Dmitry Yakimov retweeted
Here's how exactly Telegram provides user data to U.S. authorities. A letter recently filed in court shows how Telegram transfers that data, such as IP address and phone number.
More: 404media.co/heres-what-teleg…
Dmitry Yakimov retweeted
My dear friends, I’d like to show you my latest toy project
Introducing Handwired: turn your regular JavaScript code into a neural net!
- no training
- exact outputs vs the JS program
- fully differentiable
All runnable in a browser, without GPU
Dmitry Yakimov retweeted
anthropic built their own git. Most interesting mental shift here, and if you buy that changing code happens more and more autonomously, faster*, then this will make a ton of sense:
Git was designed so that any client could serve the repo. Fully offline,
your *build time* dev stack is never in the hot path for your *run time* deployment.
Anthropics new version control system (VCS) does not work offline. There’s a central server which must be reachable for clients to function. They found a bunch of benefits to doing it this way.
At first this sounds wild. Today if GitHub is down, you can’t pull or push or merge. Imagine if you couldn’t COMMIT if GitHub was offline.
But in a (someday, maybe) future where code changes 1000x per day with no human in the loop, then your VCS is basically part of production anyway, so you might as well lean into keeping it online with a team of SREs etc, and then you get all sorts of interesting perf benefits for CLIENTS because you can offload some processing to server and re architect what all needs to be stored where
* I’m not sure I buy this, but the labs are certainly pushing “don’t read the code, leverage signals like “outage, feature request, user behavior change” as STIMULUS to agents to drive change in deployed code” as the future, so it lines up
Does that make sense? Are we going back to CVS instead of distributed? Will there be another swing back to distributed 5-10 years after things like Scion become Mainstream?
New on our Engineering blog: Creating in-house source control.
In May, we merged around 2,500 code changes per day. In September, we merged more than 30,000 per day. As a result, we became bottlenecked by developer infrastructure built for human (rather than agent) scale.
Here, we share how we built a new version control system—and fully migrated our monorepo from git—in five months: anthropic.com/engineering/re…
Dmitry Yakimov retweeted
On recent HW wallet supply-chain attacks: safe self-custody is hard, really hard - but it can be done. The required ingredients are:
- It must be a multisig - ideally with keys managed by different devices.
- It must have spending limits - a compromised key should not be able to drain the wallet instantly.
- It must be private - attackers should not be able to see the account state (even if a key is compromised).
The goal is to make sure that a poorly generated seed, a stolen key, or a compromised device do not result in a catastrophic loss of funds.
The tricky part is to make UX simpler than a banking app so that regular people can use it - but that's also possible (and we are doing it in Miden).
Dmitry Yakimov retweeted
this ledger supply chain attack is crazy
they soldered on an esim, LTE module, and separate CPU wtf
Dmitry Yakimov retweeted
🗞️ if your team is too busy doing their 'normal job' to experiment with AI, you're preparing them to be replaced
ghuntley.com/replaced/
In this post, I guess this's the last time I'll say it. AI use is no longer optional if you wish to be employed. What follows is advice for current employees and hiring managers on how to hire in 2026 to source AI-first candidates.
Dmitry Yakimov retweeted
The end of software secrecy is almost upon us. The death of closed source, and the final triumph of open source.
I should have realized this a few months ago when I successfully decompiled the game of Firefighter from an ancient DOS shareware binary. My robot friend was able to tell it had been written in Borland Pascal from looking at the data layout; it gave me back very readable Pascal code with sensibly chosen function and variable names. I transpiled it to Rust and now ship it as part of my heritage games collection.
The thing is, I thought of this as a fun stunt but didn't have any confidence that the technique would scale up to large, real programs. I have since learned that people are now doing this sort of thing with entire AAA games, which are among the most complex software artifacts ever to be shipped as a binary. If they can be decompiled, anything can be.
This has implications. Massive implications. We need to think about what the world is like when, in general, there is no longer a secrecy moat around almost any software at all.
1/2
Dmitry Yakimov retweeted
STOP CHAT CONTROL 2.0. - What you should know:
Tomorrow, 29 September, behind closed doors at the Council, the most draconian version of Chat Control 2.0 goes on the table. It is no longer only an intermediary reading all your private messages and cloud storage. It is a licence to search them for months, without suspicion against any individual.
The leaked Presidency note to delegations (11956/26, 10 September) proposes "authorisation of search plans for a period of time rather than on a case-by-case basis" for private chats and emails.
In plain terms: your messages, contacts, photos and cloud will be scanned under a state-issued licence for months, with no suspicion against you.
The same note admits that under this regime "a high volume of reports generated do not lead to any operational outcome." The Council's Legal Service already warned this is general and indiscriminate surveillance, illegal under EU law. The @Europarl_EN mandate says the opposite: judicial authorisation, targeted to specific persons, no scanning licences.
Tomorrow the pressure is on Parliament to fold. You remember the tricks used to push Chat Control 1.0 through and how @EPPGroup with @RobertaMetsola helped to push for it.
So fasten your seat belt for what is coming tomorrow, and call or write to your MEP and your government now to reject Chat Control 2.0. as a whole!
Remind them what this does to the privacy of every one of us.
Under a search plan, every chat, photo or contact the scanner flags is stored by the provider and sent to a new EU agency, the EU Centre, which keeps it and passes it to police. Any state authority can then demand it, with a deadline and a fine for delay, and nobody has to check who is really behind the request, in case it is hacked or weaponised.
That is exactly what happened at Revolut, and what keeps happening through abusive requests from authoritarian states, as we have reported for 13 years.
In the Revolut case the hackers got access to a real state mailbox. Their requests came from an authentic certified email (PEC) account of an Italian Prefecture on the Interior Ministry's domain, with Postal Police protocol numbers, as European Investigation Orders in the name of the Milan prosecutor, for about five months.
About 680 customers lost passports, selfies, home addresses, IBANs and full transaction histories. The files are being sold; hundreds of victims now fear kidnapping. No remedies exist as of now to protect against such attacks.
Let's stop it before it is too late. Please repost.
Dmitry Yakimov retweeted
There's some FUD circulating about Ledger signers, pushed by a "smart contract security" company claiming a vulnerability in the Ledger Ethereum app.
There was a bug concerning certain clear signing flows. It was found by the @DonjonLedger using their AI-powered vulnerability research suite. It was fixed and deployed two weeks ago. If you keep your Ledger apps up to date, you are protected. That's the whole story.
Now the framing.
What actually happened: this company reached out to our bounty program after the fix was already shipped, and did not follow responsible disclosure, they actually never discussed with the bounty program team. Then they published a thread implying the problem is unsolved. It is not. That's not security research. That's manufacturing fear for attention.
Here is the uncomfortable part. AI changes the security landscape for everyone, defenders and attackers alike. The @DonjonLedger is leading on exactly this: using AI to find real bugs before they reach users. But AI-speed research only makes the ecosystem safer if the people doing it still follow basic security principles. Disclose responsibly. Verify before you publish. Don't confuse noise with a finding.
An actor who skips all of that is net negative for the ecosystem, regardless of the tooling behind them.
The takeaway for you is simple. Keep your Ledger signers up to date (update the FW, update the apps), keep your software up to date in general, and you benefit from the latest security work automatically. Ignore the FUD.
Stay safe.
Dmitry Yakimov retweeted
WATCH: A North Korean hacker's response when asked to say something negative about Kim Jong Un:
I Interviewed a North Korean Hacker Posing as a Crypto Dev xitter.cf/i/broadcasts/1YxNrbben…
Dmitry Yakimov retweeted
More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked and 678K records leaked.
26,805 people with income over 100K€
386 people with income over 1M€
8 people with income over 10M€
frenchbreaches.com/alertes/d…
Dmitry Yakimov retweeted
When the dust settles, we'll have to talk about the fact that not a single vulnerability was found by a US frontier model.
Instead, we're spending $10k a day on open weights models like Kimi K3 and Qwen 3.8 to find vulnerabilities in Bitcoin infrastructure.
It's a disaster.
Dmitry Yakimov retweeted
Introducing Cloudflare Wallets. They will allow you to store stablecoins, purchase services, and receive funds across the web. cfl.re/455An86
Dmitry Yakimov retweeted
I have spent over $10,000 scanning 100+ bitcoin ecosystem related libraries looking for vulnerabilities with Kimi K3 running as quarterback.
Myself and a small "Red Team" have found multiple serious vulnerabilities impacting the ecosystem. They vary in scope severity, but this is a call to action.
For any critical tier vulnerability that was identified if I was able to immediately demonstrate a POC (proof of concept), I have already responsibly disclosed to the maintainers.
HERE IS HOW YOU CAN HELP ME
IF YOU ARE NOT TECHNICAL:
- please share with me any repository that is on github that I can scan, we want to cast a wide net. It takes a few moments for you to link github accounts, we'll take it from there
- if that project does not have a SECURITY.md make an issue asking the dev to list one
IF YOU ARE TECHNICAL:
- If you are a maintainer or contributor to a project, I may have already scanned your repo, hit me up I'll share the results, if not I'll add your project to the list.
- If I can trust you to do larger review to start looking through this stuff to give me more eyes let me know.
AI Has forever changed software development. Tomorrow marks 1 week of Kimi k3 being live in open weights.
We are going to accelerate.
Dmitry Yakimov retweeted
Bitwise: Can too much staking actually hurt a network's security?
"I'm not necessarily concerned about this. To me it's just an equilibrium."
If yields get too low, people unstake. That raises yields per staker, which draws people back in. The system self-corrects.
What WOULD be worrying is the opposite:
Too many entities fleeing staking at once, crushing the staking ratio and weakening the chain's economic security.
FT @KamBenbrik @Bitwise @BitcoinJesusETH @Securitize.
BMNR is sitting on $600M cash and generating over $250M a year in staking rewards.
Tom Lee: "Money is becoming software and when you make it composable, there is a transformation of the economy - and that's really where Ethereum's going to shine."
With 80% of $ETH staked, investments in Mr. Beast and Eightco, and new Ethereum Foundation spin-offs getting funded soon, Tom Lee says the bull case is intact even if the price is brutal right now.
FT @Scaramucci @FundStrat @AllThingsMkts @SkyBridge.
Dmitry Yakimov retweeted
What can be done?
We'll see a lot more of this in the age of AI-assisted cyber attacks. We see this already with things like Zcash supply bug and the resulting Ironwood. Expect more to come.
Assuming you want self-custody, what should you do?
1) Diversification: don't put all your eggs in one basket
2) Use multi-sigs: less vulnerable to vendor attacks
3) For seed phrases: Use additional passphrases and consider dice wallets
Even with all of this, there'll be more types of attacks not in our locus of control. Unfortunately, I think we are likely to see continued and worse attacks from here. There are no silver bullets, and vigilance is a prerequisite, but it might not always be enough.
Diversification applies to seeds, assets, networks, and methods.
Maybe there'll come a calm after this current set of AI assisted cyber attacks, but right now we are in the middle of a storm. Prepare accordingly.
The attack on COLDCARD HW wallet is probably one of the worst ones in crypto history.
COLDCARD was seen as one of the most secure and paranoid option for self-custody, with proper airgapping and many security measures. Its users did basically everything right, yet got hacked.
A bug in the RNG for how seed phrases are generated, undiscovered for 5 years, meant hackers can re-generate seed phrases on their own.
Owning a Mk3 and being on the exposed firmware myself, I was up late last night scrambling to access it and see if I was affected. Luckily, and more by happenstance, my seed predates the RNG bug. First close call on a hack in a long time. But this isn't true for a lot of people, and these people are fucked now despite doing 95%+ of self-custody right.
Not hopeless, there are several ways to mitigate these things, but definitely not good. Unlike e.g. previous CEX hacks, this one strikes at the very core of self-sovereignty, self-custody, and what a big part of this technology is about.
Dmitry Yakimov retweeted
1/ Today, we’re excited to introduce Lucy 2.5.
Lucy represents a paradigm shift in world models, not just in how generated worlds look, but in how we interact with them.
A thread on what makes it a paradigm shift 👇
