CEO @AnchorWatch, Bitcoin Custody & Insurance You can't stop Math, molon labe.
Joined June 2009
- Tweets27.9K
- Following2.3K
- Followers25.9K
- Likes13K
Pinned Tweet
IBM in 1979:
Claude Code wiped our production database with a Terraform command.
It took down the DataTalksClub course platform and 2.5 years of submissions: homework, projects, and leaderboards.
Automated snapshots were gone too.
In the newsletter, I wrote the full timeline + what I changed so this doesn't happen again.
If you use Terraform (or let agents touch infra), this is a good story for you to read.
alexeyondata.substack.com/p/…
ALT A console screen shows a critical warning about a destroyed database and missing backups, outlining deleted infrastructure components.
Looks like @TheGarden is taking red teaming a little too far.
This is one of the most frequent conversations I’ve had with Bitcoin Core developers in the past few months.
Announcements of patches to come benefit attackers (see php bug where “find bad bug in php” allowed anyone to spend $3 and get RCE).
Good call by the Core team.
TIL Linux in 2024 changed the rules on how CVEs work.
Would be an interesting exercise to debias to pre-2024 guidelines to see how much of this is inflated vs rate of similar bugs being found increasing.
Even post 2024, we're on pace to doubling 2025's CVEs this year.
Sources
[1] NIST National Vulnerability Database, CVE API 2.0. Record-level extraction; source of all counts.
nvd.nist.gov/developers/vuln…
[2] CVE Program, kernel.org added as a CVE Numbering Authority, 13 February 2024.
cve.org/Media/News/item/news…
[3] Linux kernel documentation, CVEs: assignment process and applicability.
docs.kernel.org/process/cve.…
[4] CVE Program history: public launch in September 1999.
cve.org/Resources/Media/Arch…
[5] Linux Foundation, Kernel Archeology (2020): initial Linux release in September 1991.
linuxfoundation.org/hubfs/Re…
[6] CVE Program FAQ: the year in a CVE identifier is not the discovery, introduction or fix year.
cve.org/Resources/Media/Arch…
Rob Hamilton 🟥 retweeted
Formal verification, fuzz testing, LLM scanning. With skilled operators.
Secure all the things.
For the record, I think Bitcoin Core is a great way to secure Bitcoin (and have for a long time). The question has always been about a tradeoffs.
Bitcoin core does not have "batteries" included. There is no GUI support for multisig (soon™), and needing to prep a device like removing bluetooth, wifi, etc add friction to the UX, but if you know what you're doing have at it!
Someone who is blind sent me an email asking about help for bitcoin custody. I'm at a loss on how to best help them.
What are good accessibility options for those who want to self custody and are blind?
Ask yourself, if the frontier AI companies actually cared about cyber security, why would they disable Zero Data Retention for their leading models?
The truth is, every time you get a cyber security flag, they are looking at that data for themselves to train on it.
I’m at @McDonalds rolling a new Certificate, does anyone else want anything?
I hope you all one day find someone who looks at you the way @stutxo looks at his phone while editing his bangers.
Rob Hamilton 🟥 retweeted
an interview with the creator of the bitcoin reference client @rbitcoin_org
You were able to find the PHP bug in advance by prompting “Find bad vulnerabilities in PHP”.
The age of software embargos and announcements of future releases is over. They asymmetrically help attackers over defenders.
Just ship the patch. It’s messy but the least worst option.
Rob Hamilton 🟥 retweeted
The cost of security exploits in the age of AI is rapidly trending to zero. Here are my thoughts as to what this means.
Rob Hamilton 🟥 retweeted
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
As high as CVSS 9.0. Whoops.
phoronix.com/news/LKML-New-T…
Rob Hamilton 🟥 retweeted
Bruh... DNS infa is fucked. Update your bind boys
is it time to turn the internet off yet
kb.isc.org/docs/cve-2026-943…
