Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.

More private keys by the Indian certificate authority have been discovered. These are all small numbers. People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.

JUST IN: E-bike injuries are soaring across the U.S., with ER visits up +760% since 2023.

JUST IN: Volkswagen reportedly plans to freeze salaries for all 660,000 employees worldwide until 2030.

My mind is blown by how far ahead Apple is with local LLMs. The new Mac Studio M5 Ultra will have a 512 GB model for around 15-20k. You can chain 6 of them together using thunderbolt 5 and this have over 3 TB of ram and a massive amount of CPU and GPU cores. This means you can run a frontier model with over 2 trillion parameters locally for around 100kish. Nivida is around 500k for the same capability.

A casino installed a smart fish tank in the lobby. Beautiful thing. Automated feeding. Temperature control. Remote monitoring. Connected to the internet. Obviously. Hackers found it. Exploited it. Downloaded the high-roller database. 10 gigabytes. Sent it to Finland. Using audio and video protocols so it looked like normal streaming traffic. The fish tank sat in the lobby maintaining water chemistry while stealing credit card numbers. The casino isolated the fish tank on its own VPN. Separate network. Segregated. Off limits to everything. Hackers didn't care. Broke through the isolation anyway. Once inside the fish tank's system. They pivoted to the main network. Quietly pulled data. Methodically. 10 gigabytes over time so nobody noticed. Nobody monitors fish tank outbound traffic. Why would they. It's a fish tank. When Darktrace finally investigated they saw it immediately. The fish tank sending massive amounts of data to an external IP. Using protocols designed for audio. Not data. Clear exfiltration. The only device in the entire casino that ever communicated with that Finland server. A fish tank. Not a computer. Not compromised credentials. Not a malware-laden email. A networked aquarium. The lesson everyone learned: IoT devices are security theater. You can secure them. Lock them down. Isolate them. They're still connected to something. Still vulnerable to something. And something will find them. Even if that something is just checking if a fish tank is running the default password.

A good buddy of mine did his PhD on this and now works on WiFi spatial mapping at a big tech company and It’s way more accurate than you’d imagine. You can map an entire college campus in real-time like Batman just with WiFi. Crazy stuff

⚠️ HORNER ACEPTA, POR PRIMERA VEZ, LA PRESIÓN QUE TUVO DEL CÍRCULO VERSTAPPEN CUANDO @SChecoPerez COMENZÓ A ALTERNAR VICTORIAS CON MAX Y ESTABLECE QUE LA ETAPA CON RICCIARDO ERA MÁS PAREJA PORQUE TENÍAN UN COCHE Y UN DESARROLLO BASTANTE NEUTRAL, COSA QUE CAMBIÓ ALREDEDOR DE 2018. “Si se analiza, obviamente durante la etapa de Daniel y Max, los dos comenzaron estando muy cerca y el coche era bastante neutral para ambos. Yo diría que empezó en 2018, cuando... Quiero decir, Max es tremendamente exigente con lo que quiere y tiene una habilidad extraordinaria: puede exigir cada vez más del tren delantero del coche y simplemente lidiar con lo que haga la parte trasera. Ahora bien, al perseguir ese objetivo de proporcionarle esa herramienta, inevitablemente tu departamento de ingeniería, tus herramientas y tu enfoque de desarrollo siguen el camino de crear esa característica en el coche. Una característica que a otros les resultaba difícil manejar. Y lo vimos en el coche de 2021, el 16B, o incluso en el coche anterior, con Alex… Lo que me resultó interesante fue que, durante 2021, Alex Albon hizo un trabajo extraordinario tras bambalinas desarrollando el coche de 2022, porque gran parte de la atención estaba puesta en el coche de 2021, desarrollándolo hasta el último momento. Y Alex había desarrollado aquel coche, que estaba muy adaptado a su estilo de conducción. Un estilo de conducción mucho más clásico, probablemente más parecido al de Sergio o Daniel. Así que, cuando comenzamos la temporada de 2022, si recuerdas, Max odiaba el coche. Tenía demasiado subviraje. Y Sergio, con esa previsibilidad… de repente ambos estaban ganando una carrera cada uno y estaban mucho más cerca al comienzo de aquel año. Y recuerdo haberme sentado con los representantes de Max, alrededor de Azerbaiyán de aquel año, y que me dijeran: ‘Mira, han desarrollado este coche alrededor de Checo. Tienen que seguir lo que Max necesita’. Así que estaba muy claro el mensaje que se estaba transmitiendo, el que llegaba a través de esa línea. Y, por supuesto, Max es el principal activo. Es el piloto con el que tienes más probabilidades de ganar. Así que, por supuesto, cualquier equipo de ingeniería gravitará de manera natural hacia su piloto más rápido, o un equipo se orientará hacia quien considere que puede darle el mejor resultado.” 🔥🇬🇧

On my way to the office this morning, I passed a group of young people protesting, a Palestinian flag draped over their shoulders. And I asked myself a question I can't shake: why does this generation always fall into the same trap? No matter the history. No matter the context. Even the ones from wealthy families, who went to the best schools, who were dealt every good card. Always the same trap. I don't think it's stupidity. I think it's a mechanism. And a mechanism can be taken apart, piece by piece. A. The observation: everything the state touches becomes unaffordable. Look at economist Mark Perry's famous chart, the one people call "the chart of the century." It tracks US prices since 2000. At the top, what explodes: hospital services, college tuition, textbooks, childcare, housing. Increases of +100%, +150%, up to +250%, far above general inflation. At the bottom, what collapses: TVs, software, phones, toys, clothing. A TV today costs a fraction of what it did in 2000, for an infinitely better product. Look at what separates the two groups. It isn't technology. It isn't complexity. It's one variable: how much the state is involved. At the top, sectors that are subsidized, regulated, shielded from competition, where the state funds demand and blocks supply. At the bottom, sectors where companies fight every single morning to serve you better and cheaper. B. The mechanism: why it's systematic. When the state subsidizes demand without freeing supply, prices rise. Every time. Guaranteed student loans, and universities raise tuition. Housing aid plus blocked building permits, and rents skyrocket. Administered healthcare, and bureaucracy eats the budget before it ever reaches the patient. In France it's even more vicious, because the price doesn't disappear: it hides. You never see the hospital bill, you pay it through payroll contributions. You never see the cost of school, you pay it through taxes. Public spending at 57% of GDP, one of the heaviest tax burdens in the world, more than €3.4 trillion in debt. And the result? Overflowing ERs, falling PISA scores, young people who can't afford to live in the city where they work. The market didn't fail in these sectors. It was never allowed in. C. Suffering demands a culprit. A 22-year-old lives all of this in their bones. They can't find a place to live. Their degree either buries them in debt or opens no doors. The future feels blocked. That suffering is real, and I don't deny it for a second. But human beings can't stand suffering without a culprit. They need a face. A scapegoat. And this is where everything is decided: who taught them how to read the world? D. Whoever tells the story picks the villain. Schools are public. Universities are public. Culture runs on grants. Film goes through funding committees. Public broadcasting shapes the narratives. The people handing down the interpretive framework are, overwhelmingly, paid by the very system that creates the problem. Do you really think that system is going to name itself as the culprit? No. It names the capitalist. The boss. The landlord. "The rich." The multinational. The commercial West. Same role, same casting, every time. E. One lens, a thousand causes. And this brings me back to that flag. A generation taught to read every situation through a single lens, oppressor on one side, rich, Western, capitalist, oppressed on the other, will apply that lens everywhere. To housing. To climate. To conflicts on the other side of the world. The cause changes, the lens stays. That's why the trap is always the same: it's not the cause that draws them in, it's the way of thinking that was installed in them. F. The perfect inversion. Here's the irony. Capitalism is the force that drove down the price of almost everything it touched. The state is the force that blew up the price of almost everything it captured. And young people blame the first for the crimes of the second. It's like blaming the firefighter for the fire because you saw him at the scene. G. The ballot box confirms it. In the US, a few weeks out from the midterms, a large share of urban young voters is getting ready to vote Democrat for more state, more spending, more regulation. New York elected a self-described socialist mayor, carried by young voters, on promises of rent freezes and city-run grocery stores. Rent freezes, the policy that has made housing scarcer everywhere it's been tried. The cure that worsens the disease. In France, it's the same play in two acts. Part of the youth votes for the radical left, which promises more state. Another part votes for the center, which promises to "manage" the state well, and has dug the debt deeper than ever. Two different ballots, one shared assumption: the problem is the market, the solution is the state. H. The way out. These young people aren't stupid. They're right to be angry. They're just aiming at the wrong target. The day they understand that their rent, their tuition and their hospital are expensive precisely because the state runs them, their anger will change direction. They'll stop protesting against those who create. They'll start protesting against those who capture. That day, the greatest intellectual scam of our time will be over.