📖: Tamers of Entropy - cypherpunk novel. Liberty / Entrepreneurship / Good vibe-codes Nostr: [email protected]
🥥
Joined April 2008
- Tweets19.9K
- Following2.3K
- Followers14.4K
- Likes11.9K
Pinned Tweet
Author of Tamers of Entropy / Krotitelia Entropie: a lunarpunk / cypherpunk novel about where we are and where we are going. tamersofentropy.net
Learn about Bitcoin for your lifestyle, enjoying volatility and thriving in uncertainty. My goal is tech + hacking => liberty and life satisfaction.
Good vibes / tech: github.com/jooray - author of Emanator (Nostr multi-account client and scheduler), Lievik (marketing channel automation), Nostrautica (event app with attendee matching) and a lot more!
Find my books and courses, such as Cryptocurrencies: Hack your way to a better life.
Books, Courses (EN, ES): hackyourself.io/shop/
Books, Courses (SK): juraj.bednar.io/shop/
I teach how to handle volatility, what to do when you want to enjoy the value of your Bitcoin, how Lightning network works, cypherpunk tech and more, hacking applied to many areas of life, etc.
Podcasts 🎙️:
Option Plus (EN) - optionplus.io/
Reči o živote, vesmíre a vôbec (SK): juraj.bednar.io/reci-o-zivot…
Ako vyhackovať otcovstvo (SK): otcovia.com/
I usually hangout on Nostr: [email protected]
Juraj Bednar🏴💛🌘 retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Another day, another set of patches - @BtcpayServer (because of rtl/nodejs/brotli), NodeJS everywhere, Bind (although I do not run vulnerable configuration).
This is fun :)
I am token poor until reset, so my daily driver is DeepSeek 4.1 Flash 1017 and it is amazing. I barely feel any difference. And I used to be a professional sysadmin, so I could do it myself, but this is way faster.
I don't understand, do they mean that when I put on a tinfoil hat and those funny glasses, I can see the future?
Or what did they mean on May 6th?
Confession: Something that I can't unsee lately and it's probably one of the best indicators of intelligence - does a person immediately see second and third order effects, understands emergence and structure of described phenomena (qualitative analysis)?
I don't want to be picky about things I understand, there are many things I am not good at (intellectually), but I think this quite well maps with exceptional intelligence and it's very rare that people understand these things, or even see them as something to understand.
And then there's this "feeling" when I am explaining this to someone and they just don't get what I am talking about. Or I meet someone with exceptional intelligence and they see it immediately.
It's a two minute IQ test. I don't know at what IQ (roughly, IQ is not perfect) there is this "switch', but I just can't unsee it. And I find myself using this probe a lot lately.
I highly recommend cloudflare's security audit skill: github.com/cloudflare/securi…
Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.
CashuPayServer v0.5.7-alpha is out — the second release from this October's three independent security audits, and it closes every code-side finding they left open.
If you've patched your PHP already, you can also upgrade CashuPayServer. If not, patching PHP is more important, go do that.
The most serious one was in the WordPress plugin: showing the seed phrase or downloading the database accepted any password, because the already-open admin session was the only check (but you still needed to be logged in as admin into WordPress). It now asks for your real WordPress password. MiniMax M3.1 found that one, and it is again the model that caught something the earlier scans missed.
The rest of the important fixes:
- Stranded-funds exports now reserve the money, so the same ecash cannot be handed out twice or spent while the token circulates.
- The setup wizard can no longer be re-entered to reset the admin password or keep a previous claimant's server address.
- Fiat pricing needs two independent sources to agree, so one bad provider cannot underprice invoices.
- An interrupted wallet backup no longer leaves a full copy of the database behind.
- Public token submissions are bounded, closing a request that could burn minutes of CPU.
- Trusted-proxy settings can no longer name the whole internet.
Upgrading takes a couple of minutes and there is nothing to configure:
- Standalone: upload the new files over the old ones, keeping your data folder.
- WordPress: upload the plugin and choose "Replace current with uploaded".
The database updates itself on your first visit.
Three audits, three models: DeepSeek 4.1 Flash 1017, Opus 5.5 and MiniMax M3.1 (Space Bunny). They found real issues at every level, including the WordPress one above.
What changed? We used the same models for previous audits, but this time we used the cloudflare security audit skill: github.com/cloudflare/securi… Highly recommended, it's good.
👉 Download: github.com/jooray/cashupayse…
PSA: turn off PHP now.
Mitigations you find on the internet are not enough. Only patched release fixes the bugs. Exploits already in the wild. Watch php.net and your distribution update channels and only enable PHP after you install patched release.
This is not a drill.
Juraj Bednar🏴💛🌘 retweeted
🧵Piatok po ceste som si tak povedal, že ten Elasticsearch, čo máme je pomalý a žerie veľa pamäte. Všetky SQL triky indexovania, čo poznám som použil, ale nebolo to ono. Tak agent dostal úlohu spraviť postgres extension na rýchly autocomplete v Ruste. Dnes je to v produkcii.
Juraj Bednar🏴💛🌘 retweeted
🚨 Google lost power in London this morning and Revolut, a bank with 80 million customers, went down with it.
I've spent the morning reading what Revolut users went through. It's wild.
People stranded at petrol stations, unable to pay for fuel or a taxi to the airport.
One traveller couldn't get out of a train station in Japan.
A 71-year-old woman stood at a supermarket till for an hour. Her kid had to drive 30km to bring her cash.
Card payments, transfers, ATM withdrawals, currency exchange, share trading. All down.
Revolut's statement said "all our customers' money and data are safe."
Safe. You just can't touch it.
Google's explanation so far is a "power event" in one zone of its London cloud region. Its advice to affected customers was to move their workloads to another zone or region "if feasible."
Must be nice. Revolut customers couldn't even move £10.
In July the UK government put Google Cloud, AWS, Microsoft and Oracle under direct Bank of England oversight, because one outage at any of them could shake the entire financial system.
12 days ago the Bank of England ran a drill with the UK's 38 biggest banks and market operators. The scenario they practised was a global cloud outage.
And exactly one year ago today, AWS went down and took Lloyds and Halifax with it.
Same date. Different cloud. Lloyds was having problems again this morning.
Revolut spent five years earning a UK banking licence.
Bitcoin has been running for almost 18 years. It doesn't have a London region.
Juraj Bednar🏴💛🌘 retweeted
We just released uv 0.13.4, which updates our bundled certs in response to the eMudra incident.
This is a huge deal, and not unique to uv! It affects much of open source due to bundled CAs in certifi, webpki-root-certs, etc. Please upgrade anything that bundles CA certs.
Fiat problems.
This is unfortunately inevitable and will only get worse
Please retweet. @Wise has blindsided us and put our business at risk. This is insane.
We’ve been a Wise customer for years, using their USD bank account to accept payments from our US clients.
Today, I discovered that Wise has capped how much we can send or withdraw from our account at roughly 40% of our usual monthly volume.
No advance notice. No explanation.
We’re suddenly at risk of being unable to make payments on time.
Luckily, we have other accounts. Some clients also pay us in Bitcoin. But most of our money comes into Wise.
How can @Wise do this after we’ve been a customer for years and processed millions of dollars through it?
Customer support can’t help us. We’ve filed a complaint, but who knows if it will go anywhere.
In the meantime, we can’t get our money out. We’re being held hostage.
Saunový večer v lunarpunkovom duchu už tento piatok. @SadeckaMarianna vedie saunové ceremónie s metličkami a spevom, medzi kolami sú masáže, ochladzovanie a debatky s ľuďmi, ktorých poznáš z Bitcoin je retro, z Lunarpunku a z našich Signal skupín.
Čo ťa čaká
Saunové ceremónie
Marianna vedie saunové ceremónie vo veľkej saune, ktorá je pre 17 ľudí. Každé kolo má svoju tému, hudbu či spev, vôňu bylinkových výluhov, ktoré sú naliate na rozpálené kamene. K tomu pridáva aj metličkovanie - dotykové alebo bezdotykové. Teplo, vôňa, tóny hudby a tvoj dych ťa povedú dovnútra.
Metličkovanie a masáže
Okrem metličkovania počas ceremoniálov môžeš zažiť aj 1:1 metličkovanie v saune. Medzi saunovými kolami ťa čakajú aj masáže od našich skvelých masérok, ktoré môžeš poznať z iných sáun V pote tváre minujeme Bitcoin alebo Lunarpunku či Bitcoin je retro.
Krotitelia Entropie
Juraj krátko o románe, ktorý napísal namiesto ďalšieho kurzu, a k tomu trailer. Knihy budú na stolíku a ak chceš, podpíše ti ju.
Debatky
O Bitcoine, súkromí, paralelných štruktúrach a o tom, čo spravíme ďalej.
Wellness aj networking
Piatkový večer, kde sa v saune a vonku počas oddychu stretávajú ľudia, ktorých zaujímajú paralelné štruktúry, píšu kód, knihy aj budúcnosť. Prostredníctvom Nostrauticy sa nájdete aj po večeri a rozhovory, ktoré začnú v saune, môžu pokračovať ďalej.
Ak sa chceš zúčastniť, napíš @SadeckaMarianna DM, dá ti vedieť heslo, ktoré napíšeš do vpotetvare.cypherpunk.today/
Juraj Bednar🏴💛🌘 retweeted
German chancellor Merz asks Jensen Huang for advice on how Europe should regulate AI.
Jensen: “You can’t regulate if there’s no technology.”
“The technology industry must invent the technology for safety. […] Safety is not hopes and dreams. Safety is technology and engineering. Second, the companies need to have best practices. […] And then lastly there’s industrial and government regulations. […] Regulating the internet is hard, but regulating internet applications is not so hard. We should be regulating the applications right way. […] There’s nothing to regulate if the industry doesn’t thrive. You want the German AI industry to thrive as well as do it safely, responsibly. […] We know there’s technology we can invent and deploy in order to have AI safety. We know that there are best practices that we can adhere to as companies and industries. And then in addition to that, if necessary, we’ll make sure we regulate.”
Juraj Bednar🏴💛🌘 retweeted
Shipping AR games, immersive films and experiences with Unity and Graspable.dev!
Release soon 🚀
Working on a native AR through @unity AR integration + WebAR through @the8thwall, both driven from Graspable.dev.
New templates and examples with new animation system soon!
Juraj Bednar🏴💛🌘 retweeted
So the chancelor of the most technologically advanced country in the world which got totally left behind in the AI thinks that they will be no. 1 AI country while telling the leader of the actually most valuable company in the world where the USA make the mistake.
I wonder who will come build the AI labs, I guess the undocumented engineers and lovemakers are ready 😂
We have a magic wand.
Yesterday I was implementing image inference in @routstrai confidential branch. It needed altering of the flow, verifying zero knowledge proofs, etc.
Opus 5.5 sketched the solution and said implementation would take 3 weeks. I joked that I'm better adapted at current intelligence timelines that he/she/it is. I replied that I think it would be 30 minutes.
I don't know if the agent thought it was a challenge, but 29 minutes later I was doing confidential image inference from the demo pwa.
After the huge migration from JavaScript to TypeScript 7, getbased is now migrated to Svelte 5, SvelteKit 3 and Tailwind 4 with Codex.
Some interesting numbers:
- It took 15 days of running a persistent /goal
- 229 commits, 4 PRs
- 3 523 files changes
- 517 UI components
- 13B tokens in total (98% cached)
- 70 subagents threads in total - 2 500 $ in API equivalent of Sol 6.1 High
Just a two months ago I though this would take at least 6-12 months more to pull this off. And I haven't even used the best model out there.
Localhost Recording Studio got covers.
Give it a recording and it sings the tune back in your style, with your words. First it listens and writes down the score: melody and chords, or just the melody. Then it makes a new song from that score. The original voice and instruments don't carry over, only the tune.
It all runs on your own device, Mac or Android, offline. On a Mac a 30 second cover at sketch quality takes about a minute. On my phone a 20 second one took 20 minutes. Slow, but it's a phone, with no server and no account.
New since yesterday:
- Covers, with a Style knob from 0.5 to 2.0 that sets how hard your style and words pull against the original tune
- Quality presets (sketch, standard, final), each with a time estimate
- Refine a sketch to full quality without starting over
- At standard and final quality you can hear a preview a quarter of the way through
- Tap the middle of the circle to play or pause
- The song list sits behind the studio now, and "New entry" starts the next song
- The time-left countdown actually counts down now
- On the Mac, songs no longer fail after you switch precision
Free software, MIT licence. The YuE2 model is CC BY-NC.
jooray.github.io/studio-loca…
Android on Zapstore, Mac and Android builds on GitHub: github.com/jooray/studio-loc…
Juraj Bednar🏴💛🌘 retweeted
Zverejnil som na GitHube vlastný bridge, ktorým som pri presune Aave pôžičiek ušetril viac než 3 000 $ na poplatkoch.
Bridge appky si z každého prevodu berú 0,05, 0,5 %. Circle pritom za štandardný prevod USDC, EURC, cirBTC či WETH neberie nič, len na to nemá appku pre bežných ľudí. Tak som si ju nechal napísať AI agentom.
Čo vie:
• USDC medzi Arc, Ethereom a Avalanche
• EURC z Arc na Ethereum prakticky len za gas
• cirBTC a WETH medzi Ethereom a Arc
• dokončiť rozpracovaný prevod podľa hashu transakcie
Bezpečnosť:
• beží lokálne vo vašom prehliadači a každú transakciu podpisujete v hardvérovej peňaženke
• pred každým prevodom overí kontrakty Circle priamo na blockchaine
• príjemca je len vaša peňaženka alebo adresa z vášho adresára (ochrana pred address poisoningom)
• presné povolenia, ochrana pred dvojitým odoslaním a prísna Content-Security-Policy
Používate ho na vlastné riziko a neručíme za žiadne zneužitie ani stratu prostriedkov. Najprv vyskúšajte malú sumu.
👉 github.com/wilderko/circle-c…
Ako som ho použil pri presune pôžičiek na Aave v4: blog.opportunist.global/ako-…
Kamarát mi povedal, že Bitcoin už nemôže urobiť 100x, lebo na mining nie je dosť elektriny. Tak som si to prepočítal. Pri 100x po ďalšom halvingu by mineri zarábali okolo 1,8 miliardy USD denne, čo zaplatí približne 500 GW miningu. To je asi 14 % svetovej elektriny, alebo nejakých 500 jadrových reaktorov, a to za jeden halvingový cyklus nikto nepostaví. Kto dostane minerov prvý? Krajiny, ktoré vedia povoliť priehradu alebo reaktor za mesiace, alebo tie, kde povolenia netreba vôbec?
Pozrite si, ako súvisí cena s nákladmi na mining (investícia do ASICov a elektrina) a prečo hashrate ide za cenou, a nie naopak.
juraj.bednar.io/blog/2026/10…
