making @unchained_game (now on Abstract Portal). burner, love dogs & coffee. before: @gankstars, @intel
US / SEA
Joined April 2010
- Tweets72.2K
- Following4.7K
- Followers10.4K
- Likes108K
nftsasha retweeted
What do you say to your family when you don’t know if you’ll ever see them again?
In February 2022, he told his wife and children the war had begun. Then he left as Russian forces advanced towards Kyiv, unsure what the coming hours would bring.
This is President Volodymyr Zelenskyy.
Before politics, he built a successful career in Ukrainian television as a writer, producer and performer, even portraying a president on screen. In 2019, he was elected President of Ukraine. Three years later, Russia launched its full-scale invasion.
Sitting down with him was surreal and an enormous responsibility. It was a rare chance to hear his account of the first hours of the war and the decisions that followed.
We discussed things like:
How he found out Russia had invaded.
Why he refused an offer to evacuate Kyiv.
The 64km Russian military convoy advancing towards the capital.
How Russian forces tried to capture a key airport.
His account of discovering hundreds of bodies after Russian occupation.
What he believes it will take to end the war.
But I also wanted to understand how he’d been coping.
One of my first questions was simply, “How are you doing?” His answer was: “It’s hard.”
He spoke about meeting parents whose children had been killed. Some, he explained, simply ask him for a hug.
And as he spoke, there were tears in his eyes.
Whatever your views on the war or the decisions made by those involved, this is a rare opportunity to hear his account of events that have changed millions of lives.
Because behind every map, every headline and every political decision, there are real people.
Out now on all platforms ❤️👊🏾
(President Zelenskyy was recorded in Ukrainian and dubbed in English.)
see step 5
PSA for macOS users:
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
nftsasha retweeted
I wrote a quick new post on "Digital Hygiene".
Basically there are some no-brainer decisions you can make in your life to dramatically improve the privacy and security of your computing and this post goes over some of them. Blog post link in the reply, but copy pasting below too.
Every now and then I get reminded about the vast fraud apparatus of the internet, re-invigorating my pursuit of basic digital hygiene around privacy/security of day to day computing. The sketchiness starts with major tech companies who are incentivized to build comprehensive profiles of you, to monetize it directly for advertising, or sell it off to professional data broker companies who further enrich, de-anonymize, cross-reference and resell it further. Inevitable and regular data breaches eventually runoff and collect your information into dark web archives, feeding into a whole underground spammer / scammer industry of hacks, phishing, ransomware, credit card fraud, identity theft, etc. This guide is a collection of the most basic digital hygiene tips, starting with the most basic to a bit more niche.
Password manager. Your passwords are your "first factor", i.e. "something you know". Do not be a noob and mint new, unique, hard passwords for every website or service that you sign up with. Combine this with a browser extension to create and Autofill them super fast. For example, I use and like 1Password. This prevents your passwords from 1) being easy to guess or crack, and 2) leaking one single time, and opening doors to many other services. In return, we now have a central location for all your 1st factors (passwords), so we must make sure to secure it thoroughly, which brings us to...
Hardware security key. The most critical services in your life (e.g. Google, or 1Password) must be additionally secured with a "2nd factor", i.e. "something you have". An attacker would have to be in possession of both factors to gain access to these services. The most common 2nd factor implemented by many services is a phone number, the idea being that you get a text message with a pin code to enter in addition to your password. Clearly, this is much better than having no 2nd factor at all, but the use of a phone number is known to be extremely insecure due to the SIM swap attack. Basically, it turns out to be surprisingly easy for an attacker to call your phone company, pretend they are you, and get them to switch your phone number over to a new phone that they control. I know this sounds totally crazy but it is true, and I have many friends who are victims of this attack. Therefore, purchase and set up hardware security keys - the industrial strength protection standard. In particular, I like and use YubiKey. These devices generate and store a private key on the device secure element itself, so the private key is never materialized on a suspiciously general purpose computing device like your laptop. Once you set these up, an attacker will not only need to know your password, but have physical possession of your security key to log in to a service. Your risk of getting pwned has just decreased by about 1000X. Purchase and set up 2-3 keys and store them in different physical locations to prevent lockout should you physically lose one of the keys. The security keys support a few authentication methods. Look for "U2F" in the 2nd factor settings of your service as the strongest protection. E.g. Google and 1Password support it. Fallback on "TOTP" if you have to, and note that your YubiKeys can store TOTP private keys, so you can use the YubiKey Authenticator app to access them easily through NFC by touching your key to the phone to get your pin when logging in. This is significantly better than storing TOTP private keys on other (software) authenticator apps, because again you should not trust general purpose computing devices. It is beyond the scope of this post to go into full detail, but basically I strongly recommend the use of 2-3 YubiKeys to dramatically strengthen your digital security.
Biometrics. Biometrics are the third common authentication factor ("something you are"). E.g. if you're on iOS I recommend setting up FaceID basically everywhere, e.g. to access the 1Password app and such.
Security questions. Dinosaur businesses are obsessed with the idea of security questions like "what is your mother's maidan name?", and force you to set them up from time to time. Clearly, these are in the category of "something you know" so they are basically passwords, but conveniently for scammers, they are easy to research out on the open internet and you should refuse any prompts to participate in this ridiculous "security" exercise. Instead, treat security questions like passwords, generate random answers to random questions, and store them in your 1Password along with your passwords.
Disk encryption. Always ensure that your computers use disk encryption. For example, on Macs this total no-brainer feature is called "File Vault". This feature ensures that if your computer gets stolen, an attacker won't be able to get the hard disk and go to town on all your data.
Internet of Things. More like @internetofshit. Whenever possible, avoid "smart" devices, which are essentially incredibly insecure, internet-connected computers that gather tons of data, get hacked all the time, and that people willingly place into their homes. These things have microphones, and they routinely send data back to the mothership for analytics and to "improve customer experience" lol ok. As an example, in my younger and naive years I once purchased a CO2 monitor from China that demanded to know everything about me and my precise physical location before it would tell me the amount of CO2 in my room. These devices are a huge and very common attack surface on your privacy and security and should be avoided.
Messaging. I recommend Signal instead of text messages because it end-to-end encrypts all your communications. In addition, it does not store metadata like many other apps do (e.g. iMessage, WhatsApp). Turn on disappearing messages (e.g. 90 days default is good). In my experience they are an information vulnerability with no significant upside.
Browser. I recommend Brave browser, which is a privacy-first browser based on Chromium. That means that basically all Chrome extensions work out of the box and the browser feels like Chrome, but without Google having front row seats to your entire digital life.
Search engine. I recommend Brave search, which you can set up as your default in the browser settings. Brave Search is a privacy-first search engine with its own index, unlike e.g. Duck Duck Go which basically a nice skin for Bing, and is forced into weird partnerships with Microsoft that compromise user privacy. As with all services on this list, I pay $3/mo for Brave Premium because I prefer to be the customer, not the product in my digital life. I find that empirically, about 95% of my search engine queries are super simple website lookups, with the search engine basically acting as a tiny DNS. And if you're not finding what you're looking for, fallback to Google by just prepending "!g" to your search query, which will redirect it to Google.
Credit cards. Mint new, unique credit cards per merchant. There is no need to use one credit card on many services. This allows them to "link up" your purchasing across different services, and additionally it opens you up to credit card fraud because the services might leak your credit card number. I like and use privacy dot com to mint new credit cards for every single transaction or merchant. You get a nice interface for all your spending and notifications for each swipe. You can also set limits on each credit card (e.g. $50/month etc.), which dramatically decreases the risk of being charged more than you expect. Additionally, with a privacy dot com card you get to enter totally random information for your name and address when filling out billing information. This is huge, because there is simply no need and totally crazy that random internet merchants should be given your physical address. Which brings me to...
Address. There is no need to give out your physical address to the majority of random services and merchants on the internet. Use a virtual mail service. I currently use Earth Class Mail but tbh I'm a bit embarrassed by that and I'm looking to switch to Virtual Post Mail due to its much strong commitments to privacy, security, and its ownership structure and reputation. In any case, you get an address you can give out, they receive your mail, they scan it and digitize it, they have an app for you to quickly see it, and you can decide what to do with it (e.g. shred, forward, etc.). Not only do you gain security and privacy but also quite a bit of convenience.
Email. I still use gmail just due to sheer convenience, but I've started to partially use Proton Mail as well. And while we're on email, a few more thoughts. Never click on any link inside any email you receive. Email addresses are extremely easy to spoof and you can never be guaranteed that the email you got is a phishing email from a scammer. Instead, I manually navigate to any service of interest and log in from there. In addition, disable image loading by default in your email's settings. If you get an email that requires you to see images, you can click on "show images" to see them and it's not a big deal at all. This is important because many services use embedded images to track you - they hide information inside the image URL you get, so when your email client loads the image, they can see that you opened the email. There's just no need for that. Additionally, confusing images are one way scammers hide information to avoid being filtered by email servers as scam / spam.
VPN. If you wish to hide your IP/location to services, you can do so via VPN indirection. I recommend Mullvad VPN. I keep VPN off by default, but enable it selectively when I'm dealing with services I trust less and want more protection from.
DNS-based blocker. You can block ads by blocking entire domains at the DNS level. I like and use NextDNS, which blocks all kinds of ads and trackers. For more advanced users who like to tinker, pi-hole is the physical alternative.
Network monitor. I like and use The Little Snitch, which I have installed and running on my MacBook. This lets you see which apps are communicating, how much data and when, so you can keep track of what apps on your computer "call home" and how often. Any app that communicates too much is sus, and should potentially be uninstalled if you don't expect the traffic.
I just want to live a secure digital life and establish harmonious relationships with products and services that leak only the necessary information. And I wish to pay for the software I use so that incentives are aligned and so that I am the customer. This is not trivial, but it is possible to approach with some determination and discipline.
Finally, what's not on the list. I mostly still use Gmail + Gsuite because it's just too convenient and pervasive. I also use 𝕏 instead of something exotic (e.g. Mastodon), trading off sovereignty for convenience. I don't use a VoIP burner phone service (e.g. MySudo) but I am interested in it. I don't really mint new/unique email addresses but I want to. The journey continues. Let me know if there are other digital hygiene tips and tricks that should be on this list.
Link to blog post version in the reply, on my brand new Bear ʕ•ᴥ•ʔ blog cute 👇
top hackers
top warriors
top scientists
we're half-viking, half-european
100% grit
and we never, ever give up
Zelensky:
They called Ukraine the Soviet Union's forge of talent.
There were so many scientists, engineers, universities, a huge intelligentsia.
Many people who came from Ukraine went on to run various institutions and ministries in the Soviet Union.
Ukraine was the intellectual part of the Soviet Union.
Ukraine was always involved in rocket manufacturing. The biggest rocket manufacturing was here, nuclear weapons, which Ukraine handed over. A lot of things were made in Ukraine.
ugh no thanks? i like to live, not survive
omgggg yessss nerd boner full mast!
It's the final countdown 🎶
We're one step closer to Roman's first images! The observatory is now fully functional and the team is performing their final checks and calibrations before starting science observations.
go.nasa.gov/4A9menV
last Dragon Age was almost AI slop combined with extreme leftist writing, so no surprise here
as a liberal, it's wild to me these big studios keep targeting this imaginary "modern audience" w/o depth or nuance or options for the other 95% of audience
BREAKING: Electronic Arts is cutting 400 jobs and shutting down BioWare, the legendary development studio behind Dragon Age and Mass Effect. bloomberg.com/news/articles/…
nftsasha retweeted
Just start putting this guy’s tweets on the back of food labels.
Most decaf coffee is made with methylene chloride. It's the solvent that used to be in paint stripper.
The green beans are steamed, then washed in methylene chloride, which pulls out the caffeine and not much else. The beans are steamed again to drive off the solvent and then roasted at over 400F. FDA allows up to 10 parts per million. When a lab tested 24 decaf brands in 2020 it found the solvent in 10 of them at about 0.05 to 0.1 ppm, around 100 times below the limit. The industry calls this the European method.
There are 3 other ways to do it. Ethyl acetate, a solvent that can be made from sugarcane, which the trade calls the natural method. Carbon dioxide under pressure. And the Swiss Water process, which uses hot water and carbon filters and no solvent at all. Peet's says all of its decaf is water process. Starbucks has told reporters most of its decaf is the direct contact method, meaning solvent.
EPA banned most uses of methylene chloride in 2024, but food is FDA's job, so decaf wasn't part of it. A petition to pull it from food has sat at FDA since December 2023. FDA reopened comments on it in May and hasn't decided. If the bag says Swiss Water or water process, no solvent touched it. If the bag says nothing, you don't know.
marked safe from phpocalypse
my thoughts xitter.cf/nftsasha/status/211252…
This isn't ragebait, clickbait or a joke. I genuinely want to have a meaningful discussion.
Web3 gaming is in a really tough spot right now, and I want to keep believing in it and pushing it forward.
But man, it's been ages since I've made money while actually having fun.
"But what about Cambria Gold Rush?"
I spent 7 days creating content, playing 8 hours a day and genuinely having fun. But I didn't make any money because I didn't reach a specific milestone.
I'm not saying Cambria is bad. It's not.
But it's been a while since a Web3 game has made me genuinely invested in its economy and excited to build alongside its community. Most things I've engaged with have either gone nowhere or ended in disappointment.
A lot of people ask me if I'm going to mint X or invest in Y, and honestly, I don't want to.
Not because they're necessarily bad investments. Some are already established enough that they could still do a solid 2x or 3x.
I just want something new to believe in.
Something I can discover early, get invested in, push alongside the community and watch grow.
I don't want to keep jumping into things that are already at the top. I want to help build something that gets there.
I'll most likely be playing Cambria when it launches. It's still my favorite Web3 game and, quite literally, the most fun I've had playing any Web3 game.
This isn't a criticism of Cambria. I just wanted to share what's been on my mind lately.
I'd genuinely love to hear your thoughts.
Where is Web3 gaming heading? What needs to change? Are there games or ecosystems right now that have given you a reason to believe again?
PS: I don't give a fuck if your entire argument is that "Web3 gaming is dead." Give me reasons. Give me data. Explain what went wrong and why.
I'm looking for actual discussion, not people hating for the sake of hating.
F*ck Russia. F*ck Orange Clown. F*ck anyone who blames Ukraine for the terrorism of an evil, psycopathic dictator.
Ukraine will win, w/ Starlink or not. We Ukrainians never give up, we're impossible to defeat. Just extra children will die needlessly.
A horrific Russian strike in the Kharkiv region. A “shahed” struck people directly – in a park near an ordinary café. Pure atrocity. Six people were killed, including children. A little girl was killed in a stroller – her name was Angelina, she was just over a year old, born in August 2025… Her mother’s name was Inna. She died in the hospital… Another girl who was killed was 11 years old. My condolences to their families and loved ones. Another 14 people were injured, including six more children.
I am grateful to everyone who supports Ukraine under these circumstances and helps us shoot down “shaheds,” shoot down missiles, and stop Russian assaults. These are horrific photos, but behind them are shattered lives and the truth about this war. Lives must be protected. Ukraine needs air defense. You can't think about making money with Russia as long as it continues its asinine war. We ask that sanctions on Russia stay in place as long as the killings continue. We ask America to be strong, and we ask it to apply the Lindsey Graham law. We ask Europe to continue its support. We ask that everything possible be done to bring peace and guarantee security. Ukraine wants peace. It is Russia that has insisted on continuing the killing all this time. The world has enough strength to stop the war. That strength must finally be used – against the murderers.
