PhD candidate at UCF | Quantitative Finance
Orlando, FL
Joined August 2013
- Tweets127
- Following140
- Followers15
- Likes58
Robert Bach retweeted
a developer just put $2,000 in bitcoin on a server with the PHP vulnerability and dared the entire internet to steal it
17 hours later the money is still there
people are crashing the server but nobody can actually pull off the exploit
remember when i posted about marcus hutchins calling out all those fake AI-generated exploits on github? this is the proof
the vulnerability is real. but actually using it is a completely different story
$2,000 sitting on a broken server and the whole internet can't touch it
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it.
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
Readers added context they thought people might want to know
The GitHub repository cited as the source explicitly acknowledges in its README that the supposed exploit is fabricated: “And of course it’s fake. Duh. Note: No harm intended, purely for fun.”
github.com/0x1c1101/CVE-2…
Robert Bach retweeted
If you've ever wondered why smart TVs are so cheap, this is why.
@log4j rooted his Samsung and found an always-on hot mic, automatic content recognition, geolocation, network mapping, ad targeting and user profiling, shared with Samsung's "400 partners".
A lot of it can be blocked in <15 min, wrote a basic guide below.
What your TV is doing
The main culprit is ACR (automatic content recognition). Your TV screenshots what's on screen, fingerprints it, and sends it home to build your ad profile. Samsung does it every 500ms, LG every 10ms [1].
What is insane: it happens on connected devices too.
Plug in your laptop, your console, your work machine, and your TV can fingerprint that via HDMI [1].
He also found that if your Samsung doesn't have a mic, it'll look for one from a connected soundbar or bluetooth device.
xitter.cf/log4j/status/211376224…
It's on by default, and you likely agreed to it on the setup screen you clicked through in 10 seconds.
Step 1: Turn off ACR
Samsung: Terms & Privacy → Viewing Information Services
LG: Live Plus
Vizio: Viewing Data
Roku: "Use info from TV inputs"
Sony/Google TV: Samba Interactive TV
Menus vary by model, but those are the names to look for. While you're in there, opt out of interest-based ads, reset your advertising ID, decline every optional privacy agreement, turn off voice recognition, and delete apps you never open.
Step 2: Give smart devices their own network
Put the TV, cameras, speakers and vacuum on your router's guest/IoT network. The logic is simple: these devices rarely get patched. If one gets compromised (getting drastically more frequent with AI), it shouldn't be able to see your other devices or home network.
Step 3: Block trackers for the whole house with DNS-level filtering
NextDNS (cloud-based) is easy and has a solid free plan. Pi-hole is a little bit more work if you prefer self hosting. For simplicity we'll focus on the former.
1. Sign up at nextdns.io (free tier is plenty)
2. Privacy tab: add a blocklist (OISD is a good bet) and turn on Native Tracking Protection for Samsung, LG, Roku, Amazon (see attached image)
3. Setup tab: copy your endpoint
4. Paste it into your router's DNS settings as DNS-over-HTTPS/TLS (or use the IPs + "Link IP" if your router only does plain DNS)
5. Bonus: block outbound port 53 except to your router. Some devices hardcode their own DNS to get around you
Then open the NextDNS logs and watch how often your TV phones home. It's eye-opening. If an app or update breaks, find the domain in the logs and allowlist it.
Why they do this
TV prices are down 97% since 2000 [2]. Most of that is better manufacturing and brutal competition. But once margins on the hardware hit zero, the cost moved to you.
In Q3 2024, Vizio lost $6.7M selling TVs and made $115.8M in gross profit from ads and viewing data [3]. They've said on earnings calls that they keep TV prices low to grow the audience they sell to advertisers. Walmart bought them in 2024.
This isn't a conspiracy theory either. Vizio paid $2.2M to the FTC in 2017 for tracking 11 million TVs without consent. Last December, Texas sued Samsung, LG, Sony, Hisense and TCL over ACR. Samsung and LG have since agreed to stop collecting that data without explicit consent [4].
TL;DR
1. ACR off
2. Ads + voice off
3. Smart devices on their own network
4. NextDNS filtering on the router
Sources:
[1] ACR study: arxiv.org/abs/2409.06203
[2] Cost of US consumer goods: aei.org/economics/chart-of-t…
[3] Vizio Q3 2024: sec.gov/Archives/edgar/data/…
[4] Texas v. Samsung: texasattorneygeneral.gov/new…
I handed my Obsidian vault to three coding agents: Claude Code, Codex, and Hermes Agent on a local model.
They capture sources, keep the index, answer from my notes, and lint the vault. I approve every note that becomes permanent.
Open-sourced the setup. Thread:
5. A frontier model and a 27B local model share the vault: a mkdir write lock, git rules for the second machine, and a smaller role for the small model.
Skills are written in "80% ASD-STE100", another Karpathy tip. Short imperative steps work far better on the small model.
6. One command, and it never overwrites your files:
curl -fsSL raw.githubusercontent.com/ba… | bash -s -- ~/external-brain
Repo: github.com/baobach/llm-wiki-…
Full write-up: quantfin.net/posts/llm-wiki-…
Robert Bach retweeted
this is wild... all open source? are you kidding me
What if Spotlight actually understood the meaning inside your files?
DigUp is an open-source macOS menu bar app powered by EmbeddingGemma 2 that brings 100% local, multimodal semantic search to your Mac.
Instead of searching for file names, you can use natural language to:
📸 Find specific scenes in your photos
⏳ Jump to the exact timestamp in audio or video
💻 Search through your codebase by intent
Everything runs locally in a single vector space.
Robert Bach retweeted
I wrote a blog post detailing the writing approach I took while working on my recent paper: sophielwang.com/blog/paper-w…
I describe the behind the scenes for how this paper came to be, why and how I storyboarded figures before running experiments, and some figure design tips! :)
Can “chicken” make a base model reason? 🐔
Yes!
Why? With the right first tokens, base models can match RL in reasoning. We trace this to learned training data associations and use a simple data edit to make “chicken” elicit reasoning too.
blog: sophielwang.com/cues
Robert Bach retweeted
Accepted to #NeurIPS2026, we reshaped Monte-Carlo Tree Search 🙉
Introducing 2FFS, a new tree search algorithm that combines multi-fidelity bandits to resolve the fundamental trade-off: should we use cheaper, approximated evaluations, or expansive but accurate samplings?
More:
Robert Bach retweeted
耶鲁一位计算机博士生，把自己发论文用的画图脚本全开源了，项目叫 figures4papers。
支持柱状、雷达、折线趋势、三维球体示意、概念等类型图，8 个论文项目各一个文件夹，脚本、数据、成图放在一起，照着改数据就能出自己的图。
他还把这套画图风格整理成了一个 Skill，接进 Cursor、Claude Code 或 Codex，让 Agent 按这套规范帮我们写画图脚本。
GitHub：github.com/ChenLiu-1996/figu…
规范写得挺细，去掉上边和右边的坐标轴线，柱子加黑边，配色固定一套语义，蓝色给自己的方法，绿色系给改进项，红色系给对比基线，默认 300 DPI 导出。
不装也能用，把仓库在 Agent 里打开，提示词里让它照 SKILL.md 和设计原则文件来写就行，README 里给了现成的提示词模板。
前几天分享的 vivid-figures-skill 是让 AI 选图画图，这个更像拿一位常年投顶会的作者的审美当模板，写论文要出图的可以两个都看看。
Robert Bach retweeted
"A Mathematical Explanation of Transformers" is a recent paper that develops a rigorous mathematical framework for understanding the architecture behind Transformers and large language models.
It interprets the Transformer as a discretization of a continuous integro-differential equation, with self-attention represented as a non-local integral operator, layer normalization as a projection onto a constrained set, and feedforward layers and activation functions incorporated into the same mathematical framework, then uses operator splitting and numerical discretization to recover the standard Transformer architecture and extend the formulation to multi-head attention, Vision Transformers, and convolutional Transformers.
I've already shared several resources on the mathematics behind neural networks, Transformers, and LLMs, but there always seems to be something new and interesting to explore in this area.
arxiv.org/pdf/2510.03989
Robert Bach retweeted
Chinese researcher just reinvented the transformer encoder and RNN decoder for the Nth time.
since 2017, every major AI, ChatGPT, Claude, Gemini, has been built on the exact same architecture: The Transformer.
but Transformers have a fatal flaw.
it can only "think" as far as its context window allows.
before Transformers, we used RNNs (Recurrent Neural Networks). they could theoretically remember things forever, but they were too slow to scale. so the industry killed them.
now, Chinese researcher Yifan Zhang just merged them back together.
it is called the Recurrent Looped Transformer (RLT).
instead of just predicting the next word, RLT creates an infinite loop of hidden reasoning.
here is how it works:
raditional AI reads your prompt, stops, and then starts generating.. there is a hard boundary between the input and the output.
RLT destroys that boundary.. it creates a single recurrent computation across every single prompt and response token.
here is the exact architecture that makes it work:
- it uses a massive 48-layer causal encoder to build a global key-value memory bank.
- a 48-layer recurrent decoder takes its final hidden state and sliding-window attention cache, and injects it directly into the very next token.
- because of this, after processing 't' tokens, the reasoning path has traversed t * 48 decoder blocks.
it doesn't just passively read.. it carries a continuous, unbroken chain of latent computation forward in an endless loop.
the temporal depth is theoretically infinite.. every single word processed actively extends the ai's reasoning capacity without hitting a fixed architectural depth limit.
We are at the dawn of Superintelligence.
Introducing the Recurrent Looped Transformer (RLT),
We now have Transformers with Infinite Reasoning depth.
From now on, we should pace progress at the Open Frontier of Superintelligence,
Until Safe Superintelligence is achieved.
github.com/yifanzhang-pro/re…
Robert Bach retweeted
I'm selling ad space on my MacBook
→ 10 sticker spots on the lid
→ live auction
→ 14 days
except I don't own it yet, the auction buys it
→ your logo travels with me and gets seen both online and IRL
BrandMyMac.com
Robert Bach retweeted
A Chinese developer just explained the shift from Loop Engineering to Graph Engineering better than anyone.
most people are still building agents the way that's about to be obsolete.
> why single-agent loops break and go "goal blind"
> the 4 parts of a graph: nodes, edges, state, policy
> 3 topologies that run everything: diamond, supervisor, pipeline
> Anthropic's 5 official workflow patterns
the punchline: it's not how many agents you run. it's the determinism you build with verifiers, code fallbacks, and reality anchors.
I broke the same architecture down with Kimi K3. Full A-Z guide below.
Robert Bach retweeted
Google just released a free 1-hour lecture from Chief Scientist Jeff Dean on full AI Engineering.
How to go from one LLM to coordinating 100 AI agents:
01:45 - Build an LLM from scratch
17:22 - Learn how to actually use AI models
30:03 - Master prompt engineering
52:35 - Coordinate 100 agents as one human
Most people are still learning how to prompt one model.
Jeff Dean is showing the full stack:
LLMs → Prompts → Agents → Agent Teams → Graphs
Prompting is the old workflow.
Coordinating agent systems is the new one.
This is 27 years of Google AI compressed into one hour.
Bookmark and watch it today
Then read the full Graph Engineering guide below ↓
