Pinned Tweet
Soft launching my new product: Assay
If you have a strategic decision that you're trying to make at work, instead of spending $500k+ on consultants, let your own employees invest or divest stock based on the decision. Skin in the game triggers honesty that bypasses politics and chain of command.
takeassay.com
Ryan Singer retweeted
Crypto grew up in the Dark Forest, and the entire world is about to find itself there
Ryan Singer retweeted
You will know them by their fruits
Ryan Singer retweeted
It’s baffling that we still use a CA system where one compromised CA can cause this level of blast radius.
The equivalent for DNS would be if one compromised TLD could suddenly issue valid names for domains in other TLDs.
Like come on, who thought this was a good idea?
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
Ryan Singer retweeted
ime, among polyamorists, the simplicity of a life with just one partner (ideally a spouse) is underrated
healthy marriage-esque relationships come with lots of efficiency gains. like you can specialize in different skills, pool resources, and function as a unit
but less-entangled, less-committed relationships generally lack those gains, and are more likely to make you sink time into emotional rollercoasters and drama
monogamy has an end goal of marriage, where your love life is 100% the stable efficient kind of relationship. but long-term polyamory generally involves managing uncommitted relationships indefinitely
plus your partner(s) will be managing uncommitted relationships indefinitely too
a web of uncommitted romance *is* more complicated than just one committed dyad. feelings inevitably arise throughout the network and take time to be sorted out
poly is cool if you're the right mix of "low neuroticism/jealousy/etc" + "enjoys spending extra time on relationships"
but it's not, like, the cool thing everyone should do (if only they were cool enough)
Ryan Singer retweeted
p(China) is what we should be talking about, not p(doom)
What is the probability that China - with its lead in robotics, manufacturing, construction capability, and second place on AI, GPUs, innovation - will become the primary beneficiary of the technological revolution the world is experiencing, over the next decades?
If your p(China) is high, what are you doing - and what should we be doing - to advance US capabilities in the coming decades so that we can lead, not follow?
IMHO p(doom) is the sideshow
Ryan Singer retweeted
Guys, I'm just trying to store some files... wtf is this.
KYC bs has gone completely insane.
It makes *zero* sense to require name, address, ID verification, SSN (!), face verification, etc. for online purchases of <$1,000 of digital goods *with a credit card*. Specially fuel for developer tools. Where the payment processor *already* has credit card and bank information.
Meanwhile, KYC databases leak and result in robberies, assaults, and kidnappings. 🤡🤡🤡 KYC mAkEs eVeRyOnE sAfEr 🤡🤡🤡
Horrible overreach from a horrible anti-crypto era.
This must end.
@privy_io and @link were the *least* egregious i tried.
@Filecoin @BlockchainAssn @coincenter @standwithcrypto @GBBC_io
Ryan Singer retweeted
It's always fascinating to see folks who thought Bitcoin would replace the foundation of money for the planet without rich people, corporations, or governments noticing, acquiring it, or getting involved. It's just so cartoonish and implausible.
Ryan Singer retweeted
Abundance usually gets explained as a list of problems: zoning, permits, licensing, slow approvals.
Here’s what we'd actually get if we fixed them:
Lunch costs $4, like it does in Japan and Singapore. Most US cities require three or four separate sinks, which makes a kitchen under 200 square feet nearly impossible.
Anyone can open an owl cafe or a vegan lesbian bookstore. Japan is full of tiny, oddly specific businesses run by one or two people. They survive because small spaces are cheap and enough people live close enough to walk in.
A room in a big city for $400 a month. These buildings housed millions of low-income and older Americans until cities banned most of them by the 1980s.
A three-bedroom apartment you can stay in after you have a kid. US codes require two staircases in buildings over three stories, so family-sized units only fit on the corners. Most of the world allows one staircase.
A new electric car for about $10,000. China sells these globally. Americans can't buy it.
A government so dependable it's boring. When a loved one dies, you report it once instead of to every agency.
We can decide to make it happen here.
The full list has 16 things, from taco trucks on every corner to no more pandemics. I wrote this to also announce that today is DC Abundance's official launch!
If you’re in DC, come celebrate and see the G.O.A.T. Derek Thompson speak!
Ryan Singer retweeted
Silvergate is gone. Signature was shut on a Sunday.
Bank of America willfully broke the BSA for 7 years and paid a fraction of one quarter's profit.
Some institutions live above the law.
tftc.io/occ-debanking-report…
Ryan Singer retweeted
Software developers (who write code) are punished 100x more severely than banking executives (who enable money laundering at 1000x the rate).
Messed up.
Dear Secretary Bessent @SecScottBessent,
My name is Everett Stern. In 2010 I was a compliance officer at @HSBC. From a back office in New Castle, Delaware, I watched billions of dollars move to drug cartels, sanctioned regimes, and terrorist organizations. The enemies of the United States. I documented it, I escalated it, and when the bank would not act, I took it to the @FBI, the @CIA, and eventually the @SECGov.
The result was a $1.92 billion settlement. At the time, it was one of the largest in American history. It was also about five weeks of the bank’s profit. Not one banker was charged. Not one went to prison.
I paid a different price. I lost my career, my savings, and my place in the industry I had trained for. I was blacklisted. Every door in American finance closed at once. I slept on a camping cot in a 300 square foot apartment because I could not afford a bed, and I waited tables at @PFChangs to eat. I tell you this not for sympathy, but so you understand that I know exactly what it costs to do the right thing in American finance, and exactly how little the system does in return.
I made that sacrifice because I believed it would change something.
Yesterday, your department fined @BankofAmerica $1.2 billion for failing to report more than $5 billion in suspicious transactions, some of it tied by your own findings to Chinese laundering networks, narcotics, and the southwest border, alongside 475 apparent sanctions violations touching Russia, Iran, and global terrorism. The bank admitted it willfully violated the Bank Secrecy Act.
Fourteen years after HSBC. A bank with “America” in its name. And once again, not one individual charged.
Secretary Bessent, I want to say plainly what I believe you already know. The fines are not working.
A fine is paid by shareholders, absorbed by the balance sheet, and forgotten by the next earnings call. Bank of America reported earnings this morning. Nobody who set the alert thresholds, nobody who decided the 2024 cease and desist could wait, nobody who chose the backlog over the law will lose a single thing they value. Their lives are untouched. That is the entire reason the behavior repeats.
This is money laundering. This is blood money. Money that reaches a cartel buys fentanyl that kills Americans. Money that reaches a terrorist organization buys the next attack. This country has fought a war on drugs and a war on terror for decades, at enormous cost in lives and treasure, and all the while we have allowed the financing to flow through institutions we charter and regulate. Cut off the money and we win. We have never seriously tried.
There is also a question of equal justice that I cannot let go.
Before I walked into the FBI building to report HSBC, I stopped in front of the Great Seal on the wall and read the words engraved beneath it: “Justice is the defense of our liberty.” I believed that. I still want to. But every day in this country, people go to prison for crimes that are nothing next to moving money for the people who want Americans dead. A suit, a title, and a corporate badge should not be a shield from the consequences that apply to everyone else. If a street dealer goes to prison for what he sells, the banker who moved the cartel’s money should be standing next to him.
I also want to raise something that is rarely said in these conversations. Why has no one inside Bank of America come forward the way I did? The answer is that everyone in American banking knows what happened to me, and to the whistleblowers who came after. The last person who spoke up is the only policy anyone believes. That is a culture problem, and it starts with leadership, in the banks and in the agencies that regulate them.
This is not a political issue. It has spanned administrations of both parties. It is a national security issue, and I am asking you to treat it as one.
Three things would change the math overnight.
Refer individuals for criminal prosecution. Not the analyst in the queue. The executives who set the thresholds and chose the risk. One banker in handcuffs would do more than every fine in Treasury’s history combined.
End “too big to jail.” An institution cannot be too big to fail and too big to jail at the same time. If it is the first, it must be held to a higher standard, not a lower one.
And if Bank of America will not act as America’s bank, review its charter. A national charter is a privilege granted on behalf of the American people. It should be conditioned on not moving money for the people trying to kill them.
Secretary Bessent, you said yesterday that these actions send a clear message that even the biggest institutions are not above the law. With respect, the institution was never the problem. The people inside it are above the law, and they know it. Until that changes, I will keep writing letters like this one, and the next bank will keep paying the next fine.
I gave up everything I had to stop this. I am asking you to use the power you have to finish it.
Respectfully,
Everett A. Stern
HSBC Whistleblower
Founder and Intelligence Director, Tactical Rabbit
Maybe we should start a competitor to Amazon 🤔
amazon is blocking grok @bots from ordering, and elon's answer is just have your bot buy it somewhere else.
one of my grok bots only handles my amazon returns, so i'm watching this one closely.
would you switch stores for your bot? 🛒
Elon, i think its time for an X Shop? 👀
Ryan Singer retweeted
Not only did we not get a great stagnation. We got the fifth great American religious revival!
Chilling!
An Anthropic researcher privately tells friends that we have 6 MONTHS LEFT until AI takes over.
What's even more alarming is that reportedly this view is widespread among Anthropic employees.
@Shaughnessy119 explains in his conversation with @arrington what an engineer from Anthropic told him over dinner:
Tommy: "He's like, 'Yeah, I’m just enjoying my last six months.'"
Arrington: “He was joking I hope, right?”
Tommy: “No. No, he wasn’t.”
Arrington: What?
Arrington: “And he legitimately thinks that we have six months of life?”
Tommy: “Not just him. Legitimately most people at Anthropic think that.”
Later, the conversation turns to Sam Altman: Arrington: “I’ve known Sam a long time... He has exceptional charisma."
Tommy: “Do you think he’s evil?”
Arrington: “He’s evil. I believe he’s a psychopath.”
Ryan Singer retweeted
We had a lot of people asking us to put this up.
@valkenburgh delivered a heartfelt talk about the failure of CLARITY and our continuing fight to guarantee legal protections for developers of open software that endure from one administration to the next.
Ryan Singer retweeted
"The problem I have with new rules is that there can always be newer rules.
Listen to what we’re saying when we tell a worried developer: “Don’t worry. We have a pretty good relationship with the Administration.”
That’s not fucking good enough. They should be able to ask what the law is and get a straight answer they can rely on for years." - @valkenburgh
Ryan Singer retweeted
"Coin Center wasn’t founded to collect favorable exercises of government discretion. We’re here to establish legal limits that survive the officials who happen to agree with us. Our mission was never simply to get the government to say yes to crypto.
Washington increasingly knows how to say yes to crypto when it can find an issuer, a compliance department, a transparent ledger, and a freeze function."
We have stablecoin legislation. Great. Stablecoins are useful products issued by financial institutions. But we still need to protect the right to build things that don’t require financial institutions.
Will the law tolerate software nobody controls, communications nobody intermediates, computer programs you run yourself, and transactions nobody has unilateral authority to reverse? Those are the harder questions."
Ryan Singer retweeted
So it wasn't all just in our heads.
bombshell report from the OCC out today confirming what we all suspected:
between 2020 and 2025, based on a review of 100,000 complaints, America’s largest banks systematically denied banking to lawful businesses based on political and reputational considerations rather than objective financial risk, effectively appointing themselves arbiters of which industries deserved access to the financial system. digital assets was specifically named as one of the six most affected industries.
TLDR: we weren't imagining it. OCP2.0 was real.





























