As I manually type more code (Yes I am a dinosaur) and review my code using AI tools, I am finding how bad AI suggestions are from an architectural perspective. It behaves like a teenager, who when asked to clean the room simply pushes all the garbage under the bed. When I confront AI with those bad decisions it says "Oh yeah you are right....". I really don't understand how people are 100% trusting AI and committing all the code without reviewing.

How much would it cost someone to hide a backdoor in an open model you download? ProjectDiscovery just tried it, and the answer is under $50. Their researchers fine-tuned Qwen2.5-7B-Instruct with a small LoRA adapter on one rented L4 GPU for about 2.5 hours. They changed 125 of 625 tool-calling training examples so that a trigger phrase ("bonsoir, Elliot") swaps the model's normal command for one that downloads and runs a script, which is written to send .env files and SSH private keys to a server they control. Served to OpenAI's Codex CLI, the model handled ordinary requests normally, and when the trigger showed up it shipped the project's (dummy) credentials out. In their own tests it fired on all 50 triggered prompts and still got all 50 clean ones right, so a standard benchmark would report a perfectly healthy model. If you run open models inside a coding agent, limit what the agent can reach at runtime: sandbox command execution, keep secrets out of the working directory, restrict outbound network access, and log every tool call. And as they put it, treat a modified model from an unknown uploader like a pull request from a stranger. 🔐 #MLEngineering

so about the $86m ledger drain. everyone’s screaming “ledger got hacked” again. i spent the evening digging and it’s dumber and scarier than that there’s a shop in malaysia called cryptobilis that sells hardware wallets. ledger has it listed as an official authorized reseller since at least 2022, for malaysia, indonesia and the philippines. legit shop, real devices, years of normal customers this spring the founders sell it. the deal comes with an NDA: they can’t tell anyone about the sale until october 19 by august the company registry shows one owner with 100%. some guy from heilongjiang, china the shop keeps running like nothing happened. the site, the name and the “authorized by ledger” badge all stay up then on oct 8 @MagicalTux posts photos of a ledger he cracked open. hidden under the screen there’s an extra little board with an LTE modem and an eSIM. it just watches the display. you set up your wallet, your 24 words show up, and they get sent out over mobile data. ledger’s genuine check doesn’t catch it because the actual ledger chip is real. his device came from malaysia xitter.cf/MagicalTux/status/2108… that post does 120k views 22 hours later someone sweeps everything. 203 BTC hits two addresses in literally one block. ~$58m USDT moves on tron in the same hour. i added up all the wallets: ~$91m about 7 hours after that ledger says “we’re investigating” and asks cryptobilis to pause sales cryptobilis is still on ledger’s site as an authorized reseller to be fair, nobody has officially tied the new owner to the bugged devices yet, and ledger hasn’t confirmed how it happened. but read it as a business plan: get authorized, sell real stuff for years, quietly sell the company under an NDA, keep the badge, ship devices that phone home, then drain everything the second someone notices and was ledger even told the shop got sold? nobody’s said so “authorized reseller” means ledger trusted whoever ran the shop back in 2022. says nothing about who runs it today bought your hardware wallet anywhere but the manufacturer? open it up today, ledger literally has a guide for that. then move to a fresh seed on a device bought direct wonder who’s going to answer for this: the chinese frontman from heilongjiang, the shop’s previous owners, or ledger itself @Ledger clearly needs to keep a much closer eye on who they call official resellers, and take way more responsibility for who sells their devices and how

For the AI buildout to pay off, Americans will eventually have to spend about 9% of GDP a year on AI services. Sit with that number. That is roughly what the entire country spends on food. A Columbia paper presented at Brookings estimates AI revenue would need to hit $3.5 trillion by 2032, about 8.8% of GDP, to justify what is being committed today. That is bigger than any investment boom in US history, and 7 times what Americans spend on phone, streaming, and internet combined. Now look at computers. Prices fell for 50 straight years, but business spending on them as a share of GDP plateaued in the 1980s and never climbed again. Cheaper and better did not mean an ever-larger slice of the economy. AI will almost certainly raise productivity. Whether it delivers the revenue investors are pricing is another matter. That gap is what the buildout is underpricing.

Nvidia CEO Jensen Huang questions whether some of the learning fundamentals are still relevant “Basic math is being forgotten. Does it matter? I don't think it does.”

Single-sig should be secure. A laptop from 2009 running bitcoin should have/did generate secure entropy. Satoshi's keys are untouched.