🇪🇺🇨🇿🇺🇸. math. Ethereum. ZK. Rust🦀. @worldcoinfnd. accelerating @worldnetwork. World Chain⚪️. angeling in friends. Hopeful about humanity. @EthPrague
🇺🇸🇨🇿cz/acc🇨🇿🇪🇺
Joined April 2017
- Tweets56.5K
- Following5.5K
- Followers49.4K
- Likes194K
dcbuilder.eth ⚪️ retweeted
I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it:
Long-live static credentials must die. We never want to rotate API keys again.
Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part:
- We are requiring vendors on our marketplace to support OIDC
- We shipped @shadcn components to make it easier to ship OIDC configuration
- We are expanding OIDC support on our own platform
The last generation got the web from HTTP to HTTPS. It is on us to move past API keys.
vercel.com/blog/death-to-lon…
dcbuilder.eth ⚪️ retweeted
Marc Andreessen says the gap between what AI-native startups and incumbents think AI can do is the widest he’s ever seen:
"The AI-native early stage startups have just a completely different view on what they can do with AI than the typical incumbents in almost any industry, almost without exception."
"AI is just racing ahead in capability even week by week... There are going to be a lot of industries that are really up for grabs in a fundamentally more profound way than maybe has been the case in the past."
"The founders are gonna have a level of superpowers coming from the use of these tools and these technologies that they just simply haven't had in the past... Had I had Astra and Netscape in 1994, like, oh my God. Like, Ben, what would you and I have been able to do at Netscape?"
"Those entrepreneurs are gonna color way outside the lines. We already see this. They're not gonna think of themselves as like, 'I'm just a software company,' or, 'I'm just a hardware company,' or even, 'I'm just an AI company.'"
@pmarca @bhorowitz
Today, a16z Crypto is becoming a16z Frontier.
Since joining a16z in 2013, @cdixon has focused on technologies that look futuristic well before they reach the mainstream. Those themes led to investments in Oculus, Skydio, Zipline, Coinbase, Solana, and Uniswap.
Frontier expands that mandate beyond crypto to back "outer planet" founders who are building new technologies and creating markets that may take years to develop.
Chris joins @pmarca, @bhorowitz, and @eriktorenberg to discuss why crypto has become part of the broader tech landscape, why Frontier fills a hole in the firm's architecture, and why they'd rather be too early than too late.
They also get into why the gap between AI-native startups and incumbents is the widest Marc has ever seen, how AI could pull forward 20 years of frontier technology, why stablecoins may become the way AI agents pay each other, how AI is breaking the internet's business model, and why today's 18-year-olds are about to become superhumans.
0:50 Introducing a16z Frontier
2:49 Smartphone parts to drones and VR
4:47 Backing the "outer planets"
7:11 Good ideas that look like bad ideas
10:43 The JP Morgan photo in Marc's office
15:13 Good tech ideas eventually work
16:53 AI may pull tech 20 years forward
18:18 The widest AI gap Marc's ever seen
22:06 Workers adopt AI before companies do
26:32 Old use cases vs. AI-native ones
30:08 Beyond "product manager brain"
34:45 AI can reverse engineer any hardware
38:23 The case for open source AI
46:36 How AI breaks the internet's model
49:11 VR, homebrew hacking, multiplayer AI
54:00 If you're 18, study "modern alchemy"
YouTube: youtu.be/-9XQMHhpypc
Not an offer or solicitation. None of the information herein should be taken as investment advice; Some of the companies mentioned are portfolio companies of a16z. Please see a16z.com/disclosures for more information. A list of investments made by a16z is available at a16z.com/portfolio.
dcbuilder.eth ⚪️ retweeted
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?
Expert: No, software is constantly evolving.
Philomena: So they've been writing the same website for 20 years?
Expert: No, different projects.
Philomena: Have they tried finishing one before starting another?
Expert: That's not how software development works.
Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.
Expert: Right.
Philomena: Is PHP like that?
dcbuilder.eth ⚪️ retweeted
PSA: If you use Node or Bun, please upgrade even if you’ve enabled --use-system-ca!
That flag unions the system roots with the the bundled roots, so older versions will continue to accept the eMudhra cert even if your OS removes it.
dcbuilder.eth ⚪️ retweeted
DC fined me $75 for littering after I put some things out for a bulk trash pickup my neighbor had arranged. The city actually collected the trash. As far as I know, I did nothing wrong.
Still, I was perfectly happy to pay $75 rather than waste time fighting it. But the citation didn't even mention an online payment portal. When I asked ChatGPT how to deal with it, it found that the online filing portal appeared to be down for maintenance, but offered to submit an "admit with explanation" response by email.
I said sure. It prepared the paperwork, attached the citation, and emailed the administrative hearings office.
It was significantly easier than paying the fine.
This is a fascinating reversal of the traditional asymmetry between citizens and government. The state has automated issuing fines, while citizens have had to manually navigate cumbersome appeals processes. AI makes responding almost frictionless.
If everyone starts doing this, not as a protest but simply because it's easier, governments will face a deluge of procedurally valid responses where they previously collected revenue with little effort.
Things are going to get interesting.
dcbuilder.eth ⚪️ retweeted
Crypto’s irony is that it usually is attacked first and mocked for its operational failures
Yet the competition ends up looted more aggressively later by the same actors (🇰🇵) and reluctantly adopts the security solutions that wouldn’t exist without crypto being attacked first
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
dcbuilder.eth ⚪️ retweeted
BREAKING: JPMorgan, Bank of America, Wells Fargo, & other major banks have reportedly detected unauthorized AI agents operating inside customer accounts.
dcbuilder.eth ⚪️ retweeted
We've decided to sunset Arc on December 22, 2026.
That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community.
Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward.
We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how:
· Your passwords, bookmarks, extensions and history come over to Dia seamlessly.
· Spaces, Folders, and Tab Groups are in Dia and import over with your data intact.
· Dia now surpasses Arc benchmarks in stability, speed, and security.
· The browser features you use in Arc are free in Dia, and the AI is optional.
Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.
dcbuilder.eth ⚪️ retweeted
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
dcbuilder.eth ⚪️ retweeted
gotta give it to @OpenAI and their sane daybreak program
heif heist by harsh
kvmescape by paulos
php2shell by lcfr
gitlab rces by joaxcar
chrome full chain by moyix
wordpress rce by hashkitten
all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol.
dcbuilder.eth ⚪️ retweeted
People don’t necessarily think of @OpenAI as a cyber security company but I think over the next 6 months or so that will change.
The php vuln found today is important and I’m proud of our contribution to discovering it.
There is much much more we can/have/will do to ensure we keep the Internet safe.
Watch this space!
dcbuilder.eth ⚪️ retweeted
dcbuilder.eth ⚪️ retweeted
Last month, we demonstrated high-rate alchemy: turning mercury into real, stable gold, beating CERN’s record by a factor of 10.
Last week, we enriched isotopes in the world’s most powerful plasma centrifuge, beating the Soviet record that stood for 40 years.
Now, we’re building a fusion reactor in San Francisco to achieve record power density.
dcbuilder.eth ⚪️ retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
dcbuilder.eth ⚪️ retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.