Weaponized curiosity. CTO @ https://xitter.cf/t.co/6gglPaqDol
Riga, Latvia
Joined March 2010
- Tweets13.9K
- Following402
- Followers1.2K
- Likes2K
Vyacheslav retweeted
this post on the chinese internet by a deepseek kernel engineer explains software crafter's daily dread so perfectly
Vyacheslav retweeted
Terence Tao just posted this really insightful thread which seems to have been written in reaction to the Navier Stokes announcement. Please give it a read. mathstodon.xyz/@tao/11723732…
Vyacheslav retweeted
If that happens Europe is officially fucked.
CHINA CONSIDERS RESTRICTING OVERSEAS ACCESS TO CUTTING-EDGE AI MODELS
China’s Ministry of Commerce has led meetings over the past month with major AI companies, including Alibaba, ByteDance, and Z.ai, to discuss measures that would restrict overseas access to cutting-edge AI models, including models that have not yet been released.
The discussions reportedly include not only closed-source models but also open-weight models. However, the scope of application is still under debate, and the rules may ultimately apply only to future frontier models.
Officials have also discussed designating the leakage or theft of proprietary AI technologies as a national security crime, with stronger penalties, as well as restricting the types of foreign capital that can invest in Chinese AI startups.
The backdrop is the U.S. move to strengthen export controls on AI models, along with national security concerns over cutting-edge models that could possess advanced cyberattack capabilities.
Chinese authorities are reportedly concerned that advanced U.S. cybersecurity AI models could be used to exploit vulnerabilities in Chinese software.
Since the beginning of this year, China has continued to tighten measures to prevent AI technology from being transferred overseas. Authorities have investigated whether Chinese AI startups that relocated abroad violated export control laws, while also strengthening oversight of overseas transactions involving Chinese investors, technology, data, and national security concerns.
Future regulations could take the form of a tiered framework based on technological capability. Basic open-source AI models may be managed through a filing system, high-performance models may be subject to security reviews, and the most sensitive frontier models may be banned from public release or restricted to use within China.
Vyacheslav retweeted
The EU age verification app is presented as “completely anonymous”. But the risk is that member states (the countries are supposed to create their own versions of the open-source EU app) use it to introduce identity verification that makes it impossible to post anonymously on social media.
The idea behind “completely anonymous” is to use Zero-Knowledge Proof (ZKP) cryptography to break the link between the age credential issuer (EU governments) and the regulated services/sites. Currently, the EU app does not have ZKP functionality, contrasting Ursula von der Leyen’s claim that the app ”is technically ready to be used”. But more importantly, the app is designed to always function without ZKP technology; if ZKP is unavailable, the app falls back to a non-ZKP model. Even if fully developed ZKP technology could be implemented in the future, it would remain an optional extra feature that countries may choose to disable and that the EU could remove at any time.
This means that the EU could decide at any time that ZKP may no longer be used, and in one stroke the app would fall back to its default mode, meaning that every post on social media carries an ID tag. By that point, an infrastructure will already have been rolled out; people will have gotten used to it, and it will be harder to roll it back.
More details on mullvad.net/blog/age-verific…
Vyacheslav retweeted
Add a 7-day dependency cooldown.
uv's `exclude-newer` refuses any version published inside a rolling window. With 7 days set, today's malicious uploads would not be considered for resolution at all.
Most malicious uploads are caught within that window.
Vyacheslav retweeted
We got a lot of requests to bring this back to life, and as promised, it's live now! drpc.org/docs/gettingstarted…
If you build a mission-critical dApp, or if part of your functionality is super fragile to RPC poisoning, please use the Verification feature from dRPC via NodeCloud or NodeCore; there is no excuse not to use it, and you can't say, after yet another hack, that you were not aware of this.
In dRPC you can run a quorum of data providers, including internal nodes, with custom rules for quorum. We made it in 2023: drpc.org/docs/gettingstarted…. For a mission-critical application like a bridge or oracle, there's no excuse not to set it up. But they didn’t.
The framing of the recent KelpDAO and LayerZero incidents as some novel attack vector, or the work of meaningfully smarter attackers, is mostly wrong. The actual failure mode - applications trusting a single RPC endpoint to return honest data - has been discussed openly for years, by @VitalikButerin, @lomashuk, @MicahZoltu, @wagmiAlexander, @ChainLinkGod, @banteg, and many others. It is neither new nor subtle. A closely related failure happened in 2022 with the Ankr DNS hijack on Polygon and Fantom: xitter.cf/Mudit__Gupta/status/15…
The point here isn't ideological. In a 24/7 market where automated systems act on RPC responses in real time, assuming one provider will always return correct data is a system-level risk. There is no T+2 window in which a human notices the error and reverses it.
When we launched dRPC, cross-verification across a permissioned set of RPC providers was the core idea. The original repo and docs are still up (although outdated since then):
-drpc.org/docs/gettingstarted…
- github.com/drpcorg/drpc-side…
We used a simple quorum rather than zk-based verification, partly to test real demand before overbuilding. Two observations from that period:
1. The demand was not there. In public, everyone agreed with the thesis. In private, the responses were "we are not ready to pay more for quorum," or "yes, we could apply it to sensitive paths only, but it's not a priority."
2. The risk was real. The market is now discovering this at a cost of roughly $250M.
Because full cross-verification on every request is overkill for most workloads, we eventually shifted toward shadow checks — randomized background comparisons across providers that detect and eject unhealthy nodes before they serve meaningful traffic. This is a reasonable compromise for general workloads. It is not a substitute for quorum on sensitive paths.
So the practical rule, for anyone building infrastructure whose failure mode is user funds:
1. Use at least 3–5 independent, reliable RPC providers.
2. Do not build your load balancer on training wheels. Something like drpc.org/nodecore-open-sourc… is open source, free, and almost certainly better than what you would build in-house. Contributing to it is a better use of time than reinventing it.
You cannot defend against every possible attack. But this particular class is avoidable at low cost, if you are willing to treat RPC as a system-level dependency rather than a commodity input. That is a reasonable bar for anything meant to serve more than a narrow circle of users.
We will update the dRPC NodeCore (drpc.org/nodecore-open-sourc…) with strict rules for quorum on your side in the near future, stay tuned. If you have more sophisticated requirements for security, we are fully open for your requests - feel free to each me our via DM here or by email [email protected]
Vyacheslav retweeted
In dRPC you can run a quorum of data providers, including internal nodes, with custom rules for quorum. We made it in 2023: drpc.org/docs/gettingstarted…. For a mission-critical application like a bridge or oracle, there's no excuse not to set it up. But they didn’t.
The framing of the recent KelpDAO and LayerZero incidents as some novel attack vector, or the work of meaningfully smarter attackers, is mostly wrong. The actual failure mode - applications trusting a single RPC endpoint to return honest data - has been discussed openly for years, by @VitalikButerin, @lomashuk, @MicahZoltu, @wagmiAlexander, @ChainLinkGod, @banteg, and many others. It is neither new nor subtle. A closely related failure happened in 2022 with the Ankr DNS hijack on Polygon and Fantom: xitter.cf/Mudit__Gupta/status/15…
The point here isn't ideological. In a 24/7 market where automated systems act on RPC responses in real time, assuming one provider will always return correct data is a system-level risk. There is no T+2 window in which a human notices the error and reverses it.
When we launched dRPC, cross-verification across a permissioned set of RPC providers was the core idea. The original repo and docs are still up (although outdated since then):
-drpc.org/docs/gettingstarted…
- github.com/drpcorg/drpc-side…
We used a simple quorum rather than zk-based verification, partly to test real demand before overbuilding. Two observations from that period:
1. The demand was not there. In public, everyone agreed with the thesis. In private, the responses were "we are not ready to pay more for quorum," or "yes, we could apply it to sensitive paths only, but it's not a priority."
2. The risk was real. The market is now discovering this at a cost of roughly $250M.
Because full cross-verification on every request is overkill for most workloads, we eventually shifted toward shadow checks — randomized background comparisons across providers that detect and eject unhealthy nodes before they serve meaningful traffic. This is a reasonable compromise for general workloads. It is not a substitute for quorum on sensitive paths.
So the practical rule, for anyone building infrastructure whose failure mode is user funds:
1. Use at least 3–5 independent, reliable RPC providers.
2. Do not build your load balancer on training wheels. Something like drpc.org/nodecore-open-sourc… is open source, free, and almost certainly better than what you would build in-house. Contributing to it is a better use of time than reinventing it.
You cannot defend against every possible attack. But this particular class is avoidable at low cost, if you are willing to treat RPC as a system-level dependency rather than a commodity input. That is a reasonable bar for anything meant to serve more than a narrow circle of users.
We will update the dRPC NodeCore (drpc.org/nodecore-open-sourc…) with strict rules for quorum on your side in the near future, stay tuned. If you have more sophisticated requirements for security, we are fully open for your requests - feel free to each me our via DM here or by email [email protected]
Vyacheslav retweeted
If you build a public goods like @DappRadar @DefiLlama @l2beat and you can’t handle your unit economy, please don’t close your services.
Reach me out, we will help you with RPC and I personally will help you to optimize other spending where it’s possible.
Vyacheslav retweeted
The hidden risk of @ethereum infra 🧵
On Sept 2nd, Ethereum mainnet faced a hiccup when one of the execution clients(reth), hit a bug in state root computation 🐞
The result? Multiple Reth-powered nodes stalled at block 23272426.
👇
We had a bug in Reth's state root computation today in Ethereum mainnet, which caused multiple nodes to stall.
Recover by running the following:
```
1. reth stage drop --datadir DATADIR merkle
2. reth stage unwind --datadir DATADIR to-block 23272426
3. reth node --datadir DATADIR --debug.tip 0x2eb1fcafd864aafe21f2cb66310a869b8945231330f0da80c9e9b77861b56fca
```
We are still investigating root cause, but the above gets you past the issue. This is safe to run on both pruned & archive nodes, won't lose you any RPC information, and will take ~45m to rebuild the trie before it continues syncing.
Brutal moment, but ultimately one we learn from and get stronger as we break through performance barriers.
github.com/paradigmxyz/reth/…
Vyacheslav retweeted
I've done a full writeup of my experience participating in the @METR_Evals study on AI productivity: domenic.me/metr-ai-productiv….
Vyacheslav retweeted
Why Decentralization Matters by:
-@thought_sync from @drpcorg
-@ChadNehemiah from @Atoma_Network
-Evin McMullen from @PrivadoID
-Maxwell Saal from @0xbowio
-Brad Keoun from Distro Media
Full video below 👇🧵
Vyacheslav retweeted
🎬 NOW LIVE: Alice in Node-land!
Watch Alice battle the Queen of Nodes in this web3 short film.
Join the resistance ✊
Vyacheslav retweeted
WE ARE AT @EthereumDenver 📍 Booth 109
💚 It is going to be an epic week in Denver connecting with our valued partners and community IRL.
🎬🍿 Our Alice in Node-land movie premieres at #ETHDenver and X on February 25th.
👉 Stay tuned for updates on mobile cinema side-event routes.
Vyacheslav retweeted
🚨 Never miss important blockchain updates!
Follow @thechainupdates for your one-stop source of crypto chain news and developments.
👉 @thechainupdates
👉 @thechainupdates
👉 @thechainupdates
👉 @thechainupdates
Vyacheslav retweeted
I just want to say that I have no brief for Meta/WhatsApp. I don’t support the business goals of that company. But: they’ve deployed advanced encryption to billions of people who otherwise wouldn’t have it, in expensive defiance of world governments. That matters.
Vyacheslav retweeted
После материала про систему деанонимизации пользователей Telegram «Инсайдер» я получил с несколько десятков однотипных сообщений.
«А что теперь делать?»
Напомню для тех, кто все пропустил: региональные силовики и чиновники используют систему «Инсайдер», которая: а) умеет деанонить пользователей Telegram, используя телефоны из утекших баз; б) закачивает комментарии, которые вы оставляете в публичных чатах в Telegram, и позволяет искать как по ключевым словам (например, «Слава Украине!»), так и просто по запросу «все комментарии такого-то человека».
Звучит страшно. Но получил я и упрек: «Андрей, без инструкции безопасности это и не имела смысла писать».
Окей, исправляюсь.
1. Если вы уже сдеанонены «Инсайдером», сделать с этим, боюсь, ничего нельзя. Если Telegram-боты с персональными данными выдают по вашему Telegram-id ваш номер телефона, значит, скорее всего, вы есть в «Инсайдере» (всего там, по заявлению разработчика, 76 млн пар телефон+id в Telegram, то есть 76 млн сдеаноненных аккаунтов).
2. В Telegram можно сменить телефон, username (или вообще удалить его), но id — неизменный идентификатор человека. Таким образом, просто убрать username, скрыть/поменять телефон — не вариант: ваши публичные комментарии в Telegram по-прежнему будут видны как ваши комментарии по id.
3. Это легко проверить в Telegram-ботах, которые показывают, в каких чатах появлялся человек. Вот я скрыл давно номер телефона, менял его: а он прекрасно видит, в какие публичные чаты я добавляюсь/в каких чатах пишу сейчас. Потому что главный идентификатор там — id.
4. Разработчик «Инсайдера» так и не поговорил со мной, но, судя по видеопрезентации, наши публичные комментарии в Telegram закачиваются внутрь этой системы и, возможно, там остаются. В теории это означает, что даже если вы сегодня прекратите писать в Telegram или даже удалите старые комментарии, в системе они останутся как ваши. Возможно, там, конечно, периодически происходит синхронизация, а возможно, и нет.
5. Процедура сокрытие номера телефона в Telegram выглядит так: Privacy — Phone Number — Who can see my phone number — Nobody.
Однако если ранее ваш номер был открыт, это был номер, которым вы активно пользовались в России, и он есть в утечках, — значит, в системах, подобных «Инсайдеру», ваш id сдеанонен, и сокрытие/замена номера не помогут. Ну, вас нельзя будет там найти по номеру, окей.
6. Если вы хотите использовать Telegram как соцсеть, то есть оставлять комментарии (особенно те, которые власти считают «экстремистскими»), и вы находитесь в России или ездите в нее, лучше завести себе левый/новый аккаунт с новым id. При его регистрации нужно обязательно в стартовом окне отменить синхронизацию контактов, а потом зайти в настройки и спрятать от всех номер телефона.
С этого аккаунта нельзя вступать в чаты, которые могут что-то рассказать о вас (домовой чат, например). И не писать что-то, что может позволить вас сдеанонить методом социальной инженерии.
Телефон, конечно, лучше левый, и не российский. Есть сервисы, позволяющие купить виртуальные сим-карты; если нет иностранной карты, можно купить за крипту — например, за дуровские TON на платформе Fragment (дорого, правда). Все это, конечно, не защищает вас в случае физического доступа к телефону со стороны ментов (равно как и вычисления физической иностранной симки путем ОРМ).
7. В обществе до сих пор считается: «ВКонтакте» — подментованная соцсеть, а Telegram — безопасен. Лично я считаю, что личные переписки (при соблюдении определенных правил) в Telegram недоступны для российских силовиков, но авторов публичных комментариев они находить могут прекрасно.
8. Каждый оценивает свои риски сам, я лишь написал свое мнение.
Более подробно об «Инсайдере» и его создателе можно почитать тут: telegra.ph/Siloviki-i-chinov…
Vyacheslav retweeted
✨📢 Startup Program Launch Announcement 📢✨
Launching at #ETHDenver2024, aimed to support developers so they can focus on what's important: building. Benefits 👇
🔓 get unlimited free access to premium nodes for 6 months
🚀 enjoy a promotional boost with co-marketing activities
💰 earn an extra through a referral program
Apply now --> bit.ly/48zY2wo
Learn more --> bit.ly/3P2AmKe
ALT web3-infrastructure-depin-rpc-drpc-startup-program