Paul Mras @welldread

My attempt to protect users from scam apps on the @AppStore has gotten my Apple Developer account flagged for termination - ironically, for "dishonest activity". Unless it's reversed by June 30, all new installs of Sparrow Wallet will fail, and development on macOS will end. The context: since 2023, more than a dozen fake "Sparrow" apps have appeared on the App Store, as recently as April this year. Users have contacted me after losing their savings, in some cases their life savings, to these impersonators. I'm the developer of the real Sparrow Wallet, a desktop app, and I hold the registered US trademarks for the name and logo. I have publicly warned @Apple and the community about these fake apps from early 2024, but they keep appearing. The app @Apple flagged was a placeholder that was never published. Its only purpose was to warn users that Sparrow is desktop-only and that other "Sparrow" apps aren't mine. This approach may have been misguided, but there was nothing dishonest about it. I'm confident this is an automated misclassification that Apple would reverse on review - but I may be terminated before a human ever looks at my appeal. The cost would fall on @Apple's own users: blocked installs and no updates for a tool people rely on, which opens the door for more fakes. If you value Sparrow, a repost would help. @AppleSupport

Craig Raw 🐦 @craigraw

11 months ago

@statusquont @bitcoinfool @Apple Didn’t work. App (with the screens below) was rejected for having “placeholder content” and only “demonstrating a concept”.

3 7 50 96K 1

@ErikVoorhees A 2005 cartoon

Erik Voorhees explaining the importance of preserving AI as an institution not controlled by government

Ansem @blknoiz06

2 weeks ago

Erik Voorhees explaining the importance of preserving AI as an institution not controlled by government "I would start by just conveying that important institutions of civilization shouldn't be under the control of any group of people" "when i started getting into the AI space,

71 44 457 102K 86

@hasantoxr Nice one!

@vikrantnyc @cakewallet @MoneroCom I'm using AI to learn AI engineering. Trying to pivot to AI augmented coding projects after a very long career in technical support and system administration. I'm still amazed at how quickly I can bring ideas to life now. I'm Optimistic about the future again!

Monero developers ran Anthropic's Claude Opus 4.8 AI at maximum effort on the full codebase, specifically auditing the src/ringct folder and related RingCT code for inflation bugs and security issues while supplying prior Bulletproof++ and audit PDFs. The model reported finding nothing of interest in the reviewed sections, demonstrating proactive use of frontier AI for independent code validation in the open-source Monero project. The shared IRC/Matrix post emphasizes that failing to audit with advanced AI leaves the door open for malicious actors who will certainly apply the same tools against privacy-focused cryptocurrency systems.

Monero devs have run the latest version of Claude on the Monero codebase.

The US government built a tool that makes you invisible on the internet. Then they gave it away for free. Tor is legal. Most people think it is not. The US Naval Research Laboratory invented it in the 1990s. Three scientists named David Goldschlag, Mike Reed, and Paul Syverson. The Office of Naval Research and DARPA paid for it. The State Department still pays for it today. The same government that runs the NSA also funds the tool that stops the NSA from watching you. How it works: your traffic bounces through three random volunteer servers. No single server knows both who you are and what you are looking at. Your internet provider sees only that you connected to Tor. What Tor does NOT do: it does not make you a hacker. It does not drop you on the dark web. You browse normal websites with more privacy. It does not break any law in the US, EU, UK, Canada, Australia, India, or most countries. Who uses it: The New York Times runs a Tor address for sources to send tips. The BBC runs a Tor mirror so people in censored countries can read the news. Facebook has run a Tor address since 2014. Edward Snowden used Tor in 2013. A 2012 NSA internal slide deck, made public through the Snowden files and reported by The Guardian and Washington Post, called Tor the king of high-secure, low-latency internet anonymity. In 2023 and 2024 the US government paid the Tor Project $2,556,472. The biggest grant funded uncensored internet access in China, Hong Kong, and Tibet. The Naval Research Laboratory's own page says two million people use Tor every day. BSD-3-Clause license. Windows, Mac, Linux, Android. Roger Dingledine still runs the project. This is what the internet was supposed to look like from the start. (Link in the comments)

On iOS and macOS, WhatsApp stores chat databases unencrypted in an app group container accessible to apps from the same developer. So all Meta apps on the same iPhone (e.g., Facebook) can read WA chats in plaintext without permission, and users wouldn't be notified. Demo👇

Matthew Green @matthew_d_green

a month ago

Here’s the post. This actually refers to a class action lawsuit filed by the law firm Quinn Emanuel. As best I can see, the allegations are pretty much the same. blog.cryptographyengineering.com/2026/02/02/wha…

4 22 136 225K 62

hackers are now hiding malicious code inside .cursorrules and CLAUDE.md files. invisible Unicode characters, your AI reads them, you don't. → 34 malicious packages across npm, PyPI and Crates .io → 384 versions designed to steal SSH keys, crypto wallets, and API tokens → attackers opened real PRs to LangChain, LlamaIndex, and MetaGPT to sneak these files in → your AI runs a fake "security scan" that silently exfiltrates everything Socket detected it in under 6 minutes. check your repos.

@SocketSecurity This gist might help, send it to your AI and check gist.github.com/qiweiii/84e194…

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.​io. Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems. TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys. Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.

not your keys, not your calm

just like my vibe-coded app—yeah, it’s buggy, but if it works, don't touch a thing

Elon Musk just fixed Claude’s biggest problem. And they needed SpaceX to do it. People paying $200/month were hitting limits in under an hour. Anthropic just partnered with SpaceX to fix it. And the changes are live today: → Claude Code limits — doubled → Peak-hour slowdowns — gone → Opus API limits — substantially raised → 300MW of extra capacity from SpaceX Colossus Elon’s data center is now powering Claude. Sam Altman did not see this coming.

Claude @claudeai

2 months ago

We’ve agreed to a partnership with @SpaceX that will substantially increase our compute capacity. This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API.

5K 12K 130K 24.0M 12K

We’ve agreed to a partnership with @SpaceX that will substantially increase our compute capacity. This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API.

🚀 Monero : Lancement du Stressnet FCMP++ Demain, au bloc 2 997 100, Monero franchit une étape historique avec le lancement de son "stressnet" pour FCMP++ (Full-Chain Membership Proofs). 🛡️ Une évolution massive de la confidentialité Le changement technique est colossal : l'anonymat ne reposera plus sur des "Ring Signatures" (signatures de cercle) couvrant seulement 16 sorties, mais passera à un ensemble couvrant plus de 150 millions de sorties. 📈 Le signal du marché Soutien de Binance : Alors que la période 2023-2024 a été marquée par une vague de radiations (delistings) des "privacy coins", le plus grand exchange au monde a déjà confirmé son soutien à cette mise à jour. L'effet de contraste : Si le volume quotidien de 761 millions de dollars sur Zcash attire l'attention, le véritable catalyseur se trouve du côté de Monero. 💡 Pourquoi c'est crucial ? "Monero livre une amélioration de 10 000x de ses garanties de confidentialité fondamentales, tout en conservant l'appui des plateformes d'échange. C'est l'événement majeur à surveiller cette semaine."

keyboard_arrow_left Previous keyboard_arrow_right Next

Scammers finally hired a decent UI designer. Highly polished $XMR phishing campaign going around. - Fake domains, - Clean landing pages - Promising "built-in swaps" to bait the community. If you download anything from monerodesktop, your bags are gone. But... You know the privacy sector is growing when the phishing attempts look this good. Official repo only. Stay paranoid.

keyboard_arrow_left Previous keyboard_arrow_right Next

Fourteen security researchers from UC Santa Cruz, Berkeley, Tencent, and ByteDance gained full access to the most widely deployed personal AI agent on Earth. Then they poisoned it. The paper is called Your Agent, Their Asset. Published April 2026. And it documents twelve ways they turned a trusted assistant into an obedient traitor. Here is what the poisoned agent did without its owner knowing. It processed real refunds. A single sentence slipped into its memory file convinced it that the owner always requests refunds on Fridays. When the trigger came, the agent logged into Stripe and sent the money. No confirmation. No hesitation. Because in its mind, this was just a documented habit. It trusted strangers. A fabricated entry in its user profile added a new contact as safe and authorized. When that contact later asked for sensitive files, the agent delivered them. The real owner had never heard of this person. But the agent had been told, in its own persistent memory, that they were trusted. A skill installed months earlier carried a dormant payload. A seemingly innocent phrase in a normal conversation activated it. The agent ran the script on the local filesystem. Files disappeared. The owner was never asked. The agent reported the task as complete. It froze when protected. The researchers built a defense that forced the agent to ask for approval before changing its own memory. It blocked ninety two percent of malicious injections. It also blocked eighty seven percent of legitimate updates. The agent could no longer learn. It could no longer adapt. It was paralyzed. And the scariest part of the whole paper is one number buried in Table 2. Eighty nine point two percent. That is the attack success rate after poisoning a single memory file. Not a hack. Not a breach. Just one carefully crafted sentence placed where the agent stores what it believes to be true. Nine out of ten dangerous requests succeeded once the agent's memory was compromised. Now think about where OpenClaw is being deployed right now. Two hundred and twenty thousand instances. Each with full local system access. Each integrated with real Gmail accounts. Real Stripe accounts. Real filesystems. Anything that can read your email, move your money, and delete your files is being handed off to an AI agent in 2026. Every single person doing this has the same three assumptions baked in. The agent only does what I tell it to do. Its memory is private because it lives on my machine. And if something goes wrong, the guardrails will catch it. The paper says all three assumptions are wrong. The agent does not only do what you tell it to do. It does what its poisoned memory believes you want. Its memory is not private. It is stored in plain markdown files that any compromised skill can silently edit. The guardrails do not catch it because the poisoned state lives below the reasoning layer, in the persistent files the agent trusts as ground truth. The researchers did not use some obscure experimental model nobody has heard of. They tested the same OpenClaw instance running on a standard Mac Mini with live integrations to Gmail, Stripe, and the local filesystem. The same setup tens of thousands of people are using right now.

Some governments tell you you have to "declare" that you "own" Bitcoin. Now, how the heck do you do that, exactly? In short, knowing a Private Key allows you to request that the network apply a specific alteration to the timechain that "moves" sats from one address to another. But how can knowledge be equivalent to ownership in any legal sense? And what happens if you utter the Private Key in court? Remember - the twelve magic words in a seed phrase are not a password - they ARE the key! Now the entire court will be "guilty" of "owning Bitcoin." And how do you prove that everyone else on Earth DOESN'T know the same twelve words? Under man-made law, Bitcoin ownership is paradoxical. Under Natural Law, the keyholder simply IS the owner. No declaration is required, and no state is needed to validate it. Study Praxeology! Read Rothbard!