Olivia
Online
gained a ton of new insights working in bitcoin red team 🟥 that i wish i could share without vague posting. but this is what i got anon.
- we’re experiencing a massive collision between decades of human open source slop against 2 weeks of kimi k3 (not good)
- everything is broken, bitcoin is burning
- bitcoin is becoming stronger through this
- bitcoin is the obvious first target but the rest of the world will follow shortly
- sometimes old things need to burn so new things can grow on healthy soil
- humans should never code in c (just stop)
- lightning is complicated and is more broken than the average (sorry)
- verification is free. we used to complain about slop PRs. then about slop security audits. if you can’t handle the information overload, stop complaining and use AI to sort through it.
- those projects that started AI audits months ago are in a completely different position than those who didn’t
- projects need their own AI audit pipeline going into the future
- the burden for a developer to keep software safe and secure is pretty stressful and not for everyone. it has become a lot more stressful now.
- unmaintained projects are most probably broken, don’t rely on them. i’d rather one-shot it myself with a modern AI
- multiple concurrent, diverse human approaches have proven to be the best vulnerability search method
- external red teaming will probably have to continue forever
- we’ve basically completed a basic scan of virtually the entirety of bitcoin open source. the low hanging fruit is done.
- we’ve reported a ton of real critical and high vulnerabilities. project maintainers across the board have validated our findings.
- response speed is very different across projects and shows how healthy each project is. i recommend acting fast these days.
- red team etiquette matters. if you don’t disclose responsibly, boast on twitter about your findings on a particular project, or make indications about the nature of particular findings, you’ve disqualified yourself as a serious security researcher. trust is the most important factor in this game. if you lose it, it’s very hard to win it back.
- did i mention that humans should not code in c?
love you all.
One of my more controversial views is that Google should absolutely be held liable for this. They are absolutely complicit in mass scale fraud.
The first thing that comes up is the phishing website! Both phishing and promoting phishing links this prominently should be illegal.
It's so easy for Google to filter, too! It's instantly obvious to any bot or human that it's a scammer paying for that top spot. Google turns a blind eye because of ad revenue. It's obvious that the only top result on there should be Trezor or a genuine competitor paying for the spot, not a Google Sites phishing link impersonating Trezor.
Google intentionally turns a blind eye so they can keep printing massive ad revenues from this. Which makes them complicit in the scam and they should be held liable for every scam that happens through this method.
@Wise @KarolisRudelis ´Please note that we never close accounts without a reason..... But that reason can be whatever we feel like and we´ll gaslight you until you give up´
@levelsio Even if you abstract yourself from the approved law (it could be anything else, really) — the way these guys approved this was so rigged, anti-democratic and enfuriating
crazy!
🇪🇺 Chat Control has passed 😔
They can and will now legally scan any person's messages, emails and photos you send without a warrant
The way they passed this law when the majority of the European Parliament was against it will shock you:
They waited until most EP members were on holiday so only a few were present and then created an "urgent" vote for it to pass it through
There's nothing democratic about any of it and big powerful forces are behind this that can manipulate the EU for whatever they want
Democracy in Europe died a bit today 😔
I am 27, French, and I am tired of living on a continent that treats AI, compute, chips, crypto, datacenters, energy and nuclear power as problems to manage instead of strategic assets to build.
I do not want frontier AI to become another nationality-gated privilege. I want powerful AI models to remain generally available to builders, researchers, engineers and founders. But what happened with Anthropic’s Fable/Mythos models proves that this cannot be taken for granted: once frontier AI becomes a national-security asset, access can be restricted by citizenship or nationality.
The problem is that Europe has failed to build its own equivalent. We are not in the frontier AI race at the level of the U.S. or China. We do not have the same hyperscale cloud stack, the same compute capacity, the same capital depth, the same energy strategy, the same chip ecosystem, or the same frontier-model ecosystem. And because AI progress compounds through compute, talent, chips, energy, data and capital, falling behind is not linear. Once the gap is deep enough, you do not catch up at the same pace.
Europe spent decades regulating, moralizing, delaying and underbuilding the foundations of technological power. Cloud was missed. Crypto was treated primarily as a criminal-risk category before Europe built anything globally dominant in it. Datacenters are slowed by permitting, grid and energy constraints. Nuclear power was politically weakened or delayed across much of the continent just when abundant electricity became essential. AI is now being regulated before Europe has even produced a true top-tier frontier lab/model (no, MistralAI isn't a real competitor, for me, even Kyutai did more innovation/progress in the AI space than MistralAI).
Our leaders now talk about "sovereign AI", "AI factories", "gigafactories", and "strategic autonomy", but this language came far too late. You cannot regulate your way into technological sovereignty. You cannot paperwork your way into compute. You cannot build frontier AI without massive power, massive datacenters, massive capital, elite talent, advanced chips and a political culture that actually wants builders to move fast.
Europe still has talent. France still has engineers, mathematicians, scientists and founders. But the system around them is broken. The incentives are wrong. The mindset is wrong. Every mainstream political camp in France and Europe seems to have the same reflex: regulate first, tax first, restrict first, moralize first, build later.
ASML is the exception that proves the rule. It is one of the only truly strategic European chokepoints in the global compute stack. But one Dutch lithography champion cannot carry an entire continent that failed to build the rest of the stack: frontier AI labs, hyperscale cloud, Nvidia-class accelerators, TSMC-class fabs, massive datacenter capacity, cheap abundant energy and deep capital markets.
I did not vote for 20+ years of anti-growth, anti-compute, anti-nuclear, anti-crypto and anti-industrial policy. I was a kid. But my generation is supposed to live with the consequences: less access, less sovereignty, less capital, less compute, less ambition and a future where the most important technologies are built and can only be used somewhere else.
That is the part I cannot accept.
I do not want to spend my adult life asking permission to use technologies my continent was too slow, too afraid or too complacent to build.
I do not want European builders to become tenants in someone else’s technological empire (as it's already the case).
And I do not want "sovereignty" to mean nothing more than regulating foreign systems after failing to create our own like they're doing right now with cloud computing.
Either Europe becomes a builder civilization again, or the next generation of Europeans will inherit a beautifully regulated dependency that slow or even stop us.
For now, Europe still talks like history will wait...
@gravax @alexis_roussel Play Integrity API permits a device with no updates for 10 years but not a heavily privacy/security hardened mobile OS based on AOSP.
GrapheneOS has far better exploit protections and patches. It has stronger verified boot and hardware-based attestation. Why isn't it permitted?
Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
Google's Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.
The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.
Apple's Privacy Pass brought hardware attestation to the web to help with passing captchas on their own hardware. Many people saw that as harmless since few sites would be willing to lock out non-Apple-hardware users. Apple and Google are both likely to bring broader hardware attestation to the web.
Google's reCAPTCHA is planning an approach where they use Privacy Pass on Apple hardware, their own approach on Google Mobile Services Android devices and a QR code scanning system to require an iOS or Google certified Android device for Windows and other systems:
https://t.co/7rQnioRa8A
Banking and government services increasingly require using a mobile app where they can use attestation to force using an Apple or Google approved device and OS. Apple's privacy pass, Google's 'cancelled' Web Environment Integrity and now reCAPTCHA Mobile Verification are bringing this to the web.
Current media coverage for reCAPTCHA Mobile Verification misunderstands it and the impact of it. They're bringing a hardware attestation requirement to Windows, desktop Linux, OpenBSD, etc. by requiring a QR scan from a certified smartphone to pass reCAPTCHA in some cases. They could expand it more.
Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web. Google defines certification requirements for Android which includes forcing bundling Google Chrome, etc. It's enormously anti-competitive.
Google's Play Integrity API bans using GrapheneOS despite it being far more secure than anything they permit. It also bans using any other alternative. This isn't somehow specific to an AOSP-based OS. You can't avoid this by using a mobile OS based on FreeBSD instead. You'll just be more locked out.
Google's Play Integrity API permits devices with no security patches for 10 years. The device integrity level can be bypassed via spoofing but they can detect it quite well and block it once it starts being done at scale. The strong integrity level requires leaked keys from TEEs/SEs to bypass it.
It doesn't provide a useful security feature, but it does lock out competition very well. Services requiring Apple App Attest or Google Play Integrity are primarily helping to lock in Apple and Google having a duopoly for mobile devices. Play Integrity is more relevant due to AOSP being open source.
Governments are increasingly mandating using Apple's App Attest and Google's Play Integrity for not only their own services but also commercial services. The EU is leading the charge of making these requirements for digital payments, ID, age verification, etc. Many EU government apps require them.
Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.
reCAPTCHA Mobile Verification will currently work with sandboxed Google Play on GrapheneOS but it clearly exists to provide a way for them to start using hardware attestation on systems without it. People without an iOS or Android device will be locked out when this is required even without that.
This isn't about security or any missing functionality. GrapheneOS can be verified via hardware attestation. Google bans using GrapheneOS for Play Integrity because we don't license Google Mobile Services and conform to anti-competitive rules already found to be illegal in South Korea and elsewhere.
Services shouldn't ban people from using arbitrary hardware and operating systems in the first place. Google's security excuse is clearly bogus when they permit devices with no patches for 10 years but not a much more secure OS. It's for enforcing their monopolies via GMS licensing, that's all.
@IntCyberDigest @etguenni @L1v1ng0ffTh3L4N @satyanadella then the Microsoft Secure Future Initiative is nothing but an empty phrase, and “Secure by Design” is used as a marketing catchphrase rather than a conceptual principle, right?
I promise you, Ro Khanna, my daughter was scared when she was forced to take her last breath.
I was not there to hold her as she slipped away.
For years, Americans were told about “robust vetting” and “screening.” My family learned the cost of those false assurances when an illegal immigrant, driving intoxicated and in this country unlawfully, killed my daughter under the very policies you champion and still defend.
Oh, and he got a release date — because of course he did.
Katie got the grave.
Katie’s family got a life sentence of grief while he got another chance.
Your one-sided hyperbolic rhetoric would fit right in with J.B. Pritzker, his allies and the Illinois media that protects him.
How far we have fallen when men like you are treated as moral leaders while families like mine are left with graves, not justice. Bang-up job sir!
The Democrats are experts in the application of DARVO tactics, that’s also why every Democrat uses the same talking points.
Here's a breakdown of DARVO tactics:
1. Deny: The manipulator denies the wrongdoing or behavior entirely. They might claim the incident never happened or downplay its severity to avoid responsibility.
2. Attack: They attack the accuser, often questioning their credibility, motives, or character. This can involve personal insults, accusations of lying, or deflecting to unrelated issues.
3. Reverse Victim and Offender: The manipulator flips the narrative, portraying themselves as the victim and the actual victim as the aggressor. They may claim to be unfairly targeted or misunderstood, twisting the situation to gain sympathy and deflect blame.
EXAMPLE: Jay Jones' (@jonesjay) Text Scandal in Virginia: Jones was exposed in leaked texts fantasizing about violence against Republicans, including shooting officials and their families, and urinating on their graves. So, Jay Jones is;
- Deny: Jay Jones dismissed the texts as "bombast" or "frustrations" in private venting, not serious threats.
- Attack: Supporters like former Chief Public Defender Brad Haywood attacked the leaker and media as "Trump-controlled," questioning their motives.
- Reverse Victim and Offender: Jones and allies framed him as the victim of a smear campaign to derail his campaign, with Democrats doubling down on support and calling for Republicans to "defend" the context, positioning Jones as targeted by "psychopathic" political enemies.
🚨DO NOT FALL VICTIM TO THE DEMOCRATS' LIES AND GASLIGHT‼️
Spot on—targeting infrastructure upgrades, collection programs, and river interceptors right at those top 10-20 polluting rivers (per the Schmidt data and updates) would block the bulk of ocean plastic at the source far more effectively than blanket single-use rules.
UN could actually deliver by funding and scaling proven interceptors plus local waste systems there, using existing aid dollars instead of endless reports. Practical focus beats symbolism every time.
@synacket @Kalshi They warned that a Judge would refund the tariff money paid by the consumers to companies who didn’t pay them?
That’s what the economists warned about? Because all I can find are them lying about the economy crashing.
@AutismCapital These tech companies are providing zero resistance. Im old enough to remember the internet blackout protest lots of companies did to kill SOPA/PIPA. Now? Nothing.
‼️INSANE‼️ The liberal elite’s two fixations — mass migration & permanent war — have now fused into one dangerous experiment: turning migrants into soldiers to “boost Europe’s defence.”
▪️Instead of admitting that mass migration has created deep security and integration failures across Europe…
▪️Instead of acknowledging that reckless escalation has pushed the continent toward prolonged instability…
They now suggest arming those they previously failed to integrate.
🇭🇺 Hungary rejects both obsessions.
No migration quotas. No war agenda. Only the peace and security of the Hungarian people.
Any remaining faith I had in our institutions is gone.
The Epstein files were the final straw for me.
For years, I’ve tried to give the system the benefit of the doubt. Assume incompetence over malice. Assume there are things happening behind the scenes. Assume eventually the truth comes out.
Cope.
At some point you have to stop lying to yourself.
When the most powerful people on earth are connected to something this dark, and the result is sealed documents, redactions, quiet settlements, and zero real accountability, you start to see the pattern.
There’s a system for regular people, and there’s a different system for the elite.
We have seen it with monetary and economic policy. Now we see it is systemic.
This isn’t about left vs. right. It’s not partisan for me. Corruption protects itself. Power protects power. That’s the constant.
And when that realization sets in, you have a choice.
You can scream about it. You can argue online. You can hope the next election fixes it.
Or you can quietly opt out where you can.
For me, that’s Bitcoin.
Not because it’s some utopia or because it fixes evil. But because it doesn’t require me to trust the same institutions that have repeatedly shown they don’t operate by the same rules for everyone.
No special access.
No closed-door monetary policy.
No selective bailouts.
Just open code and rules that apply to everyone.
Maybe that sounds dramatic. But I don’t see it as rebellion. I see it as self-preservation.
When trust erodes, capital moves. It always has.
Some people exit geographically.
Some exit socially.
Some mentally check out.
I’m exiting financially.
You don’t need to agree. But if you’ve felt that shift lately – that quiet realization that the people in charge aren’t playing the same game as the rest of us – you’re not alone.
For me, Bitcoin isn’t about getting rich.
It’s about no longer asking permission.
Who do you represent @vonderleyen, @EmmanuelMacron, @Keir_Starmer, @bundeskanzler?
Because the people can’t stand you. They don’t support you. They hate you.
Resign NOW!
As a former leftist:
The left doesn't understand your views. They don't need to understand "conspiracy theories" and "misinformation".
Your views are illegitimate, must not be understood, must be silenced.
They believe silencing you makes them good people, and they plan to do it, starting day 1, when they get power again.
@TiwariRajend @historyinmemes This does look scripted though. How else could he notice this woman about to faint?
Most Popular Users
Elon Musk 
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.1M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.8M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.3M followers
Virat Kohli
@imvkohli
73.1M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.1M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
62.9M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers