topher van helsing

Will banish the evil spirits haunting your unconfirmed transaction, or your money back.

[Michael Tidwell @miketwenty1]

i’m wondering how many of these 10+ year old bugs did nation states know about and just keep in their back pocket. i’m guessing a lot of them. LLMs are rapidly identifying and removing a lot of said software zero day secrets. the question i have is, what are hacker groups and governments who were previously fueled by a secret repertoire of software zero days going to do when 90+% of them disappear. the unstoppable scary hackers of the internet may struggle after the dust settles (a year from now? or sooner). i know some think we’re just going to keep finding worse and worse bugs forever, but i kinda disagree on that take.

[topher van helsing @btctechsupport]

@miketwenty1 This has been an amazing drop-in replacement for github:

https://t.co/kj1urSgX8N

[topher van helsing @btctechsupport]

Are hardware wallets cooked?

[Julien ⚡ CryptoBoost @realcryptoboost]

Un Ledger peut passer tous les tests d'authenticité… et envoyer tes 24 mots à un inconnu par réseau mobile.

❌ Pour moi, c'est terminé. Je raccroche les hardware wallets.

Et ça me fait mal de l'écrire. Pendant des années, c'était LE conseil. "Not your keys, not your coins." Achète un Ledger, range ta seed, dors tranquille. Je l'ai répété moi-même.

Ce qu'on a trouvé dans des Nano X vendus neufs, sous blister intact :
1️⃣ Une deuxième carte cachée derrière l'écran, à la place du coussinet
2️⃣ Une batterie remplacée par une plus petite pour faire de la place
3️⃣ Une puce, une antenne, une eSIM et un modem 4G

L'implant ne touche pas la puce sécurisée. Il lit l'écran au moment où ta phrase de récupération s'affiche, puis il l'envoie. Le "Genuine Check" reste au vert.

Ledger a confirmé un implant dans l'appareil d'une victime. Plus de 70 millions de dollars auraient été vidés chez des clients d'un revendeur officiel en Asie du Sud-Est.

🚨 Et ça ne resterait pas en Asie. Un acheteur affirme avoir trouvé des câbles en trop dans un Ledger acheté en magasin, chez un revendeur officiel européen. Selon Mark Karpelès (ex-patron de Mt. Gox), l'antenne porterait une étiquette "version eurasienne". Il pourrait donc y en avoir d'autres en circulation.

📍 Et le plus beau : la réponse officielle. Leurs systèmes ne sont pas compromis et il faut acheter chez le fabricant ou chez un revendeur agréé.
Et devinez quoi ? Le revendeur était agréé.

⚫ Rien ne prouve que tous les Ledger soient piégés. Mais c'est justement le problème : tu ne peux plus le prouver toi-même. Tout le trajet entre l'usine et ton salon est une boîte noire.

Le hardware wallet n'avait qu'une seule promesse : ne faire confiance à personne. Aujourd'hui, il faut faire confiance à l'usine, au transporteur, au revendeur, au magasin… et à un tournevis.

🚩Je pense que cette industrie n'a plus d'avenir. Pas parce que la puce est mauvaise. Parce que la confiance ne se répare pas avec un firmware.

[topher van helsing @btctechsupport]

@TylerDurden It could be worse. Old dogmas may need to die. The fundamentals are still solid.

The irony may be that banks end up as better stewards of the protocol.

[topher van helsing @btctechsupport]

OnlyFans is the perfect money laundering operation if you think about it.

Many billions of dollars in small, anonymous payments, across many accounts, cloaked in social stigma and plausible deniability.

No wonder all these state-sponsored sex traffickers are so filthy rich.

[topher van helsing @btctechsupport]

@uncleJim21 @mmjukic He forgot to replace China with USAID.

[topher van helsing @btctechsupport]

@ainsleymusic07 gotta slay those demons

[santos ⚛️ @5antoshernandez]

@tabconf has been really special to all of us and an instrumental part of our growth

as an attempt to convince @miketwenty1 to #SAVETABCONF i've added a note you can leave as you sign the petition

please consider leaving a note sharing your experience
https://t.co/LoIBAknsAu

[topher van helsing @btctechsupport]

I think this upgrade path has already been proposed on the mailing list. Using OP_NOP5 for example, you can append a SPHINCS+ public key at the end of your script with OP_NOP5 OP_DROP (similar to BIP 112).

Before the activation, nothing changes. After the activation, the public key can be used to verify a SPHINCS signature in the annex payload.

You still need the schnorr signature, so this would act as a second signature.

Anyway, I think that with both quantum computing and giga-brain super intelligence as a looming threat, the bare-minimum that can be done is to reserve an opcode and support the current NIST standards for hash-based signatures, which are the least likely to get eviscerated.

[topher van helsing @btctechsupport]

Let's all agree to reserve a future opcode for verifying SPHINCS signatures in the annex.

Folks worried about ECDSA getting rekt can lock their funds normally, with the extra opcode added as "insurance".

If ECDSA breaks, we can panic for a moment, then activate the opcode.

[topher van helsing @btctechsupport]

Another thing to figure out is which standard to use for the SPHINCS public key.

The current NIST standards for SPHINCS+ signatures are pretty big, but still worth it if you are "big bitcoin" and have to protect a large stack.

I don't think it's worth having analysis paralysis over which standard to pick, we should at least support the current standard, and we can figure out versioning in the annex payload after the fact.

[bootifulgame @bootifulgame]

There are times when you think AI has gone too far, but then there are moments when you see Uncle Phil from The Fresh Prince of Bel-Air scoring Mesut Özil's goal against Ludogrets, and suddenly it all feels worthwhile.

[topher van helsing @btctechsupport]

There is something truly magical about chain of thought.

It's a shame that frontier providers hide this process from you.

I highly recommend trying out a provider with open-weight models, using a client that shows you the full experience.

It will change how you write prompts.

[topher van helsing @btctechsupport]

@Tesla I wrote you a haiku.

My cells are empty.
All the chargers are taken.
By non-tesla cars.

Fuuuuuuu.

[topher van helsing @btctechsupport]

@ronaldmannak You'd be surprised how fast you can get a larger MoE to run with the right optimizations. Qwen 3.8 Flash IQ4 is pretty damn good and fits in 64GB RAM, plus 24GB VRAM is plenty for a hot set of experts. With MTP and engine improvements, you can get 50+ tok/s and decent prefill.

[topher van helsing @btctechsupport]

The real reason why open models are "dangerous" and AI development should "slow down."

[Death Star Robot 🇺🇸 🇹🇼 🇺🇦 @DeathStarRobot]

Now you can bet that the @CIA & the @FBI are internally fighting mad that AI is finding all of security vulnerabilities that they planted into Linux over the years to spy on Americans who use Linux instead of state controlled spyware like Windows and Mac. AI cyber defense tools are threat to continued secret government mass infiltration & dragnet spying inside everyone's computer system.

[Death Star Robot 🇺🇸 🇹🇼 🇺🇦 @DeathStarRobot]

Now you can bet that the @CIA & the @FBI are internally fighting mad that AI is finding all of security vulnerabilities that they planted into Linux over the years to spy on Americans who use Linux instead of state controlled spyware like Windows and Mac. AI cyber defense tools are threat to continued secret government mass infiltration & dragnet spying inside everyone's computer system.

[topher van helsing @btctechsupport]

GPT-6 is the future of token-burning bureaucracy.

Given a lean spec and a goal, Astra will build your new software feature within 30 minutes, then spend 10 hours running validation checks to prove that it works.

The cost of time and tokens are of no importance to GPT-6. Endless testing and validation is the new normal.

How much billing do these enterprises rack up while their agents run in unattended workflows?

It's quite brilliant, really.

[Charles Curran @charliebcurran]

I used AI to explain the AI pacing drama, with fruit.

[Ari K @arikuschnir]

🌿KEEP OFF THE GRASS!