Pinned Tweet
1/ I build AI and digital infrastructure across the wider Caribbean and other Small Island Developing States, starting in Barbados.
Search. Local knowledge. Language. Government. Culture.
Here's what I'm building, and what I've learned putting it into production. 🧵
Search. Local knowledge. Language. Government. Culture.
Here's what I'm building, and what I've learned putting it into production. 🧵
5
2
19
6,097
Matt Hamilton retweeted
I guess Chinese models really were the biggest threat…
273
1,163
16,806
515,937
This is so good. Really does show when you have people who understand the built environment in charge. Reminds me of when @GeorgeFergusonx was mayor of Bristol.
LA’s new Mayor Nithya Raman is a Harvard and MIT-educated public planner—and it shows ✨
1
3
20
2,918
Where is the massive rush of all the 2A militia people? Isn’t the whole point of the 2A that they have the right to bear arms to fight back against this tyranny?
Don’t worry. I know the answer. They are too busy licking boots.
Don’t worry. I know the answer. They are too busy licking boots.
Let this sink in: ICE agents reportedly blocked the emergency entrance of a Los Angeles hospital for TWO HOURS, forcing ambulances carrying people who needed emergency care to go elsewhere.
This isn’t law enforcement. This is a reckless abuse of power that put innocent people’s lance entrance is not a political battleground. A hospital emergency room is not an immigration checkpoint.
And federal agents do not get to hold an entire community’s access to emergency medical care hostage.
Imagine being in an ambulance, fighting for your life, only to be diverted because federal agents decided their operation mattered more than emergency access.
Where is the humanity? Where is the accountability? And where is the line that these agents are no longer allowed to cross?
You cannot claim to be protecting America while putting Americans’ lives in danger.
This isn’t making America great. It’s making America cruel. And anyone defending this should be ashamed.
9
0
17
2,577
Matt Hamilton retweeted
An OpenSSH bug that took 46 years to ripen!
1980
UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password.
2012
The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead.
Guess which one?
The same asterisk: *.
Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *.
2016
OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time.
2022
Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images.
… and the loop closes!
You connect over SSH as root (whose shadow entry is *).
You type any password longer than 256 characters (e.g. 300 As).
crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root.
That chain took 46 years (!!!) to complete.
Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.
1980
UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password.
2012
The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead.
Guess which one?
The same asterisk: *.
Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *.
2016
OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time.
2022
Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images.
… and the loop closes!
You connect over SSH as root (whose shadow entry is *).
You type any password longer than 256 characters (e.g. 300 As).
crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root.
That chain took 46 years (!!!) to complete.
Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.
🚨 Critical OpenSSH flaw allows passwordless account access using any password over 256 characters
sshhole.com
A newly disclosed vulnerability dubbed *sshole has been discovered in OpenSSH installations using musl libc, potentially allowing attackers to bypass access to accounts that should reject password logins entirely.
The flaw affects certain configurations of Alpine Linux, OpenWrt, Buildroot, and Yocto where PAM is disabled and password authentication remains enabled. Under specific conditions, attackers can authenticate to locked accounts using arbitrary passwords between 257 and 1,024 characters.
The researcher demonstrated that affected Alpine Linux cloud images could allow attackers to gain root privileges through a passwordless administrative account.
OpenSSH 10.6p2 addresses the issue. Administrators are urged to update immediately or disable SSH password authentication until patches can be applied.
97
553
4,315
221,807
The backstory: x.com/redhotnerd/sta…
Ok, I didn’t expect a story time on Saturday, but here we go. What I’m about to write is TRUE. It is insane, stupid, and very dumb, but it is true. Earlier today Donald J Trump, the p[resident of the United States, posted that he had offered the job of Press Secretary to Dana White. Well, it was the wrong Dana White… 🧵
1
0
0
443
I thought this must be parody. But nope. It’s real. The regime that struggles to even pronounce someone’s name and comes out in hives if they have to try, is bringing a guy literally called “Islam”.
Trump: “I am pleased to announce that the Great Dana White, a violent Fighter and Warrior, has been offered the job of Press Secretary of the United States. I have requested that he bring with him assistants, even though some are not from our Country, of Islam Makhachev, Khabib ethje, Daniel Cormier, Amanda Nunes, and Kayla Harris. We need these people to defend us against the Lunatic Left. Dana will be a Press Secretary like none other. Dana, please take the job! President DONALD J. TRUMP”
7
1
17
2,701
Random Q: just in the supermarket and saw they sell singular toilet paper rolls. Ok, so this may be a privileged view, but who the hell buys *single* rolls of toilet paper? That is living dangerously.
26
1
43
18,315
Matt Hamilton retweeted
Four Bittensor subnets pushed the AI frontier in just 24 hours.
On the latest Novelty Search, @const_reborn highlights major advances from @MacrocosmosAI, @trishoolai, @reliquary_ai and @chronollm across decision models, AI safety, decentralized training and historical LLMs.
REAX and Reliquary also join to discuss their latest research and results.
Full episode in the first comment
On the latest Novelty Search, @const_reborn highlights major advances from @MacrocosmosAI, @trishoolai, @reliquary_ai and @chronollm across decision models, AI safety, decentralized training and historical LLMs.
REAX and Reliquary also join to discuss their latest research and results.
Full episode in the first comment
12
50
308
11,192
🤣🤣🤣🤣 I really should stop posting about the stupidity of MAGA and the current admin. But they just make it so easy.
Rewards for Justice is offering a reward of up to $20 million and possible relocation for information about Iran’s nuclear program, including its facilities, equipment, and associated personnel, such as those in the scientific community, or the movement of any of the above.
t.co/A8uRQJSosj
13
22
160
6,025
Matt Hamilton retweeted
Bittensor’s open competition just produced a world-leading AI decision model.
REAX 1.3 has the highest score among 270+ entries on the Decision Index hosted on @huggingface, ahead of leading models from Perplexity and Fastino.
REAX 1.3 has the highest score among 270+ entries on the Decision Index hosted on @huggingface, ahead of leading models from Perplexity and Fastino.
🥇 REAX 1.3 is #1 on the Hugging Face Decision Index.
We produced the best decision model in the world.
274 models. One top spot. Built on Bittensor $TAO.
Four weeks ago, Subnet 92 didn't exist. Then the miners went to work: an open competition, two selected miner models, one ow REAX 1.3 sits at the top of Decision Index 0.4.1 with a Full score of 74.0.
This is what decentralized AI looks like when it ships.⚡
Live today on a Jev-compatible API
decisionmodels.io
huggingface.co/spaces/multimo…
9
50
284
10,427
Matt Hamilton retweeted
Another Bittensor release which shouldnt go silently. This is a full top to bottom model, pre-trained on Teutonic (3) and then post trained in a competitive environment to reach coding performance above Qwen's flag ship 9B model.
These models are small sure, put these performance metrics are not, and the thing to watch here is alignment -- the team was able to aim a laser cannon at intelligence production and punch through SOTA weight class.
Every day something new. Congrats @reliquary_ai
These models are small sure, put these performance metrics are not, and the thing to watch here is alignment -- the team was able to aim a laser cannon at intelligence production and punch through SOTA weight class.
Every day something new. Congrats @reliquary_ai
We’ve released Teutonic-I-Reliquary, a 9B model post-trained entirely on Bittensor using untrusted GPUs, from RTX 3090s to B200s.
It beats Qwen3.5-9B on SWE-bench Verified, scoring 43.6% vs 35.1%.
3
57
353
10,570
Matt Hamilton retweeted
A Bloomberg journalist thinks ChatGPT might have just changed how this election turned out.
34
152
1,399
105,985
Matt Hamilton retweeted
The irony being that the more likely outcome from this war Trump started is a regime change in the US, not Iran.
13
4
46
6,525
