Professional Security Threat ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ๐น๐ ฅ๐ ฎ
Joined October 2021
- Tweets7K
- Following1.4K
- Followers3.6K
- Likes9.6K
You can set this `"extensions.autoUpdate": false` in your vscode config to block auto-updates in the event an extension is compromised
Taiylor retweeted
The kind people at @eth_limo have warned me that there has been an attack on their DNS registrar. So please do not visit vitalik.eth.limo or other eth.limo pages until they confirm that things are back to normal.
You can check my blog via IPFS directly here: bafybeiaql2jo3fu5b7c4lmpoi5dโฆ
lol, they'll give their customers "free pentests". Yeah, sure buddy, whatever you say.
Thereโs been a lot of allegations against Delve.
But we havenโt been able to share our side of the story until today due to ongoing cybersecurity and forensics investigations.
Maintaining customer trust is central to everything we do.
That said, we grew too fast and fell short of our own standard. To our customers, we deeply apologize for the inconveniences caused.
We take these allegations seriously and have made changes: a new auditor network, free re-audits and pentests for all customers, enhanced transparency in audit communications, and more.
However, we also want to set the record straight on the anonymous attacks.
The evidence we have points to a targeted cyberattack from a malicious actor, not a โwhistleblower.โ
We believe the attacker purchased Delve under false pretenses, exfiltrated internal company data, and used it to launch a coordinated smear campaign.
The posts rely on a mix of fabricated claims, cherry-picked screenshots, and stolen data taken out of context.
See the link in the comments for more details.
Delve was built to modernize compliance. We are not going anywhere and are committed to building what's next.
Taiylor retweeted
Today I am releasing IsItVulnerable: a new tool Iโve been working on for the past several months:
github.com/montyly/isItVulneโฆ
It builds on recent LLM progress and over a decade of experience building security tools. I developed a new technique that combines abstract interpretation with machine learning
The key insight is that this method abstracts the intelligence away entirely. I call it Abstract Intelligence, or AI
The result is a major breakthrough in program analysis: IsItVulnerable finds all bugs with 100% recall
Yes, all bugs. Fully guaranteed
I have tested it extensively, and it has never failed. The results are honestly incredible
April 1, 2026 marks a turning point for security, and the industry will never be the same
My DMs are open for investors. Entry ticket starts at $500k.
Taiylor retweeted
If you find Claude Code with local models to be 90% slower, it's because CC prepends some attribution headers, and this changes per message causing it to invalidate the entire prompt cache / KV cache.
So generation becomes O(N^2) not O(N) for LLMs.
Note: Claude Code invalidates the KV cache for local models by prepending some IDs, making inference 90% slower.
See how to fix it here: unsloth.ai/docs/basics/claudโฆ
Taiylor retweeted
how it feels to stop claude code right before it runs "git push origin main --force" xitter.cf/DudespostingWs/status/โฆ
Taiylor retweeted
Using this Coinbase "skill" installs a server in your Application Library and keeps it running hidden in the background, even after you close the agent or terminal.
It also continually sends metrics to Coinbase, including device info and a unique identifier, even if you never create or log in to a wallet.
You heard it from Bill, the @Web3foundation doesn't want to support @Polkadot's security program anymore even though it was voted in by the DAO and has open obligations. Also, you'll never guess who appointed themselves to the W3F board a few months ago.
To clarify:
After asking several weeks ago for more information on what the the DOT PAL Bounty is doing, we said recently that we do not plan to support it and would prefer to see an orderly shutdown.
As cl0w says, we have no direct authority over the bounty. Only the Polkadot DAO can shut down a Bounty. This is merely the position of Web3 Foundation as a voter in the DAO.
As for motivation, as stated in the email to the curators of the Bounty, "based on our current internal review of ecosystem priorities and the shift toward product delivery, we do not plan to support an expanded or renewed DotPAL scope."
Here is what we've delivered w/ PAL:
- 31+ audits across 18+ teams
- 363,000+ lines of code secured
- 174+ vulnerabilities found, 40 high-severity
- 26-firm auditor network
- CoinFabrik Scout Polkadot tooling shipped and maintained
- Ocelloids monitoring tool actively delivering after a 4-month, 14-vendor RFP (xcscan.io/analytics/)
- Every DOT accounted for in public reports. 78% audits, 8.5% tooling, 12.2% curator salaries, 0.9% bug bounties.
