Pinned Tweet
'a streak of light that moves at the speed of the Earth's rotation'
“The Speed of the Earth” has returned to Black Rock City. Originally created in 02024, this art piece by Long Now Board members Kevin Kelly and David Rumsey uses a mile-long line of solar-powered LED strobes to create a streak of light that moves at the speed of the Earth's rotation.
More about the installation from @DavidRumseyMaps: davidrumsey.com/blog/2024/10…
More about Burning Man art from Kelly in this 1999 issue of Whole Earth magazine: kk.org/wp-content/uploads/20…
Anthropic users went with their AI agent's opinion 86% of the time, in research where a coin flip had picked that opinion. www-cdn.anthropic.com/519c17…
Ross Hill retweeted
The Cybercab got to Melbourne faster than FSD got to the Australian HW3 cars that already paid for it. Day 1,946 and counting. @TeslaAUNZ @Tesla @elonmusk #FSD
⚡️
Just paid $25 for 400km of range at a Tesla Supercharger.
You’re looking at over $100 in 98 petrol for the same distance in a comparable performance sedan like a BMW M3, at $2.60/L.
At home on an 8c/kWh overnight rate, that would be about $5. EV’s are a game changer and I can’t believe that so many people are still denying this fact.
Bhutan's new mindfulness city is being built with 10,000 bitcoins mined from hydropower from the Himalayas.
Bhutan has announced a landmark Bitcoin Development Pledge, committing up to 10,000 BTC (≈ USD 1B) to support the long-term development of Gelephu Mindfulness City (GMC).
Guided by the vision of His Majesty King Jigme Khesar Namgyel Wangchuck, the pledge reflects a values-led, responsible approach to using digital assets for national resilience, jobs, and youth opportunity.
Read more: gmc.bt/pledge
📺 livestream of Bhutan raising 108 chortens in their new mindfulness city youtube.com/live/gzFGM1R3dDA
His Holiness the Je Khenpo today presided over the Sri-Non ritual at 108 sites along the Mao River in Gelephu, ahead of the raising of 108 Jangchub Chortens on November 1.
Following the three-day Sri Drub at Sarpang Dzong, the rituals aim to subdue negative forces, clear obstacles and invoke blessings for the project.
Their Eminences the Lop Lhengay, Drubpoens and Lam Netens also conducted the rites, completing the spiritual preparations for all 108 sites.
bitcoin.pdf released 18 years ago 🥳
Everyone should read the Bitcoin whitepaper. Once you're deep enough down the rabbit hole you should go read the original email thread in which it was announced. You'll recognize many criticisms that are rehashed to this day.
mail-archive.com/search?l=cr…
Ross Hill retweeted
We finally have an explanation for “Facebook is listening to me through my phone”. They’d never do that (and it’s not really possible).
Turns out literally everyone else was — and then selling that to ad data brokers.
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
Ross Hill retweeted
theres a hidden fully functional ipod as a 404 page on apple music music.apple.com/us/jfdsalkfa…
Ross Hill retweeted
There’s a world of difference between user-authorized agents (Muse, Instinct, Grokbot, etc.) and true unauthorized/rogue agents that could constitute cyberattacks.
Most of the activity described in the Axios story appears to be the former: customers sharing credentials with agents so they can take actions on their behalf. This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks.
The direction banks should go is to support user-directed agents. For example, Amex is an authorized connection in Muse, making it easy for users to grant, limit, and revoke access.
Read-only permission levels are a sensible interim step. Several banks already support or are moving toward them. Full write access (with user credentials) is a different risk category and should be approached carefully.
Frightening the public by blurring the line between user-authorized agentic behavior and cyberattacks is irresponsible.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
The internet is held together with servers everyone is afraid to turn off.
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Ross Hill retweeted
breathing is enough to give you away
each breath slightly changes how Wi-Fi waves reflect off your chest. with the right receiver and processing, those tiny changes can reveal your breathing rhythm
the graphs in this animation use real WiRe-Breath recordings: orange is the rhythm extracted from Wi-Fi, gray is a reference breathing sensor
i broke down how this works, and what else you can pull out of the radio waves around you, in the article below ↓
