@TimOnPoint

Cold, wet and sandy… as God intended. 🇺🇸 "The map is not the territory." A(n) - Forward Compute

Pennsylvania, USA
Joined January 2017
No, The New Kalashnikov Is Not a Weapon – A rebuttal to Gerald Mako's @smallwars opinion. Cheap commercial drones fitted with readily available guidance software have collapsed the cost of precision strikes. Ukraine has demonstrated the method at scale: mass-produced frames, improvised warheads, and increasingly autonomous terminal guidance have given states and non-state actors capabilities once reserved for conventional military forces. The warfare equation has changed. That much is not disputed. What does not logically follow is the policy package offered to reverse it. Gerald Mako's argument for tighter controls on hardware that enables onboard autonomy, enforceable obligations on manufacturers whose platforms are routinely militarized, and a minilateral coalition of component producers treats the commercial dual-use ecosystem as if it were a controllable arsenal. It absolutely is not. The systems in question began as hobby, racing, photography, and agricultural products and became weapons only after conversion. The proposed remedies – manufacturer due diligence, conversion-resistant firmware, and supply denial of enabling components – do not survive contact with how these systems are actually built and fielded. The AK-47 analogy fails as an analogy. The Kalashnikov was purpose-designed as a military weapon and then deliberately proliferated as a geopolitical instrument: cheap, rugged, and simple to operate by design. Small UAVs and FPV platforms followed the opposite path. They began as commercial products before being adapted, often in small shops and wartime factories, into delivery vehicles. The distinction is acknowledged in passing and then ignored. A weapon that begins as a weapon can be regulated as one. A commercial airframe that becomes a weapon only after a user straps on a warhead or swaps the flight controller presents a fundamentally different regulatory problem. Imposing strict due-diligence duties, secure-boot mandates, and market-access conditions on commercial manufacturers because downstream actors convert their products is the gun-control argument applied to dual-use electronics. A manufacturer cannot reasonably be held responsible for every illicit modification any more than a tire company can be held liable for a drunk-driving manslaughter. The article concedes that no firm can be responsible for every conversion, then recommends treating refusal to adopt “reasonable” anti-militarization features as grounds for exclusion from Western markets. That substitutes upstream obligations for downstream enforcement. Such measures may deter some casual misuse and impose compliance costs. They will not stop a knowledgeable bad guy. The practical failures are straightforward. Software is already open and mirrored. Jailbreaks, forks, and companion computers have been routine in the hobby community for years and are now industrialized. Physical conversion does not require defeating firmware. A warhead and basic fuze can be zip-tied or strapped to a commercial platform. Motors, props, batteries, and boards can be stripped from a “conversion-resistant” airframe and reused on an open stack. Middle markets and gray-market channels for commodity components persist as a structural feature of global trade, not a temporary loophole. These realities make conversion resistance a weak foundation for policy. Local fabrication has already collapsed the premise that the original commercial stack is an indispensable chokepoint. Ukraine’s wartime industry is the existence proof. Firms there now machine motor housings, wind stators, fabricate or assemble flight controllers, ESCs, and initiation boards, and produce frames and props at meaningful volume. Localization of 70–90 percent or more is documented across multiple producers, with isolated examples of near-full domestic component sets for FPV systems. Residual dependencies remain – high-grade magnets, battery cells at volume, certain specialized sensors, higher-end edge chips – but they are narrower than a comprehensive supply-denial regime assumes. Once process knowledge and modest equipment exist, a determined actor does not need the original manufacturer for an effective short-to-medium-range system. Targeting commercial makers or the commodity layer cannot be the primary line of effort. The coherent response is therefore actor-centric. If the concern is bad actors using drones, policy should target those actors and the systems they field. That means intelligence and interdiction against the specific groups, workshops, conversion networks, and deployment chains that assemble, arm, and employ them. It means layered detection and defeat once the systems are in the air. It means narrow restrictions only where they can be tied to identified diversion networks and the few high-end items that still materially improve particular programs. It does not mean spreading friction across legitimate commercial markets, component producers, and software repositories in the hope of raising costs for actors who have already demonstrated their ability to substitute and fabricate around those frictions. Two clocks are running, but not the clocks described. One is the conversion cycle on commercial frames. The other is the localization and substitution cycle that has already outpaced upstream controls. Geneva processes and minilateral component coalitions will not stop what small shops and motivated actors can already build. The practical task is to target the people who turn available technology into weapons, not the manufacturers and markets that produce the technology.
2
3
13
650
So… yeah. Wait until you find out that your “CONUS-based” dev, QA, and integration “3rd-party support” was actually just an Indian guy in his bedroom outsourcing all his contracted work to his friends and family in India for pennies on the dollar. Know the workers by name and location. Always.
When you suddenly realize that the movie "Spaceballs" was actually a thinly disguised documentary about tech support in India 🇮🇳.
1
3
145
Context
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
1
64
I AM.
This is an allegory
1
6
315
This is a legendary post for all the wrong reasons.
Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.
3
2
9
823
TimOnPoint retweeted
No, The New Kalashnikov Is Not a Weapon – A rebuttal to Gerald Mako's @smallwars opinion. Cheap commercial drones fitted with readily available guidance software have collapsed the cost of precision strikes. Ukraine has demonstrated the method at scale: mass-produced frames, improvised warheads, and increasingly autonomous terminal guidance have given states and non-state actors capabilities once reserved for conventional military forces. The warfare equation has changed. That much is not disputed. What does not logically follow is the policy package offered to reverse it. Gerald Mako's argument for tighter controls on hardware that enables onboard autonomy, enforceable obligations on manufacturers whose platforms are routinely militarized, and a minilateral coalition of component producers treats the commercial dual-use ecosystem as if it were a controllable arsenal. It absolutely is not. The systems in question began as hobby, racing, photography, and agricultural products and became weapons only after conversion. The proposed remedies – manufacturer due diligence, conversion-resistant firmware, and supply denial of enabling components – do not survive contact with how these systems are actually built and fielded. The AK-47 analogy fails as an analogy. The Kalashnikov was purpose-designed as a military weapon and then deliberately proliferated as a geopolitical instrument: cheap, rugged, and simple to operate by design. Small UAVs and FPV platforms followed the opposite path. They began as commercial products before being adapted, often in small shops and wartime factories, into delivery vehicles. The distinction is acknowledged in passing and then ignored. A weapon that begins as a weapon can be regulated as one. A commercial airframe that becomes a weapon only after a user straps on a warhead or swaps the flight controller presents a fundamentally different regulatory problem. Imposing strict due-diligence duties, secure-boot mandates, and market-access conditions on commercial manufacturers because downstream actors convert their products is the gun-control argument applied to dual-use electronics. A manufacturer cannot reasonably be held responsible for every illicit modification any more than a tire company can be held liable for a drunk-driving manslaughter. The article concedes that no firm can be responsible for every conversion, then recommends treating refusal to adopt “reasonable” anti-militarization features as grounds for exclusion from Western markets. That substitutes upstream obligations for downstream enforcement. Such measures may deter some casual misuse and impose compliance costs. They will not stop a knowledgeable bad guy. The practical failures are straightforward. Software is already open and mirrored. Jailbreaks, forks, and companion computers have been routine in the hobby community for years and are now industrialized. Physical conversion does not require defeating firmware. A warhead and basic fuze can be zip-tied or strapped to a commercial platform. Motors, props, batteries, and boards can be stripped from a “conversion-resistant” airframe and reused on an open stack. Middle markets and gray-market channels for commodity components persist as a structural feature of global trade, not a temporary loophole. These realities make conversion resistance a weak foundation for policy. Local fabrication has already collapsed the premise that the original commercial stack is an indispensable chokepoint. Ukraine’s wartime industry is the existence proof. Firms there now machine motor housings, wind stators, fabricate or assemble flight controllers, ESCs, and initiation boards, and produce frames and props at meaningful volume. Localization of 70–90 percent or more is documented across multiple producers, with isolated examples of near-full domestic component sets for FPV systems. Residual dependencies remain – high-grade magnets, battery cells at volume, certain specialized sensors, higher-end edge chips – but they are narrower than a comprehensive supply-denial regime assumes. Once process knowledge and modest equipment exist, a determined actor does not need the original manufacturer for an effective short-to-medium-range system. Targeting commercial makers or the commodity layer cannot be the primary line of effort. The coherent response is therefore actor-centric. If the concern is bad actors using drones, policy should target those actors and the systems they field. That means intelligence and interdiction against the specific groups, workshops, conversion networks, and deployment chains that assemble, arm, and employ them. It means layered detection and defeat once the systems are in the air. It means narrow restrictions only where they can be tied to identified diversion networks and the few high-end items that still materially improve particular programs. It does not mean spreading friction across legitimate commercial markets, component producers, and software repositories in the hope of raising costs for actors who have already demonstrated their ability to substitute and fabricate around those frictions. Two clocks are running, but not the clocks described. One is the conversion cycle on commercial frames. The other is the localization and substitution cycle that has already outpaced upstream controls. Geneva processes and minilateral component coalitions will not stop what small shops and motivated actors can already build. The practical task is to target the people who turn available technology into weapons, not the manufacturers and markets that produce the technology.
2
3
13
650
Western education requires a hard reset. So many of our modern-day social problems dissolve if we do. The modern K-16 education was the experiment. The classical model – deep reading, rigorous discussion, and transmitting a civilizational inheritance – was the proven standard. It is time to return to what works.
I’m excited to head back to Thomas Aquinas College tomorrow, this time to their New England campus. The course of study at Thomas Aquinas College (TAC), where there are no majors, is remarkably similar to the course of study at Harvard in the 18th and 19th century. In the past, when I have posted that in 2026 Thomas Aquinas College is objectively more academically rigorous than modern Harvard, the Internet went insane. My posts about Thomas Aquinas College over the past five years total more than 12 million views. A Catholic Great Books College with no majors may seem like an experiment, but this is exactly backwards, the modern university is the experiment. And let’s be honest, it’s not going well. Thomas Aquinas College is the tried and true model. Deep reading, intense discussion, the passing down of a civilization inheritance, all while immersed in the beauty of the faith…If someone on the Internet has a better vision for what higher education should be I want to hear about it!
4
8
44
2,506
Yes, yes, and yes. I’ll add trigonometry and calculus too. There’s a hard science to destroying stuff. Well, she asked…
Did learning algebra, physics and chemistry ever actually come in handy in your adult life?
3
1
1
36
763
Morning edition. Still working on the workflow bug that's stripping the links out. You can find all the links on our LinkedIn page. Not a fan of LinkedIn, but it's working. Link is in the next post. We'll get it figured out. Give @AUTOWAR25 a follow.
AUTOWAR25 Morning Edition, Thursday, Oct. 22. The top 25 autonomous-warfare stories, ranked. 🧵 Russia hit Ukraine overnight with 210 drones, 110 of them jet-powered, plus a missile salvo aimed mainly at Kyiv, and Moscow's mayor says 630 drones headed for the Moscow region. The Army's top Pacific logistics general says its watercraft are "moving into the autonomous lane," and the Air Force is just starting to plan sustainment for its CCA drones.
1
2
13
1,029
TimOnPoint retweeted
US Flag rank officers are professionally ill suited to address the video below. Living 30(+) years inside "cost plus Big/Expensive/Few" means "mass produced Small/Cheap/Many" is outside their professional career frame of reference. Careerism means they deny this reality.🙄⬇️
A boat drone launched an interceptor drone to shoot down a strike drone. Its a drone world and you're just living in it.
2
10
1
49
4,578
Get in, homies. We’re AUTOWARing.
AUTOWAR25 Afternoon Edition, Wednesday, Oct. 21. The top 25 autonomous-warfare stories, ranked. 🧵 Project Agincourt's leaders lay out the road to a four-star Autonomous Warfare Command by Oct. 1, 2027, and DIU says Gauntlet II drone orders are moving, with Perennial Autonomy and Neros each getting the maximum 8,000-drone first order. The Army's CTO says its drone marketplace has topped $800 million, and the toll from the drone strike on Abyei's Amiet market stands at 153.
2
2
22
701
Here's the afternoon edition. I'm working on a bug that is stripping the links out. It's working in LinkedIn though. link below
AUTOWAR25 Afternoon Edition, Wednesday, Oct. 21. The top 25 autonomous-warfare stories, ranked. 🧵 Project Agincourt's leaders lay out the road to a four-star Autonomous Warfare Command by Oct. 1, 2027, and DIU says Gauntlet II drone orders are moving, with Perennial Autonomy and Neros each getting the maximum 8,000-drone first order. The Army's CTO says its drone marketplace has topped $800 million, and the toll from the drone strike on Abyei's Amiet market stands at 153.
3
3
22
860
Autonomy is also a discussion about human scarcity. Human scarcity is the condition in which available human attention, access, or response time is insufficient to maintain every required transition in a continuing operation.
2
3
8
618
Hey folks, I'm doing a thing you might be interested in. I'm working out the bugs and format right now Consider it a soft opening.
AUTOWAR25 is a free, ranked briefing on autonomous warfare: drones, uncrewed ships and subs, ground robots, counter-UAS and the software behind them. Two editions a day, top 25 stories, ranked. 🧵
4
14
3
84
4,264
It uses microwaves to heat the top millimeter of exposed skin. Apparently, quite effective.
The border is now a military installation and a battle lab for testing new systems, to include directed energy weapons. The border is locked down! @DoWCTO
2
3
28
836
I've watched some amazing churches close and be demolished or repurposed in my area. Philly was an Italian and Irish Catholic stronghold for almost 150 years. Still strong in the suburbs, but not so much in the City.
Detroit's Historic Catholic Churches Deserve a Future, Not a Farewell As Catholic conversions rise, Detroit considers eliminating Sunday Mass at dozens of historic churches, threatening generations of faith, tradition, and community.
2
8
40
921
I’m wondering about the future of SDV Teams. *SEAL Delivery Vehicle
"Ghost Shark has teeth now." - @PatConroy1, Australia's Minister for Defence Industry. The @ausgov and @Australian_Navy confirmed the payloads that our Ghost Shark extra-large autonomous submarine carries: sea mines, logistics caches, and air-launched effects for ISR and strike. Ghost Sharks are rolling off the production line. Payload testing is active.
4
1
22
1,269
“Our fake polls were an experiment to help you…” or something like that. If the Wedgewood Polls were an experiment, they should have come clean the second it drifted into public reporting. They got caught and are deflecting now.
Absolutely incredible… "Wedgewood Polls" just admitted they are a fake polling firm and made up their polls. Their fake polls have been posted in both the NYT and Nate Silver’s averages.
5
4
41
1,104