Partner, Kenetic; Strategic Advisor to Blockdaemon, Hypernative, SVRN, Mythical Games
Hong Kong
Joined November 2008
- Tweets687
- Following446
- Followers795
- Likes1.3K
John Fiorelli retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
John Fiorelli retweeted
We are at Security Armageddon now.
A large part of internet is affect in some way today, lots of older software vulnerabilities are coming out and through those more software is getting exploited.
PHP systems like Wordpress power a big part of content websites. Malicious TLS certificates especially affect basic services and older codebases. Plus node.js, plus LiteLLM, etc etc.
Uncensored models are becoming a key to enable security defenses to keep up. Formal verification allows to improve on how things are verified but still requires smart models to translate between systems and make sure formalizations are correct.
We also really need to transition to models that involve cryptography where right now API keys and access tokens are used. Hosting platforms that can secure the software even from platform itself.
Meanwhile, update, patch, rotate.
John Fiorelli retweeted
You can update your NEAR account to post-quantum readiness today.
NEAR Co-Founder @ilblackdragon breaks down how NEAR is already preparing for the migration.
NEAR co-founder Illia Polosukhin: "You can literally just update the keys to be post-quantum right now." NEAR added ML-DSA signing in its July mainnet upgrade, with no need to move assets.
@ilblackdragon @therollupco
John Fiorelli retweeted
Anyone with a NEAR account can add a quantum-safe FIPS-204 (ML-DSA) key on mainnet today in one transaction, and keep their account and its assets. NEAR wallets like Meteor also support quantum-safe signing.
Docs: docs.near.org/tools/cli#ml-d…
NEAR's full roadmap to post-quantum security: near.org/blog/near-quantum-s…
John Fiorelli retweeted
The deeper $NEAR thesis is about who controls intelligence.
“If we build towards a future that centralizes intelligence and context… it would not be a utopian outcome.”
“We can build technology to enable users to be sovereign and control their intelligence, control their assets, control their data.”
“It’s a future I wanna build towards that my children can live in.”
- @sal_ternullo
NEW EPISODE - Why the Near $NRR ETF is Different
@NEARProtocol just got a new institutional gateway.
@Bitwise CEO @HHorsley and @svrn_ai's @sal_ternullo join @TrustlessState to break down NRR’s strong launch, $32B+ in NEAR Intents volume, staking and token buybacks, and why NEAR may increasingly be viewed as a bet on the convergence of crypto and AI.
Plus, why a future with many models, chains, and agents could play directly into NEAR’s strengths.
CHAPTERS
---
0:00 NEAR’s New ETF
2:15 Bitwise and NEAR
8:49 Selling NEAR to Investors
12:18 Intents and Buybacks
20:23 Staking and ETF Demand
26:34 The AI Opportunity
33:11 Many Models, Many Chains
38:37 AI Privacy
42:48 Closing Thoughts
John Fiorelli retweeted
The funds from the $3.8M NEAR Intents hack were sent back in full.
We are stopping the investigation.
Please use bug bounties instead of disrupting the services.
John Fiorelli retweeted
Netflix just confirmed in an SEC filing that it paid $587 million in cash for Ben Affleck's 16 person AI startup. That's about $37 million per employee.
And the model is the least valuable thing they bought.
Affleck's logic, in his own words, was that public video models were trained on his peers' films, and he didn't think that was a real business. You can't sell studios a tool their own lawyers would sue over. So InterPositive raised money, spent 8 months shooting its own dataset on a controlled stage, and used that footage only for late-stage training, so output hits real production standards instead of demo-reel quality.
Then comes the part Netflix actually paid for. Each new film fine-tunes a private model on its own dailies. The production keeps the footage and keeps the weights.
Dailies might be the cleanest video training data on earth. Professionally lit, continuity tracked, shot at a ratio of hours of footage per usable minute, with every rights question already settled in the contracts. Hollywood generates this at industrial scale every day, and until now it all went into a vault after the edit.
Affleck was on Rogan in January calling AI writing mid and the valuations overblown, while running this company in stealth since 2022. Turns out the two positions were consistent. Scraped models were the ones he called worthless. The one with clean title to everything it learned was the one he sold for half a billion.
Netflix says around 300 of its titles have already used generative AI. The $587 million bought the pipeline that makes the next 300 defensible in court.
Ben Affleck (Hollywood star & Artists Equity CEO) talks about how he fine-tunes open video models by unfreezing weights and trained only the last cinematic layer so a film crew can hit real production standards.
for context, Ben Affleck founded InterPositive in 2022, a 16-person AI shop for film post and Netflix bought it in March 2026 for $587 mn in cash.
He needed that model because public video models were trained on his peers' films, and he did not think that was a real business. So InterPositive raised money, shot its own dataset for 8 months on a controlled stage, and used it only as late-stage training.
Each new film then trains a private model on its own dailies, so the production keeps the footage and the learning. That is the product Netflix paid $587 million for.
----
From "Bloomberg Live" YouTube channel, (link in comment)
John Fiorelli retweeted
Six months ago we published our first NEAR report with @TheTieIO, built bottom-up from real fee data. With lots of momentum around NEAR's growth, I'm taking a quick look back at the report's key ideas, and what's transpired in the time since it published.
We said @near_intents was real economic activity worth modeling, $14B in volume in its first 14 months. Now it’s $32B+, and its first $300M day last week.
We said the Feb fee switch would turn every swap into demand for NEAR. Since then: fees have passed $50M, roughly double the $25M in our report.
We said the market was valuing NEAR like any other L1 and missing the revenue flowing through Intents. Since then, the market has started to reprice it.
We said a US ETF would open NEAR to traditional investors. Since then, Bitwise's NEAR ETF was just cleared to list (today).
The supply side is still catching up. near:native's repricing pushed the threshold higher, so volume has more ground to cover than it did in March.
An area I think we were most conservative is AI. Intents proved that NEAR's economics live in coordination between users, solvers and chains. Agents are the next wave of that coordination. Every agent paying for private inference, settling a trade or renting compute on NEAR creates demand we didn’t model. That’s coming next…
For a peek back at the report, here’s the link.
svrn.net/research/near-proto…
John Fiorelli retweeted
I told Opus 5.5 to find out who Satoshi was and ask him to rap the whitepaper for me.
It located an old email address nobody knew about.
Then a swarm of agents set up a studio for him and got a mic and everything. They even brought in pineapple jalapeno pizza.
Sound up!
John Fiorelli retweeted
Illia on why real world businesses using crypto make privacy a necessity
"Speculation has been the biggest use case of blockchain thus far. I think what's also happening, at least from what I'm seeing over the past year and a half, is that we're actually getting people starting to use this for real businesses. Cloudflare is adding agentic payments that are gonna be on blockchain."
"While you were speculating, yes, the visibility of the trades was a problem. But people were okay with that for the most part. When you're starting to actually use it for real business, if I'm paying for coffee, if the coffee shop sees my balance, my net worth, during that transaction, that's a massive security issue."
"And for businesses, it's a massive business operations issue. Because everybody sees who they paid, what is their cost of goods, how much is sold."
"People ask, nobody cared about privacy. ZEC existed for a long time. Nobody cared about it. What happened? The change that came is people actually starting to use it for day to day stuff, starting to use it for running businesses."
"So privacy becomes really an enabler. I do feel there's a transition that's happening, and $ZEC and $NEAR both are really delivering on that value prop."
Zcash vs. NEAR: Two Very Different Privacy Bets xitter.cf/i/broadcasts/1pKkOXEeQ…
John Fiorelli retweeted
been thinking more on coherent messaging re: NEAR
let's ideate from first principles:
- the product of capitalism is markets
- capitalism -> markets -> competition -> specialization -> fragmentation
- within the specializations, there will be dominant leaders in each category
- SoV: gold, zec, btc
- trading: solana, hyperliquid, robinhood, binance
- currencies: usd, eur, gbp
- and on it goes: ai inference, private compute, real estate, international stocks, metals, e-commerce yada yada
- this requires connective tissue, which has been traditionally served via something like binance
- but one centralized company can not serve this need for infinite markets. there are too many handicaps, lack of network effects, and singular points of risk and stoppage. this is a rare case of decentralization being necessary. neutrality is non-negotiable for unstoppable global trade.
- now, you may see where I'm going and say: well Ethereum and Cosmos already tried this. but that's wrong. what they tried to do was structurally flawed
- those models required the succeeding nodes (L2s and L3s) to be from within the ecosystem, but that is incoherent since i) you can't force success, ii) if one were to succeed, they would just want to own the platform
- the other model is of course the Solana/Hyperliquid model of having everything concentrated on the L1. this model works. however this requires a high-degree of specialization to be competitive. you won't out nasdaq solana.
- but, NEAR does not need to do this. where there is concentration, there is also the need for connection.
- especially with their chain signature architecture, instead of forcing new internal nodes, they can just discover the successful ones and connect them to each other without ideology (see: NEAR intents supporting ZEC but also ZEC on Solana!)
- importantly, this is PvE and not zero sum. the more markets succeed, the more interesting NEAR becomes, i.e if Solana is one continent, and AI another, and Zcash another, then NEAR is the silk road.
so I think the coherent message for NEAR is:
the market of markets — the capital of capital
John Fiorelli retweeted
For those who just (re)discovered $NEAR:
- Mission is all people own their assets, data and power of choice
- Vision is AI is the frontend, markets/blockchain is the backend
- Privacy is fundamental and enables the mission
- NEAR Intents is universal, private markets routed already $30B, integrated across all of onchain ecosystem from Ledger to ZODL to Metamask to Trust to Brave
- NEAR AI is private AI powering end to end encrypted inference in Brave, Venice, and more
- More products across ecosystem are developing to leverage AI x markets
- Apps in Web3 that don’t want to limit themself to one chain’s users use Intents to enable seamless connect by users of any chain
- near(.)com brings this whole vision together into a consumer product making private unstoppable liquidity and (soon) AI seamless
If you are using onchain and private products you are probably using NEAR.
And if you are struggling onchain - try near(.)com for seamless experience.
John Fiorelli retweeted
PERPS NOW CONFIDENTIAL BY DEFAULT
Open a position from the account you already use, and nobody can tell it's yours.
Only on perps.near.com/
John Fiorelli retweeted
Massive spike in sign ups for @near_ai cloud as people realize they need to encrypt their prompts.
Keeping your AI private is as critical for businesses as having op sec. Cat is out of the bag and everyone needs to position accordingly.
John Fiorelli retweeted
I sold my $ZEC for $NEAR
After trying how good NEAR privacy actually is
Deposited USDC on ETH, traded it, sent it to Solana
Took me less than 2 minutes
The biggest difference from other privacy tools?
It feels like using a regular mainnet, no shield, no unshield
And yes, I know they're different: one depends on hardware, the other is pure math
But at $3B vs $10B, I think $NEAR has way better short-term potential, plus Agents what they plan to ship this month
What you think, did you try it?
We're in a Bitcoin bear market
But you can still make money with just three coins:
• $HYPE ($16B)
• $ZEC ($10B)
• $NEAR ($3B)
It's crazy how this trio keeps pumping against the whole market
But notice something?
$NEAR is still sitting at just $3B
I think it has the most room to run short term
What's your pick of the three? (my def near rn, nfa btw)
John Fiorelli retweeted
Join us next week on September 10 for Virtual NEAR Day, ft. a great lineup of speakers and conversations about the agent economy. I'm closing out the agenda with a fireside chat on formal verification w/ @AlexSkidanov.
Livestreamed from @NEARProtocol – see you there.
John Fiorelli retweeted
We spent the past few months working with @Oracle and @NEARProtocol on a proof of concept that puts stablecoin payments inside Simphony, the Oracle point-of-sale system running checkout at food and beverage venues worldwide. Oracle brought in SVRN as a commercialization partner of NEAR, to design a solution for integrating @near_intents' coordination infrastructure with Simphony.
Payment settlement is moving onchain for practical reasons that Oracle and other large payment infrastructure providers can no longer ignore. Cards authorize in seconds, then the merchant often waits days for the money. Onchain settlement finishes in seconds, costs less, and the funds are ready to use nearly instantly.
The larger opportunity will arrive when agents start doing the buying. NEAR Intents is well positioned to serve that future, and Oracle's writeup on our collaboration points right towards it.
