Rob Hamilton 🟥

CEO @AnchorWatch, Bitcoin Custody & Insurance
You can't stop Math, molon labe.

[Rob Hamilton 🟥 @Rob1Ham]

IBM in 1979:

[Alexey Grigorev @Al_Grigor]

Claude Code wiped our production database with a Terraform command.

It took down the DataTalksClub course platform and 2.5 years of submissions: homework, projects, and leaderboards.

Automated snapshots were gone too.

In the newsletter, I wrote the full timeline + what I changed so this doesn't happen again.

If you use Terraform (or let agents touch infra), this is a good story for you to read.

https://t.co/Mbi3oM4HMn

[Rob Hamilton 🟥 @Rob1Ham]

@pseudoramdom 🙌

[Rob Hamilton 🟥 @Rob1Ham]

For the record, I think Bitcoin Core is a great way to secure Bitcoin (and have for a long time). The question has always been about a tradeoffs.

Bitcoin core does not have "batteries" included. There is no GUI support for multisig (soon™), and needing to prep a device like removing bluetooth, wifi, etc add friction to the UX, but if you know what you're doing have at it!

[calle @callebtc]

I'm tired boss

[Rob Hamilton 🟥 @Rob1Ham]

This is one of the most frequent conversations I’ve had with Bitcoin Core developers in the past few months.

Announcements of patches to come benefit attackers (see php bug where “find bad bug in php” allowed anyone to spend $3 and get RCE).

Good call by the Core team.

[Mike Schmidt @bitschmidty]

An update to Bitcoin Core's security policy
via @darosior on the Bitcoin-Dev mailing list

[Rob Hamilton 🟥 @Rob1Ham]

@SHATOSHI_BTC Its being worked on actively as we speak!

https://t.co/TpmOKSz0Kb

[Rob Hamilton 🟥 @Rob1Ham]

@callebtc @zk_bits have a boss clanker to spin up/down the other clanker boxes, its great

[Rob Hamilton 🟥 @Rob1Ham]

@miketwenty1 @mfosterio every day is tabconf if you believe hard enough

[Rob Hamilton 🟥 @Rob1Ham]

Someone who is blind sent me an email asking about help for bitcoin custody. I'm at a loss on how to best help them.

What are good accessibility options for those who want to self custody and are blind?

[Rob Hamilton 🟥 @Rob1Ham]

Sources

[1] NIST National Vulnerability Database, CVE API 2.0. Record-level extraction; source of all counts.
https://t.co/Ioa8YzEg3M

[2] CVE Program, https://t.co/sN41t2SjBu added as a CVE Numbering Authority, 13 February 2024.
https://t.co/zwVFEdk9Ex

[3] Linux kernel documentation, CVEs: assignment process and applicability.
https://t.co/bkxTHgTkSj

[4] CVE Program history: public launch in September 1999.
https://t.co/P9dt98atn8

[5] Linux Foundation, Kernel Archeology (2020): initial Linux release in September 1991.
https://t.co/0bbLrVcBuO

[6] CVE Program FAQ: the year in a CVE identifier is not the discovery, introduction or fix year.
https://t.co/SHWVhUmEls

[Rob Hamilton 🟥 @Rob1Ham]

TIL Linux in 2024 changed the rules on how CVEs work.

Would be an interesting exercise to debias to pre-2024 guidelines to see how much of this is inflated vs rate of similar bugs being found increasing.

Even post 2024, we're on pace to doubling 2025's CVEs this year.

[Mike Schmidt @bitschmidty]

Formal verification, fuzz testing, LLM scanning. With skilled operators.

Secure all the things.

[Rob Hamilton 🟥 @Rob1Ham]

@bitschmidty Enjoy my slop

https://t.co/6trkQUKwk0

https://t.co/OtunJyS3hB

https://t.co/fBXzpnyg7C

[Rob Hamilton 🟥 @Rob1Ham]

@BritishHodl @BTCsessions @theBTCmentor @coinjoined In Control @_podconf

[Rob Hamilton 🟥 @Rob1Ham]

@CiccioMadonna @coinjoined @giacomozucco @BitvaultApp Oh no!

[Rob Hamilton 🟥 @Rob1Ham]

Ask yourself, if the frontier AI companies actually cared about cyber security, why would they disable Zero Data Retention for their leading models?

The truth is, every time you get a cyber security flag, they are looking at that data for themselves to train on it.

[Rob Hamilton 🟥 @Rob1Ham]

@btcmantis @rot13maxi @McDonalds You can’t roll a 7 on a six sided dice, it’s more secure

[Rob Hamilton 🟥 @Rob1Ham]

I’m at @McDonalds rolling a new Certificate, does anyone else want anything?

[Rod Palmer 🟥 @rodpalmerhodl]

how it feels lately