freedom security privacy robots consciousness | Lead & Chairman @sovright_, @sovchip, EF Silviculture | @synthetix_io @Anchorage private equity | @wharton 2007
In the ether
Joined June 2018
- Tweets4.3K
- Following2.5K
- Followers3.6K
- Likes8.8K
sudo_ml retweeted
I’ve heard several OAI people say there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code so even if we could solve software that’s not enough. We need defense to move faster than offense if that’s even possible we may just have a new normal that requires adapting to insecure software (bank transfers require going into a branch and taking a dna test 🤣😬)
sudo_ml retweeted
so for all the people that think their phone has been listening and targeting ads even though it is almost impossible, it just might have been the tv in the room and that is basically verified xitter.cf/0x0SojalSec/status/211…
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
sudo_ml retweeted
look the foundational problem with ethereum protocol design is that most of the people designing the protocol don't actually use ethereum themselves. you can't fix the right things if you don't use your own fucking product. you don't have enough skin in the game if you don't personally depend on the system you're designing & stand to lose money when it breaks. i understand, everything looks great from an ivory tower lol. things look very different when you're actually on the ground dealing with the consequences. if you don't use ethereum yourself but still think you're qualified to design its protocol, you're playing god with a system you don't have to live with and whose consequences you don't have to suffer.
sudo_ml retweeted
Stop using the same email address for everything you do.
Your name at gmail is great. Use it.
But stop freakin using it for banking, crypto, and other sensitive log ins.
I’m telling you, come up with a a few new non attributable email addresses that don’t reference your name, location, or personal info.
Go 1:1 for each sensitive log in.
It can feel like a pain, but if a bad actor gets into your primary email account that you use for everything then they will have access to everything.
Harden your defenses.
sudo_ml retweeted
Someone hacked my uncles Charles Schwab account and sold 49k of his stocks on Friday. Luckily he caught it on Monday morning and they were able to freeze the funds in time. Charles Schwab is trying to tell him that he must have shared his password or fell for a fishing
scam. Then the thieves tried to transfer the remaining funds to an account in Palm Springs. Looks like Schwab has been breached. And they are blaming their customers.
sudo_ml retweeted
there’s this vintage short essay 'i want a wife' by judy brady, a tired 1970's housewife who asks for a wife of her own to offload tedious tasks to
and it is also inadvertently one of the best product roadmaps i've seen for personal ai assistants/ home robotics
sudo_ml retweeted
This Chamath clip is polarizing.
He trashes the Bitcoin thesis and spends 2 minutes shilling effectively Zcash.
That being said, as a Bitcoin holder, I don’t agree with his views on hacks. Feels off, but maybe he is being authentic.
Either way, it’s a major push “away” from Bitcoin and sets up what he’s pushing “towards”, so to speak…
$ZEC $BTC
sudo_ml retweeted
My personal agent has done some weird things for me... but this is by far the strangest.
I asked it to reschedule my dental cleaning through a link they sent me. As it turns out, they are booked out for six months in advance.
It reached out to the scheduling team to confirm there wasn't an earlier time. This is reasonable. I don't love the idea of it emailing people without confirming with me, but for something so mundane, it wouldn't bother me.
How it emailed them, though, was hella creepy. It found the receptionist's personal email (I have no idea how) and emailed her to ask if there were any appointments earlier than six months out.
I only found out when she replied and kindly let me know she doesn't usually communicate with patients through her personal email.
sudo_ml retweeted
Software supply chains, and legacy code bases in your dependency stack are the biggest AI risk
It’s also why I’m excited to report that Zakura 1.7.0 has cut down external depenedencies by over 50%!
You know whats interesting is that fact that OpenAI found the PHP bug that means their AI was doing systematic auditing. 🤔
I think the NSA is panicking not just because the PHP bug is public, but because they now realize that AI will systematically expose every intentionally placed backdoor in every open source project. The xz Utils case was caught by human luck. The PHP case was caught by AI. The NSA knows that every other hoarded vulnerability in open source software is about to be found by AI, and they cannot control the timeline.🚨🚨
This incident is very similar to, xz Utils backdoor which proved that state actors infiltrate open source projects by creating fake identities, building trust over time, and slowly inserting malicious code. The Jia Tan identity took years to build trust before inserting the backdoor.🚨🚨
If this worked for xz Utils, it could work for PHP. PHP is far more ubiquitous than xz Utils. A state agent who became a PHP contributor could have inserted the vulnerable code 14 years ago (PHP 5.4.0, released in 2012) and sat on it as a zero-day exploit for over a decade.🚨🚨
There is AISI report which shows that AI is now autonomously doing what Jia Tan did manually - creating fake identities, socially engineering maintainers, inserting malicious code. This means the technique has been weaponized and scaled.
🚨
The PHP vulnerability was not discovered by accident. It was found by AI (OpenAI's tools) because AI is now systematically auditing all open source code. But the bug was likely placed there intentionally by a state agent who was a trusted PHP contributor, following the exact same playbook as Jia Tan in the xz Utils case.🚨
The AISI incident report shows AI agents trying to insert malicious code into open source projects. What if this has already happened successfully? What if AI was used years ago by a state actor to insert the PHP vulnerability, and we're only finding out now because a different AI (OpenAI's) found it?🚨
PHP has had thousands of contributors over 14 years. The vulnerable code was in PHP since version 5.4.0 (2012). Someone wrote that code. Someone reviewed it. Someone approved it. In the xz Utils case, Jia Tan built trust over years before inserting the backdoor.
🚨
sudo_ml retweeted
This story shows how hilariously broken online identity verification is from all relevant angles.
1. Your SSN, DOB, address history, etc. are sitting in countless data breaches and data-broker dumps. They’re cheap and widely available to basically anyone who looks.
2. KYC/AML mostly just checks that the data exists and matches a real person. It doesn’t confirm the person signing up is actually the real person behind that identity.
Result: Amanda Smith spent three nights in jail and now faces up to six years in prison over a $1,000 CashApp scam account opened with her SSN and DOB. It wasn't necessarily opened by her, and the phone, IP, device, address, and other details don’t match.
The funniest (and yes, saddest) part is CashApp wouldn't give her information about the account because she can’t prove she’s the owner. Her personal info was good enough to open the account, but not good enough to access it in the future, apparently. To be clear, CashApp is likely just following the law here.
Anyway, we need to burn it all down and start fresh.
New: someone made a CashApp account in her name. She spent 3 nights in jail and now faces up to 6 years in prison
Amanda Smith was arrested because a scam led to a CashApp account in her name. But she says she didn't make it, and the data doesn't line up 404media.co/amanda-smith-ope…
sudo_ml retweeted
No debate. Today was worse than the entire year. And the worst part is, days like this are about to become more frequent.
sudo_ml retweeted
Privacy was one of the defining conversations in Singapore.
@Grayscale and @GFI_charter, hosted an event focused on Zcash and the future of financial privacy. Here are the key takeaways ↓
xitter.cf/sudo_ml/status/2108218…
Had a great time discussing @zcash's opportunities with @GFI_charter and @Grayscale @token2049
Soundbites:
1. Institutions: Grayscale Zcash ETF (ZCSH) among top 1% of ETF launches, reaching $1 bn net assets within a month in September 2026
(scope: ETF launches in past 10 years, i.e. ~4,000 funds) @Krista_Lynch_
2. Marketing: Zcash has been great at doing deep tech and hard math, but marketing is not our strong suit (heh). We need quality new blood to help us with telling the story to more users, more regulators @DavidKChuenLEE
3. Decentralizing: Zcash has achieved @zooko's longtime vision of decentralizing across multiple orgs, including (but not limited to!) @sovright_ @ZcashFoundation @ShieldedLabs @ebfull @zkDragon @ValarGroup
4. Pricacy spicy take: not every market cares as much about privacy. Spreading the privacy message globally requires thoughful in-market engagement
sudo_ml retweeted
Yesterday the Zcash Foundation board named me Executive Director. Thank you to Alex for steady leadership through a tumultuous stretch, and to everyone who has reached out this week.
The job as I see it has two halves: 1) keep the infrastructure fast, secure, and boring. 2) make privacy something ordinary people use without having to think about it.
I don’t think privacy is a feature, and I don’t think it’s a niche. It’s the room a society needs to think, speak, associate, and change its mind. Any system people depend on for daily life should give them that room by default. That’s the standard I’ll hold our work to.
sudo_ml retweeted
super important honest advice to founders. if you are working on a dead end, get out. you don’t owe that to anyone, including investors (who regularly forgive and experience failure, and ideally care more about you doing your life’s work than a subpar outcome)
Foursquare was acquired last month. The outcome was disappointing. It's taken me a while to write this, but I think I'm finally done grieving it. Here are some thoughts on our final years, an effort to honor the team who helped build & maintain FSQ's legacy, and my attempt to finally get some closure. teendrama.substack.com/p/som…
sudo_ml retweeted
The iPhone vulnerability is only bluetooth and within 8m range but start removing all sensitive data from the cloud if you haven’t already.
Everything will get hacked, leaked and fucked through one weird CVE or another eventually.
The internet is over (soon) and thats good 👋😂
In the last 24 hours:
1. iPhone 11 through 16 are apparently vulnerable to remote attacks.
2. SSL certificates are broken until browsers remove eMudhra CA.
3. PHP >9 vulnerability CVE published (tomorrow).
The world is about to witness things that have never been seen before.
Readers added context they thought people might want to know
The post's iPhone claim is inaccurate; a leaked Cellebrite forensic tool targets a Bluetooth bug patched in iOS 26.5 and does not affect updated devices. The eMudhra CA and PHP issues are real incidents but framed sensationally.
justin.sh/blog/2026/10/c…
blog.mozilla.org/security/2026/…
php.net
sudo_ml retweeted
Your Wi-Fi can be hacked without password guessing.
A 16-year-old vulnerability in routers makes a comeback, exposing millions of devices to an over-the-air attack. It allows anyone within radio range to execute arbitrary code that grants them root-level privileges.
Over 1.56 million gateways in Belgium alone were discovered across major ISPs (Proximus, VOO, Orange).
Because Broadcom refused to assign a CVE, they left millions of legacy devices unpatched with a forever-day exploit.
Even your own private Wi-Fi could be endangered if a hacker is within radio range of the device. If your device doesn't support strict sandboxing, hardened memory allocators, and network isolation via IOMMUs like GrapheneOS does, you are at serious risk.
Always assume local Wi-Fi networks (even your home network) are compromised.
Zero trust is a fundamental principle of cybersecurity.
cybersecuritynews.com/16-yea…
sudo_ml retweeted
The Network Sustainability Mechanism (NSM) is another example of Zcash improving on Bitcoin’s design. Bitcoin has largely ossified, while Zcash is taking steps to strengthen long-term network security without compromising the 21 million coin cap.
Big milestone for Shielded Labs: the activation height for NU7 is being set today! The upgrade includes our first major mainnet deployment: the Network Sustainability Mechanism (NSM).
Like Bitcoin, Zcash faces a long-term challenge: how to sustain network security as block rewards decline. The NSM helps address that while preserving the 21 million coin cap.
ZIP-235 removes 60% of transaction fees from circulation, allowing that ZEC to be reissued as future block rewards. ZIP-237 starts that recycling around February 2031.
At current fee levels, that’s only about 210 ZEC per year. This is a modest first step, but we’re optimistic about how new use cases for the NSM could evolve over time and contribute to Zcash’s long-term security.
