self. design & ux guy @cake · @cakewallet · @radarchat
madrid 🇪🇸
Joined April 2024
- Tweets7.2K
- Following294
- Followers601
- Likes33.8K
jaim3 retweeted
Yet another example of why you should never use a node you don't trust.
We are extremely selective about the default node + optional nodes in @cakewallet for just this reason, and I am fanatical about securing our infra to protect our users against things like this.
I have never understood the Electrum Wallet approach of connecting to random servers on each start as it has led to many severe vulnerabilities being exploited there.
That being said, this underlying vuln is a fascinating one (and much easier to exploit for an attacker than previously-known RBF bugs I've seen) and likely affects almost every Bitcoin wallet right now until patched, so stay safe and run your own node or use one from someone you trust.
We'll have a patch for Cake Wallet out first thing this week to ensure that even if you opt to connect to malicious node this attack will not be possible.
ELECTRUM BITCOIN WALLET CONFIRMS CRITICAL SECURITY VULNERABILITY EXPLOITED IN THE WILD
Electrum has disclosed a high-severity vulnerability allowing malicious servers to trick users into sending Bitcoin to an attacker when increasing a transaction fee.
The attack works by intercepting a broadcast transaction and replacing it in the wallet’s history with a fake transaction redirecting funds to an attacker-controlled address.
If the user attempts to increase the fee using Replace-by-Fee (RBF), Electrum can sign the malicious transaction, sending the Bitcoin to the attacker.
Electrum confirmed two reported incidents, including one user who lost funds. Attackers even generated addresses matching the last four characters of the intended recipient’s address.
The vulnerability affects versions before 4.8.3 and has been patched in the latest release.
Users are urged to update immediately and verify all destination addresses and amounts before signing transactions.
jaim3 retweeted
Lo que pasó anoche en Barcelona huele a una operación encubierta/ataque hibrido
Esto no viene de ninguna organización de izquierdas ni, en general, de ninguna organización conocida. Ha sido una movilización convocada a través de TikTok y WhatsApp que llamaba a replicar lo ocurrido en Francia
Ahora viene lo interesante:
El nombre de los «convocantes» es Blocus, un grupo del que no había constancia que existiera en españa hasta el 18 de octubre (hace 6 días)
Entre el 18 y el 19 de octubre se activaron unas 20 cuentas en TikTok, prácticamente al mismo tiempo, llamando a hacer lo mismo que en Francia
Algunas de estas cuentas llegaron a publicar hasta 59 vídeos en apenas 48 horas
Los grupos de WhatsApp identificados no llegaban a los 1.000 participantes
¿Alguien de verdad me quiere convencer de que un grupo espontáneo aparece en TikTok hace seis días y consigue movilizar a miles de chavales para salir de forma organizada por Barcelona a quemar cosas y saquear locales concretos?
Y, además, justo en plena época electoral. Huele esto muy mal
i think the suits and neobank-adjecent “fintech” people should definitely renounce the word “crypto”
leave it to the guys actually building the alternative and keeping the cypherpunk project alive
they had it
the only relevant new browser to change the game in recent years and build a solid brand. pretty rare
then, instead of building it up, they decided to ignore it and launch another one because "ai" 💀
then sold the company to Atlassian, and now its gone.
rip
We've decided to sunset Arc on December 22, 2026.
That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community.
Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward.
We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how:
· Your passwords, bookmarks, extensions and history come over to Dia seamlessly.
· Spaces, Folders, and Tab Groups are in Dia and import over with your data intact.
· Dia now surpasses Arc benchmarks in stability, speed, and security.
· The browser features you use in Arc are free in Dia, and the AI is optional.
Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.
de las cosas mas graciosas de ser español es ir haciendo esto por todo el mundo ante rostros de incredulidad del personal hostelero
ellos no disponen de nuestra tecnología ni conocimientos
Orgullo de nuestro país, de su gente, de su solidaridad y diversidad, de su riqueza cultural y su patrimonio natural.
Orgullo de España.
¡Feliz #FiestaNacional! 🇪🇸
jaim3 retweeted
Bitcoin and Monero software, including @cakewallet and @SparrowWallet are prepared for this - they've been building ai cybersecurity strategies for quite some time now, thanks to the diligence of forward thinkers like @vikrantnyc @sethforprivacy @callebtc
Keep it up bros, stay sharp!
xitter.cf/kimmonismus/status/211…
Whats happening right now is probably way worse than the Hugging Face incident.
AI-powered attacks are hitting real organizations while major platforms disclose breaches and critical flaws.
- Microsoft reports AI agents targeting hundreds of organizations, reaching privileged cloud access in under three hours in multiple cases. It attributes the ConnectWise compromise to the same group.
- CrowdStrike documented four operators running successful AI-agent campaigns. One compromised at least 15 Argentine healthcare organizations.
- PHP2Shell: AI helped turn longstanding PHP flaws into working exploits. Cloudflare’s CEO reports millions of exploitation attempts. Their AI involvement is unknown.
- Railway disclosed possible access to customer secrets. LiteLLM shipped a backdoored release. Zeabur confirmed another breach and is shutting down.
- GitLab patched a maximum-severity flaw affecting 12 years of releases. Node.js patched a serious code-execution vulnerability, with Vercel deploying firewall protections.
Feels like a turningpoint.
the whole process of designing features/UI has no top-down commercial factor. they just let us come up with stuff & make it how we'd use it ourselves
all feedback is like "change this to avoid support tickets", "remove that, too many steps", "what if they also want to do X"...
they used to be the digital music company, and then the ipod era died & streaming took over
now they are chasing spotify, bigger and more culturally relevant. they need to be cool again
Introducing a new identity for Apple Music, physically shaped by an original composition from @fredagainagain1 and NEST Acoustics.
they are so trying to be cool
Introducing a new identity for Apple Music, physically shaped by an original composition from @fredagainagain1 and NEST Acoustics.