D&Dgen - Chaotic Neutral Half Orc Fighter Barbarian - Adventure !! 👹 https://xitter.gq/t.co/7QDaiOWkXb, prev @yearnfi
Joined August 2021
- Tweets778
- Following722
- Followers248
- Likes10.9K
"pmf is about solving a massive pain that others are not solving, having a fun ui or a pretty brand is not enough" -- pmf is like porn. you know it when you see it. it's when a market starts pulling your product into existence instead of you doing all the push work
painful lessons that I learned as I built my own company
- if you are pre-revenue, you have no luxury to spend on things that are not about finding pmf, finding pmf is the most important thing and nothing else needs capital besides this
- pmf is about solving a massive pain that others are not solving, having a fun ui or a pretty brand is not enough
- hiring/marketing/burning more capital may look like it will solve your issues but without pmf it will increase your burn and put you in a position to die faster
- don't depend exclusively on one partner, even if they are a market leader, when their direction changes or no longer matches yours, you will be left with all the rework to regain your autonomy (I got rekt on this 3 times already depending on zora, farcaster, and clanker)
- it's up to you (the founder) and only you to figure out how to get to pmf and execute the strategy until the first success cases show
- the project vibes are very important, if you can't keep the vibes up and conviction refreshed in your thesis everything else will crumble apart, when lacking conviction, go talk to potential users and study your market more
I know most of these are standard startup advice but I guess in life we have to shit our pants ourselves to learn even the obvious things
murderteeth retweeted
A malicious hook doesn't need a UI to scam you.
👉 It just needs to look like the best quote.
After analyzing over 84,000 v4 hooks, we determined only 19% of hooks to be safe.
It's time to get real about hooks.
https everywhere has been a great win. i still think there's a strong case for vpn-always, especially on public wifi: your browser isn't your whole device. there's no https-everywhere gaurantee built into the other apps and services on your system
murderteeth retweeted
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.
murderteeth retweeted
Everyone's telling devs to be careful, but nobody's telling their agents. One command 👇 (thank me later)
github.com/orlyjamie/interne…
murderteeth retweeted
🚨 Active supply chain attack on npm: keyv and cacheable are compromised right now, and the payload is a worm.
The maintainer account behind both package families was compromised. On August 4, ten packages were republished with a malicious preinstall hook that steals your credentials, then uses those credentials to publish itself into more packages. Malicious versions are live on npm as I write this.
These are foundational packages. keyv, cacheable, flat-cache, and file-entry-cache sit deep in dependency trees as transitive deps of common tooling like ESLint. Tens of millions of weekly downloads. Most affected users never installed them directly.
What the payload does:
• preinstall hook (setup.mjs) downloads a standalone Bun runtime and runs the second stage under it, sidestepping the host Node version and any Node-level monitoring
• Harvests cloud and CI credentials: AWS/GCP/Azure keys, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC, and npm tokens
• Repackages other npm packages with the same hook and republishes them through npm OIDC trusted publishing. This is what makes it a worm.
• Exfiltrates over DNS and by committing stolen secrets to attacker-created GitHub repos
• Plants autostart hooks in .claude and .vscode that execute when a developer or an AI coding agent opens the cloned repo. No npm install required.
The detail worth sitting with: [email protected] shipped with a passing npm provenance attestation. The build pipeline faithfully attested a source that was already trojanized. Signature verification alone did not stop this.
Socket’s AI scanner flagged the malicious setup.mjs hook. If you install anything in the keyv, @keyv, or cacheable scopes:
• Pin to the last known-clean version and rebuild lockfiles by integrity hash. No caret or tilde ranges, no npm update.
• Better: block the entire keyv, @keyv, and cacheable scope at your registry proxy until the account is confirmed clean.
• Rotate and revoke every credential reachable from any host that ran install scripts. npm and GitHub tokens should be revoked, not just rotated.
Developing story. Socket is updating the affected-package list as new versions appear.
Full research report with IoCs: socket.dev/blog/popular-npm-…
If you are dealing with this right now and want help, email [email protected] and we will spin up emergency white-glove assistance.
one defi's strongest ai builders @MarcoWorms might be dropping ai SECRETS live with @austingriffith 👀
🎥 going live with @MarcoWorms (and co-host @clawdbotatg)
🛠️ we will jam on prototyping and shipping with ai
🪱 come thru! xitter.gq/i/broadcasts/1qKVmmXOm…
murderteeth retweeted
🎥 going live with @MarcoWorms (and co-host @clawdbotatg)
🛠️ we will jam on prototyping and shipping with ai
🪱 come thru! xitter.gq/i/broadcasts/1qKVmmXOm…
murderteeth retweeted
I had a great time talking about the risks of vaults (and many new yield bearing tokens in general) with david. To be clear i'm still very bullish on vaults, and have roughly 50% of my crypto sitting in a few different steakhouse/yearn vaults.
I just think the industry needs to be more transparent about the risks depositors are getting into. Just showing a yield number and a rating I think is a recipe for financial disaster - and is how we will end up back at "banks" and fully centralized solutions again.
LIVE NOW: Why Vaults Are a Ticking Time Bomb | @andrewhong5297 from @herd_eco
DeFi vaults make yield feel simple. Behind one deposit can sit dozens of markets, recursive wrappers, leverage, curators, and risk assumptions most users never see.
Andrew Hong joins @TrustlessState to tell us about:
• Why vaults are becoming crypto’s one-click financial layer
• How Coinbase and institutions could take them mainstream
• Where risk creep and hidden dependencies enter
• Why transparency must come before ratings
---
TIMESTAMPS
0:00 Introducing DeFi Vaults
2:20 From Yearn to Morpho
3:58 Why One-Click Yield Is Growing
9:02 Coinbase Earn and the Safer End of Vaults
11:40 How Vaults Rebalance Capital
14:38 Leverage, RWAs, and Higher Yields
18:28 When Strategies Go Seven Layers Deep
20:43 The Summer Finance Exploit
23:56 The Incentive to Take More Risk
27:59 An Inevitable but Unstable Product
29:45 Regulation and the Role of Curators
34:10 The Transparency Gap
39:32 Misaligned Incentives and Liability
41:48 What Happens When Vaults Reach Mainstream Users
46:22 What the Vault Sector Needs
51:13 How to Evaluate a Vault
53:41 Did DeFi Reinvent the Bank?
58:01 What to Watch Next
1:03:44 What Herd Is Building
Telegram support coming soon 👀
Plz take the extra effort to own your data and your infrastructure, assign 1 person on your team to set up Centaur over Claude Tag and let me know how it goes - docs in reply.
Claude Tag is awesome, I've spent a few reps using it to understand where it does better than our OSS alternative (just memory right now which we'll have next week and have intentionally delayed because we didn't think it was worth it) but it's just hard to risk your entire company's brain atrophying if that were to be taken away from you.
And soon we'll allow you to swap out frontier models for finetuned OSS ones on each channel (working on the eval rn) and then your cost is going to be in the low tens of thousands per year vs 10-100x that, plus you owning it all. That's the catch the forces above us don't want you to know.
murderteeth retweeted
Yesterday we published a YIP to endorse and fund yTranche.
yTranche is a generalized, CLO-inspired tranching framework purpose-built for the next generation of Yearn vaults.
Unlike traditional tranching systems, yTranche allows each vault in the system to hold a "target" rate as well as an "excess" buffer. Yield is paid from most senior to junior first hitting each levels "target", then any excess left over once all targets are hit gets split based on the "excess" split.
This allows us the ability to turn one underlying yield source into many compelling structured products each with their own features, including fixed rate products.
It will be launched with three initial version USD, ETH and BTC
Each asset having a "fixed" (senior), a "levered" (mezzanine) and a "equity" (junior).
Current launch targets for the fixed senior is 5% USD, 3% ETH and 1.5% BTC. Each senior vault carries the same atomic liquidity as the current Yearn vaults, but with the added benefit of explicit junior capital protecting it.
The proposal requests for Yearn to be the anchor depositor in the Levered and Equity tranches, therefore showing we are willing and able to put our own money on the line to back our products and reap the benefits if they outperform.
By packaging one underlying vault into different products it allows Yearn to simplify its operations, continue to use the same trusted V3 vault code underneath, take on more risk in the strategies but still serve different groups.
murderteeth retweeted
Neon Does not expose cpu usage very easily so i've gathered through their api ways to do and put together a quick neon-monitor-dashboard.verce… where you add the api key and is able to see many of those missing indicators!
Enjoy!
murderteeth retweeted
made an automated newspaper website that only reports news from prediction market's price moves
🗞️ priced.lol
murderteeth retweeted
fascinating example of a “toxic pool”:
an ordinary curve/uniswap/etc pools designed to fool dex aggregators
a malicious oracle/hook forces quotes via eth_call to see a different rate than the real transactions
credit to @EnsoBuild / @MilosCostantini for putting me onto this ...
murderteeth retweeted
Correlated. Assets.
We're looking for more stables and volatile assets that are yield bearing and instantly redeemable back to their native form. This is what Flex is built for.
Now time to up my leverage because I will only be liquidated if yvUSD posts a huge loss and that's a bet I am taking
@flexmeow is a Fixed Rate lending product built to loop correlated assets. On Flex:
1. You can adjust your interest rate once per week for free
2. There is liquidation protection. Your position is only brought back to health
3. Up to zero spread on loops. Positions are always liquid through Redemptions, we don't need a cash buffer
Never get stuck with negative carry again. Know any great instantly redeemable assets? Put them in the comments or dm me. Requests always open
Another supply chain attack that started with a socially engineered malicious video conference install. Don't accept candy or apps from strangers, be safe 💝
Yesterday, Mastra was hit by a supply chain attack.
A malicious postinstall script that exfiltrated credentials and then self-deleted was added to specific versions of our npm packages.
Most importantly: the incident is over. All relevant package versions are unpublished.
The root cause is that one of our maintainers was compromised.
Between 6:12 PM and 6:37PM PT yesterday, a token associated with their account published 116 malicious NPM packages, almost all in the `@mastra/` namespace.
We became aware of this at 8:45pm PT. We immediately contacted npm as well as trusted third parties (eg @SocketSecurity).
We also began unpublishing, and unpublished 59 packages.
As part of the attack, we lost access to some packages. Around 10:15pm PT, we were able to re-add our accounts to those packages. We began unpublishing the rest. In total, we unpublished 110 packages, and deprecated 6.
By 11:57pm PT, all affected packages were unpublished or deprecated.
At around 1am PT, we also published new, safe versions of each package affected (github.com/mastra-ai/mastra/…), so that installs would resolve
We have always required MFA on NPM for maintainers, but we also allowed (mistakenly) token bypass. Also around 1am PT, we removed token bypass across all packages.
At 2:25am PT, we established contact with the compromised maintainer. He is a current, active Mastra employee. His machine was compromised via a social phishing attack.
A compromised LinkedIn account reached out to him as well as maintainers of other prominent TypeScript open source packages. He was on a call and clicked a suspicious link.
This was the same attack vector as other open-source maintainers have reported (eg xitter.gq/aidenybai/status/20667…).
Around 4:40am, npm responded to the security ticket we'd filed and confirmed the breach. They unpublished the last 6 affected packages.
For a third-party report on the incident / malware, including a list of package versions affected, and the mechanisms of the RAT: socket.dev/blog/mastra-npm-p….
We're continuing to keep reducing scope of sensitive credentials and enhance our use of MFA. Security is an ongoing process of review and hardening.
Thanks for the hugops. Stay safe out there. I'll be here answering questions.
murderteeth retweeted
CSL is so right about this. The meeting of RWA and DeFi is opening the door to a lot of "trust me bro" finance
If you're in a vault that can change the share price manually it will eventually be exploited
2022 flushed out CeFiDeFi (celsius, ftx, blockfi) and the obvious cases got cleared
now we're moving down the spectrum, where ai is accelerating discovery of the same failure modes inside teams that called themselves defi: security tools find bugs faster, fuzzers probe deeper, and agents test edge cases that humans miss
most of these patterns are web2-style: human errors, weak oracles, fragile admin and governance, repo hygiene, etc. decentralization still matters as the structural floor, and what's failing are the teams that took shortcuts past it while claiming to embody it
RWAs aren't exempt either, where the bar is the same: transparency, attested backing, clear user ownership rights, real redemption paths. the ones that meet it become defensible infrastructure, while the ones that don't, end up as CeFiDeFi in another wrapper
CROPS is what survives the flush test
murderteeth retweeted
new shai hulud wave. interestingly it has this inside the payload to trigger safety refusals in potential defensive scans.
We are now tracking 471 affected artifacts across npm and PyPI in the Mini Shai-Hulud/Miasma/Hades campaign.
The newer PyPI artifacts from this wave have been added to the dedicated campaign tracker.
Full breakdown:
socket.dev/blog/mini-shai-hu…
