Sanity
⚠️ A little fact-checking on the alarming preparedness warnings circulating online.
I’m seeing a lot of claims suggesting that governments around the world are suddenly telling citizens to prepare for war, blackouts, and major infrastructure collapse.
Having been deeply involved with Team Reality during COVID, I understand why these reports are unsettling.
People remember what it felt like when governments began announcing emergency measures, seemingly in unison. They remember wondering what officials knew, what they weren’t telling us, and what they themselves should be doing.
Frankly, it was traumatizing for almost all of us. The aftermath still feels like time shifted and we all lost…something.
But we need to be careful not to let those memories substitute for facts. We need to not let panic porn take over the narrative.
So I checked the dates.
🇸🇪 Sweden: Distributed its updated In Case of Crisis or War brochure in November 2024.
🇳🇴 Norway: Published its national preparedness white paper in January 2025.
🇪🇺 European Union: Announced its 72-hour civilian preparedness strategy in March 2025.
🇫🇷 France: Published its Tous responsables emergency guide in November 2025. Despite claims suggesting France is suddenly sending emergency instructions to all its citizens, the guide was published last year. Plans for mass postal distribution were reportedly abandoned.
🇯🇵 Japan: Has maintained disaster-preparedness guidance for years, including recommendations for several days to a week’s worth of supplies. This is not a newly announced emergency mobilization related to Iran.
🇬🇧 United Kingdom: Launched its Be Ready campaign on October 22, 2026. This is genuinely recent. It recommends three days of basic supplies for disruptions involving weather, electricity, water, communications, and other emergencies.
🇺🇸 United States: The Pentagon’s recent planning to make military installations more resilient is also real.
But here’s an important distinction:
The military preparing for a contingency does not mean civilians have been instructed to prepare for that contingency.
A military base preparing to function independently for an extended period is not a warning that American households should expect a 90-day blackout or rush to imitate military preparations.
Plainly put - this wasn’t a recent synchronized global action. Far from it. Yes there are geographically specific risks - and that’s always been true. Political risks varying have also varied and always been true.
What the facts do not establish is a sudden, synchronized global emergency warning ahead of the November 3 U.S. midterms.
Things are not all “pointing in one direction.”
So we should be especially cautious about how these stories are packaged.
Panic porn sells.
Fear generates clicks, advertising revenue, and an entire market for people selling certainty about an uncertain future.
That doesn’t mean every warning is dishonest or every preparedness product is unnecessary. But it does mean we should examine sensational claims before accepting the narrative they’re selling.
When years-old announcements are assembled into an apparently urgent global warning, people naturally begin wondering what they’re missing.
What do governments know? What should I be buying? Why am I not doing more?
And there’s something particularly troubling about this.
Fear can make people stop trusting their own judgment.
Instead of observing what’s actually happening, they begin looking to the next frightening headline for instructions.
As Frank Herbert wrote in Dune, “Fear is the mind-killer.”
And fear can become a habit.
We learned during COVID how quickly an atmosphere of emergency can transform everyday life. That experience should make us more attentive to facts, not more susceptible to another frightening narrative.
There is no way to prepare for every conceivable catastrophe. Nor should we spend our lives trying…
Mark Spencer retweeted
A classic chart to counter the wisdom of crowds idea. US Americans are absolutely clueless about how common things are. They think over a quarter of Americans are Native Americans, one in five Americans is transgender, over a quarter of the population are Muslim, one in five households earn over half a million dollars. The right answer to all of these questions is 1%. They build their worldview on totally incorrect assumptions towards reality. Data literacy matters.
Mark Spencer retweeted
This is without a doubt the best political “ad” I have ever seen. Using Waffle House to get you to vote Democrat is brilliant. Someone on Mayor Pete’s team knows what they’re doing
Mark Spencer retweeted
Five seasons released yearly without proper marketing made possible purely by love and dedication for the queen
Use your Claude or ChatGPT subscription to help you locate and add b-roll to your Final Cut Pro projects. Link in comments.
Add b-roll to your FCP project with Claude or ChatGPT youtube.com/watch?v=wjKUX8bI…
Mark Spencer retweeted
Apple has some huge updates to Creator Studio, most exciting for me is Motion VFX (thousands of dollars worth of plugins) is now included in Final Cut Pro apple.com/newsroom/2026/10/a…
Mark Spencer retweeted
Tailscale replied on Reddit:
Hi folks, Mike Shaver here, VP of Engineering at Tailscale.
We've seen the concerns about Tailscale SSH and wanted to share what we know so far.
If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.
We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected.
A bit of technical context:
Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do.
While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not.
Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.
In the meantime, there are a few precautions you can take:
•Review your SSH access policies. Make sure only the people and devices that need access have it.
•Review SSH forwarding permissions and remove access you don't need.
•Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access.
•Enable automatic updates where supported so you can pick up fixes when they're released.
For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.
We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up.
If we find anything that changes our assessment or requires immediate customer action, we'll communicate that.
We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet.
We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team tailscale.com/contact/suppor…
Mark Spencer retweeted
Looks like Apple did release a support document about compromised eMudhra certificates as well
About the compromised eMudhra intermediate CAs - Apple Support support.apple.com/en-us/1495…
Mark Spencer retweeted
PSA for macOS users:
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
Mark Spencer retweeted
Amy Acton was raped by her stepfather when she was 12 years old.
Vivek Ramaswamy, Donald Trump, and J.D. Vance support her rapist.
Mark Spencer retweeted
This is Monica Alba. The reporter from NBC on whom DT lashed out today when she questioned him about defending Vivek Ramaswamy’s ad.
Thank you for not backing down and relentlessly confronting him about this. This is exactly how the media should continue to push him. Thank you for your incredible work.
Mark Spencer retweeted
PSA: This week was kind of a turning point for AI and cybersecurity. Please take this weekend to do some simple cleanup for your family. Some suggestions:
- Set up a password manager like 1Password and give your spouse or partner access to a shared vault. Teach them how to use it.
- Update your passwords for critical stuff - your email account, your bank or financial stuff, etc. Store in your password manager and use the strongest password you can.
- Use two factor auth for everything you can. SMS is not ideal although better than nothing. Google Authenticator or a passkey is better. Hardware key is safest.)
- Add a sim pin to your phone. Makes it harder to sim jack.
- Update your phone and your computer to the newest releases. Turn auto-updates on.
- Freeze your credit - takes 5 minutes.
- Get an IRS Identity Protection PIN.
- If you’re using claude code or have AI agents that browse the web, they’re probably using Node.js. It’s also vulnerable. Update claude code, update node on your machine.
- If you’re building stuff on your computer, ask claude or grokbot (which is connected to twitter and likely has the most current info) to audit any of your repos for vulnerabilities. Ask grok to make it a scheduled task so it can do this daily - things are moving very quickly in the space right now.
- Consider some light resiliency stuff. This probably sounds silly, but it sounded silly at the beginning of covid too. Having printed out copies of important stuff - especially financial accounts. Having some cash on hand. Having some shelf-stable food and clean water or a water filter. Having a map. Having a generator that can at least power your fridge or some devices. Cheap insurance.
Again, I don’t want to alarm people, but I was taught that you should have a Secure plan, a Comfortable plan, and a Wealthy plan. And it seems pretty clear the secure plan needs to now factor cybersecurity risk as a legit threat. Take a weekend and shore yourself up.




























