Dmitry Yakimov

[Dmitry Yakimov @welldan97]

Atwood's Law in 2026: any application that can be written in Rust, will eventually be written in Rust.

[Theo - t3.gg @theo]

lmao, opus decided to really honor the "porting" aspect and ported most of gostd library into Rust

[Eric S. Raymond @esrtweet]

The end of software secrecy is almost upon us. The death of closed source, and the final triumph of open source.

I should have realized this a few months ago when I successfully decompiled the game of Firefighter from an ancient DOS shareware binary. My robot friend was able to tell it had been written in Borland Pascal from looking at the data layout; it gave me back very readable Pascal code with sensibly chosen function and variable names. I transpiled it to Rust and now ship it as part of my heritage games collection.

The thing is, I thought of this as a fun stunt but didn't have any confidence that the technique would scale up to large, real programs. I have since learned that people are now doing this sort of thing with entire AAA games, which are among the most complex software artifacts ever to be shipped as a binary. If they can be decompiled, anything can be.

This has implications. Massive implications. We need to think about what the world is like when, in general, there is no longer a secrecy moat around almost any software at all.

1/2

[Lyudmyla Kozlovska 🇪🇺🇺🇦 @LyudaKozlovska]

STOP CHAT CONTROL 2.0. - What you should know:

Tomorrow, 29 September, behind closed doors at the Council, the most draconian version of Chat Control 2.0 goes on the table. It is no longer only an intermediary reading all your private messages and cloud storage. It is a licence to search them for months, without suspicion against any individual.

The leaked Presidency note to delegations (11956/26, 10 September) proposes "authorisation of search plans for a period of time rather than on a case-by-case basis" for private chats and emails.

In plain terms: your messages, contacts, photos and cloud will be scanned under a state-issued licence for months, with no suspicion against you.

The same note admits that under this regime "a high volume of reports generated do not lead to any operational outcome." The Council's Legal Service already warned this is general and indiscriminate surveillance, illegal under EU law. The @Europarl_EN mandate says the opposite: judicial authorisation, targeted to specific persons, no scanning licences.

Tomorrow the pressure is on Parliament to fold. You remember the tricks used to push Chat Control 1.0 through and how @EPPGroup with @RobertaMetsola helped to push for it.

So fasten your seat belt for what is coming tomorrow, and call or write to your MEP and your government now to reject Chat Control 2.0. as a whole!

Remind them what this does to the privacy of every one of us.

Under a search plan, every chat, photo or contact the scanner flags is stored by the provider and sent to a new EU agency, the EU Centre, which keeps it and passes it to police. Any state authority can then demand it, with a deadline and a fine for delay, and nobody has to check who is really behind the request, in case it is hacked or weaponised.

That is exactly what happened at Revolut, and what keeps happening through abusive requests from authoritarian states, as we have reported for 13 years.

In the Revolut case the hackers got access to a real state mailbox. Their requests came from an authentic certified email (PEC) account of an Italian Prefecture on the Interior Ministry's domain, with Postal Police protocol numbers, as European Investigation Orders in the name of the Milan prosecutor, for about five months.

About 680 customers lost passports, selfies, home addresses, IBANs and full transaction histories. The files are being sold; hundreds of victims now fear kidnapping. No remedies exist as of now to protect against such attacks.

Let's stop it before it is too late. Please repost.

[Charles Guillemet @P3b7_]

There's some FUD circulating about Ledger signers, pushed by a "smart contract security" company claiming a vulnerability in the Ledger Ethereum app.

There was a bug concerning certain clear signing flows. It was found by the @DonjonLedger using their AI-powered vulnerability research suite. It was fixed and deployed two weeks ago. If you keep your Ledger apps up to date, you are protected. That's the whole story.

Now the framing.

What actually happened: this company reached out to our bounty program after the fix was already shipped, and did not follow responsible disclosure, they actually never discussed with the bounty program team. Then they published a thread implying the problem is unsolved. It is not. That's not security research. That's manufacturing fear for attention.

Here is the uncomfortable part. AI changes the security landscape for everyone, defenders and attackers alike. The @DonjonLedger is leading on exactly this: using AI to find real bugs before they reach users. But AI-speed research only makes the ecosystem safer if the people doing it still follow basic security principles. Disclose responsibly. Verify before you publish. Don't confuse noise with a finding.

An actor who skips all of that is net negative for the ecosystem, regardless of the tooling behind them.

The takeaway for you is simple. Keep your Ledger signers up to date (update the FW, update the apps), keep your software up to date in general, and you benefit from the latest security work automatically. Ignore the FUD.

Stay safe.

[Laura Shin @laurashin]

WATCH: A North Korean hacker's response when asked to say something negative about Kim Jong Un:

[Jameson Lopp @lopp]

More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked and 678K records leaked.

26,805 people with income over 100K€
386 people with income over 1M€
8 people with income over 10M€
https://t.co/KlT0XqPLFR

[calle @callebtc]

When the dust settles, we'll have to talk about the fact that not a single vulnerability was found by a US frontier model.

Instead, we're spending $10k a day on open weights models like Kimi K3 and Qwen 3.8 to find vulnerabilities in Bitcoin infrastructure.

It's a disaster.

[Uttam @uttam_singhk]

TLDR of the new ethereum proposal

[Cloudflare @Cloudflare]

Introducing Cloudflare Wallets. They will allow you to store stablecoins, purchase services, and receive funds across the web. https://t.co/ucAaoKMs4Q

[Rob Hamilton 🟥 @Rob1Ham]

I have spent over $10,000 scanning 100+ bitcoin ecosystem related libraries looking for vulnerabilities with Kimi K3 running as quarterback.

Myself and a small "Red Team" have found multiple serious vulnerabilities impacting the ecosystem. They vary in scope severity, but this is a call to action.

For any critical tier vulnerability that was identified if I was able to immediately demonstrate a POC (proof of concept), I have already responsibly disclosed to the maintainers.

HERE IS HOW YOU CAN HELP ME

IF YOU ARE NOT TECHNICAL:
- please share with me any repository that is on github that I can scan, we want to cast a wide net. It takes a few moments for you to link github accounts, we'll take it from there
- if that project does not have a SECURITY.md make an issue asking the dev to list one

IF YOU ARE TECHNICAL:
- If you are a maintainer or contributor to a project, I may have already scanned your repo, hit me up I'll share the results, if not I'll add your project to the list.
- If I can trust you to do larger review to start looking through this stuff to give me more eyes let me know.

AI Has forever changed software development. Tomorrow marks 1 week of Kimi k3 being live in open weights.

We are going to accelerate.

[Milk Road Crypto @milkroaddaily]

Bitwise: Can too much staking actually hurt a network's security?

"I'm not necessarily concerned about this. To me it's just an equilibrium."

If yields get too low, people unstake. That raises yields per staker, which draws people back in. The system self-corrects.

What WOULD be worrying is the opposite:

Too many entities fleeing staking at once, crushing the staking ratio and weakening the chain's economic security.

FT @KamBenbrik @Bitwise @BitcoinJesusETH @Securitize.

[oskarth @oskarth]

What can be done?

We'll see a lot more of this in the age of AI-assisted cyber attacks. We see this already with things like Zcash supply bug and the resulting Ironwood. Expect more to come.

Assuming you want self-custody, what should you do?
1) Diversification: don't put all your eggs in one basket
2) Use multi-sigs: less vulnerable to vendor attacks
3) For seed phrases: Use additional passphrases and consider dice wallets

Even with all of this, there'll be more types of attacks not in our locus of control. Unfortunately, I think we are likely to see continued and worse attacks from here. There are no silver bullets, and vigilance is a prerequisite, but it might not always be enough.

Diversification applies to seeds, assets, networks, and methods.

Maybe there'll come a calm after this current set of AI assisted cyber attacks, but right now we are in the middle of a storm. Prepare accordingly.

[Kfir Aberman @AbermanKfir]

1/ Today, we’re excited to introduce Lucy 2.5.

Lucy represents a paradigm shift in world models, not just in how generated worlds look, but in how we interact with them.

A thread on what makes it a paradigm shift 👇

[pash @pashmerepat]

Absolutely beautiful rant about AI in Linux Kernel from Linus yesterday:

I realize that some people really dislike AI, but this is an area
where I'm willing to absolutely put my foot down as the top-level
maintainer.

Linux is not one of those anti-AI projects, and if somebody has issues
with that, they can do the open-source thing and fork it.

Or just walk away.

AI is a tool, just like other tools we use. And it's clearly a useful one.

It may not have been that "clearly" even just a year ago, but it's no
longer in question today.

There are other questions around AI (like what the economy of it will
actually look like in the end), but "is it useful" is no longer one of
those questions. Anybody who doubts that clearly hasn't actually used
it.

Yes, it can also be a somewhat painful tool, both for maintainer
workloads and just from a "it keeps finding embarrassing bugs"
standpoint.

But the solution is not to put your head in the sand and sing "La La
La, I can't hear you" at the top of your voice like some people seem
to do.

The solution is to make sure those LLM tools _help_ maintainers
instead of just causing them pain. There's no question on that side.

We're not forcing anybody to use it, but I will very loudly ignore
people who try to argue against other people from using it.

And no, AI isn't perfect. But Christ, anybody who points to the
problems at AI had better be looking in the mirror and pointing at
themselves at the same time.

Because it's not like natural intelligence is always all that great either.

The kernel project has been and will continue to be about the technology.

Sure, the social angle of working on open source is important and
often a very motivating part of the project, but in the end that's a
side benefit, not the _point_ of the project.

This is *NOT* some kind of "social warrior" project, never has been,
and never will be.

In the kernel community we do open source because it results in better
technology, not because of religious reasons.

And so we make decisions primarily based on technical merit. Not fear
of new tools.

Linus

[Paul Frambot 🦋 @PaulFrambot]

One of the next frontiers for onchain lending will be privacy: the ability for institutions to allocate, earn, and manage positions without showing their strategy to the entire market.

Today we announce with @Zama the launch of the first confidential vault: confidential USDC can be deposited into Morpho Vaults, allowing institutions to earn yield on their stablecoins without exposing their positions.

[Theo - t3.gg @theo]

cPanel, lightning (on PyPi), and intercom-client (on npm) were all pwn’d in the last 24 hours. We also had a brutal Linux zero day go public.

I fear this is only the beginning.

[agentyoda @chainyoda]

North Korea already running distilled Mythos

[Simplifying AI @simplifyinAI]

🚨 BREAKING: Your internet fiber cable is secretly listening to you right now.

Researchers from hong kong just dropped a paper at NDSS 2026 showing how they can spy on your conversations through the fiber optics in your walls.

They successfully turned ordinary Fiber-to-the-Home (FTTH) cables into hidden, long-range microphones.

No laser bugs. No physical implants. No drilling through walls.

Just the broadband cable that is already sitting in your living room or office.

By connecting a commercially available Distributed Acoustic Sensing (DAS) system to one end of the fiber, they can measure microscopic vibrations caused by sound waves in the room.

Then, they use AI to reconstruct those vibrations into crystal-clear speech.

Through walls. From adjacent rooms. From up to 50 meters away.

It was tested on actually deployed infrastructure.

The attack cost is dropping. Commercial gear is all that is required if an attacker has access to the other end of the fiber connection.

Millions of homes and offices have FTTH installed. And every single one is potentially exposed.

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.