📖: Tamers of Entropy - cypherpunk novel. Liberty / Entrepreneurship / Good vibe-codes Nostr: [email protected]
🥥
Joined April 2008
- Tweets19.9K
- Following2.3K
- Followers14.6K
- Likes11.9K
Pinned Tweet
Author of Tamers of Entropy / Krotitelia Entropie: a lunarpunk / cypherpunk novel about where we are and where we are going. tamersofentropy.net
Learn about Bitcoin for your lifestyle, enjoying volatility and thriving in uncertainty. My goal is tech + hacking => liberty and life satisfaction.
Good vibes / tech: github.com/jooray - author of Emanator (Nostr multi-account client and scheduler), Lievik (marketing channel automation), Nostrautica (event app with attendee matching) and a lot more!
Find my books and courses, such as Cryptocurrencies: Hack your way to a better life.
Books, Courses (EN, ES): hackyourself.io/shop/
Books, Courses (SK): juraj.bednar.io/shop/
I teach how to handle volatility, what to do when you want to enjoy the value of your Bitcoin, how Lightning network works, cypherpunk tech and more, hacking applied to many areas of life, etc.
Podcasts 🎙️:
Option Plus (EN) - optionplus.io/
Reči o živote, vesmíre a vôbec (SK): juraj.bednar.io/reci-o-zivot…
Ako vyhackovať otcovstvo (SK): otcovia.com/
I usually hangout on Nostr: [email protected]
Routstr (@routstrai) confidential mode update, live on routstr.cypherpunk.today and in the demo PWA (v0.1.31):
- The node's signed offer now defines which request parameters it pins. Clients enforce one rule: a pin may only switch an extra off.
- Fairer billing: idle connections can't block paying clients, a long response gets time to finish, only attested usage is charged, the node's own provider-key errors cost only the session fee, prompt-cache writes are billed correctly, and a failed database write is retried instead of charging the full reservation.
- Hardening: the proofs also bind the record's content type, proof connections need a per-session token, clients refuse unsafe offers and limit how much the node can make them buffer, and the browser pre-warms only after your first message.
- Sidecar: session files are deleted after 24 h, and the container is built from digest-pinned base images with no package installs.
- Upstream: the v2 PRs are rebased, plus six separate fixes for every Routstr node: admin login, revoking credentials, startup reservations, log redaction, no caching of API keys, private logs.
- Paper: every figure is backed by archived receipts and runs, or marked as unarchived.
Your prompts and the model's answers stay private from the node, and you never get its API key.
jooray.github.io/routstr-con…
nsite-clay 0.3.26 is out. It's about sites with more than one page.
Until now each page of a site stood on its own. To edit another one you had to know its address, open it and sign in again, and a new page meant a trip back to the publisher.
Now the editing toolbar has a Pages button. It lists every page of your site and opens the one you pick, ready to edit. You stay signed in for an hour while you move around, and the hour starts over whenever you do something. A signer app like Amber or a browser extension carries across tabs. A key you typed in stays in that one tab and is never saved.
From the same dialog you can add a page. It copies the design, header, footer and blocks of the page you're on and can put itself in that page's menu. Or let Edit with AI write it from a short description. Both pages go out in one publish.
Links have a real dialog now: pick one of your pages or a heading on it, or type a web address, an email or a phone number. While you edit, a link that leads nowhere gets a dashed outline.
Also: an upgrade taken on one page now moves every page of the site (before, it could leave the others with a broken editor). Settings can copy instructions for your own coding agent, and the CLI has a pull command.
Existing sites get all of this from Settings, Upgrade.
nsite-clay.cypherpunk.today/
Juraj Bednar🏴💛🌘 retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
Juraj Bednar🏴💛🌘 retweeted
HOLY MOLY. Something genuinely strange just happened in AI training.
Q Labs says it can now pretrain a transformer WITHOUT backpropagation, cutting the time to reach a fixed validation-loss target from 1.76 hours to just 1.6 seconds in only 10 days. A nearly 4,000x speedup.
The latest run also beats backprop + Adam on validation loss.
Its Dust algorithm was already estimated to be up to 10,000x more compute-efficient than the previous state-of-the-art zeroth-order method.
The biggest question now is scaling. Some of the tricks won't scale, so the team is moving from 10M to 30M training tokens.
I think the last month might have been the biggest month in (zeroth-order) optimization history.
In the 10 days since we released the Noise speedrun, the time to pretrain a transformer went from 1.76 hours to 1.6 seconds, a 4,000x (!!!) speedup. Dust itself was up to 10,000x more compute-efficient than the previous state-of-the-art.
Not only can we pretrain a transformer without backprop, it's much more efficient than anyone would've expected. Search fking works!
Now, scaling is the biggest open question. Some of the tricks that brought the time down to 1.6 seconds will simply not scale. To discard those, we'll be scaling the dataset every time it gets overfit, starting with 30M tokens instead of 10M.
Huge thanks to @jayden_teoh_, @spicey_lemonade, @RobertTLange, @EmanueleRodola, @ChunyuanDeng, @LuochengHuman, @Alaxarr, @pavleculafic, @IsaacYong13, Euraba and areu01or00 (GitHub), for the contributions. And @cs_serdar for gracefully maintaining the speedrun and @bishmdl76 for helping out.
Expect a lot more from us over the coming weeks.
Juraj Bednar🏴💛🌘 retweeted
🛑 A filename is enough to trigger OS command execution in Python's widely used Pillow image library.
CVE-2026-112900 abuses how Pillow passes EPS filenames to Ghostscript.
What you need to know ↓ thehackernews.com/2026/10/cr…
Juraj Bednar🏴💛🌘 retweeted
dstack is the open source library for CPU/GPU TEE underpinning this Brave Leo private inference announcement brave.com/blog/browser-ai-e2…
Juraj Bednar🏴💛🌘 retweeted
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
Juraj Bednar🏴💛🌘 retweeted
Ich bin vor drei Wochen nach Prag ausgewandert.
Wer Deutschland verlässt, muss sich innerhalb von zwei Wochen abmelden, sonst gibt's ein Bußgeld. Also hab ich direkt online einen Termin beim Bürgeramt gebucht.
Nächster freier Termin: in neun Wochen.
Okay, dann eben Spontantermin. Ich stand um 7:30 Uhr vorm Bürgeramt. Vor mir 6 bis 7 Leute. Mit Klappstühlen. Eine Frau hatte eine Thermoskanne und ein Kreuzworträtselheft dabei, die war offensichtlich nicht zum ersten Mal hier.
Um 7:58 Uhr kommt ein Mann raus und klebt einen Zettel an die Tür: „Heute keine Spontantermine wegen Systemumstellung."
Die Frau mit der Thermoskanne hat nur genickt und ihr Rätselheft eingepackt. Als wäre das ein ganz normaler Dienstag.
Nach meinem Umzug habe ich dort angerufen. 47 Minuten Warteschleife. Dann: „Sie können sich auch per Fax abmelden."
Ich bin in Prag in eine Apotheke gegangen und hab gefragt, ob ich da was faxen kann. Die Apothekerin hat mich angeschaut, als hätte ich nach einem Telegramm gefragt. Sie hat es dann gemacht, wahrscheinlich aus Mitleid.
Soweit so gut.
Eine Woche später ruf ich wieder an. „Das Fax ist angekommen. Aber wir brauchen die Unterschrift im Original."
Warum gibt es dann die Fax-Option?
„Das kann ich Ihnen nicht sagen."
Also bin ich zurück nach Deutschland gefahren. Fünf Stunden. 6:30 Uhr vorm Bürgeramt. Diesmal hat es geklappt.
Die Sachbearbeiterin tippt alles ein, stempelt, druckt die Abmeldebescheinigung aus, perfekt. Ich will gerade aufstehen.
„Ach, Moment. Sie sind ja schon seit drei Wochen weg. Die Frist ist zwei Wochen. Das ist eine Ordnungswidrigkeit, das muss ich weitergeben."
Ich hab ihr erklärt, dass ich am ersten Tag einen Termin gebucht habe und das Bürgeramt mir einfach keinen früheren gegeben hat.
Sie hat mich ganz ruhig angeschaut und gesagt: „Das ist nicht mein Problem und außerdem bin ich dafür nicht zuständig."
Gestern kam der Bußgeldbescheid: 35 Euro.
An meine neue Adresse in Prag. Hier sind die natürlich ganz schnell.
Das ist das beste Deutschland aller Zeiten.
Localhost Recording Studio 0.5.0 — the app now tells you what it is doing, and the catalogue tells you which takes you liked.
Against 0.4.9:
- The song page answers. Open a take while it is being made and you get the phase — LISTENING, SCORING, RECORDING, MIXING, MASTERING, FILING — the time left, and a rule under the words that fills as the job moves. The ring of the disc carries the same progress. Before this, the phase lived only in the studio and a song page said nothing at all about the job that was running.
- Hearts. Mark a keeper from its page or with a long press; the index shows a filled heart next to every take you liked, so a batch of variations can be scanned for the good ones.
- NEW. A finished take nobody has heard yet is marked NEW in the list. The mark goes when you play the mix or like the take.
- The hole in the disc is a play/pause button. It used to seek only on the ring, and did nothing on the song page. While a take is still mixing, it plays the preview.
- Covers remember their score. The score written down from a recording is kept, keyed by the recording's own bytes, so covering the same file again skips the listening and goes straight to the song — in a later session too, or after the first take was deleted. SCORE and MELODY stay apart.
jooray.github.io/studio-loca…
Android on Zapstore, Mac and Android builds on GitHub: github.com/jooray/studio-loc…
And check this nice hallucinated song playing in the interface :)
Turns out AI is taking jobs of entrepreneurs in "creative" domains.
And we thought robots would be all logic and physical power. And they're hallucinating pictures, videos, codes, photos and songs.
Tomorrow is a very special event that we organize, to celebrate, we have new version for you!
Emanator 1.4.1 for Android and the web
Interactions moved into the bottom bar.
A reply is a daily errand; the calendar is a plan you look at now and then. The phone bar is now Dashboard, Posts, Interactions, Messages, More. Calendar moved behind More — it keeps its own entry on a tablet's rail, and the bar stays put while the calendar is open.
You can mention people while replying.
Type @ in the Interactions reply box and you get the composer's suggestions: your own accounts first, then people your accounts follow. The pick becomes a real Nostr mention, so the person is notified. Same in the app and on the web.
Copy a note, share it as text.
Every post page has "Copy text" under the note. Settings → Sharing adds a button per network, off by default:
- X opens x.com's compose window with the note already written.
- Facebook and LinkedIn cannot take a post's text from a link: their share endpoints only accept a URL, and a note is not a link. On the web the button copies the note and opens their composer to paste. In the Android app the note goes into their app through the system share, and without the app it falls back to copy and open.
Retry actually republishes.
A failed post that was never signed asks your signer again instead of answering "Cannot retry publishing.". A note that was signed but no relay accepted, and whose signature is older than 15 minutes, is signed again dated now — sending the old event would only bury it — and its reposts are rebuilt with their delays after the new time. A note some relay did accept is resent unchanged, so a retry cannot make a duplicate. Retried replies are dated now instead of the day they failed, and replies can no longer be rescheduled (that path built a plain note and dropped the reply tags).
A reply says what it answers.
The post page shows "In reply to: view the note", on the web and in the app, so a failed reply is not mistaken for a standalone note.
Behind the scenes: imported legacy DMs are stored as history rather than as messages you just sent, and one malformed event no longer aborts the import.
Get it:
- Website: emanator.cypherpunk.today/
- Zapstore: zapstore.dev/apps/today.cyph…
- GitHub release / Obtainium: github.com/jooray/nostr-eman…
- Direct APK: emanator.cypherpunk.today/an…
- Web app: emanator.cypherpunk.today (already updated, nothing to install)
Emanator 1.4.0 is out — Android and web
Interactions is now a primary view instead of a menu item. On the phone it takes Calendar's place in the bottom bar (Dashboard · Posts · Interactions · Messages · More); replies are a daily errand, the calendar is something you look at now and then.
The bigger change: you can mention people while replying. Type @ in the Interactions reply box and you get the same suggestions the composer has — your own accounts first, then people your accounts follow. The pick becomes a real Nostr mention, so the person is notified. It works in the Android app and in the web app, whose inline reply boxes got the same treatment.
Both clients also share a set of retry fixes. A failed post that was never signed now goes back to your signer instead of answering “Cannot retry publishing.”. A note no relay accepted, signed more than 15 minutes ago, is signed again dated now — sending the old event would only bury it — with its reposts rebuilt after the new time and previously failed reposts brought back. A note some relay did take is resent unchanged, so retrying can't duplicate it. Retried replies are dated now rather than the day they failed, and replies can no longer be rescheduled (that path built a plain note and dropped the reply tags).
Replies also show what they answer: “In reply to: view the note” on the post page, in both clients.
Get it:
· Zapstore — zapstore.dev/apps/today.cyph…
· GitHub release / Obtainium — github.com/jooray/nostr-eman…
· Direct APK — emanator.cypherpunk.today/an…
· Web app — emanator.cypherpunk.today
The web is already updated — same features, no install.
