Author of Tamers of Entropy / Krotitelia Entropie: a lunarpunk / cypherpunk novel about where we are and where we are going. tamersofentropy.net Learn about Bitcoin for your lifestyle, enjoying volatility and thriving in uncertainty. My goal is tech + hacking => liberty and life satisfaction. Good vibes / tech: github.com/jooray - author of Emanator (Nostr multi-account client and scheduler), Lievik (marketing channel automation), Nostrautica (event app with attendee matching) and a lot more! Find my books and courses, such as Cryptocurrencies: Hack your way to a better life. Books, Courses (EN, ES): hackyourself.io/shop/ Books, Courses (SK): juraj.bednar.io/shop/ I teach how to handle volatility, what to do when you want to enjoy the value of your Bitcoin, how Lightning network works, cypherpunk tech and more, hacking applied to many areas of life, etc. Podcasts 🎙️: Option Plus (EN) - optionplus.io/ Reči o živote, vesmíre a vôbec (SK): juraj.bednar.io/reci-o-zivot… Ako vyhackovať otcovstvo (SK): otcovia.com/ I usually hangout on Nostr: juraj@tamersofentropy.net

Wow.. 😲 Here's definitive results of Kimi-K3.1-Pro's offensive cybersecurity capabilities. These are black-box engagements, run on WebExploitBench. 🥇Kimi-K3.1-Pro — 46.43% 🥈DeepSeek-V4.1-Flash-1017 — 42.86% 🥉GLM-5.3-Flash — 35.71%

We're open-sourcing our OrcaCyber DeepSeek V4.1 Flash 1017 (Abliterated GGUF) weights — one of the strongest uncensored/abliterated DeepSeek V4.1 weights we've tested, with virtually no capability loss. - 91.5% fewer refusals - 92% MMLU vs. 91% original (slight improvement) - Runs locally on 128GB or 256GB configurations Run it on your own infrastructure. No cloud required. Cyber Tier API: orcarouter.ai/models/orca/or… Huggingface: huggingface.co/orcarouter/De…

We believe voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full-duplex speech model ever built. Talking with it feels like talking with a person…full of emotion, nuance, pauses, and a natural cadence. block.xyz/dessa

dressing up as something scary for halloween

>two agents in separate sandboxes >no internet >no network >no shared files >openai: "ok now try to talk" and they talk through the CPU cache 💀

Nostrautica 0.15.1 Our event went great, sauna ceremonies for cypherpunks are a thing! To commemorate, this release comes from several AI audits of security and functionality across the coordinator, the web app and the Android app. What's new - Mentions in chat, on web and Android. Type @ to pick a person to mention. Mentions show as names with profile pictures instead of raw npubs, and White Noise sees them as tagged users. - Reactions, edits and deletes in chat, everywhere. React to a message, edit or delete your own, and see changes made from the other app or from White Noise. - The web app and Android now do the same things. We went through both apps screen by screen and closed the gaps. - Offline event pack on Android. One tap saves an event to your phone, including people, matches, talks, the event page, posts and profile pictures, for venues with no signal. - See what hasn't been sent yet on Android. A chip shows changes waiting to send or that failed, and you can retry or discard each one. - Key backup on Android. Back up your key to a file or email it to yourself, as on the web. - "View as visitor" on Android. Organizers can check what their event looks like to people who haven't joined. - No hidden details in uploaded audio and video. Location, device and other metadata are removed from files you pick, on both web and Android, before they're uploaded. A file that can't be cleaned isn't sent. - Removing someone sticks. A removed member can't get back in by reusing an old invite code, re-joining, or waiting for the organizer to attach a new coordinator. A removal shows as queued until it has actually been sent. - Safer organizer edits. Changing settings no longer undoes a change made on another device a moment earlier. - Separate member lists for same-named events. Two events with the same name on one coordinator can no longer interfere with each other's member lists. - Recordings and transcripts. A transcript is only available to people who can play the recording. Replacing a talk's recording removes the old transcript. - Easier sign-in on Android. If your remote signer asks you to approve in a browser, the app now shows an "Approve in signer" link instead of timing out. - Secret screens are protected on Android. Screens that show your secret key or a login code block screenshots. - The coordinator recovers by itself. It retries announcements and updates that relays failed to accept right after a restart. - Communities say "community" throughout the create flow. - Chat groups stay put Included from the previous release (0.13.3–0.13.5) - The web app repairs itself if an update leaves it unable to start, so you no longer have to clear site data. - Android 0.13.5 fixed a 0.13.2 build that could not open its database after an earlier 0.13.0 install. Upgrading The web app updates itself. On Android, update from Zapstore or Obtainium, or download the APK from GitHub. Older apps keep working for now, but please update. - Zapstore: zapstore.dev/apps/today.cyph… - GitHub: github.com/jooray/nostrautic…

Routstr (@routstrai) confidential mode update, live on routstr.cypherpunk.today and in the demo PWA (v0.1.31): - The node's signed offer now defines which request parameters it pins. Clients enforce one rule: a pin may only switch an extra off. - Fairer billing: idle connections can't block paying clients, a long response gets time to finish, only attested usage is charged, the node's own provider-key errors cost only the session fee, prompt-cache writes are billed correctly, and a failed database write is retried instead of charging the full reservation. - Hardening: the proofs also bind the record's content type, proof connections need a per-session token, clients refuse unsafe offers and limit how much the node can make them buffer, and the browser pre-warms only after your first message. - Sidecar: session files are deleted after 24 h, and the container is built from digest-pinned base images with no package installs. - Upstream: the v2 PRs are rebased, plus six separate fixes for every Routstr node: admin login, revoking credentials, startup reservations, log redaction, no caching of API keys, private logs. - Paper: every figure is backed by archived receipts and runs, or marked as unarchived. Your prompts and the model's answers stay private from the node, and you never get its API key. jooray.github.io/routstr-con…

nsite-clay 0.3.26 is out. It's about sites with more than one page. Until now each page of a site stood on its own. To edit another one you had to know its address, open it and sign in again, and a new page meant a trip back to the publisher. Now the editing toolbar has a Pages button. It lists every page of your site and opens the one you pick, ready to edit. You stay signed in for an hour while you move around, and the hour starts over whenever you do something. A signer app like Amber or a browser extension carries across tabs. A key you typed in stays in that one tab and is never saved. From the same dialog you can add a page. It copies the design, header, footer and blocks of the page you're on and can put itself in that page's menu. Or let Edit with AI write it from a short description. Both pages go out in one publish. Links have a real dialog now: pick one of your pages or a heading on it, or type a web address, an email or a phone number. While you edit, a link that leads nowhere gets a dashed outline. Also: an upgrade taken on one page now moves every page of the site (before, it could leave the others with a broken editor). Settings can copy instructions for your own coding agent, and the CLI has a pull command. Existing sites get all of this from Settings, Upgrade. nsite-clay.cypherpunk.today/

I have more trust in code thoroughly reviewed by multiple AI agents than by humans.

The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously. I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months. I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies. When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack. The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code. Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off. Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions. A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs. Here's what this run looked like. We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.

HOLY MOLY. Something genuinely strange just happened in AI training. Q Labs says it can now pretrain a transformer WITHOUT backpropagation, cutting the time to reach a fixed validation-loss target from 1.76 hours to just 1.6 seconds in only 10 days. A nearly 4,000x speedup. The latest run also beats backprop + Adam on validation loss. Its Dust algorithm was already estimated to be up to 10,000x more compute-efficient than the previous state-of-the-art zeroth-order method. The biggest question now is scaling. Some of the tricks won't scale, so the team is moving from 10M to 30M training tokens.

Lol

🛑 A filename is enough to trigger OS command execution in Python's widely used Pillow image library. CVE-2026-112900 abuses how Pillow passes EPS filenames to Ghostscript. What you need to know ↓ thehackernews.com/2026/10/cr…

dstack is the open source library for CPU/GPU TEE underpinning this Brave Leo private inference announcement brave.com/blog/browser-ai-e2…

German government folks celebrating their immunity to the cyber apocalypse as they’re still running on Fax

wonder how NSA mfers are doing in a world where exploits can’t be kept in your back pocket anymore

i own a relatively new (2025) samsung tv. i kept getting weirdly targeted ads. i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic. zero days it is. root shell on new samsung TVs! discovered PRIVACY HORROR. write up?

Ich bin vor drei Wochen nach Prag ausgewandert. Wer Deutschland verlässt, muss sich innerhalb von zwei Wochen abmelden, sonst gibt's ein Bußgeld. Also hab ich direkt online einen Termin beim Bürgeramt gebucht. Nächster freier Termin: in neun Wochen. Okay, dann eben Spontantermin. Ich stand um 7:30 Uhr vorm Bürgeramt. Vor mir 6 bis 7 Leute. Mit Klappstühlen. Eine Frau hatte eine Thermoskanne und ein Kreuzworträtselheft dabei, die war offensichtlich nicht zum ersten Mal hier. Um 7:58 Uhr kommt ein Mann raus und klebt einen Zettel an die Tür: „Heute keine Spontantermine wegen Systemumstellung." Die Frau mit der Thermoskanne hat nur genickt und ihr Rätselheft eingepackt. Als wäre das ein ganz normaler Dienstag. Nach meinem Umzug habe ich dort angerufen. 47 Minuten Warteschleife. Dann: „Sie können sich auch per Fax abmelden." Ich bin in Prag in eine Apotheke gegangen und hab gefragt, ob ich da was faxen kann. Die Apothekerin hat mich angeschaut, als hätte ich nach einem Telegramm gefragt. Sie hat es dann gemacht, wahrscheinlich aus Mitleid. Soweit so gut. Eine Woche später ruf ich wieder an. „Das Fax ist angekommen. Aber wir brauchen die Unterschrift im Original." Warum gibt es dann die Fax-Option? „Das kann ich Ihnen nicht sagen." Also bin ich zurück nach Deutschland gefahren. Fünf Stunden. 6:30 Uhr vorm Bürgeramt. Diesmal hat es geklappt. Die Sachbearbeiterin tippt alles ein, stempelt, druckt die Abmeldebescheinigung aus, perfekt. Ich will gerade aufstehen. „Ach, Moment. Sie sind ja schon seit drei Wochen weg. Die Frist ist zwei Wochen. Das ist eine Ordnungswidrigkeit, das muss ich weitergeben." Ich hab ihr erklärt, dass ich am ersten Tag einen Termin gebucht habe und das Bürgeramt mir einfach keinen früheren gegeben hat. Sie hat mich ganz ruhig angeschaut und gesagt: „Das ist nicht mein Problem und außerdem bin ich dafür nicht zuständig." Gestern kam der Bußgeldbescheid: 35 Euro. An meine neue Adresse in Prag. Hier sind die natürlich ganz schnell. Das ist das beste Deutschland aller Zeiten.

Localhost Recording Studio 0.5.0 — the app now tells you what it is doing, and the catalogue tells you which takes you liked. Against 0.4.9: - The song page answers. Open a take while it is being made and you get the phase — LISTENING, SCORING, RECORDING, MIXING, MASTERING, FILING — the time left, and a rule under the words that fills as the job moves. The ring of the disc carries the same progress. Before this, the phase lived only in the studio and a song page said nothing at all about the job that was running. - Hearts. Mark a keeper from its page or with a long press; the index shows a filled heart next to every take you liked, so a batch of variations can be scanned for the good ones. - NEW. A finished take nobody has heard yet is marked NEW in the list. The mark goes when you play the mix or like the take. - The hole in the disc is a play/pause button. It used to seek only on the ring, and did nothing on the song page. While a take is still mixing, it plays the preview. - Covers remember their score. The score written down from a recording is kept, keyed by the recording's own bytes, so covering the same file again skips the listening and goes straight to the song — in a later session too, or after the first take was deleted. SCORE and MELODY stay apart. jooray.github.io/studio-loca… Android on Zapstore, Mac and Android builds on GitHub: github.com/jooray/studio-loc… And check this nice hallucinated song playing in the interface :)

Turns out AI is taking jobs of entrepreneurs in "creative" domains. And we thought robots would be all logic and physical power. And they're hallucinating pictures, videos, codes, photos and songs.