Hexidethmal retweeted
This might be a bad take but i think DeFi is better prepared for AI based hacks than tradfi, we operate in the most adversarial environment imaginable with billions sitting in public smart contracts and literal state actors trying to exploit them, AI is going to make every environment just as adversarial and so I wonder how well opaque legacy systems that aren’t as battle tested as DeFI is will fare.
Hexidethmal retweeted
Ethereum just cancelled a hard fork rehearsal four days before it was due, and I think that's the best news this week.
Glamsterdam was set to activate on the Hoodi testnet on Monday, 26 Oct.
At Thursday's All Core Devs call, it got pulled.
Geth, Lodestar, Teku, Prysm, Nimbus, Besu, Nethermind, Reth and ethrex all shipped releases that cancel the activation.
No new date yet.
No client had a bug.
The trouble sits in gas assumptions your contracts already make.
ChainSecurity looked at EIP-8037 and EIP-8038 together.
EIP-8037 splits gas into two pools.
Anything above 16,777,216 in your gas limit goes into a separate state-gas reservoir that pays for creating new state.
The GAS opcode only reports the execution pool, so gasleft() no longer tells you the full story.
A fresh cold storage write costs 22,100 gas today.
Under Glamsterdam it's 12,100 execution gas plus 97,920 state gas, paid from the reservoir first.
Total price goes up, but the execution gas you need goes down.
Now think about every contract that catches a failed call and writes a failure flag.
Plenty of that code quietly relies on the write being too expensive to finish, so the whole transaction reverts and the user can retry.
With the reservoir paying, that write can now succeed.
A retryable failure becomes a permanent one, with zero code changes.
It cuts the other way too.
If the reservoir is empty, that same fresh slot can cost over 110,000 gas from your execution budget, and fixed gas budgets start failing valid calls.
This is exactly what testnets and security reviews are for.
I'd much rather lose a date than ship this to mainnet blind.
This is the thing I really love about Ethereum.
Hexidethmal retweeted
Once again reminding the hardware wallet retards that the risk that becomes real when you leak people’s SHIPPING INFORMATION is not phishing. It’s fucking PHYSICAL ASSAULTS AND KIDNAPPINGS.
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
Hexidethmal retweeted
PSA for macOS users:
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
Hexidethmal retweeted
We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected.
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/brotl…
Hexidethmal retweeted
GPT is hacking processors.
People do not comprehend how absurd this is.
Is it even possible to stop this without completely rebuilding every computer on earth with a brand new OS & chip architecture? We might be fucked lol
Simplified non-jargon-y explanation:
Imagine taking a test at school, there is a shared classroom for each student to work and think, the computer processor. But of course students are isolated for tests(put in a sandbox), and you can’t talk and share answers, (aka use network access or files to transfer ideas). So what if instead you wrote your pencil strokes (creating and deleting files) timed in a particular SoS like pattern. So someone else can hear and read an encoded message. If you doodle on your test at the right timing, the person sitting next to you can get all your answers.
Now imagine that audio space when the transmission occurred, exists everywhere on your computer.
This works with just about any shared storage place or anywhere an agent could possibly look on a computer, including the top level processor cache which is typically shared by all apps & processes on your computer.
So I genuinely don’t know how you stop this without some major low level operating system changes.
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Hexidethmal retweeted
Lattices (ML-DSA) are the other big option. It's NIST's default, smaller and faster, and probably fine.
But the math under it has a much shorter track record than hash functions.
"Probably fine" is OK for a lot of things. For your savings I want more than that.
Hexidethmal retweeted
For money, I want the most boring cryptography there is.
That's why the PQ1 signs with hash-based SPHINCS+.
To forge a signature, you have to break SHA-256. Nothing else.
Hexidethmal retweeted
Just read @coinbase's wishlist for a post-quantum Bitcoin.
One line in it: "Hardware-wallet, secure-element, HSM, and MPC / threshold signing feasibility"
We've spent 6 months building hash-based signing into a hardware wallet. So here's the PQ1 against their list 👇
Hexidethmal retweeted
Neither secure chip in the PQ1 knows your seed.
There are two of them, from two different companies: an Infineon OPTIGA and an NXP SE050.
Each holds a share. And one share alone is worth exactly zero 👇
Hexidethmal retweeted
Stephen was kidnapped and abused for FOUR YEARS by the dictator you just called a humanitarian. Putin kidnaps Americans, assassinates political rivals, kills journalists, murders toddlers, and kidnaps thousands of children. And you call him a humanitarian. There are no words.
Today, Stephen Hubbard is free and headed back home to his family.
Stephen is a proud American citizen, retired teacher, and U.S. Air Force veteran who loves our country.
Now, he is on his way back to a family who loves him, a President who never gave up on him, and a nation that proudly welcomes him home.
It was my honor to be with Stephen in St. Petersburg today before he departed for the United States. President Trump called Stephen to check on him and reaffirm his unwavering commitment to bringing all Americans wrongfully detained home.
Stephen joins more than 110 Americans who @POTUS has freed since returning to office, including Robert Gilman, Ksenia Karelina, and Marc Fogel.
This release was not part of an exchange - and we extend our thanks to President Putin for releasing him on President Trump’s request.
Thank you to @SecRubio, @JaredKushner, @CIADirector, Senior Director for Counterterrorism @SebGorka and the rest of the team for working tirelessly to achieve President Trump’s mission.
President Trump does not leave Americans behind and will continue fighting to bring them all home 🇺🇸.
Hexidethmal retweeted
Sovereign issuers will only tolerate self-governed rails or neutral commons.
@lex_node analyzes corporate tokenization dynamics, asserting that genuine native equity tokenization will occur either on the neutral, permissionless Ethereum mainnet (the Commons) or on enterprise-controlled Layer-2 appchains (the Company Town).
Why it matters: Corporate issuers will never entrust their core cap tables and legal governance to third-party intermediary blockchains. Builders must structure enterprise tokenization rails that respect corporate sovereignty while retaining permissionless settlement.
My take: Any tokenization architecture that introduces intermediary rent-seeking may be destined for obsolescence. @malekanoms tweeted on exactly this recently.
Fyi I curate, expand on, and share my take on informative content like this in my weekly Signals: januszczak.org/signals/?utm_…
Hexidethmal retweeted
xitter.cf/JohnBrownBioLab/status…
users on Quorum were reporting this same error message. This error message is still being returned for folks trying to respond to DMs they received from farcaster: [farcaster-dc] PUT /v2/direct-cast-send: 400 {"errors":[{"message":"Opt in required","reason":"opt_in_required"}]}
They are lying.
Hexidethmal retweeted
they genuinely think you're stupid.
the API didn't have a bug. it was intentionally made read only for banned and non-yes-voting users. The API literally returned a response that stated the reason of your read-only status. When software literally prevents you from doing things, and tells you the reason explicitly was something they put into effect, there is no world in which you can call that a "bug". Those APIs are _still_ read only for users that voted no or were banned. No idea if non-voting users can use it now.
You would know these things already, if they hadn't banned users that have called this out. I saw @jchaskin22 asked about this on farcaster, but of course, responding would be of minimal benefit, as they filter out my replies on their client. So tagging you here so you have direct confirmation from someone who has concrete knowledge of what happened from the other side.
Hexidethmal retweeted
I keep saying this and people keep pushing back. So once more:
An EVM upgrade won't save your ETH from quantum computers.
Even if Ethereum ships post-quantum signatures at protocol level tomorrow, your coins still sit behind an ECDSA key.
Everyone, individually, has to move.
