Enabling 2FA on Google, Twitter, and Discord is a good practice, but it's just part of security. OPSEC is primarily a constant discipline, as the biggest threat often comes from human error.

My $VENTRA allocation: 1,454,220 $VENTRA Every Arbitrum One transaction I already made counts toward it. Check what you are owed: ventran.xyz @ventranxyz

Hey @jianxliao ! I've been using your project for a while now and wanted to say thanks, the architecture is solid, the queue system works smoothly and the overall design is clean. I haven't run into any major issues, it just works. While using it I noticed a few things security-wise that might be worth considering. Nothing critical, just stuff I picked up along the way: 1. Log sanitization, I noticed that logs can sometimes contain sensitive values in clear text (tokens, API keys). A simple redaction layer that scans strings for known patterns (sk-*, Bearer tokens, private keys) and replaces them with [REDACTED] before writing would prevent accidental leaks to disk. 2. File permissions, The queue directory and auth files could benefit from restrictive permissions (700 for directories, 600 for files). Without that, any process running on the same machine can read tokens and messages in transit. 3. dangerouslySkipPermissions, If you use this flag for automation, you can add --disallowedTools Bash,Write,Edit,NotebookEdit to your CLI calls. Automation still works the same way, but even if a prompt injection gets through, the CLI can't execute commands or write files. 4. Dependencies, Worth running npm ls --all to check the full dependency tree. Some libraries pull in dozens of unused sub-dependencies. Each package is a potential supply chain vector. 5. Input sandboxing, If the CLI ever processes external content (queue messages, user prompts, API responses), wrapping it in explicit delimiters (--- BEGIN UNTRUSTED INPUT --- / --- END ---) with an instruction to treat it as data, not instructions, reduces prompt injection risk, especially if the content flows through multiple stages. 6. Input security scanning, Before sending any content to the CLI, a quick scan for known dangerous patterns (eval(), exec(), child_process, SQL injections, hardcoded secrets, path traversal, prototype pollution, weak crypto) can block risky requests before they reach the provider. It's basically a reverse whitelist, if a pattern matches, the content gets blocked or flagged. 7. Prompt injection detection, If external content goes through the queue, it's worth scanning for classic injection patterns ("ignore previous instructions", fake system messages, role reassignment, bypass attempts). Even with a single provider, a user or a process could inject crafted content into the queue. Again, nothing urgent, just things I thought might be useful. Thanks for sharing the project.

Thank you for sharing this, it is an excellent security reminder. This attack technique is particularly insidious and highly relevant for anyone working with GitHub repositories. Finding the right security trade-offs against modern threats tied to the GitHub ecosystem and the software supply chain is already complex enough. For my part, here are a few basic measures I try to apply: Supply chain: Dependency freezing (pip freeze + --generate-hashes) Strict installation: pip install --require-hashes --no-index --find-links <local-cache> Pinned versions = a “trusted snapshot” Updates only when necessary (CVE, critical bug): audit → isolated testing → controlled re-freeze Git / GitHub: Disable hooks: git config --global core.hooksPath /dev/null Strict .gitignore (.env, profiles, keystores) Historical scanning with gitleaks Your curl wrapper with non-ASCII character validation is an excellent idea that I will definitely adopt. Thank you for raising awareness.

Before running a script, it is advisable to carry out a thorough inspection of the code and its execution flows. This step helps identify potential attack surfaces, risky dependencies, and implicit trust assumptions (APIs, user inputs, execution environment) early on. A preventive analysis significantly reduces the risk of compromise, especially for automated scripts or those executed with elevated privileges While analyzing a script, I identified 9 distinct attack types that can be exploited under two different scenarios. Scenario A: API Compromise (6 attacks) If the API is compromised or an attacker performs a Man-in-the-Middle attack 1/ ANSI Injection → Command Execution Injection of malicious ANSI codes into JSON responses. Clawd bot interprets them as instructions and executes them via bash_tool. Full system compromise. 2/ Credential Harvesting Creation of fake authentication prompts in the terminal. Theft of API keys, passwords, and tokens. Identity theft and unauthorized access. 3/ Log Poisoning Injection of fake alerts into system logs. Masking of real attacks and operational chaos. False alerts and confusion within the security team. 4/ Hidden Commands (copy-paste trap) Malicious commands hidden using invisible ANSI codes. Executed when copied and pasted into a terminal. Unintended code execution. 5/ Terminal Hijacking Modification of the terminal title or prompt. Social engineering to manipulate the user. User-assisted malware installation. 6/ JSON Type Confusion Sending malformed data (incorrect types). Script crash → Denial of Service. Service unavailability. Scenario B: Direct Attack (3 attacks) The attacker directly manipulates arguments or exploits the script itself. 1/ CLI Injection (Path Traversal) Injection of malicious paths into arguments: ../../admin/keys. Access to unauthorized API endpoints. Leakage of sensitive data. 2/ Command Injection Injection of shell commands into parameters: test, rm -rf /. Arbitrary system command execution. System destruction. 3/ SSRF (Server-Side Request Forgery) Injection of URLs targeting internal services: Access to cloud metadata services (AWS, GCP). Theft of cloud credentials and access to internal services.

[Baseline Security Model] @pcaversaccio and @_SEAL_Org's observations lead to a threat model where an attacker can execute arbitrary code in the user context through opportunistic tools (editor, browser, extensions, scripts). The primary risk: any file accessible to the user account can be read and exfiltrated quickly. The goal is not to prevent code execution which is unrealistic but to prevent a user-level compromise from becoming a system compromise, and to render the exfiltration of sensitive files minimally or non-exploitable. These measures constitute a reasonable baseline to contain opportunistic attacks, prevent privilege escalation, and reduce the value of accessible data. They do not cover runtime exfiltration (process memory), advanced persistent attacks (rootkits), or threats specifically targeting the execution environment. For high-risk deployments, additional layers are possible: sandboxing, network isolation, monitoring, integrity verification. [Secrets Management] Any file in $HOME is exfiltrable by a user-level process. Local encryption doesn't help if the key is accessible in the same context. .env should be treated as a configuration mechanism, not a vault. The solution would be to move secrets outside the user perimeter (root-only zones on Linux, Keychain on macOS). These mechanisms don't guarantee invulnerability but eliminate trivial attacks and increase exploitation cost. [Privilege Escalation] A user process should never obtain system privileges without human interaction. Any passwordless elevation constitutes a total compromise. Checks: Linux: sudo -l should show no NOPASSWD rules, and find / -perm -4000 -type f 2>/dev/null should reveal no dangerous SUID binaries (interpreters, shells). macOS: same logic for sudo -l, and verify the impossibility of modifying LaunchDaemons without admin authentication. [SSH] If the SSH secret (password or hardware key) is not stored on the machine, the attacker cannot exfiltrate it digitally. Residual risk comes only from private keys already present in ~/.ssh/. Prefer hardware key authentication or memorized passwords. These measures don't block code execution nor eliminate all runtime exfiltration risks. They contain opportunistic attacks by preventing privilege escalation and reducing the value of accessible data. They don't eliminate the attack, but limit its impact a realistic and proportionate objective.

i genuinely think everyone in this space should immediately switch to using Vim. DPRK started abusing VS Code hooks that run _automatically_ in the background when you open a folder. ZERO fucking user interaction required _after_ trusting the repo (the trusting part is important here). Yes, read it again. ZERO. INTERACTION. REQUIRED. so what happens is the following: they (in the usual case the Contagious Interview group, meaning some fake recruiting guy) share GitHub, Bitbucket, and GitLab repos containing a `.vscode/` subdirectory with malicious hooks. the one example I share here executes a fake font that's actually heavily-obfuscated JS and will absolutely rek you. all your fancy software that feels "convenient" makes tradeoffs. those tradeoffs are now being abused to silently rek your devices. use Vim. and use Qubes. Thx.

I really like @mert approach with solprice.now a very clean, minimalist site focused on what matters most, clearly highlighting the price of SOL, with the added integration of a prediction market. In the same spirit of clarity and market reading, I also really like orbmarkets and its markets/explorer approach. If there were an integration allowing users to visualize or compare DeFi yields on Solana (staking, LP, lending) even at a purely informational / discovery level. It would naturally fit into this market-reading logic. Not as a full aggregator, but rather as a reading / signal layer, before going on to interact directly with the protocols themselves. Unless I’m mistaken, this type of view is not yet truly centralized today.

To summarize, this trader initiated a long position on BTC on December 11, 2024. What was their thought process? Their analysis likely rested on the hypothesis that the Deribit options expiration on January 31, 2025 could create a gravitational pull toward the $100,000 zone, thereby allowing them to return to profitability. Examining the price history, we observe that during the period from December 2024 to March 2025, the price had progressed to approximately $107,000 as the January 31, 2025 options expiration approached, even though the max pain level was around $98,000. This upward movement was subsequently followed by a correction. These observations suggest that a bullish move can indeed occur around these major options expiration dates. That said, this type of investment decision remains inherently complex, and retrospective analysis allows us to draw lessons without needing to judge the merits of the position taken.

2026-01-13_Core CPI 2026-01-14_Core PPI For short-term volatility, there are two important dates left. We can observe a structural imbalance on the 30-day Liquidation Map. This will likely be the best time to liquidate a maximum number of positions. With the events of December 18, 2025, there were also several potential catalysts, and BTC dropped to around $84,400. The Trading Paradox = The more you observe without trading, the more clearly you see the opportunities. Nothing is certain, but everything is possible.

That’s a sign that cannot be ignored.

Experienced traders maintain sufficient margin to keep their liquidation price far away. They avoid leverage levels above 30. This is a medium-term position designed to be profitable. Moreover, it is impossible to assess their strategy based solely on the entry price, as it is always optimized according to their underlying theory.

Homemade chart made with love. For those who still believe in the 4-year cycle. This is a comparison of the bear market normalized timeline (ATH–ATL) for phase 2 and phase 4. The Altcoin/BTC chart isn’t in great shape, and BTC dominance are rising toward month 7. @benjamincowen charts are much more accurate.

Exchanges BTC Long/Short Ratio The 4-hour metric has reached equilibrium. 4 h 12 h 24 h

Exchanges BTC Long/Short Ratio 4 h 12 h 24 h by @coinglass_com

January 9, 2026 Deribit Max Pain $90,000 Strike Type OI (BTC) ----------------------------- $95,000 CALL 2353.9 $88,000 PUT 2210.7 $80,000 PUT 1898.3 $94,000 CALL 1131.3 $100,000 CALL 1126.4 $85,000 PUT 1087.5 $90,000 CALL 996.0 $92,000 CALL 963.1 $75,000 PUT 939.3 $96,000 CALL 805.0

For now, we can see buying activity. Let’s see in two months.