sidequesting | fmr @MessariCrypto, @DL_Research, @Accenture | travel, culture, cars, golf and tech
Midwest
Joined February 2016
- Tweets2.9K
- Following7.5K
- Followers1.6K
- Likes22.2K
Ffs really
🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.
🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker
pip install est compromis.
L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.
Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour pypi.org, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.
Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.
La situation est terrifiante !
Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.
Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.
Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.
C'est quand il y a de la mer qu'on reconnaît les vrais marins...
Readers added context they thought people might want to know
Ce n'est pas un bug Python mais une vulnérabilité des clés privées faibles des certificats intermédiaires eMudhra/emSign (d<256 dont une valant 4), exposant les bundles certifi/pip à des MITM TLS potentiels jusqu'aux mises à jour.
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
scotthelme.co.uk/eight-bits-of-…
github.com/advisories/GHS…
Sean 🇯🇵🇺🇸 retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Sean 🇯🇵🇺🇸 retweeted
First they ignore you, then they laugh at you, then they fight at you, then they add you to their Long-Term Capital Markets Assumptions paper and predict you'll be the best-performing asset of the next decade.
Use my referral code
Blast will be shutting down.
We launched Blast with the goal of building a self-sustaining chain for users and developers. Unfortunately, the economics of operating the chain no longer make sense: the ongoing costs of maintaining Blast exceed the revenue generated by the L2, and we do not see a credible path to making the chain economically sustainable.
As a result, we've made the difficult decision to wind Blast down.
We're sorry to the users and developers who believed in Blast, built on it, and supported the ecosystem. Our priority now is making the shutdown as smooth and safe as possible.
We're asking all users to withdraw their assets from Blast to Ethereum mainnet, including any balances held in the Blast PWA.
To make this easier, we will be reducing the withdrawal delay to 24 hours.
As part of the shutdown process, we'll first begin withdrawing Blast's Lido assets. This process is expected to take approximately one week. During this period, withdrawals will temporarily be unavailable, even after the withdrawal delay is reduced to 24 hours.
Once that process is complete, withdrawals will resume with the new 24-hour delay.
Users will have until October 26, 2026 to withdraw through the normal Blast interface.
After October 26, assets will remain withdrawable, but users will need to interact directly with the Blast bridge contracts on Ethereum L1. We'll publish detailed instructions before then.
We strongly encourage everyone to withdraw their assets to Ethereum mainnet before October 26.
I think everyone knew the outcome here 🤣
Website claim portal is live!
Claim eligible new fees based on the quote asset the fees were claimed in. In most cases this is SOL.
Alternate claim options like DM or tagging us in a post will be available soon.
X Money payments remain paused until further notice. Your historical balances remain separate and we are working on a separate claim for these.
We hope to bring X Money payouts back in the future.
I think this energy situation could be a catalyst for increased rail demand.
North American reindustrialization is already creating the need to move more raw materials and finished goods domestically, while an increasingly unstable oil regime could make the economics of long-haul trucking less predictable and further strengthen rail’s cost advantage.
That demand story is converging with an aging North American railcar fleet approaching a meaningful replacement cycle.
Lease fleeet utilization across major players are already approaching 100%. If higher rail demand, fleet replacement and reindustrialization reinforce one another, this can create a multi-year tailwind across the rail value chain.
It seems most people don't understand how severe the energy situation is right now in the Middle East.
As of Friday, Saudi Arabia's East-West pipeline has officially been shut down after recent attacks, putting -4 million barrels of daily oil exports at risk.
Meanwhile, the Bab el-Mandeb Strait is now at risk of being shut down, threatening up to -9 million barrels of daily oil supply.
All while the Strait of Hormuz is operating at ~20% of its pre-Iran War capacity, removing -15 million barrels of daily oil flows.
Combined, this represents nearly ~30 MILLION barrels per day of oil flows that are either offline or at risk.
Even after accounting for some overlap between these routes, the scale of the potential disruption is enormous relative to the ~100 million barrel per day global oil market.
This is one of the most severe energy supply situations in modern history.
