and that eventually finds its way down the rest of the ballot over the course of an entire generation, and sometimes even multiple generations. Voters experiment with voting for a different party for President before they fully convert to a new partisan loyalty.
The point here is that realignments are a process, not an event.
And if you want another example of this, look at suburban America.
Clinton made major inroads in the suburbs in the 1990s. Republicans respond with the 1994 Revolution and wipe Democrats out in many of those same suburban districts.
George W. Bush won those same suburbs again in the 2000s, though not by the same margins as his father did in 1988. And in 2008, Obama builds on the suburban shift that began with Clinton.
Then what happened?
Republicans blow Democrats out of the water in those same suburbs in 2010 and 2014, but they don't even come close to the sort of margins they put up in the 1980s or even the 1990s in many of these same counties. In some suburbs, they can't even match Bush's 2000 or 2004 margins.
We are watching the same thing happen again. What Republicans achieved in the South in the 70s and 80s, and what Democrats pulled off in the suburbs in the 90s and 2000s, appears to be playing out all over again with younger voters and Hispanics.
In 2024, Republicans made serious inroads with both blocs.
So what's going to happen in 2026 is that the GOP will massively lose ground from where they were two years ago. But if it’s a realignment, they won’t lose those voters by the sort of margins they lost them by in 2012 or 2018 or even 2000. The “crash” will still leave them at a structurally higher floor than a generation ago.
And why am I so confident of this?
Because in a year where they won Virginia by over 15 points against one of the weakest GOP campaigns in history, Democrats couldn't even match the same margin in some of the most overwhelmingly Hispanic precincts in the entire state as they did in 2016, when they only carried Virginia by barely 5 points.
The entire state moved over 10 points to the Left from 2016 to 2025, and Democrats LOST ground in the most Hispanic precincts in the state.
That doesn't mean they won't win these places overwhelmingly in 2026. They absolutely will. But they're not going to win them the same way they did a decade or two ago.
Just like in the stock market, we've set a new all-time high, so there's inevitably going to be a pullback. But the overall trajectory on a long-term multi-generational basis is very clearly moving in one direction, and no midterm election pullback is likely to undo that.
Rhett Reisman retweeted
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
Rhett Reisman retweeted
"Visiting Japan is radicalizing."
"What do you mean?"
"You'll see."
.......
"Oh."
I'm back now and yeah I see.
Donnie is sniping the bottom and some of you are still bearish
BREAKING: We just caught another interesting trade.
President Trump just filed multiple July purchases of Microstrategy stock.
$MSTR has risen 83% since his purchase on July 24th.
Rhett Reisman retweeted
For one example of the plunging “cost of thought,” take OpenAI’s o3 model. Released in January 2025, it was the first LLM to score >25% on FrontierMath Tiers 1-3. The bill for achieving this mark: $0.55.
This summer, GPT-5.6 Luna did the same for $0.0015. A 377-fold drop in 18 months.
Rhett Reisman retweeted
I don’t think there’s any benchmarks that accurately reflect the current capabilities of LLMs
Rhett Reisman retweeted
I've enjoyed working with Cursor pre-acquisition and have respect for the team and what they have built. The 5% here should have come with strong caveat and I would love for Michael to share the math.
Tokens are not a proxy for revenue nor value created and the OpenAI models are on the very frontier of token efficiency. Smaller or less strong models require many more tokens to achieve a task and therefore will inflate traffic share significantly.
We’re sorry to see that OpenAI put out a note saying they plan to block Cursor users from accessing OpenAI models in three months.
OpenAI models serve about 5% of Cursor user traffic, and we’re speaking with the OpenAI team to resolve this.
Cursor was one of the very first users of OpenAI, we’ve worked closely with their team for years, and we’ve trusted their platform to be neutral infrastructure for our business.
Rhett Reisman retweeted
If I try to replace all my American engineers with foreign engineers who scored a few points better, I should be stopped by the law or worse.
We cured cancer and half the comments are bearish.
Do not ever listen to the mob of negative opinions.
BREAKING: Moderna stock, $MRNA, surges over +110% after announcing the first ever positive Phase 3 results for a personalized cancer vaccine.
Rhett Reisman retweeted
“Whoa this is so cool!”
Discarded Magneton:
Scrapped Pokémon Designs from Gen 1
Readers added context they thought people might want to know
These are not authentic scrapped designs from Gen 1. Real beta and unused Pokémon from the original development are documented on these sites and do not include the sprites or names shown here.
bulbapedia.bulbagarden.net/wiki/List_of_u… pokemon.fandom.com/wiki/Pok%C3%A9…
When will all the Tether truthers apologize and admit they were wrong?
Wen Tether audit? nOw.
Today Tether announces its first full financial audit for Tether International, conducted by KPMG U.S. which resulted in an unqualified clean opinion, marking the highest result possible.
An unqualified opinion is the best possible audit opinion an independent auditor can issue.
(“unqualified” in accounting jargon means without reservations — not that the audit was incomplete).
Tether’s financial audit, by at least an order of magnitude, is the largest inaugural audit in the history of finance. My congratulations go to the entire Tether team and especially to our Finance function, which demonstrated its ability, precision and commitment to complete this review process within the highest standards across the whole digital assets and global financial industry. We couldn’t be more proud.
Despite our Company being subject to several years of detractors’ false claims, competitors lies, political attacks and misinformed coverage by several mainstream newspapers trying desperately to discredit us for the benefit of their friends in the tall ivory towers, Tether delivered what it promised: a full financial audit issued by a Big Four accounting firm, KPMG U.S.
Tether created the stablecoin industry with USD₮ in 2014, revolutionizing the whole financial industry. Today everyone talks about stablecoins, yet it all started 12 years ago, with a tiny team and a big mission. We were there when no one else could understand the disruptive potential of what we invented.
Our Company has evolved into one of the most financially significant and operationally sophisticated private companies in the world. This audit demonstrates that our financial infrastructure and governance have evolved alongside that responsibility. Today, more than 650 million users across all emerging markets continue to rely on Tether daily, choosing USD₮ as their currency, for their life savings, for their commerce, for the future of their children. These are people that have been left behind by the traditional financial system and they trust our Company to remain resilient amidst all the global uncertainty that plagues the world - the proof of that stability is no longer just a Tether promise; it's now an independent signed opinion.
“Never cared for what they say
Never cared for games they play
Never cared for what they do
Never cared for what they know
And I know
Nothing Else Matters”
Rhett Reisman retweeted
Open source is not a security property. It is a distribution and inspection property. Confusing the two is how the industry keeps selling trust minimization theater.
Those who equated Coldcard’s public source (not really open source, by the way) with security just learned, the hard way, that availability is not a security property.
1️⃣ Open source is genuinely great
First, the philosophical case. Sharing knowledge, letting anyone inspect, fork, and build on it, is one of the best things computing ever produced. It compounds human knowledge. And now, AI knowledge too.
Second, for pure software, it can reduce trust. Clone the repo. Compile it. Run it on your machine. That is a real, concrete property. You are not downloading a black box from a vendor and hoping the binary matches the marketing page.
2️⃣ Hardware wallets break the simple story
On a hardware wallet, verifying source is not enough. You also have a trust assumption on the device itself.
Yes, you can review the code, compile it, and load it onto the wallet. But unless the device gives you attestation and real tamper resistance, you have no strong guarantee that what runs is what you loaded. You may believe you are running your firmware while a backdoor was introduced in the process.
That is the uncomfortable part: source availability does not magically transfer integrity guarantees onto silicon.
3️⃣ The chip is still a black box
Even if the application firmware is open, the chip embeds low-level firmware that handles the hardware primitives. That layer is almost never open. You have no visibility into it, and a lot of blind trust assumptions sit right there.
You might think: "Then build an open-source secure element." That sounds elegant. It is mostly wishful thinking.
Reaching the security level of secure element manufacturers is incredibly hard. Decades of experience. Mountains of patents. Billions invested. Specialized process nodes, countermeasures, certifications, attack labs. This is not a weekend GitHub project with better vibes.
4️⃣ Even full openness does not solve verification
Assume the hard part is somehow solved. Full design open. All the sources in your left hand. Actual chip in your right hand.
How do you prove these two things match?
You cannot. That gap is not a footnote. It is the core problem of hardware trust. Open schematics do not give you a cryptographic bridge between "what was designed" and "what was manufactured and shipped."
5️⃣ "Many eyes" is not a threat model
Another popular claim: open source means anyone can review and audit the code, so bugs get found faster.
In theory, yes. In practice, professional security researchers do not review code for free. Bug bounties help align incentives a bit. They do not replace paid third-party reviews, audits, pentests, and certifications.
If your security model is "the crowd will save us," you do not have a security model. You have a hope.
6️⃣ Then AI entered the chat
AI is extremely good at finding vulnerabilities and turning them into exploits at very low cost.
What happens next is predictable. Malicious actors scan interesting open-source repositories, extract attack surface, and exploit at scale. The incentive misalignment is structural: defenders pay to secure one codebase; attackers amortize discovery across thousands.
You cannot clap your way out of that.
7️⃣ Closed source is not security. It is friction.
Incidentally, closed source makes exploitation harder. Anyone who has done offensive security knows this. If you cannot get the source or even the binary easily, breaking the system becomes much more expensive.
That does not mean security should rely on obscurity. Not at all.
Security must come from security by design, defense in depth, secure hardware, real countermeasures, attack detection, and so on. Then you pay competent people to review the code, run pentests, and challenge the design.
And if, on top of that, attackers do not get free access to your source, you add friction. You widen the moat. Obscurity as a foundation is weak. Obscurity as an extra layer on top of strong design is rational.
Where this leaves us
Open source is valuable. Philosophically. Practically. For software transparency and community building.
It is not a substitute for secure hardware. It is not a substitute for attestation. It is not a substitute for paid adversarial review. And it is definitely not a free lunch against AI-assisted attackers.
Those who equated Coldcard’s public source (not really open source, by the way) with security just learned, the hard way, that availability is not a security property.
ℹ️What about Ledger?
Most of Ledger’s code is open source: Ledger Wallet, the crypto libraries, and the apps that run on the device. You can inspect them. You can audit them. That part is real.
The low-level part of the operating system is not. Not because we enjoy secrecy. Because it talks to the internals of the Secure Element, and that interface sits under NDA with the chip vendor. We cannot publish it.
So we face a tradeoff: publish everything and pretend that “open” equals “trustless,” or keep the SE boundary closed and actually use hardware that can resist real attackers.
Between a high level of security and a fake trust assumption, we chose the former.
Call it what it is: open source reduces some trust assumptions and creates others. Hardware security lives in the ones it cannot eliminate. Stay honest about which ones you are actually removing.
Stay safe. Stay honest about your trust assumptions.
Rhett Reisman retweeted
In 2024, victims came to us with bitcoin missing from Coldcard wallets. No malware, no phishing. We traced it to weak seed entropy and filed reports with the manufacturer and multiple agencies. Two years later: $38M swept in 25 minutes.
blockchainunmasked.com/post/…
