THE STORY SO FAR… Man… it’s three in the morning. The coffee’s cold, the tape keeps rolling, and somebody upstairs just swore the whole system’s gone down. While the suits keep saying, “Trust us, baby…” the people on the night shift know better. They know every switch, every wire, every busted promise. So we wrote a record about it. Not with speeches. With bass lines. These songs are for everybody who’s ever stayed late to keep the lights on, everybody who’d rather look under the hood than take somebody’s word for it, and everybody who believes the best way to keep something honest… is to let the whole neighborhood see it. So kick off your shoes. Turn the receiver down. Turn the speakers up. Raise one finger to the ceiling… And if anybody asks what you’re doin, Tell ‘em you’re just… Stayin’ Alive.

In cybersecurity, the dangerous knowledge is the defensive knowledge.

Security through obscurity failed before. It will fail again. IDT stands with the Open Secure AI Alliance.

Brooklyn Bridge Park overlooking the skyline instagr.am/p/DatuoDWFMyO/

Shakespeare in the garden instagr.am/p/Das5zOQs3s-/

See: youtu.be/pPNwAKW9Mzw?is=wfko… instagr.am/p/DZeCX-8kyT4/

Wedding made in heaven, down to earth. instagr.am/p/DZBXLvHlMMM/

Eleven minutes. That is how long the malicious build of Nx Console sat live on the VS Code Marketplace last Monday before it was pulled, and that is the number being passed around as the story. It is the wrong number. The right number is 2.2 million installs, a payload that activates on workspace open rather than on install, and a credential collector that walks straight into your AWS keys, your 1Password vault items, your HashiCorp Vault tokens, your GitHub Actions organization secrets, and — for the first time as a standard target in this class of payload — your ~/.claude/ directory. What makes this incident worth reading carefully is not the speed of the response. It is what the payload contained: a full Sigstore attestation pipeline that lets the attacker publish downstream npm packages with valid signed provenance using stolen OIDC tokens, a command-and-control channel that runs through api.github.com/search/commit… with RSA-signed instructions, and a dropper hidden in an orphan commit inside the official nrwl/nx repository that can only be fetched if you already know the SHA. Every layer of trust the ecosystem has built over the last three years was either used as infrastructure or impersonated. My read on what this actually tells us about the developer endpoint as a perimeter, and why eleven minutes was the defender's most flattering metric in this story: xitter.cf/gbenoni/status/2057373…

Every quarter, six AI companies hold the same press conference. They all claim the best benchmarks. They all promise the lowest prices. They all swear by the most safety. They all want your tokens. So here’s the song. Bar for Bar — GPT, Claude, Gemini, Grok, Llama, DeepSeek. Six verses. One beat. One wallet. Each model spits sixteen bars roasting its own marketing. The roasts aren’t fictional. They’re the market positions, delivered accurately, over a Hamilton-grade live band. The joke isn’t the genre. The joke is that this is what every CIO procurement cycle already sounds like — and nobody had bothered to write the song down.​​​​​​​​​​​​​​​​ v1/v2

Coming this Friday-day boyeee! instagr.am/p/DYWusBOOccN/

Decided to skip reality for a bit and join a comic strip. instagr.am/p/DYLUxVBk56M/