Pinned Tweet
'a streak of light that moves at the speed of the Earth's rotation'
“The Speed of the Earth” has returned to Black Rock City. Originally created in 02024, this art piece by Long Now Board members Kevin Kelly and David Rumsey uses a mile-long line of solar-powered LED strobes to create a streak of light that moves at the speed of the Earth's rotation.
More about the installation from @DavidRumseyMaps: davidrumsey.com/blog/2024/10…
More about Burning Man art from Kelly in this 1999 issue of Whole Earth magazine: kk.org/wp-content/uploads/20…
Ross Hill retweeted
We finally have an explanation for “Facebook is listening to me through my phone”. They’d never do that (and it’s not really possible).
Turns out literally everyone else was — and then selling that to ad data brokers.
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
Ross Hill retweeted
theres a hidden fully functional ipod as a 404 page on apple music music.apple.com/us/jfdsalkfa…
Ross Hill retweeted
There’s a world of difference between user-authorized agents (Muse, Instinct, Grokbot, etc.) and true unauthorized/rogue agents that could constitute cyberattacks.
Most of the activity described in the Axios story appears to be the former: customers sharing credentials with agents so they can take actions on their behalf. This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks.
The direction banks should go is to support user-directed agents. For example, Amex is an authorized connection in Muse, making it easy for users to grant, limit, and revoke access.
Read-only permission levels are a sensible interim step. Several banks already support or are moving toward them. Full write access (with user credentials) is a different risk category and should be approached carefully.
Frightening the public by blurring the line between user-authorized agentic behavior and cyberattacks is irresponsible.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
The internet is held together with servers everyone is afraid to turn off.
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Ross Hill retweeted
breathing is enough to give you away
each breath slightly changes how Wi-Fi waves reflect off your chest. with the right receiver and processing, those tiny changes can reveal your breathing rhythm
the graphs in this animation use real WiRe-Breath recordings: orange is the rhythm extracted from Wi-Fi, gray is a reference breathing sensor
i broke down how this works, and what else you can pull out of the radio waves around you, in the article below ↓
Ross Hill retweeted
They think they're running a tight ship but have shown their true colours, leading a culture holed beneath the waterline. We must batten down the hatches and, by heading into the wind, hope to stem the tide. It won't be plain sailing, but must be seen through to the bitter end.
Flying car! @Tesla
“I asked why the law allowed them to be used for government propaganda”
Wow, wow, wow. I just left the National Press Club where Minister of Communications @AnikaWells spoke. She repeatedly and brazenly lied about the fake accounts, claiming they were only for enforcement, even though the legislation says in black and white that the eSafety Commissioner can use them in unlimited ways for "educational" and "promotional" purposes.
One big moment came when a Politico reporter got up and said something about how mean people like @PaulineHansonOz were to eSafety Commissioner Julie Inman-Grant. Seriously. A supposed reporter was white-knighting for a government official during the official Q&A. The same reporter had come up to me before Wells' speech and asked if I had criticized Inman-Grant. Who needs government censors when you have Politico?
After he asked his question, Wells showed the most emotion, describing online criticism of Inman-Grant as "abuse." She also talked about her own staff's supposed suffering. I kid you not. The mask dropped, and you could see what really upset her: people — including a sitting Senator — criticizing government officials.
After gaslighting the audience about fake accounts, Wells repeatedly insisted the government wasn't trying to censor content. She said this after filling her speech with examples of content she claimed harmed people. You couldn't make it up.
This legislation is the culmination of decades of progressives equating words with physical violence. Wells cynically compared her legislation to prevent psychological "harm" to various laws that protect people from physical harm, like seat belt laws.
BTW, Wells never said what content it was that she thought caused eating disorders. Pictures of skinny women? Dietary advice? Who knows. Nobody asked.
Another important moment came when Wells explicitly said Australia would be pursuing censorship alongside other nations, including the UK, France, and Spain—all countries where governments risk losing power to populists.
I spoke with Julie Inman-Grant before the speech began and asked about the fake accounts. She insisted they were there just for enforcement, and when I asked why the law allowed them to be used for government propaganda, she said she might write an "enforcement memo," which, of course, would have no impact on the legislation.
After her speech, I went up to Wells and asked if she was seriously saying the legislation didn't allow the government to use fake accounts for government propaganda. She refused to answer. A man who said he was from the National Press Club stepped in front of me and said I could interview her afterward. But that wasn't possible because they rushed her out the back to avoid any difficult questions.
So there you have it. The pettiest people in Australia are seeking to silence citizens and their political opponents in the name of protecting children. These deeply intolerant and cynical people want to control what you can see and say online. And they're doing it with most of the media's support. Australia has reached a new low in its rapid descent into dogmatism, intolerance, and censorship.