I love computers, cats and candy, in no specific order. Mastodon: @mbh@infosec.exchange Signal user: xul.01
Joined December 2010
- Tweets94.4K
- Following987
- Followers1.8K
- Likes9.6K
MBH retweeted
My college dorm project just broke the world speed record.
Reaper hit 790 km/h (491 mph) carrying a 1.2 kg (2.6 lb) payload.
These 3 Reapers are now the world’s fastest small jet-powered drones.
Each of them can hold that speed for 4 minutes on a full tank.
Reaper can be rail- or truck-launched, climb to 2,000 m (6,600 ft) in under 20 seconds, then fly for 50 km (31 mi) at full speed.
This is now a reliable and repeatable system. Future testing and small optimizations should push the top speed past 800 km/h (500 mph).
Twitter is a weird place. Fajer's comment is about commending Saudi women/girls on their beauty, but all the replies from Saudi women are angry at her, because they think she meant ill...
And this is between 2 gulf countries with very close cultures!
MBH retweeted
The groundbreaking documentary by Lebanese journalist @radwanmortada about Israel’s pager attacks is now available for English speakers.
3 weeks after it was released, the Israelis looted and then blew up Radwan’s house.
Tomorrow pro-Israel fanatics will release a propaganda film in U.S. theaters about the criminal pager attacks.
Watch Radwan’s movie instead ⬇️
aljazeera360.com/video/10423…
MBH retweeted
Finally, the first EQS 450+ with a faulty CATL battery, at 300,000 km. CATL is otherwise the only cell manufacturer with a system so reliable that it doesn't even need service centres in Europe, because the failure rate is minimal compared to LG cells, which have proven to be extremely critical in practice. EOLHC is the most likely end of life for this battery, not a cell failure itself. A new battery is no longer offered by Mercedes at all, and a "Refurbished" one is around €55,000, which is unrealistically expensive. Our visit to CATL headquarters gave us an insight into the likely purchase price of the cells, which is probably in the range of €12,000, while the housing and the rest of the pack make up the remainder of the cost. Used batteries go for €7,000 to €14,000.
Part number: A7893400027
Defect: damaged cells, self discharge delta
Now lets build diagnostic bench protocol, repair manual and training material.
MBH retweeted
Heads-up: New round of Apple Threat Notifications is going out right now, distinct from the August wave and tied to new attacks!
Apple’s notice:
“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total. The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”
Received one and need help? DM me, happy to assist.
I would love to get this as a service from @GrapheneOS . I rely on GrapheneOS to secure some critical data and would love it if it's possible for them to notify users if they were targeted or a breach had occurred, then remediate.
Worth it w/ the upcoming Motorola phone.
MBH retweeted
ALERT: did you just get a threat notification from Apple?
Seek expert help.
Apple just sent new notifications about mercenary spyware.
Here are steps to take right now. 1/
MBH retweeted
كارثة -🇮🇶
- بعد تصدير شحنات من البطاطا العراقية إلى الكويت والسعودية وفعلاً "البطاطا عراقية"
ثم ماذا؟
الكويتيين والسعوديين ابلغوا الجهات المعنية بالعراق على إن هذه البطاطا "إيرانية" وليست العراقية التي نعرفها وبعد التدقيق تبين إن إيران تهرب منتجاتها عبر العراق وبأسم العراق
The zionists must be very pleased with their work of spreading propaganda & hatred towards Muslims.
Probably the only country that took the proper measures against these tactics is China, by mostly banning American social media to block interference & manipulation.
#BREAKING 🇯🇵 A mosque has been burned down by a Japanese villager in Hokkaido.
"I hoped they would leave"
MBH retweeted
Yesterday, I received a security notification from Apple warning me that my iPhone had been targeted by a sophisticated mercenary spyware attack, involving technology of the kind developed by companies such as NSO Group, the Israeli firm behind the notorious Pegasus spyware.
Perhaps the most alarming aspect of Apple’s warning was its confirmation that such attacks target specific individuals “because of who you are or what you do.”
This is not the first time I have been targeted by spyware. I was previously targeted with Pegasus in both 2017 and 2021.
I do not yet know who is behind this latest attack, or whether it is connected to my investigative documentary, The Trap, which I directed and co-produced. The film, available on Al Jazeera 360, exposed the details of the September 2024 pager explosions in Lebanon.
What is certain, however, is that the targeting of journalists with sophisticated spyware poses a grave threat to press freedom, the confidentiality of journalistic sources, and the very foundations of independent investigative journalism.
MBH retweeted
🚨🚨Apple basically told him that Israel has either just hacked his devices or is trying to.
He made the brilliant documentary on the Pager attack in Lebanon.
They literally destroyed his home last week.
Now this.
Yesterday, I received a security notification from Apple warning me that my iPhone had been targeted by a sophisticated mercenary spyware attack, involving technology of the kind developed by companies such as NSO Group, the Israeli firm behind the notorious Pegasus spyware.
Perhaps the most alarming aspect of Apple’s warning was its confirmation that such attacks target specific individuals “because of who you are or what you do.”
This is not the first time I have been targeted by spyware. I was previously targeted with Pegasus in both 2017 and 2021.
I do not yet know who is behind this latest attack, or whether it is connected to my investigative documentary, The Trap, which I directed and co-produced. The film, available on Al Jazeera 360, exposed the details of the September 2024 pager explosions in Lebanon.
What is certain, however, is that the targeting of journalists with sophisticated spyware poses a grave threat to press freedom, the confidentiality of journalistic sources, and the very foundations of independent investigative journalism.
MBH retweeted
Look at this graph. It’s a disaster.
A new working paper tracked 26,811 students in China.
Homework scores rose by 18%.
Meanwhile, closed-book exam scores fell by 20%.
This divergence between home performance and class performance seems driven by AI usage:
Among students who never used AI, higher homework scores are associated with higher exam scores.
Among AI users, the relationship switches completely: exceptionally high homework scores are associated with substantially worse exam performance.
*
Paper in the first reply
MBH retweeted
Oxide just raised $445M at a $6B valuation.
@bcantrill and @sdtuck started @oxidecomputer to build the computers the hyperscalers keep for themselves. @EclipseVentures led the seed when nobody else would. now they're profitable, and he says they didn't even need to raise.
i also asked him if AI is a bubble, why america hates data centers, and why every oxide employee makes the same salary.
nontechnical, episode 4.
00:00 $445M at $6B, and they didn't need it
03:06 one wire transfer bigger than their whole seed
07:14 "they don't have the guts. they're too chicken."
09:09 100% banked at SVB
13:04 a 92-year-old kicking their asses in board meetings
14:48 "would you like me to name names?"
16:58 a16z loved it, then sent the first rejection
20:19 leaving a first round partner meeting for the A's
22:52 "Marc Andreessen was offended"
23:05 NEA: "we will only invest in software"
25:55 "legends are dead"
28:32 "when a VC says 'I've got a technical question'"
42:39 the firm that walked away from a signed term sheet
46:48 "if I could get sequoia, do you think you'd be here?"
49:41 "they were cowards"
52:36 the nuke email he wrote and never sent
58:33 four years later, they asked for a reference
1:02:01 "politics and business don't mix"
1:10:51 is AI a bubble?
1:14:56 how he ruined a dinner party in 1997
1:20:44 "people hate data centers"
1:22:08 how sun got thrown through the windshield in 2000
1:26:26 why everyone at oxide makes the same salary
1:30:58 the worst hire of all time
1:40:42 when oxide goes public
MBH retweeted
Confirmed: Binance hacker routed stolen TRX through Bitget wallet bridge into ETH, dumping straight into a wallet previously used in the Phemex hack.
It's Lazarus, without a doubt.
Funny how an APT unit can orchestrate a $6.3B multi-chain heist, but still gets caught reusing old deposit targets from 2025.
Swapping TRX to native ETH as fast as humanly possible because they know mainnet ETH has no admin freeze button.
2024: DMM Bitcoin
2025: Phemex & Bybit
2026: Binance ($6.3B)
They don't even bother generating fresh deposit addresses anymore. Lazarus is just running an automated DevOps pipeline to turn Web3 liquidity into national treasury reserves.
Bridge TRX -> native ETH -> Tornado/privacy -> off-grid.
The industry keeps building bridges, and North Korea keeps using them as sovereign exit liquidity.
MBH retweeted
Sam Altman says local inference is a terrible idea. Japanese companies did not get the memo.
A consultant in Japan says he now gets requests to deploy local LLMs almost every day.
His reason: GLM-5.3-Flash and DeepSeek V4.1 Flash 1017 hit near frontier quality.
Both are Chinese. Both are open weights. Both run on hardware a company can own.
That is what the cloud guys are scared of.
Not that local is slow.
That it got good enough.
I run both on my 4x 3090. GLM-5.3-Flash does 58 tok/s here.
Honestly, China did more for private AI in one month than the US labs did in years.
xitter.gq/gosrum/status/21159447…
MBH retweeted
“We’ve built software to track Wikipedia editors,” says the head of the ADL.
We have an investigation publishing soon about pro-Israel manipulation of Wikipedia, and he just blurts it out
MBH retweeted
when we (the legal team) tried to update Aafia Siddiqui's Wikipedia account we were told it's a locked account that cannot be edited unless ~500 editors make edits on it. we were told it's the same situation for Propjet Muhammad's Wikipedia account. we were told that Israel had some thing to do with these high profile accounts being locked & uneditable......
i dismissed it as conspiracy so seeing this is v interesting.......
MBH retweeted
有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。
MBH retweeted
Denmark paid 71 million kroner for artillery shells for Ukraine.
Shells delivered: 0.
The "arms maker"? A registered software firm in Italy, sharing an address with an Audi dealer, advertising with video game and AI images.
Estonia had already prepaid the same firm 187M and got nothing. Then sent our 71M anyway.
No money has been recovered. We are a laughing stock 🤦♂️
MBH retweeted
🚨Polymarket is forcing hack victims to sign an NDA to receive their refunds !
The terms are insane:
- Full KYC (on a crypto platform)
- *AGREE TO NO PUBLICLY CRITICIZE POLYMARKET*
- Waive known AND unknown claims from the incident.
- Keep the settlement terms confidential
The gag clause is crazy.
It covers all statements "creating a negative, critical, or unfavorable impression,” including on social media.
Polymarket is essentially asking users to dox and silence themselves if they want any refunds for the hack THEY are responsible for.
Thanks to @TheNotoriousSKi for leaking the terms despite the NDA.
What about just owning up to the mistake and replenishing affected wallets ?
