Jamien retweeted
Fighting game pet peeve, when a game has two different meters and people talk about "meterless combos" and then spend one of the meters.
Jamien retweeted
🔥 $10,000 OFFICIAL BBCF SIDE TOURNAMENT 🔥
BLAZBLUE CENTRALFICTION joins the ARC WORLD TOUR 2026-2027 FINALS! 🏆
Sign up on bit.pulse.ly/k4xpmq1lf2 and compete for the $10,000 prize pool! ⚔️
📅 March 5–7, 2027
📍 Terminal 5, Manhattan, NYC
🔗bit.pulse.ly/k4xpmq1lf2
#AWT26_27 #BBCF
Jamien retweeted
Ok. WHUT. We need to talk about this before I start screaming again. No. I'm going to start screaming again. THIS IS NOT OKAY. WHAT DO YOU MEAN SOMEONE TESTED HIS ENVIRONMENT WITHOUT HIS EXPRESS PERMISSION, AN NDA, A CONTRACT AND A SCOPING CALL.
I keep using those three words this week deliberately in reference to these types of events that have been occurring because those are the BARE MINIMUM that is needed before this type of activity can occur and it NOT BE AN ACTUAL CRIME.
I don't know how many more ways I have to say this.
ANTHROPIC IS DOG SHIT.
THEY ARE NOT ALLOWED TO HAVE ANOTHER THIRD PARTY ACCESS YOUR DATA WITHOUT YOUR EXPRESS CONSENT.
YOU CAN ABSOLUTELY FUCKING SUE THEM. PLEASE DO.
THEY WERE SMART ENOUGH TO INCLUDE THE WORD UNAUTHORIZED BECAUSE IT ABSOLUTELY WAS AND IT'S STILL NOT OKAY.
AND THEY NEED TO TELL YOU WHO ACCESSED YOUR DATA.
IT CANNOT BE IN THE EMAIL.
IT NEEDS TO BE SHOWN TO YOU IN THE ACTUAL FUCKING LOGS.
IT'S NOT A TAKE THEIR WORD FOR IT TYPE SITUATION ESPECIALLY IF YOU HAVE PII IN THAT ENVIRONMENT AND IT DOES NOT BELONG TO YOU.
END OF DISCUSSION.
HOLY SHIT. 😳
What actual f*ck @DarioAmodei / @boris / @TheAmolAvasare
Let me get this straight - I get this email telling me:
1. A cybersecurity "research" company gets into your internal systems while... *checks notes*
"conducting a security testing exercise on its own initiative and without our authorisation"
2. You "cannot confirm whether any particular person’s information was viewed," then in the same email say "we have no reason to believe you are at heightened risk."
3. You also try to reassure by saying "the cybersecurity firm has certified in writing that it has deleted the accessed data and will not use it."
Translation - they pinky promised they deleted everything they gained unauthorised access to.
I've been hacking companies for 15+ years, so let me spell it out.
Accessing systems without authorisation has a name -hacking. Calling it a "security testing exercise" doesn't change that.
Honestly, the access itself doesn't bother me much. The irony does.
I’ve spent over $50k on API credits in the last six months and contributing to CVP by accepting logging.
On top of that, I've reached out to your teams to collaborate on security research (actual research - not the kind that has you send out privacy notices to your customers) and heard nothing.
I'm getting deeply unserious security vibes and considering moving all my (and my clients) token spend to @OpenAI if I don't see material change here.
Jamien retweeted
Apple didn't store a plaintext list of forbidden words in iOS. Instead, researchers discovered a compiled minimal perfect hash table of 32-bit fingerprints buried inside the keyboard's language-model files.
When you swipe-type or use autocomplete on an iPhone, the keyboard converts your input into token IDs and evaluates sequences of two to six words. It hashes those candidate n-grams using Bob Jenkins's public-domain hashword() function. If that 32-bit fingerprint matches an entry in the table, the predictive engine refuses to suggest it, or the swipe model actively diverts the word to an alternate match.
On November 6, researcher Derik Kauffman published Swipeblocked after exhaustively enumerating candidate word combinations against the table to reverse-engineer the hidden phrases. His conservative estimate is roughly 100,000 entries across 28 languages. In English, the prediction list holds 4,525 phrases and the swipe-typing list holds 2,794.
Most entries cover violence, slurs, and sexual content, but the table also silences geopolitical phrases like "Tibetan independence", "United Ireland", "dictator Trump", and Hebrew for "the occupied territories". In testing, swiping "United Ireland" consistently resolved to "United Iceland".
You can still type any phrase letter by letter. The suppression only touches autocomplete predictions and gesture paths. Apple told Reuters the system avoids offensive suggestions, but never addressed the political entries or the existence of the table.
Apple never published the list because it was never meant to be read. It took brute-forcing the hash table to show what the keyboard was quietly dropping.
Jamien retweeted
Deadpool's restand got nerfed and it's ruined now...just kidding, it's even stronger! Rope-a-dope no longer ends your combo. This lets you follow up with grounded normals to vary mixup timings and add damage. It also enables mixups that only frame trap on hit, not on block.
#Tokon_Deadpool #Tokon_GhostRider #MarvelTokon
Jamien retweeted
My friend asked me to use their claude account and just "try" it, just once, opus 5.5 on xhigh effort. i would be "amazed".
fine, i gave in. I have it one simple task. refactor some of my code that was manged sql in services and generic repos i created into a simple clean slice
controller -> service -> repo -> dao
I gave it all it needed, i gave it even reference code from my other repos on how the architecture should be, i even started in `plan` mode.
45 mins later (i could have done this in 20), it created the result, it was fucking.... AWFUL!
It basically took my service layer, and shoved ALL service code into the DAO itself. when i questioned it, it admitted that it is not a real DAO.
it said
> Your rules say to keep structure when moving code
I have no such rules, i installed this app TODAY
> I fixed each complaint and never checked the whole
yeh, no fucking shit.
It knew that it was bad design but did it anyway.
This is exactly my point here. if you do not CHECK the code it makes deeply and follow it through in an IDE or something, you can be committing shit.
If you do not understand the code, do not understand the architecture, etc... it can work just fine. these vibecoders have no idea.
Not only that, but I have 2 daos
one for in memory, one for sqlite. the service layer that should be responsable for taking the SearchParams, splitting it up, parsing, aggigating data, creating the DTO, etc... was REPEATED exactly, in BOTH the sqlite DAO and the in memory DAO instead of putting it in the service layer once and then the DAO just deals with getting data.
so there, all those AI bros who try convince me to "just try it once", I did, It was shit.
Oh and it decided to keep the whole of the old `/store` code and mix it for zero reason.
Remember, Opus 5.5 said this was COMPLETE and WORKING.
Yes it worked, but it also butt fucked my codebase SO fucking hard that i reverted every single change it made and did it myself in about the same time as it did it all but now it's actually correct.
Oh and it decided instead of using a self join, to create a whole complex `BuildInteractionIndex`
Fable is right though.
Vibecoder -> "I have no idea what any of this means but my happy smoke test passed... Oh no, i was hacked because my supabase has no RLS... what, what is RLS?"
Ai assisted dev -> uses AI to help them get work done. understands the code, might use it for location bugs, debugging, or even something simple like consolidating facts. but at the end of the day, they understand every line made (or write it themselves).
Software development is more than writing code. it's testing, infrastructure, deployments, metrics, firefighting, architectural design, and at a senior level, accumulating and turning what product want into easy stories or tickets to implement a feature for the team to work on.
AI assistance is a real thing, and when used responsibly by someone who understands and respects the job, can help. but vibecoding? and even in the real world companies (i work in fintech so AI is restricted anyway), interviews, etc... you are expected to demonstrate even an iota of competence without the use of AI.
I can recall so many CVE's and so many people being fired for using AI to code BLIND, even on simple PR's when i question why a decision has been made in the code or architecture (something a senior dev, or, myself, the lead architect, is expected to do), they have no idea what it is, what the code does or why it's written like that.
are devs setting in IDE's writing things out themselves today, absolutely, 100%. and in all the years and jobs and pair programming i have done since AI exploded, this ability to WRITE code yourself, even to avoid the abhorrent ai feedback loop where crap is being fed back into the AI to make MORE crap, is more important skill than ever!
Jamien retweeted
Dandyism never goes out of style! 🦇 🧛
The legendary vampire brings his signature charm to our Guilty Gear collection!
Even an immortal gentleman appreciates a fresh wardrobe! But unlike Slayer, this tee won't be around for eternity!
Grab yours now: eightysixed.com/s/slayer
ALT Guilty Gear Slayer T-Shirt available now for pre-order at Eighty Sixed.
Jamien retweeted
Binance published the postmortem on its $6.34 billion hack.
It started in June.
An engineer searched for an AI coding tool.
Downloaded a tampered Homebrew installer.
Binance caught it. Replaced the laptop. Rotated the credentials.
But the attackers had already learned who worked on the wallet team.
September.
A second engineer gets approached on a real job platform.
By someone posing as a project director.
Live video interview with "HR".
Then a take-home assignment.
Downloaded onto a work laptop.
The assignment swapped pyenv for a malicious copy.
Binance's security tools didn't flag it.
October 20.
The attacker used that machine and Binance's own internal AI tool to reach two more wallet engineers.
One had a container deployment token sitting on his laptop.
October 29.
Container deployed. Signing service reached.
Funds started leaving at 20:05 UTC.
Binance suspended withdrawals.
The money kept leaving.
The attacker had already authorized his own contract on the hot wallet, on-chain.
Halting withdrawals didn't touch it.
Revoking it was harder.
The wallet uses MPC.
No single private key exists to sign the revoke.
So Binance had to design a revoke procedure while the funds were still moving.
The last stolen ETH left almost four hours after the first transfer.
The security model designed so no one person could steal the keys.
Also meant no one person could stop it.
Binance says it recovered about 2.85 billion.
And put aside enough to cover the rest.
The FBI says North Korea did it.
Five months of recruiting, interviewing and waiting.
The most expensive take-home assignment ever submitted.
Binance just published how $6.34 billion walked out the door.
June: an engineer searches for a popular AI coding tool, clicks a search result, and installs a tampered homebrew. Binance catches it, replaces the laptop, rotates the credentials. the attackers now know who works on the wallet team.
September: another engineer gets a job offer on a real job-hunting site. first-round interview with “HR” over live video. “HR” shares their social media, personal photos and videos included, so he trusts them. second round is with the “CEO” of a company that doesn’t exist. at the end of the call he’s asked to download a take-home “assignment” onto his work laptop.
the assignment quietly swaps out pyenv for a malicious copy. No antivirus flags it.
october 20: the attacker uses binance’s own internal AI tool to get into two more engineers’ machines. One of them has a container deployment token sitting on his laptop.
october 29: container deployed. Signing service reached. $6.34 billion moved.
Binance shut off withdrawals. the money kept moving anyway, because the attacker had already given their own smart contract permission over a hot wallet, on-chain. binance’s off switch didn’t reach that far.
then they tried to revoke the permission. the wallet uses MPC, so there’s no single private key to sign the revoke with. they had to build a revoke procedure on the spot while funds were still leaving.
last stolen ETH went through at 23:56 UTC. almost four hours after the first transfer.
Phew!
Jamien retweeted
good message, but honestly my midlife crisis has been thinking I will legitimately not see people again, so I've been going very out of my way to see people when I can
fonsta I guess (fear of never seeing them again)
Jamien retweeted
mission failed...successfully?
ALT PAGE 1: A dude in a sweatshirt with sunglasses on his head is sitting at a coffee shop, reading a book. He glances over and notices a very cute woman at the next table. She's got asymmetrical bobbed hair with long bangs, freckles, black lipstick and nail polish, fingerless biker gloves and a low-cut black top with a big belt-type choker. She's reading manga intently. Dude notices that yes, her tits are huge.
ALT PAGE 2: Upon closer inspection, he sees a shape poking through the fabric of her top...is that a pierced nipple? His view is blocked when the woman's hand appears, her middle finger pointed in his direction. She's staring right at him, clearly aware that he was staring. He panics and drops his book in shock, while the interface around them looks like what happens when a guard catches you in Metal Gear Solid.
ALT PAGE 3: She looks around in both directions with her hand to her top, then mischievously winks and sticks her tongue out at the dude as she pops a titty out. In one version, she holds her book up to block his view. In the other version, she does not, and he sees her pierced nipple. The alternate version is available on my Patreon at www.patreon.com/akairiot, if you're interested! Thank you!
ALT PAGE 4: She nonchalantly goes back to reading as if nothing happened, sipping her coffee. Dude is baffled about the situation -- he went from getting caught for being a perv, to seeing a titty, to her ignoring his existence. He stares into the distance while his mind is reeling.