
#Web5 is more open and decentralized. Where you own the hardware, software and data, with no user agreements or contracts. #Bitcoin #lunarpunk #ArchipelagoNode
elsewhere
Joined April 2022
- Tweets4.9K
- Following3K
- Followers1.9K
- Likes9.3K
Pinned Tweet
Do you remember the tower of babel Anon?
#ArchipelagoNode is coming to change the languages of the computers.
Get ready for the next generation of Bitcoin. Decentralized Mesh internet run on Bitcoin nodes.
An internet that is not owned by anyone, but works for everyone.
Don't you feel offended when labs and governments tell you what type of intelligence you're allowed to use?
We live in a world of forbidden thoughts and ideas. Nobody should be able to limit your ability to seek information or share knowledge.
Free all minds.
SITUATION DETECTED: Following the massive cyberattack on Japan's GMO Internet Group, which led to fraudulent trades across 70+ brokerages and FX platforms, CEO Masatoshi Kumagai warns that the internet itself is on the verge of collapse.
Polycarp Nakamoto priv/acc retweeted
RESEARCHERS CLAIM SERIOUS FLAWS IN TAILSCALE, A TOOL MANY BITCOINERS USE TO REACH THEIR NODES
A new report says users with approved access through Tailscale's built-in SSH can take root control of machines, and the attack can spread to other devices on the network.
If you run a node through Tailscale:
- Turn off Tailscale SSH
- Update when a patch ships
Tailscale has not yet responded.
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone.
tailworm.com
x.com/IntCyberDigest…
Polycarp Nakamoto priv/acc retweeted
A single command to install @omarchy on your iPad
Coming soon
Video is sped up, total install took 3.8 minutes
@OmarchyMac @OmarchyUpdates @dhh @OmarchyLinux @tcballard
Polycarp Nakamoto priv/acc retweeted
Claim your compute.
Run AI locally.
Protect your privacy.
Keep your data.
Own the model.
Work offline.
No subscriptions.
No rate limits.
No outage page.
Your thoughts stay yours.
Your IP stays yours.
Your stack stays yours.
Nothing more important than this today.
Polycarp Nakamoto priv/acc retweeted
Be careful using abliterated models guys
There has to be a middle ground between the Anthropic nanny state approval process for Mythos and using bootleg abliterated Chinese models
Whoever figures this out is going to print a lot of money for SI Cyber – at San Francisco, CA
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
Polycarp Nakamoto priv/acc retweeted
🚨Austin Texas🚨 The Grand Opening of your local Micro Center is just weeks away on November 13th! Come celebrate Tech Heaven with food trucks, a DJ, and of course deals. Learn more: micro.center/wzfu
turns out it classifies what audio it hears, before reporting back to samsung.
sensor preferences, dog-barking and baby-crying event counters, and camera streaming duration are built into telemetry paths.
Polycarp Nakamoto priv/acc retweeted
The Bitcoin security hysteria is hilarious. There is no technology on earth more battle tested than BTC. It has had a giant target on its back since day one because it holds actual money that can be stolen with no accountability. Every hacker on the planet has tried for 16 years. Nobody has cracked the protocol. Meanwhile, hacking everything else is getting cheaper and easier by the day. Your money is at far greater risk sitting in a bank or brokerage account. Someone wires it out and the bank says you authorized it. Now prove you didn’t. Good luck with that…🚀
Polycarp Nakamoto priv/acc retweeted
BREAKING: OpenAI says it found a critical flaw in Brotli, a widely used compression library built into software like Node.js, Bun and Envoy.
The bug could let an attacker take over a system just by sending it malicious compressed data, with no login needed. That works both ways: a hacker could hijack an unpatched server, or a malicious server could hijack an unpatched user’s device.
This is called #Web5.
We are building it with #archipelagoNode.
Eventually everyone will be using p2p mesh nodes to communicate.
Want to know the solution to the collapse of web3?
check the link in the replies.
I think we’re approaching the end of the ‘open internet’ as we know it
If you don’t follow AI or cybersecurity, what happened yesterday is akin to assassination of Archduke Franz Ferdinand for the internet. think of it like this - we keep finding broken locks in software used everywhere. More capable AI could help attackers check those locks much faster, before everyone has time to fix them. And now we’re entering a time we’re the lock checks are being automated, opening doors that could expose millions of people’s data or take critical services offline.
Yesterday - PHP, GitLab and Node.js patched flaws that could let attackers run code on affected systems. LiteLLM disclosed a release containing credential stealing malware.
I expect sensitive systems to move behind private access, with strict limits on what each person or agent can touch. A good solution I’ve seen proposed is moving sensitive infrastructure onto intranets, (smaller private networks) with tightly controlled gateways for the information that needs to travel between them.
Polycarp Nakamoto priv/acc retweeted
I think this is completely backwards.
We have mountains of legacy code, unpatched vulnerabilities, and critical systems nobody fully understands because Bill, who wrote them 15 years ago, is now sipping mai tais on a beach.
AI is exactly how understaffed, underfunded security teams can finally fix the basics quickly and at scale.
The attackers are scaling with AI. Telling defenders not to do the same is a death sentence.
Polycarp Nakamoto priv/acc retweeted
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
Polycarp Nakamoto priv/acc retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
Polycarp Nakamoto priv/acc retweeted
PrismML has released Bonsai 2 in 2B, 4B, and 9B sizes, with model files as small as 430MB.
The models are based on Qwen3.5 and use ternary quantization to make local AI more practical on devices with limited memory.
The model sizes:
Bonsai 2 2B: 430MB
Bonsai 2 4B: 950MB
Bonsai 2 9B: 2GB
All three are released under Apache 2.0, allowing commercial and personal use under the license terms.
But the interesting part isn’t just how small these models are. PrismML is also targeting the capabilities that make an AI assistant useful beyond ordinary text generation.
What has improved?
Bonsai 2 is designed to improve reasoning, visual understanding, instruction following, and tool calling.
The team has also worked on reducing repetitive responses, unnecessary verbosity, and output loops. Those issues can make smaller models frustrating to use, particularly in agentic workflows where a model needs to follow instructions and interact with external tools.
PrismML reports that Bonsai 2 9B uses roughly 40% fewer tokens on standard instruction-following and everyday math tasks.
That could reduce generation time and inference costs. However, fewer tokens are only an advantage if the model still produces correct, complete answers. Actual speed also depends on the hardware and inference runtime.
How does ternary quantization work?
Most conventional models represent their weights using several bits per parameter. Ternary quantization reduces the possible weight values to three choices, typically -1, 0, and +1, with scaling factors used to preserve useful weight magnitudes.
This can dramatically reduce storage requirements compared with conventional weight formats.
The result is a 9B model whose weight file is approximately 2GB, opening up possibilities for running more capable models on memory-constrained hardware.
One important distinction: the weight file is not the full memory requirement. Inference also needs memory for the KV cache, intermediate computations, and runtime overhead. The actual hardware requirements will depend on the implementation and context length.
Why this matters for local AI agents
PrismML is positioning Bonsai 2 for applications on personal computers, smartphones, and wearables.
Imagine an assistant that follows instructions, interprets visual information, and calls tools locally rather than sending every interaction to a remote server.
That could help reduce dependence on cloud inference, improve privacy for suitable workloads, and make AI features available on devices with limited resources.
The Bonsai family now spans four sizes, from 2B to 27B parameters, giving developers more options when balancing model capability against hardware constraints. Bonsai 2 also builds on the earlier 1.7B, 4B, and 8B models.
The next question is how reliably these compact models perform on real tasks. Tool-call accuracy, reasoning quality, visual understanding, and resistance to repetitive output will matter more than file size alone.
Availability: Bonsai 2 2B, 4B, and 9B are released under Apache 2.0.
Qwen Flash generated a game in about 60 minutes using a single M4 Mac mini with 16GB of unified memory paired with an RTX 3090.
The reported generation speed was around 22 tokens per second.
And this was a one-shot attempt. One prompt, one run, no extended cycle of manual fixes.
There’s still room to improve the setup. I think we could potentially cut the generation time significantly, possibly doubling the effective speed by the end of the week.
That remains a target, not a measured result, but it will be interesting to see how far the setup can go with further optimization.
The hardware combination is worth paying attention to. The M4 Mac mini provides the compact host system, while the RTX 3090 brings 24GB of dedicated GPU memory to the setup. Depending on how inference is distributed between the two machines, this can offer more flexibility than relying on the Mac mini alone.
One important distinction: 22 tokens per second is the reported generation speed, not necessarily the speed of the entire game-building process. Planning, tool calls, code execution, and any validation or repair work can all affect the final completion time.
Still, finishing a game generation run in roughly an hour with a one-shot workflow is a useful starting point.
If you bought a Mac mini during the Clawdbot craze, your purchase might not have aged quite as badly as you thought.
Polycarp Nakamoto priv/acc retweeted
Do you know the meaning of the @NousResearch logo?
The girl is called the "Nous Girl". She was drawn in July 2023 by Nous's first artist, who goes by John Galt. Yes, the Atlas Shrugged rebel
She stands for the rebellion of decentralized AI, and for keeping our humanity in the face of censorship and machine intelligence
The words around her: "Rebellion to tyrants is obedience to God."
That line goes back to 1776. Jefferson, Franklin and Adams put it on their proposed Great Seal of the United States. Congress said no, so Jefferson put it on his own personal seal instead
Nous pointed it at AI. Today's tyrants are closed labs and gatekeepers deciding who gets access to intelligence. The rebellion is open weights, open agents and open infrastructure.
That's why I build on Hermes
Wearing it proudly 🏴







































