sudo rm -rf --no-preserve-root / (pcaversaccio)

idk man, maybe it's just me but most devs/engineers nowadays are simple translators not true understanders. We're drifting away from a first-principles-based world toward prompt-to-slop engineering where the prompter can't even challenge the output lol. This fucking concerns me! Too many don't understand (or already forgot) how computers work. Ask them how program memory looks and you get nothing. They don't even try since they can always LLM it. IMHO true knowledge and _first principles_ build great things, everything else is temporary slop. My contrarian view is that in the age of LLMs you gain a real edge by not going down the slop engineering route.

• 3 replies
• 0 recasts
• 12 reactions

so right now transacting privately (=nobody can link your onchain movements to your identity) on Ethereum requires way too much operational overhead. You need to understand behavioural profiling, manage VPNs (always use kill switches), mix user agents and language settings of your browser (so many services log this), avoid hosted UIs and run apps locally if possible. I mean guys, let's be real, that's not real privacy. Ethereum (including its applications) must let users be _imperfect_, not flawless opsec experts, and still remain private. If avoiding surveillance depends on perfect discipline, the protocol and its applications have fundamentally failed to provide it. We're nowhere near solving this.

• 8 replies
• 2 recasts
• 23 reactions

i genuinely think everyone in this space should immediately switch to using Vim. DPRK started abusing VS Code hooks that run _automatically_ in the background when you open a folder. ZERO fucking user interaction required _after_ trusting the repo (the trusting part is important here). Yes, read it again. ZERO. INTERACTION. REQUIRED. so what happens is the following: they (in the usual case the Contagious Interview group, meaning some fake recruiting guy) share GitHub, Bitbucket, and GitLab repos containing a `.vscode/` subdirectory with malicious hooks. the one example I share here executes a fake font that's actually heavily-obfuscated JS and will absolutely rek you. all your fancy software that feels "convenient" makes tradeoffs. those tradeoffs are now being abused to silently rek your devices. use Vim. and use Qubes. Thx.

• 4 replies
• 9 recasts
• 46 reactions

In light of the recent incident at Radiant and the clear challenges of verifying multisig transactions on a Ledger device, I've built a simple Bash script designed to simplify the process. This script generates the domain, message, and Safe transaction hashes, making it easier to cross-check them with the values displayed on your Ledger hardware wallet. All you need to provide are the network name, multisig address, and transaction nonce. It supports all Safe networks, and I hope it will serve as a useful tool to temporarily ease the burden of blind signing verification for multisig transactions. Eventually, make sure to check out the trust assumptions laid out in the README for this script. https://github.com/pcaversaccio/safe-tx-hashes-util

• 17 replies
• 45 recasts
• 75 reactions

We've fucking lost it. Nobody in their right mind wants over 50 rollups and endless layers that take days to bridge back. What the world wants is one goddamn chain that just works, and that should be Ethereum. No one with a shred of sanity wants to switch networks in M***Mask. No one wants the headache of adding a token manually on another chain because the contract address isn't the same. Bridging is a pain in the ass. What people want is to transact value simply and directly, without all this convoluted bullshit!

• 23 replies
• 18 recasts
• 87 reactions

This morning I've been reviewing our last months' SEAL 911 tickets. Guys, it's clear that soon (probably sooner than you think) a large portion of our ecosystem will be running on compromised devices. I mean, man, infostealers are probably the _biggest_ ecosystem problem right now. However, and that's what I want to address here, is that OS design choices like weak data compartmentalisation & permissive default trust models are the _major enablers_, especially on macOS and Windows. Please remember: these OSes weren't built with the strict sandboxing, strong application isolation, or zero-trust principles needed to defend against these today's threats! I understand that shifting most of the space to something like QubesOS isn't realistic, but we must start prioritising security-first OS choices in our ecosystem, not just UX. Honestly, fancy features won't stop your device from being compromised.

• 3 replies
• 7 recasts
• 64 reactions

Vitalik is back writing Vyper code - what a beautiful day https://github.com/ethereum/research/blob/master/sublinear_staking/code.vy

• 2 replies
• 3 recasts
• 66 reactions