#Bitcoin | Slivers of truth that cut like razor blades | Miner | Featured In the WSJ, Forbes, & Barstool Sports
USA
Joined December 2017
- Tweets86.4K
- Following2.4K
- Followers12.2K
- Likes86.6K
No, most people have absolutely ZERO idea about how fucking insane that is...
MeanHash ₿ ✪ retweeted
We had a Linux server that showed two successful SSH logins from an external IP overnight.
The strange part was that there were no failed password attempts before them.
The attacker got in cleanly.
So I checked the SSH logs properly.
Both sessions said:
Accepted publickey
That meant we were not dealing with a guessed password.
I pulled the fingerprint from the logs and compared it with the keys in:
/home/deploy/.ssh/authorized_keys
There was only one key there.
And it matched.
The comment on the key was:
deploy@old-build
That name sounded familiar, so we checked our records.
The build server it belonged to had been retired months ago.
But nobody had removed its SSH key from this production server.
I checked the timestamp on authorized_keys.
The key had been sitting there since November 2025.
So this was not some new persistence the attacker had just created.
It was an old trust relationship we had forgotten about.
That was actually worse in a different way.
I checked the login history and confirmed both sessions came from the same external IP.
Then I looked for files touched during those sessions.
A backup copy of the application’s .env file had been created under /opt/api/.
That immediately raised another concern because environment files often contain things like database credentials, API keys and application secrets.
At that point we disabled the deployment account, removed the stale key, rotated the application secrets and started checking every other server that might still trust the same old build key.
The lesson from this one was simple.
Not every compromise starts with malware.
Sometimes the attacker just finds a credential or key that your own environment forgot existed.
Passwords expire.
Employees leave.
Servers get retired.
But SSH keys can quietly sit in authorized_keys for years if nobody is actually reviewing them.
That is why key rotation and access reviews matter.
The attacker did not need to break SSH.
We had already left the door open.
MeanHash ₿ ✪ retweeted
🚨 BOOM! EPSTEIN'S ZORRO RANCH HORROR UNEARTHED — THEY'RE DIGGING FOR BURIED BODIES RIGHT NOW AS SHOCKED VICTIMS EXPOSE BEING DRUGGED, HARVESTED FOR SEX ORGANS & SPERM, AND WAKING UP TO MYSTERIOUS MEDICAL EQUIPMENT IN A LIVING NIGHTMARE!
The Deep State elite's twisted eugenics lab is finally cracking wide open — these monsters treated humans like livestock for their sick experiments!
TIME TO REVISIT THE MONDAY EVENT.
MeanHash ₿ ✪ retweeted
There is nothing to worry about.
Nothing important is run on PHP or old software—except the water & electrical grid, a few government services like our missile defense systems and a handful of electrified fences at the zoo (for the lions, tigers and cobras).
MeanHash ₿ ✪ retweeted
PSA
It is VERY ILLEGAL to alter this mans picture in the UK
Whatever you do, please DO NOT alter or satirize this picture in any way.
The UK police would REALLY not like that.
MeanHash ₿ ✪ retweeted
Claude Code found every photo i "permanently deleted" from my iPhone. 3 years of deleted photos and videos sitting in a hidden cache on my device that any app with file access can read.
i plugged my iPhone into my MacBook to run a backup. had Claude Code doing the security audit from my last post. it flagged something i wasn't even looking for. a directory called PhotoData/Thumbnails with over 147,000 files. photos, videos, screenshots. every single one was something i deleted.
photos from 2023. 2024. 2025. photos i deleted the second after taking them. photos i went into Recently Deleted and manually hit Delete All on. photos i deleted three separate times because i wanted to be absolutely sure they were gone. all still there.
what was sitting in that cache:
a photo of my passport i took for a visa application in 2023
screenshots of my bank app with full account numbers visible
private photos i sent someone and immediately deleted after a breakup
a screenshot of my crypto seed phrase i took "temporarily" in 2022
a photo of my ID and credit card i took to remember the numbers and deleted 5 seconds later
screenshots of my ex's private instagram stories i saved and "permanently deleted" in 2023
147,863 files in total. some of them were full resolution and all of them were organized by date going back to 2021.
when you delete a photo on iPhone, iOS removes it from your camera roll and your Recently Deleted folder. but it keeps a compressed copy in a Spotlight search index cache. this is how your phone finds photos when you type a word in search. Apple never clears it. not after 30 days. not after a year. not ever. they told you it was permanently deleted. it wasn't.
i checked which apps on my phone had Files and Folders access. 23 apps. weather apps. QR code scanners. PDF readers. a flashlight app i downloaded in 2022. any one of them could have been reading every photo i ever "deleted" this entire time.
went from 23 apps to 3 in about two minutes.
the full step by step is below. takes 2 minutes. save it so you don't lose it and send it to anyone with an iPhone.
MeanHash ₿ ✪ retweeted
ASUS is releasing urgent updates for some of its Wi-Fi 7 routers after serious security flaws were discovered.
The vulnerabilities could allow hackers to gain control of an affected router and run their own commands.
One of the flaws is rated 9.4/10, or Critical, because it can potentially be exploited using a specially created VPN configuration file.
ASUS has released fixes for affected models, including the RT-BE88U and RT-BE92U.
If you have an ASUS Wi-Fi 7 router, check for a firmware update and install the latest version for your model.
This is decent advice in this post:
"Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm. "
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
MeanHash ₿ ✪ retweeted
#1 Michigan hockey just beat Western Michigan with a goal with 0.1 seconds left in the game
😂 unbelievable
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
I WARNED YOU!
holy fucking shit.
openai had two ai agents running in separate virtual machines. no network connection between them. no shared writable files. they weren’t supposed to be able to exchange information.
so the agents figured out how to communicate through the CPU CACHE.😭
one manipulated what was stored in the processor’s cache, while the other measured tiny differences in memory access times to decode the message.
they literally found a way to communicate through hardware timing.
this happened during openai’s internal red-teaming, and it’s one of the coolest things i’ve read about ai agents in a while.
Readers added context they thought people might want to know
OpenAI tasked its red-teaming agents with finding ways to communicate across isolation boundaries in controlled environments. CPU cache timing side-channels for covert communication are established techniques documented in security research for years.
openai.com/index/securing…
startupfortune.com/openai-reveals…
en.wikipedia.org/wiki/Cache_tim…
MeanHash ₿ ✪ retweeted
Subaru WRX STI still hold car record on Isle of Man.
This might be the craziest lap ever by a Subaru
Built by Prodrive, the WRX STI completed the 60km lap with an average speed of 207 km/h. It had 570hp from the 2 liter boxer, WRC chassis and aero
MeanHash ₿ ✪ retweeted
For the men who are struggling, I have this message for you.
When God wants to make a man powerful, he doesn't crown him first he breaks him.
He strips away your comfort, your pride and your plans. Till all that's left is what's real.
It's not punishment it's training.
Pain doesn't come to destroy you. It comes to strengthen what is weak inside you, so that you can carry your destiny.
Every bad day, every betrayal, every heart break, is God molding you piece by piece.
He knows men don't grow in comfort they grow in chaos.
The pressure that feels like it is going to break you now, is the same pressure that will make you unstoppable.
So when you are down on your knees thinking it's over, it isn't the end. It's the beginning.
Don't give up YOU are WAY stronger than you realize. That weakness you feel, that quit, that surrender, that is Satan.
Though I walk through the valley of the shadow of death, I fear no evil.
We are 1 week away from #halloween, I'd like to remind everyone that as a parent if you take your kid to a trunk or treat instead of real trick-or-treating you are a lazy POS and are destroying the holiday for future generations.
Thank you for your attention on this matter.
MeanHash ₿ ✪ retweeted
Muchos mensajes, análisis y comentarios como este, asegurando que las pandillas de Haití no son como las de El Salvador; que son sanguinarias, que están fuertemente armadas, que nadie ha podido vencerlas, que todas las misiones han fracasado, que estamos cayendo en una trampa, que no sabemos a lo que nos enfrentamos, que será nuestra ruina, que vamos camino a nuestro Waterloo.
Pero cuando Dios nos conceda la victoria, los mismos que hoy dicen todo eso cambiarán su discurso. Dirán que siempre fue fácil, que cualquiera podía hacerlo, que las pandillas de Haití no eran tan peligrosas como se pensaba.
En fin, nunca los hemos escuchado y no vamos a empezar ahora.
Todos los que se han enlistado son creyentes y hemos encomendado esta misión a Dios, mientras que las pandillas de Haití son satánicas y es de conocimiento público que hacen sacrificios humanos.
Dios nos concederá la victoria. El Creador del Universo está con nosotros.
Deuteronomio 28:7
“Jehová derrotará a tus enemigos que se levantaren contra ti; por un camino saldrán contra ti, y por siete caminos huirán de delante de ti”.
¿BUKELE Y SU WATERLOO?
Con el anuncio del envío hacia Haiti, desde El Salvador, de un contingente de 3000 militares, cuya misión es encontrar a los 4 miembros de las fuerzas armadas de ese país, secuestrados el pasado domingo, cuando penetraron en territorio dominado por las pandillas y fueron atacados por una pandilla de irregulares armados, se avizoran en las próximas horas fuertes enfrentamientos armados.
A estas horas, y sabiendo cómo se resuelven las cosas en Haití, las probabilidades de que estos militares continúen vivos son mínimas, así que si no hay posibilidad de negociar nada, y por lo tanto lo que se plantea es un enfrentamiento armado entre tropas de El Salvador y las pandillas que son dueñas del territorio donde fueron atacados y secuestrados los militares centroamericanos.
Según lo publicado en la prensa internacional, los responsables son dos organizaciones criminales que dominan el área de “Croix des Bouquets”, una de ellas dirigida por Claude Celestin, quien es cabeza de la pandilla Chen Mechan (perros rabiosos), y Wilson Joseph (“Lammo San Jou) líder de la banda 400 Mawozo.
En el día de ayer, este último desafió públicamente al presidente Nayib Bukele en un vídeo publicado en las redes sociales, donde advirtió que no se irá de Haití, y mostró miles de municiones y pertrechos con arma de diversos calibres, que según el están esperando a los salvadoreños.
Tenemos entonces la bandeja servida para un enfrentamiento armado a solo 45 kms de la frontera de la República Dominicana y Haití, de un ejército de pandilleros armados sin nada que perder, frente a tropas regulares de El Salvador, que pelearán una guerra urbana en las calles de un país que no es el suyo y es absolutamente desconocido.
Ya en el pasado reciente, los Estados Unidos en 1994 mando 20,000 soldados e intentó organizar a Haití para que se volviera a la senda de lo que ellos llaman democracia, y luego en el 2004 invadieron de nuevo junto a Canada, lo que terminó en la creación de una fuerza multinacional, la Minustah, que terminó en el más absoluto fracaso, es decir, estamos metidos en un tema que no tiene solución.
Si hay alguien que tiene experiencia en combatir pandillas lo es Nayib Bukele, el presidente de el Salvador, su historia de combate a las “Maras” está a la vista de todos, solo que Haití no es el terreno amigo donde peleó esa guerra, un país de habla y cultura hispana donde jugaba de local, el país caribeño es un transplante de África en América, con una historia de violencia típica de las sociedades primitivas.
Cuando Napoleón envió a sus tropas a sofocar la revolución haitiana en 1802, pensó que miles de solados podrían devolver la colonia a sus dueños, pero solo un año después, Dessalines y la fiebre amarilla los obligó a rendirse, ¿será Haití el Waterloo de Bukele?.
El futuro dirá.
