With #localfirst apps and SPAs, DNS hijacks are fatal. All end-user data, even encrypted, is revealed. Anyone else considered this? I'm doing some research, and designing some prototypes.
voboda
@voboda.com
I learn about all kinds of cryptography, and try to use it to make the world a little better. You can see a few explorations at voboda.com
"[Palantir workers] joined a company that promised to stop abuses of power, and they are watching it build the tools that make those abuses faster, wider, and harder to undo. The question they are left with is ... at what point does building the machine make you responsible for what it does?"
Even Palantir Employees Question If They’ve Become the Villains: “We Were Supposed to Stop These Abuses” – Blusher
blusherme.com
Had quite a few "oh shit" moments reading this. And it's mostly stuff I thought I knew. sockpuppet.org/blog/2026/03...
Vulnerability Research Is Cooked
sockpuppet.org
jbp.io/2025/05/02/g... "I view GHA runners as public, unsecured shell boxes that I can run scripts on. They can check out and build public code, but at no point should they be given any kind of privileges or secrets."
jbp.io :: GitHub Actions is Someone Else's Computer
jbp.io
Dependency inversion, but in space ochagavia.nl/blog/towards...
Towards interplanetary QUIC traffic
Have you ever asked yourself which protocols get used when downloading pictures from the Perseverance Mars rover to Earth? I hadn’t thought about that either, until I came across an intriguing message...
ochagavia.nl
You use a bare Git repo with a `post-receive` shell script hook. I use GitHub Actions: remote YAML, swiss-cheese key management, OIDC trust glue, job orchestration, delimiter-delimited metadata, opaque internal headers, microservice spaghetti, bug bounties, and CVEs to match. We are not the same.
Filippo Valsorda@filippo.abyssdomain.expert · 3mo ago… are fucking kidding me. A github.com cross-account RCE due to the most pedestrian of injection attacks along the obvious exposed surface… and they actually have a globally shared “git” UNIX user!! This is not what taking the role of supply chain stewards seriously looks like.
It struck me that pet names could actually work with the Reticulum network stack more than with IP, because you actually take your Reticulum address with you when you move in the network. You can't do that with IP addresses, hence the need for DNS.
If I had to identify a list of skills in high impact engineers, it would include: - ecological awe - intellectual humility - respect for the complexity of unfamiliar problems - cross functional communication - resilience engineering - marketing and sales (“Technical skills” aren’t in my top ten)
One European here, saying thanks to the Hungarians who have been standing up for their values. Hope is alive.
Pasquinel@pasquinel.bsky.social · 4mo agoHungarians celebrated the landslide defeat of Orban by singing "We Are the Champions" out in the streets
It's pencils down at the hackathon. I put 236 years of US copyright law into a git repository. Every Act of Congress from 1790 to today is a commit. Still some work to be done, and things got frantic at the end, but I'm proud of this! github.com/katelynsills...
GitHub - katelynsills/copyright-history: Every amendment to US copyright law (1790-present) as a git commit. Browse 236 years of legislation with git log, git diff, and git checkout.
Every amendment to US copyright law (1790-present) as a git commit. Browse 236 years of legislation with git log, git diff, and git checkout. - katelynsills/copyright-history
github.com
it's pretty fun that the founder of temporal logic was called Arthur Prior
"Crypto was a community that had been building for almost a decade. Economic design was what they did. And nobody had addressed the economic design problem that made their conference weeks full of over-hyped but mostly empty events?" Here is my attempt. blog.voboda.com/density-index/
The Density Index
My first Ethereum conference was 20,000 people. The Amsterdam tourist district was a drunken, crypto merch explosion. I wondered how many were setting themse...
blog.voboda.com
Working on zkal, I realised I was tackling a general problem: returning to the benefits of open data for communities, but with modern privacy protection for the individual. Came up with a pattern that might be useful (or flawed!) blog.voboda.com/proof-projec...
Proof Projectors
Everyone's focused on what ZK proofs hide. We're missing what they can usefully reveal. Reputation, attendance, commitment, these used to require surveill...
blog.voboda.com
"using network architecture to solve issues of power distribution simply shifts bottlenecks rather than eliminating them. A decentralised protocol does not automatically produce decentralised governance, it also moves power to different, less visible places." connectedplaces.online/reports/fedi...
Fediverse Report – #149 – On Protocol Governance
On the complexities of protocol governance.
connectedplaces.online
This is the privacy policy I always wanted to write. onelineforyourmind.com/privacy/
One Line For Your Mind
onelineforyourmind.com
Given today's LiteLLM supply chain attack, what are people's preferred development environment sandboxes on MacOS these days? I think it's time I started running my development environments somewhere where rogue code can't steal all my ~/... credential files
The Moltbot rename and supply-chain attacks that followed: www.malwarebytes.com/blog/threat-... I run all my dev in a hardened container, but this type of attack grabs API keys silently, and uses them to watch communication. Any ideas on mitigation?
Clawdbot’s rename to Moltbot sparks impersonation campaign
This Moltbot impersonation campaign is a case study in supply-chain risk, brand hijacking, and what happens when open source goes viral.
malwarebytes.com
We cannot let them get away with this. And the solution is not to chop of a head of this hydra and call it a day - but to fundamentally change how we do things.
I'm glad this is coming to the forefront. I was deeply inspired by Nikolai Mushgian's attitude to this ( see nikolai.fyi and look at dmap, dpack and minicash's doc ) I even made a little game about this philosophy for Devcon SEA: immutalists.infinite.build
github.com
ligi@ligi.de · 8mo agoJust called pledge on trustlessness.eth.limo A bit late as it came out in a very busy time of my life due to @devcon.org - but now finally found some time finally process the manifesto and sign. Signed it as ligi.ethereum.eth Thanks to Marissa Posner, Yoav Weiss, @vitalik.ca for the initiative!
