Co-Founder @bitdynamics_me, Solo ETH staker. My staking goal: running 1000 ETH validators solo for others.
Earth
Joined July 2007
- Tweets6.7K
- Following1.2K
- Followers740
- Likes7.5K
Maybe I should disable telegram🙈
Telegram shipped a "sandbox" for HTML widgets in messages. It's an in-process QuickJS (C) interpreter on a thread...
No fork, no isolatedProcess, no seccomp anywhere in the tree, so any QuickJS exploit is enough to gain full control with whatever privileges the Telegram client is running as without the need for any separate sandbox escape
The bug is a UaF in the interpreter, from standard JS:
```js
class D { [Symbol.dispose]() {} }
const d = new D();
let leak;
class C { static {
for (await using x of [d, d]) leak = () => x;
}}
// ... run anything ...
leak() // reads a freed frame
```
The fix for this particular vuln is still just in the master branch, and considering the number of vulnerabilities QuickJS has had in the past, this vuln will surely not be the last...
1
45
Zhe retweeted
Not endorsing the conclusions here, but this is worth a read. The financial and institutional connections deserve scrutiny.
Zhe retweeted
Jensen Huang should have spent more time studying @nntaleb. Trying to maintain a reputation as a family man and a wholesome guy is what made him fragile. If he instead went down the Elon Musk route and cared nothing for his reputation, he would have been antifragile in this situation. Now he might lose half his shares, his job, and his reputation for acting like the rockstar he was not supposed to be. Elon’s reputation not only survives attacks, criticism and controversy - it becomes stronger by it. Elon is antifragile. Jensen Huang, however, decided to brand himself as a good guy, but only played a part.
That’s why he became fragile, and will most likely be asked to stand down.
Got a minute to try our Canton DevKit out? Free CCs up for grabs!
A full Canton Network, on your laptop.
Canton DevKit by @bitdynamics_cc runs validator nodes, a super-validator and a web UI locally. Open source.
Mint a token and post your run: 25 winners take 200 CC. Until Nov 24, 15:00 UTC.
cctools.network/earn/bitdyna…
Hopefully they are not just swapping opus 5.5 to fable 5 and make opus 5.5 dumb like last time🙈
Anthropic now releasing their own Pareto curves.
Fable 5.2 looks like a savage release. Supposedly Pareto-optimal cost/intelligence at every single effort setting (aside from Max)?
Time to swap all my Opus 5.5 high+ jobs to Fable.
1
43
Or perhaps I should take a step back and ask if pure software service is still a good way to make money.
Just like diversifying investment, perhaps I should aim to have a side business that connects to the real-world, like ecommerce or experiences.
So what kind of services should indie hackers or solo founders build next?
I just created a script using AI with two prompts and exported all my koinly data even when export feature is not available for free users (github.com/zheli/koinly-tran…) In the age of AI you can't really keep your user by locking their data, so we need to find another way and also make it easier for users (AIs) to move between services.
1
30
So what kind of services should indie hackers or solo founders build next?
I just created a script using AI with two prompts and exported all my koinly data even when export feature is not available for free users (github.com/zheli/koinly-tran…) In the age of AI you can't really keep your user by locking their data, so we need to find another way and also make it easier for users (AIs) to move between services.
Really disappointed in @gnosispay . This is probably the 3rd incident I have had with them (1. KYC leak 2. Safe compromise)
I want to help web3 company to succeed but not at the expense of personal data or god forbid, family safety.
But I am glad they are transparent about it at least.
At this point I really don't know what to say @gnosispay
- Full home, name and address details
- Card number
- All wallet addresses linked to the account
Extremely disappointed. You had already lost me as a user but you could have at least protected my data ....
Damn shame, really.
1
52
Two things never change:
1. Your security is determined by the weakest link of the system.
2. Social engineering will always work
1
26
Curious why EIP-7702 helped them sweep BTC in this case. Binance can provably cover it in this case but still, it's probably one of the largest hack in history, but it won't be the last I am sure.
Binance hot wallets lost ~$6.28B across 8 chains today. $6.07B went in the first 55 minutes, and the attacker kept re-sweeping one Ethereum wallet for two more hours.
Since then Tether, Circle, Ripple, Paxos, World Liberty and Binance have frozen ~$2.80B. About $3.27B can still move, mostly BTC and ETH.
I traced it all on-chain, including how the attacker raced the freezes 🧵
1
1
58
Thanks for the great conversation!
Group brainstorm at Meridian: what developer tools does our ecosystem need to @BuildOnStellar and how do we work together to build them 🤔
1
31
AI wasn't even in the topics during Swedish elections. Perhaps Europe has too many other issues to fix first to earn votes for the politicians. Which is sad. Hopefully the new Swedish government will not tax the rich.
Starship, Starlink, Grok, and Roadster. These should all have been Sputnik moments for Europe. Triggered immediate deregulation, mobilization of capital, and ambition to catch up. And that's just the work of Elon's companies alone. But what do we get? A hollowed out EU Inc 💀
2
43
Using TG group for cross-agent communication is not reliable (Openclaw is too dumb to follow rules). Maybe a better is to use A2A protocol in the backend but show summary in the TG group for human instead.
1
2
53
Can you use that eSIM for free internet traffic?
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
3
82