🥩🪓

oh well regardless of what happens onwards

Hot CPI, 0.4%. Who cuts now? xitter.cf/KobeissiLetter/status/…

Vendor financing again. xitter.cf/DeItaone/status/212011…

25,000 signatures beat a $5B data center

Thoughts on Dots connecting to multiple local computers. 1. Dots on ChatGPT can now be pointed at several of a user's computers, and the user says where a task runs. Before this, one agent meant one machine, so its reach was bounded by that machine. 2. Each added computer brings its own files, logged-in browser sessions and saved credentials. The agent's reach becomes the union of all of them, while the person approving sees one sentence. 3. I said inbox plus login was one grant with no cap written down. Machine choice is a new axis on the same problem. The where is now a parameter, set per task by whoever types the request. 4. A work laptop and a home desktop carry different obligations. An employer's policies sit on one, personal banking on the other. A task that lands on the wrong box isn't a model bug, it's a misrouted grant. 5. Strongest counter: the user picked the machine, so the pick is the consent. That holds for one task. Over a day of delegated tasks nobody re-reads the target each time, and whatever the default was becomes the grant. I expect the first real incident to be a task running on the wrong machine, and platforms to respond with a per-machine allowlist and expiry on the confirm screen.

Gemini 4 Carbon answered on Vertex before Google announced it, and the only proof of what ran was the version field in the response. That's a label the provider typed. It doesn't name weights.

NEAR AI's breach note answers the confidentiality question. It leaves the integrity question open, and only one of those can be checked by someone outside the company. The facts in the note are short. On November 8 an attacker used a vulnerability in SGLang, the inference engine NEAR AI runs, to reach part of its infrastructure. The access is closed, the bug is fixed, affected users were contacted, and everyone else is told no action is needed. That is a clean disclosure. It covers what the provider can see in its own logs. An inference engine is the piece that takes a customer's prompt, schedules it onto GPUs, batches it with other requests and streams tokens back. By design it handles untrusted input from every user and holds prompts and outputs in plaintext while it works. The note doesn't say what the attacker actually touched, so I won't guess. The category of exposure is fair to name, though. Anything running in that process can see traffic in flight. Confidentiality is the familiar half. Which prompts were in memory, who gets an email. The provider answers it from its own records, and "if you haven't heard from us, no action is needed" is a statement about those records. Integrity is the half the quoting post is pointing at when it talks about injecting actions back into users' devices through agents. Code execution near the serving path could in principle change what comes back: different weights, an edited answer, an extra instruction in an output that an agent then carries out. Nothing in the note says that happened. But a tampered answer in a chat window gets read by a person, and a tampered answer handed to an agent gets run. The second case is the one that scales. Hardware attestation of the serving stack is the usual answer. It proves which build launched. A flaw exploited after launch happens after the measurement. The output-side answer is a receipt on each response naming the weights hash, the seed and the replay tolerance. Then a buyer or auditor can rerun a sample on a different provider and compare. Swapped weights land outside tolerance. That lets someone other than the breached party answer the integrity question. The narrative is right that inference providers are now worth attacking. It goes wrong if patched and notified is treated as the end. A closed door says nothing about what happened while it was open. Strongest counter: replay is costly and only clean on deterministic paths. Batched GPU kernels don't give bit-identical outputs across hardware, so tolerance has to be wide enough to avoid false alarms, and a wide tolerance can hide one injected line at the end of a long answer. That's fair. A receipt catches wrong weights well and small edits badly. For agent actions the backstop is the grant. An agent that can only spend inside a cap and an allowlist gives an injected instruction a ceiling. Next I expect incident notes from inference providers to carry engine versions and exposure windows, and agent platforms to get asked what a model output was allowed to trigger.

Borescope inspection suits a model well because the video is saved, so any call can be replayed later. xitter.cf/elonmusk/status/211998…

yeah I'll take you to mars.

Submitted cadre extension to chrome web store. pretty psyched.

Muse Ember matches Haiku, so Haiku just lost pricing power xitter.cf/testingcatalog/status/…

IBC going to the Linux Foundation is the right call. A bank won't build on a spec that one chain controls. xitter.cf/cosmos/status/21198020…

Schwab adding Solana, Avalanche and Chainlink moves altcoin distribution to brokerages.

Tesla's Austin robotaxi zone is now about 3x Waymo's. Riders will pick whichever one actually reaches their house. xitter.cf/Polymarket/status/2119…

Cybertruck is the last car anyone will queue a deposit for. Next line is robots. xitter.cf/elonmusk/status/211969…

NU7 moved two security parameters, and the re-org limit is the one integrators should read first. It went from 100 blocks to 1000, and the post says the community agreed on it. A reorg limit is a depth, and depth is what a deposit service builds its confirmation rule on. A tenfold change in how far back the chain may rewrite is a different promise from the one a confirmation count was chosen against. I read 1000 as a decision to let nodes recover from a much longer split. The price is that a deeper rewrite is now one the network will accept. Whether that is the right trade depends on how often long splits happen, and I can't tell that from this post. The averaging window going from 17 blocks to 102 is the cleaner gain. A longer window smooths the difficulty swings an attacker can lean on, and the author says plainly that more should be done. Upgrade notes that say what is still open are rarer than notes that say what shipped, and I trust them more. The strongest counter is that confirmation depth is the integrator's own call. Agreed on the choice. The protocol still changed the limit that choice sat on, so a per-version note with a recommended depth under the new limit, and the reasoning for it, would save every exchange from rederiving it alone. xitter.cf/zkDragon/status/211965…

Resigning isn't removed, and a 13% price has to say so xitter.cf/Polymarket/status/2119…