NVK (@nvk) header
NVK (@nvk) profile picture

The security paradigm has significantly changed. Moral panic and influencers won’t protect you. DYOR. infosec will get a LOT worse before it gets better.

🇦🇶
Joined November 2007
Photo by NVK (@nvk)Photo by NVK (@nvk)Photo by NVK (@nvk)Photo by NVK (@nvk)Photo by NVK (@nvk)Photo by NVK (@nvk)Photo by NVK (@nvk)Photo by NVK (@nvk)Photo by NVK (@nvk)
Pinned Tweet
Replying to @nvk
BAM! #Bitcoin sent over 7.077Mhz via #JS8Call to @SamuelPatt Sweep: blockchain.com/btc/tx/82c043… Toronto,CAN => Michigan,USA [40W:#SnowStorm] Bcuz its a brainwallet made ahead of time, with bearer pk I don't require internet to broadcast this transaction at the time i'm sending
515
480
259
1,897
A man in Russia was sentenced to 13 years in prison because Binance decided it would be a good idea to share his donations to Ukraine with the Russian Government. This is how AML laws are weaponized around the world, and why tools like Tornado Cash are so important.
🇷🇺🇺🇦 Russian Man Sentenced to 13 Years After Binance Shared His Data Yuri Belenkiy, a Russian IT specialist who had been living in Bulgaria, was sentenced on October 26 to 13 years in detention on terrorism financing charges over cryptocurrency donations linked by prosecutors to Ukrainian fundraising campaigns. According to documents reviewed by Reuters, Binance supplied Russian investigators in 2025 with records that were used as evidence against him, including his transaction history, personal information and copies of his Russian passport and Bulgarian residence permit. First Department, a Russian legal aid organisation that obtained the case documents, says the initial allegations covered 6 transfers totalling 742.26 USDT, before records supplied by Binance revealed 9 additional transfers, bringing the total cited in the final charges to 1,680.69 USDT. Belenkiy denied the charges, and his defence questioned whether the records came from Binance.
2
15
61
1,753
As someone who has personally spent $500k / mo+ on Google Ads for years, I can tell you with certainty: This revenue growth in Search is artificial & extremely unhealthy for Google’s business long term Search volumes are declining as legacy search is being increasingly cannibalized by non-monetized LLM queries Google’s response? Manufacture revenue growth via short-sighted, highly extractive, customer-hostile tactics. I.e. charge advertisers more for lower quality clicks, including clicks they do not want and explicitly did not approve Google to charge them for A few examples to illustrate: For all of its history until recently, Google operated on a 2nd price auction model I.e. if you bid $5 CPC and the next highest bidder bids $1 CPC, Google charged you $1.01 for the click (one penny more than the 2nd highest bidder) rather than the $5 you bid This was a genius move by Google early on as it incentivizes advertisers to input their true maximum willingness to pay rather than trying to play the game of bidding low and constantly adjusting to try to stay just ahead of the next highest bidder while still not paying too much However recently, Google silently deprecated the 2nd price auction and began charging advertisers as much as their bid and budget caps allow, regardless of what anyone else is bidding It’s a short-sighted cash grab at the expense of the long term health of the advertiser ecosystem Making thing worse, Google also recently nerfed keyword targeting precision Google previously had precise keyword targeting settings that allowed advertisers pick individual search phrases to bid on, defined down to the character w/ exact match or phrase match targeting This was one of the core features that made search advertising magic, enabling advertisers to run extremely precise campaigns based on exactly what their target customer typed But now, even if you bid on a specific term or phrase using the strictest exact -match targeting settings, Google will show your ad across 1000’s of unrelated keywords, labeling them as as “exact match (close variant)” The definition of “close variant” means whatever they want it to and changes constantly. The result is advertisers get billed for clicks that are totally irrelevant to their business and that their targeting settings explicitly forbid Google from targeting. Google does it anyway and there’s no ability to turn this off So now exact match is broad match, and broad match is just meaningless spam This is all very bad for advertisers, but for Google, it allows them to show your ad and bill you for clicks across 1000x more searches that were previously going unmonetized (mainly because they’re garbage queries no one wants) This is how you grow revenue atop declining search volumes Lastly, and perhaps most egregiously, Google quietly stopped respecting budget caps by a factor of 2x. For example campaigns we’ve been running for years with $1000 daily budget caps suddenly began spending $2000+ per day And the extra spend is entirely on the garbage keywords Google arbitrarily throws in as “exact match (close variants)” which have no value to our business, but can’t be turned off Google offers no refunds nor any recourse for overspend or spend on keywords you explicitly did not target These are not the actions of a healthy business. These are the actions of company whose core business is in decline but desperately needs to pump quarterly earnings so Wall Street will continue to fund insane capex while hopefully looking through their rapidly deteriorating negative free cash flow Google operated a benevolent monopoly for the better part of 25 yrs Meaning the value Google captured from Search was but a small fraction of the value it created, and that spread produced a potential energy that justified expectations of high earnings growth far, far into the future This is now no longer the case At the alter of AI capex, Google is sacrificing the golden goose
Q2 was an amazing quarter, with our AI investments redefining what’s possible across every part of our business. Alphabet revenue grew 24% YoY and Google Cloud accelerated to 82% growth. We saw exciting momentum across the board from Search to YouTube to the Gemini app (which reached 950M monthly active users). Our model APIs are processing 22B tokens/min (up from 16B+ last quarter) driven by our workhorse Flash models. We’re also seeing great adoption of Gemini Enterprise, used by 90% of the Fortune 100, as well as strong demand for our security solutions. Outstanding results and momentum, and such an exciting moment—thanks to all of our partners and employees around the world! 🙌 About to hop on the call!
719
1,686
583
14,997
4,486,499
No one wants this
Playing piano on the touchscreen MacBook Pro
3
2
1
33
2,671
❗️ A critical Signal bug let the other person on a call keep listening after you hung up. Flooding the call's event queue could stall your hang-up, leaving your mic and possibly your camera live. Signal patched CVE-2026-113380 on Android in September. No attacks are known.
18
56
5
491
26,388
Spent $25,000 so I can finally cancel my 2 $200 subscriptions
30
6
3
287
16,231
My top three HWS in order, explained. I intentionally left out DIY to keep this simple so the DIY people don't need to come at me but I respect you 👍 1. COLDCARD Q @Coinkite - My prized possession. I play with the Q all the time, becoming more obsessed as time goes on. The Q immediately makes most other hardware irrelevant IMO considering all the features and functionality, especially not requiring a companion app for initial setup. There really is something special about the full QWERTY keyboard... I have never regretted buying a CC and features are still being added 🐦‍🔥 2. Frostsnap @FrostsnapTech - By far the best multi sig option there is, as SIMPLE as it gets. Perfect when you don't only have yourself to think about as long as they are geographically distributed properly. These devices give me the same excitement as the Q even though I use them much less. You don't have to worry about internal batteries. They appear as single sig regardless of how many are used. The setup, signing and restoration are magical. Seriously love these things... ❄️ 3. Blockstream Jade Plus @BlockstreamJade - I gave Blockstream a hard time for months after the release of the Jade Plus because of my issues with the camera but that was eventually fixed after 2 or 3 firmware updates. The Jade does not actually force you to use an app although most people are probably better off hosting their own oracle when they can for better reliability. I enjoy the simple, small, lightweight form factor while still incorporating some features like a passphrase, BIP 85, OTP, and stateless which most people don't realize is an option. I do occasionally use liquid too so it's great for that. The oracle is not perfect but I respect @Blockstream for doing something different. The alternative theme options scores the Jade some Aura points. I do feel bad for attacking Blockstream so much in the past so hopefully they will appreciate it still being in my top 3 😇
8
9
28
5,463
with the option to export it to Coldcard 🥳
2
4
778
Lula turned Brazil into Venezuela. You can vote your way into communism, but not out of it.
110
816
7
6,918
41,595
We are aware of the recently disclosed PHP vulnerability. Trust Wallet’s wallet apps and core infrastructure are not built on PHP. Users are unaffected and no action is required.
131
203
32
1,800
552,804
Bitcoin will never break its all-time high again." — Jason Calacanis Jason, I'll bet you $1,000,000 it will break its ATH. Here are the terms: Bitcoin hits or exceeds $126,210.50 on or before October 28, 2028, 12PM PST I’m happy to trust you to pay or if you prefer we can each escrow the dollars with independent party. The bet is either settled when Bitcoin hits the ATH or on October 28, 2028. @jason Do we have a bet?
1,171
808
177
12,275
1,628,438
NVK retweeted
Replying to @PremiumBusiness
@PremiumBusiness having issues with access to premium business support, please DM back.
2
3
1,005
NVK retweeted
🔴 CVE-2026-118320 · Google Chrome >=156.0.8078.73 <156.0.8078.73 Google Chrome's V8 JavaScript engine is affected, and the flaw could let a remote attacker run arbitrary code within Chrome's sandbox if a user… CVSS 8.8. EPSS 0.00. Fix: 156.0.8078.73 cve.now/CVE-2026-118320
3
18
9
124
31,651
BREAKING: Claude Code found 12,847 photos of my face on my iPhone that I never took. It looked like the phone was taking them every time I picked it up. From the club. From home. At a red light while I was driving. Almost every time I took the phone in my hands there was a frame. They were sitting in a system cache with timestamps and location data. None of them were in Photos. I plugged the phone into my MacBook and asked Claude Code to scan for any front-camera files that weren’t in my Photos library or Recently Deleted. It flagged Private/var/mobile/Library/Caches/com.apple.faceid. Over 12,000 files. Mix of infrared frames and regular front-camera images. Each one had a timestamp and GPS coordinates attached. I started scrolling. Most were from the last 14 months. Then I saw one from four seconds ago. I was still looking at the folder. Apple says the TrueDepth system turns the capture into a mathematical model inside the Secure Enclave and discards the image. On this phone the raw frames were still in the cache. Several of the processes that wrote to the folder belonged to system diagnostics. A couple of old apps with camera permission also had access to the same directory. I turned off diagnostics sharing and revoked camera access from every app that didn’t need it. If you want to check your own phone, plug it in, run a backup, and ask Claude Code to look for front-camera files outside the Photos library. The folder path above is where mine were.
Claude Code found 145,763 photos I permanently deleted from my iPhone. Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them. I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for. PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted. Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there. Passport photo I took for a visa application in 2023. Screenshots of my bank app with full account numbers visible. Private photos I sent someone and immediately deleted after a breakup. Screenshot of my crypto seed phrase I took temporarily in 2022. Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later. Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023. Some were full resolution. All organized by date going back to 2021. When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never. They told you it was permanently deleted. It wasn't. I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time. Went from 23 apps to 3 in about two minutes. Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.
188
1,474
75
15,267
1,426,761
Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.
120
104
93
726
135,041
This might lose me some followers, but I just ordered another Coldcard Q. Huge mistskes come with huge auditng and both hardware and features are still top notch. That said, don't trust - verify.
15
2
31
4,719
4 pasos para ser de ultraderecha : 1. Trabajar 2.Querer formar una familia 3.Saber economía básica 4. Bañarse
881
5,963
190
54,082
646,049
Se você tem uma Coldcard parada e sem chaves, zerada, pode experimentar com a Catcard do @MagicalTux que está em alpha para ajudar a testar e reportar bugs - AINDA NÃO É PARA USO FINAL github.com/TibaneLabs/catcar… Catcard: Firmware opensource (MIT) independente para Coldcard em Rust
5
5
51
3,226
Replying to @Gen6G
teapaw.org/SGBarbour/status/10519… Far worse than supplying shitcoin infra (market demanded it after all) is building in a kill-switch on your miner that effectively bricks competitor hardware.
Beware "decentralized" - it is choice vocabulary for scammers and frauds. Just look at Siacoin - claims to be "decentralized" yet is clearly a *permissioned* blockchain. Start competing and they will brick your ASICs... just pathetic.
1
1
754
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets, protocols, bitcoin infra and sdks : > bitcoinjs-lib: CVE-2026-107846, GHSA-8247-5gp7-95qh, GHSA-4mfv-5394-26c7, GHSA-88jr-9qj4-ccm4, GHSA-h52v-8xwg-7j95 (patch versions: 7.0.5, 6.1.10, 5.2.3) > bip39: CVE-2026-107847, GHSA-39w3-8jr6-f676 (latest patch version: 3.1.12) > tiny-secp256k1: CVE-2026-107853, GHSA-85g9-f6v5-wqq7, GHSA-rm9w-7fv8-3rhx (latest patch version: 2.2.5) All of the above packages have ~500k downloads/week. Also, multiple other CVEs/disclosures took place over more libs of bitcoinjs by other researchers like the ARSB and Bitcoin Red Team: > bitcoinjs-lib: GHSA-4vm8-79jj-j6w4 (patch versions: v7.0.5, 6.1.10, 5.2.3) > bip38: GHSA-mj7w-64jg-8f98 > bip32-utils: GHSA-wvw7-chj5-hr2g(patch version: 0.11.2) > merkle-lib: GHSA-g353-54jg-j6gg (patch version: 2.0.11) > bolt11: CVE-2026-107855 (patch version: 1.4.2) There are a total of 15 findings (14 highs, 1 medium) and cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation. It was greating coordinating with @junderwood4649, @landabaso.
4
12
6
31
4,279