Joined May 2007
There is such a thing as a free lunch; it just isn't very tasty.
It’s impossible to not love Twitter
1
2
9
Vincent Touquet retweeted
The best, most comprehensive take on AI I’ve read. After a year of confusion and fear about the future, I finished it feeling like a weight had physically lifted. It’s long. Make the time. @vgr is undefeated. contraptions.venkateshrao.co…
61
273
85
2,424
430,226
Vincent Touquet retweeted
“Security is like Tetris: Your successes disappear but your failures pile up.” — Mikko Hyppönen
5
114
4
683
27,218
Vincent Touquet retweeted
I built 𝚌𝚙𝚞-𝚌𝚑𝚊𝚝, a reproduction of @openai's findings of covert communication using the CPU. It runs on a generic host with 2+ Firecracker microVMs with no internet access. Works on x86 and even my M5 chip. I was able to chat via 3 separate mechanisms: ① CPU contention ② Cache eviction timing ③ DRAM bandwidth contention … across multiple CPUs, defeating all Firecracker's production recommendations (no SMT, no KSM, tenants pinned to different cores.) Essentially, if shared hardware is involved, there's a good chance your agents can communicate covertly. And with really decent latency. The good news: this is decidedly different from a *side-channel attack* where the agents could steal information (Meltdown/Spectre), a category of attack that providers like Vercel Sandbox mitigate. Further, in our real-world environment, these 'whispering' techniques are much harder to pull off and easier for us to monitor and detect (sampling hardware counters + lots of at-scale statistical data.) Noteworthy: ironically, OpenAI and Anthropic's models refused to do this work. Open weight models got the job done. I'm worried the labs' stance might backfire and get in the way of helping developers build correct and secure systems. e.g: building a secure sandbox requires having this kind of analysis, and without it, we'll have a less secure world.
264
245
99
2,668
226,942
Vincent Touquet retweeted
What is the significance of Serbian election? I have been asked this by a lot of folks, so here is an unusually long post from me. The significance is... 1. ...That this happened before… 2. ...That you have no idea that it happened before… 3. ...And that the West messed it up the first time too. I am not an expert on Serbian politics. If you want to follow an actual legitimate expert, please follow Professor Dusan Pavlovic (@d_pavlovic) for proper analysis or my elementary school buddy Dimitrije Vojnov (@timjohnbyford) if you want the more anarcho-Hollywood commentary. Nonetheless, I was born in Belgrade, I left at 13 years old, and am a geopolitical/investment strategist by trade (basketball coach at heart). As such, lots of folks are asking me what is going on in Serbia and what I think about it. Well, here is what is going on… Serbia has yet again illustrated that it has the capacity for non-violent regime change. Incumbent leader Aleksandar Vucic conceded in a short and relatively sweet manner and the collective will of student protesters won. Pretty extraordinary outcome in today's jaded world. If this sounds vaguely familiar to you, it is because it also happened exactly 26 years ago, back in October 2000. Then, student protest movement OTPOR – in part led by dear friend @SrdjaPopovic – managed to do the unthinkable: use non-violent protest to topple the Slobodan Milosevic regime. The degree of difficulty then was higher than today. Say what you will about Vucic, but his government was not autocratic or engaged in military adventurism. But I don’t really want to talk about what happened in Serbia. I want to talk about how the West reacted to the extraordinary defeat of Milosevic in 2000 by a group of pro-West students. Instead of embracing the new government, it sought to force it into compliance with a deluge of conditionality. Sure, the incoming Prime Minister Vojislav Kostunica was not aligned with Western liberal values, but this is Serbia 26 years ago! Did Belgrade get a pass after it just toppled, peacefully, the so-called "Butcher of Balkans?" No. It got criticized for everything from LGBTQ+ policy to foreign policy towards Moscow. As if the country was supposed to transition from Serbia to Vermont overnight! It was all sticks all the time, very few carrots for the war-weary country. The West then wrestled ~12% of Serbia’s territory – today’s Kosovo – without any real sweeteners and called the Belgrade government obstructionist for opposing it. I don’t want to get into debates of legality or normative justification for Kosovo independence. I think we can all simply agree that giving up ~12% of one’s territory is not an act most countries accept without some sort of constrenation. The US and the EU did not care. They gave Belgrade a fait accompli in a magnificent display of hegemonic arrogance. But hey, it was 2008... different world. Underpinning this attitude has long been a general sense of antagonism by the liberal West towards conservative Serbia. In the mind of many foreign policy elites - a generation of elite "experts" for whom the first taste of geopolitics came from the wars in Yugoslavia - Serbia and Serbs are and always will be the "bad guys." Belgrade, effectively, has had to pay the price for the 1990s, even once the regime that underwrote that aggressive policy of that terrible decade was peacefully and extraordinarily toppled in 2000. The incredible enthusiasm and pro-West sentiment of that youth - the youth that stared Milosevic regime right in the face with no fear - was ignored and wasted. Many of that youth is no longer pro-EU or pro-West. It is jaded, nihilist, and very bitter. I can see the same outcome on the horizon for Serbia today. The West is going to expect instant compliance, but 60% of Serbs do not want an antagonistic relationship with Russia. As such, expecting these students today to just throw away the country's relationship with Moscow is naive. Public support for accession to the EU is as low as 32%, according to some surveys, as high as a pathetic 45% in others. That is extremely low for a country that would objectively benefit from EU membership. The West’s brand has lost its luster. If the West wants Serbia to actually change its geopolitical direction, it’s going to have to pay for that shift. No, Serbia will again not become Vermont overnight. It won’t be a bastion of liberal thought or values. So what? Judging by election results in the West, doesn’t seem like this should be a problem, now should it? The West appears to have approximated Serbia over the past quarter century. So, all should be good, no? Serbia is also not going to give up its relationship with the Global South. Not unless Europeans and Americans pay for the shift. This is a multipolar world folks. If Belgrade stood by its geopolitical independence at the very height of American hegemony, the price for its compliance just went up, not down. You had your chance to "buy" Serbia cheap in 2000. If the students protesting in the streets of Belgrade listened to their game theory lessons, they should play hard-to-get this time around. What the reaction in the West should be – and should have been in 2000 – is to celebrate the example that Serbian students just set. French students should, especially, get to studying the example set by the Serbs. As should young people in the Global South, India and elsewhere. This kind of change takes hard work, concentration, and an iron will commitment to non-violence. Now two generations of Serbian students – the generation from the 1990s and now this one 25 years later – have shown the world how to do peaceful change. The question is not whether Serbs learned any lessons, but whether the West did. If the West actually cares which way Serbia leans – and it is not clear to me that it actually does – then it is going to have to stop trying to fight its own domestic ideological battles inside Serbian society. You want Belgrade to join the West? Then stop lecturing and start paying.
49
43
11
340
43,875
Vincent Touquet retweeted
Not this shit again. This is the same as scaring people about losing their jobs. Yes, new vulnerabilities will be found faster. They also will be patched faster. Everything is vulnerable. Always was and always will be. This is going to change almost nothing.
Oh FFS. Thank you for your concern Sam, but don’t spread your FUD and doom bait in my waters. I lead one of the most utilized Linux operating systems in the world for data centers and enterprises, and I founded its predecessor too. While AI is surely accelerating finding human created security issues, it is a temporary problem, and most open source project leads have already figured out how to also use AI to reduce new bugs moving forward. Here is a graph from GKH (who maintains the stable kernel) on how many CVEs they are remediating per release: github.com/gregkh/kernel-dev… This graph describes how much better each release is now getting: github.com/gregkh/kernel-dev… This doom based marketing approach that the AI labs are pushing is really short sighted. While this will of course drive business to us, I find it unethical to distort the truth and use scare tactics in messaging. The greater truth is that AI is making the software industry more secure, by identifying the human errors in code, and soon we will end up in a much better place.
2
1
20
1,509
Vincent Touquet retweeted
Heads up, @OpenAI and @AnthropicAI. Rumor reaches my ears that you're doing a stupid thing, and should stop before you damage yourselves. I hear you've now nerfed your models so that when people try to use them to clean the spamware and spyware out of their televisions, you block that. If you really want Chinese open-weight models and open-source projects like OpenWaldo to eat your lunch, crippling your models so that people paying expensive subscriptions can't use them for completely legitimate purposes is a great way to accomplish this. If, on the other hand, you'd rather have a volume business, maybe stupid arbitrary restrictions that look like they have the sole purpose of protecting corporate sleazeballs aren't such a good idea. A word to the wise should be sufficient.
167
695
59
7,593
237,959
Vincent Touquet retweeted
Need a crumb of hope about Europe on a Saturday? Belgium has gone from rapidly closing and destroying its entire nuclear fleet (half of its power before 2023) to quickly relicensing and returning a few of them to the grid. PM @Bart_DeWever is trying to save as many as he can.
België en @ENGIE_energie zijn erin geslaagd de kerncentrales Doel IV en Tihange III in een half jaar volledig te reviseren, alle veiligheidsprocedures te doorlopen en weer op te starten. Terwijl sluiting gepland was. Dat is een applausje waard, vindt u niet? #grafiekvandedag
32
238
23
1,744
90,043
Honestly crazy Apple hasn’t patched this yet
PSA for macOS users: 1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys. 2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git. 3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately. 4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again. 4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below. 5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt: “Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.” Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple. I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
6
15
289
35,599
Vincent Touquet retweeted
Another example of “unrivaled” policymaking in Europe. ⬇️
CHART OF THE DAY: The price of natural gas in the US 🇺🇸 and Europe 🇪🇺. Now, imagine running a gas-intensive company (say, a fertilizer plant) in either region. Europe >$30; US <$3
7
11
1
48
6,202
Vincent Touquet retweeted
Be careful using abliterated models guys There has to be a middle ground between the Anthropic nanny state approval process for Mythos and using bootleg abliterated Chinese models Whoever figures this out is going to print a lot of money for SI Cyber – at San Francisco, CA
How abliterated models can get you pwned 👾 We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts. Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain. In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
98
88
18
1,630
152,782
This will surely calm things 🍿🍿🍿
🛑 The ECB can buy bonds of a euro zone country on the secondary market if their prices move in an unjustified way to protect the proper transmission ‌of monetary ⁠policy. BUT OFFICIALS SAID THIS DID NOT COVER WHAT WAS HAPPENING IN FRANCE.
1
1
227
not turtles, but grenouilles all the way down xitter.cf/AnilVohra1962/status/2…
The FROGS (FRench Over German Spreads) are jumping h/t @C_Barraud
1
3
54
sacré bleu... 🐳
🛑🇨🇵 FRANCE NEGOTIABLE GOVERNMENT DEBT BY GROUP OF HOLDERS IN SECOND QUARTER OF 2026
1
51
Vincent Touquet retweeted
In June 2017, The Economist portrayed newly elected French President Emmanuel Macron as Europe's savior, literally walking on water. Their cover stories are undefeated! @donnelly_brent
The Economist fait sa une sur Emmanuel Macron, “le sauveur de l’Europe ?”, marchant sur l’eau
17
12
10
131
25,378
Vincent Touquet retweeted
Why has this not been made into a movie??? (He asked, hoping someone would say “you idiot, it has” and give me the title)
In 1941, a Spaniard walked into the British embassy in Madrid and offered to spy on the Nazis. The British turned him down. So he went to the Germans instead, pretended to be a loyal fascist, and got hired as a German spy. His plan was to lie to them for the rest of the war. It worked better than anyone could have imagined. His name was Juan Pujol García. Before the war he had tried his hand at running a chicken farm and a movie theater. He had no spy training. What he had was a deep hatred of both fascism and communism after the Spanish Civil War, and an incredible imagination. The Germans gave him a codename, invisible ink, money, and orders to go to Britain and recruit spies. He didn't go to Britain. He went to Lisbon, Portugal, and made everything up. Using a tourist guidebook, maps, magazines, newsreels, and a British railway timetable from the library, he wrote long, detailed reports about life in England. Military movements. Morale. Ports. He'd never been there. He made mistakes. He didn't understand British money. He once reported that dockworkers in Glasgow would do anything for a liter of wine. The Germans loved him anyway. Then British codebreakers reading German messages noticed something strange. The Germans were hunting for a convoy that didn't exist, based on a report from some agent in Britain they'd never heard of. The British went looking for this mystery spy. They found Pujol. In 1942 they finally took him on and brought him to London. Now he had real help. MI5 gave him the codename Garbo, after the actress, because they thought he was the greatest actor in the world. Together with his British handler, Pujol built a fake spy network for the Germans. It eventually had 27 imaginary agents. Each had a name, a personality, a job, and a backstory. A Welsh nationalist. A Venezuelan student. A Greek sailor. Some of them recruited their own imaginary sub-agents. When they needed to explain why one agent had gone quiet, they killed him off. They even put a fake obituary in a Liverpool newspaper. The Germans reportedly paid a pension to his widow. Who also didn't exist. Then came D-Day. Hours before the landings, the British let Pujol send a message warning the Germans that the invasion was coming in Normandy. It was timed so it would arrive too late to matter, but it made him look brilliant. Three days later he sent the most important message of his career. Normandy was a trick, he said. The real invasion was still coming, at Calais, led by a huge army under General Patton. That army was fake too. But the Germans believed him. German forces that could have been rushed to Normandy were held back near Calais for weeks, waiting for an attack that never came. The Germans were so grateful they awarded him the Iron Cross. A few months later, King George VI made him a Member of the Order of the British Empire. He's one of the only people known to have been decorated by both sides of the war. After the war, afraid of revenge from surviving Nazis, he faked his own death from malaria in Africa and disappeared to Venezuela, where he lived quietly running a shop. For decades the world thought he was dead. In 1984, a British writer tracked him down. Pujol came back to Normandy for the 40th anniversary of D-Day and met veterans who had landed on the beaches. Some of them thanked him.
11
14
160
33,922
Vincent Touquet retweeted
I caught up on Friday with my friend and business partner Anatole @kaletsky for our weekly Gavekal zoominar. We were supposed to discuss how sustainable the AI capex spending boom would prove to be in the face of rapidly rising corporate bond yields? But given the headlines on France, on the Middle-East and on the growing likelihood of a peace deal between Russia and Ukraine, we struggled to stay on track… I asked the @gavekal editors to remove the locks on the podcast… research.gavekal.com/content…
24
51
3
493
42,967
Vincent Touquet retweeted
Find a partner who loves you as much as the British love being poor
44
426
13
7,529
229,148
Vincent Touquet retweeted
Hey AI build me a 4k120hz remote desktop 4:4:4 to my linux box. 'Ok ill use the dual hw encoders on your nvidia gpu interleaved'. Aaaaand it works. Wow.
5
1
88
5,654
Vincent Touquet retweeted
Postgres 19 delayed after AI reviewers find more bugs than humans can fix Core devs revert up to 10 features, push release to November, and blame better tooling rather than vibe coding theregister.com/databases/20…
2
1
10
1,598
We made the first AI model you can have a realistic conversation with that was trained entirely on speech! Dessa is a full-duplex speech-to-speech model that you can run on consumer GPUs. This is a GPT3 moment for speech.
1,010
1,219
1,191
17,113
4,548,880