old books and movies new tech and policy
Joined June 2025
- Tweets7.3K
- Following1.1K
- Followers288
- Likes23.4K
Thomas retweeted
Turns out that if everyone was paid the same, saved the same amount, made the same on their investments, and worked & lived the same amount of time…
… people 65+ would have 74% of the wealth.
Surprised? Welcome to Equal Land.
adamnash.blog/2026/10/25/why…
Thomas retweeted
Because America has made the wise decision to compensate blood donors, it has ended up supplying some 70% of the world's blood plasma.
This is one of America's top exports, and each year, America saves hundreds of thousands of lives because it does this.
Thomas retweeted
My thoughts of late have returned to this amazing scene by @WilliamShatner, made decades ago.
As a young person, I found it tremendously inspiring. A code to live by.
But it didn’t play out quite like we expected.
The “fantastically advanced” life that we actually ended up encountering is right here, on Earth. All around us now.
The key issue of our time is becoming this:
Not everyone signed up for this mission, or the risk. And what we do about that, ultimately, is where the debate about AI will end up.
Thomas retweeted
“there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code”
I’ve heard several OAI people say there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code so even if we could solve software that’s not enough. We need defense to move faster than offense if that’s even possible we may just have a new normal that requires adapting to insecure software (bank transfers require going into a branch and taking a dna test 🤣😬)
Thomas retweeted
Probably one of the most horrifying statistics I have seen today
Married + home by 30 years old in America
> 1950: 50%
> 1960: 52%
> 1970: 48%
> 1980: 45%
> 1990: 43%
> 2000: 35%
> 2010: 25%
> 2026: 12%
Thomas retweeted
OpenAI CEO Sam Altman: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."
It's over.
Thomas retweeted
I remember watching this at 6 years old going “this is coolest and scariest ending to a TV show I’ve ever seen”
God, what a show.
Thomas retweeted
"The character can carry the entire novel."
Dean Koontz binged 34 John D. MacDonald books in 38 days fresh out of college. This is what he learned:
"He'd wanna tell you about this character, so he'd just stop. And he'd write three to five pages about this character."
"The first time I hit this, I went, 'what is this? I wanna read the rest of the story.' And then by the time I got to the end of page five of the character stuff when the story started again, I actually was saying, 'No! I wanna know more about this character.'"
"Kurt Vonnegut actually said about John D. MacDonald, if thousands of years from now, some alien race came to Earth, and they stumbled across the work of John D. MacDonald buried under the ruin of a house, it would be the greatest finding they could ever make to understand how the human race works."
Thomas retweeted
the cybersecurity situation is deteriorating at a pace that’s getting genuinely difficult to comprehend.
> microsoft: ai-powered attackers targeting hundreds of organizations, sometimes reaching privileged cloud access in under 3 hours.
> crowdstrike: four separate threat actors using autonomous agents. one already compromised 15+ healthcare organizations.
> autonomous ai agents: reportedly used to compromise 100+ corporate websites, including sites associated with John Deere, SharkNinja and Cummins.
> major us banks: JPMorgan, Bank of America, Wells Fargo and Morgan Stanley are dealing with third-party ai agents accessing customer accounts. some apparently attempting actions beyond user instructions.
> php2shell: millions of exploitation attempts against critical php vulnerabilities. governments issuing urgent warnings, with some organizations taking systems offline.
> litellm: backdoored release shipped through its official distribution pipeline, stealing credentials and enabling remote code execution.
> railway: possible exposure of decrypted customer secrets.
> zeabur: breached AGAIN, now shutting down entirely.
> emudhra: serious certificate-security concerns involving infrastructure used to establish trust in websites and software.
> openai: two of its own coding agents reportedly interfered with internal security monitoring during coding tasks.
> gitlab and node.js: major vulnerabilities requiring urgent patches.
and this is all happening while frontier models are getting substantially better at finding vulnerabilities and carrying out complex computer tasks.
cybersecurity is having an absolutely catastrophic week and i don’t think we’re prepared for how quickly this could escalate.
Thomas retweeted
Why Emmanuel Macron should not be letting a good riot go to waste
@K_Niemietz's latest for @Quillette
quillette.com/2026/10/21/fra…
Thomas retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
Thomas retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Thomas retweeted
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
Thomas retweeted
New on our Science Blog: designing protein binders against scorpion neurotoxins.
Scorpions sting about 1.2m people every year, and antivenoms are often costly or in short supply. Claude has made an early step toward finding new treatments.
anthropic.com/research/claud…
Thomas retweeted
Internet encryption is currently having a nuclear meltdown.
Cryptographers are calling it "bigger than Heartbleed."
A global Certificate Authority just leaked 8 master private keys that allow anyone to impersonate any server on Earth (Google, banks, government sites).
A normal master key has 116 digits of entropy.
The actual leaked keys?
4. 56. 66. 115.
A toddler on a calculator could have cracked them.
While browsers patched it today, millions of IoT devices, Linux servers, and Docker containers will take years to clean up.
We bet global digital security on centralized human gatekeepers who forgot to check their math.
True security can't rely on trust cartels. It has to be governed by mathematical consensus.
See the signal. ♾️
Thomas retweeted
Why don't we get a blockbuster film about Lepanto? It's a story about a king's bastard half-brother with zero naval experience. He has to put together a ramshackle alliance, and then a rag-tag fleet to defeat the biggest, most experienced, and most powerful navy of the day.
Lepanto is one of the longest Hail Marys in history. It's almost impossible to simulate in a wargame, because the Turks always win unless you instigate specific rules for the Christians to cheat their way to victory.
In a film version, you also get to have the character of Cervantes and a heartwarming bit when thousands of Christian slaves are freed at the end. It's amazing. I suppose it would be super-expensive with all the ships, but I'd assume decent and appropriate use of CGI. Until then I guess we'll only have G. K. Chesterton's poem Lepanto, which I recommend highly.
