Pinned Tweet
DoTheThing (dtt) 3.0 is out - a CLI agent you point at a task and then walk away from, and it gets it done.
New in 3.0:
- Three modes: normal runs cheap, fast models by default, --advanced swaps in Fable 5 + a GPT-5.6 Sol oracle at max reasoning, and q one-shots the small stuff.
- Model defaults auto-update separately, so they change without a release.
- Web search works REALLY well now. @Searx_engine fetches with a plain HTTP client, which Google answers with a "turn on JavaScript" stub and zero results - so the general engines run through my @nottecore fork instead, and Google/Bing/DDG actually answer.
- macOS computer use baked in via Peekaboo - it drives the screen, keyboard and mouse, no MCP server needed.
- browsermcp mode hands dtt's search + browser tools to any other agent over MCP, so you can give something stuck on a sucky Playwright interface a proper one.
dtt --update to grab it, or install from: dotheth.ing
New in 3.0:
- Three modes: normal runs cheap, fast models by default, --advanced swaps in Fable 5 + a GPT-5.6 Sol oracle at max reasoning, and q one-shots the small stuff.
- Model defaults auto-update separately, so they change without a release.
- Web search works REALLY well now. @Searx_engine fetches with a plain HTTP client, which Google answers with a "turn on JavaScript" stub and zero results - so the general engines run through my @nottecore fork instead, and Google/Bing/DDG actually answer.
- macOS computer use baked in via Peekaboo - it drives the screen, keyboard and mouse, no MCP server needed.
- browsermcp mode hands dtt's search + browser tools to any other agent over MCP, so you can give something stuck on a sucky Playwright interface a proper one.
dtt --update to grab it, or install from: dotheth.ing
7
1
11
8,137
Riccardo Spagni retweeted
Today, the calendar makes a right triangle, for the last time this century.
This Saturday is October 24, 2026.
Write it as 10/24/26 or 24/10/26, and the same beautiful relationship appears:
10² + 24² = 26²
100 + 576 = 676
But here’s what makes today special.
There are rean triples. Only a handful fit our calendar.
Using the rule
month² + day² = (last two digits of the year)²,
the month cannot exceed 12, and the day cannot exceed 31. Those small limits leave exactly 12 qualifying dates in this century.
Today is the last.
The next will be March 4, 2105:
3² + 4² = 5²
That is a wait of more than 78 years.
An infinite family of triangles. Just twelve appearances on a century’s calendar.
Happy Pythagorean Triple Day.
This Saturday is October 24, 2026.
Write it as 10/24/26 or 24/10/26, and the same beautiful relationship appears:
10² + 24² = 26²
100 + 576 = 676
But here’s what makes today special.
There are rean triples. Only a handful fit our calendar.
Using the rule
month² + day² = (last two digits of the year)²,
the month cannot exceed 12, and the day cannot exceed 31. Those small limits leave exactly 12 qualifying dates in this century.
Today is the last.
The next will be March 4, 2105:
3² + 4² = 5²
That is a wait of more than 78 years.
An infinite family of triangles. Just twelve appearances on a century’s calendar.
Happy Pythagorean Triple Day.
88
4,257
16,804
420,447
Riccardo Spagni retweeted
calling teams irresponsible for not planning formal verification is absurd. Anthropic says these proofs can take hundreds of millions of tokens. Choose a property worth proving and price the work before making it the priority.
anthropic.com/research/forma…
x.com/0xdoug/status/…
anthropic.com/research/forma…
x.com/0xdoug/status/…
At this point, if you’re in software and aren’t currently working on a plan for moving to formal verification, it’s irresponsible.
The writing is on the wall. This needs to be your priority now.
0
1
33
4,433
Riccardo Spagni retweeted
good grief, that calculation counts old PHP versions. It doesn't prove a third of the internet is permanently broken. PHP's advisory now lists source backports for 7.4, 8.0 and 8.1.
php.net/archive/2026.p…
x.com/sporadica/stat…
php.net/archive/2026.p…
x.com/sporadica/stat…
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
0
1
30
3,046
Riccardo Spagni retweeted
Space Bunny was a perfectly respectable name to put in an architecture diagram
x.com/openrouter/sta…
x.com/openrouter/sta…
Stealth model reveal 🐰
Space Bunny was OpenRouter’s #1 model for 10 straight days, processing 56.7T tokens! The most of any stealth model we’ve run.
Space Bunny hopped off OpenRouter on Oct 5. It's back today as @MiniMax_AI's M3.1 Flash, and it's free for the next 72 hours.
0
1
28
2,997
Riccardo Spagni retweeted
An invoice can tell your agent to change bank details. Give the document reader no payment tools, validate its output, and bind approval to the exact operation. The guide includes twelve local validation checks. x.com/i/article/2112…
11
1
35
2,892
Riccardo Spagni retweeted
SPACE keeps a sandbox's effective network policy across resume and forks. Changing a profile doesn't refresh existing workspaces. We argue that production approval needs a revocation test, including the services an agent can still use. x.com/i/article/2110…
8
1
35
3,950
Riccardo Spagni retweeted
the Fed's July survey reported narrower business-loan spreads, with competition a leading reason for easier terms. "no one will drop the price of credit" doesn't survive that.
federalreserve.gov/data/sloos/slo…
x.com/lukaivicev/sta…
federalreserve.gov/data/sloos/slo…
x.com/lukaivicev/sta…
Ramp, Mercury, etc fighting on 10bps of margin to keep users is confirming the theme that pricing in fintech is a race to the bottom and credit is the only moat left.
What once used to be a high margin industry:
- high deposit yield
- high interchange revenue
- high FX margins
- even trading fees
is going to 0 because of revenue sharing, just to keep customers sticky in a commoditized product that has 0 loyalty.
While getting to $100M in revenue within a few years will increasingly be possible given TAM expansion, the net margin on that growth will be minimal, because of revenue shares.
This actually strengthens my thesis that the only moat left will be credit because you can’t just simply decrease the price of risk.
With rates going up, so will the price of credit.
Credit will be harder to come by and the ones that do well in fintech will have a credit offering as it’s the only product left where the margin is now increasing while every other payment or deposits (let’s call it transactional product’s margin) is significantly decreasing because of competition.
With credit it’s pure game theory where no one will drop the price of credit given the risk of losing it all.
Credit is fintech’s LAST moat.
0
1
28
3,601
Riccardo Spagni retweeted
oh come on. handing an agent your real browser session isn't sensible as blanket advice. hostile pages can try to redirect its actions. show the permission boundaries alongside the convenience demo.
x.com/garrytan/statu…
x.com/garrytan/statu…
Giving your harnesses access to a real browser with your real credentials is a real unlock - highly recommend @AsideAI
0
1
27
3,370
Riccardo Spagni retweeted
Your agent's token works at API A. Does API B reject it? Build a local Python lab that tests audience, issuer, expiry and scopes, then remove each check to see whether the tests catch it. x.com/i/article/2110…
5
1
28
4,140
I thought ZCash was private…?
Ledger theft, day two. Since yesterday the thief has pushed ether through Tornado Cash three times, and each time on into Zcash's shielded pool. We followed every lot out the far side. Here is how, step by step.
1. THE SAME BUILD, THREE TIMES
An ether wallet pays a fresh pays four fresh wallets. The four drop it into Tornado Cash's 100, 10 and 1 ETH pools. Minutes, every time.
Run 1, yesterday 15:17: 1,254 ETH. Run 2, today 09:42: 1,291 ETH. Run 3, today 11:56: 450 ETH from 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2, in the pools by 12:15.
2. OUT OF TORNADO CASH
The mixer breaks the link between a deposit and a withdrawal. We do not need the link. Our tooling fingerprints the withdrawal transactions themselves: how each one is constructed, who constructs it, and when.
Yesterday's 65 withdrawals (1,084 ETH) and today's 96 (1,726 ETH) all carry the same signature. The six other withdrawals from those pools in today's windows do not. Run 3 came out from 12:18 into 0x0d697aa182801566d87adc86e68e95fd3b2f5f82 (213 ETH) and 0x676b16cc18542f37d202a1a79ac05463395496a4 (122 ETH), and 195 ETH of it was inside a cross-chain swap service by 12:38. Forty-two minutes, end to end.
3. INTO ZCASH, AND OUT AGAIN
The swap service turns the ether into shielded ZEC, where sender, amount and recipient vanish. But the service's own shielding of each lot is public, and from it we derive a value signature for that lot's exit, then scan every transparent exit from the pool. 108 of 108 exits across both days match their lot to the zatoshi. Not one other exit from the pool does.
First lot today: in at 10:18:18, out at 11:06:16 in block 3512847 (8d26a9b095d4d28373527f7a6eb81a3be7f906d1e2190960c0512ff64f369418 and 738c6d1261e79766e4dd16bdbd38dced91b8e3a86ce41dcda83eda1f19208fbf), straight into a ZEC to USDC order.
Today so far: 20 lots ordered (2,379 ZEC, $2.9m), 14 out, 5 inside the pool, 1 still settling. Every exit feeds a ZEC to USDC order paying two wallets born at 11:11, 22 of the 28 paid by 12:43:
0x816D5Ee17DB1495d1409F135b98FF3edc5F3cDf8: 940,561 USDC
0xBA736A4b616e79867B6d586293966b552883f3F3: 852,258 USDC
1.79m USDC, unspent. @Circle can freeze it.
(1/2) 🧵⤵️
60
28
369
20,055
Riccardo Spagni retweeted
Cloudflare's new cf CLI exposes thousands of API operations to agents. Forge generates its commands from schemas. Follow a change through the pipeline, and see what to check before replacing your CLI. x.com/i/article/2106…
0
1
26
3,907
And with that, the @paradigm Kryptos CTF 2026 season comes to an end. Huge shout out to everyone in the PK Breakers Club (which had to be renamed to PK Solvers Club because it kept tripping up Fable's cyber controls🤣)!
2
0
8
4,340
Riccardo Spagni retweeted
oh come on. a clearly labelled AI doing a mock job interview isn't scamming anyone. neither is a language tutor. you can dislike the face without pretending there's no useful job for it.
x.com/valigo/status/…
x.com/valigo/status/…
The only use cases for this is scamming people and porn. There is not a single good thing this is useful for.
0
1
26
4,334
Riccardo Spagni retweeted
your payment agent timed out after the order looked done. a duplicate webhook can send a second email. this weekend project builds a Python inbox that records signed events and tests replay after a database failure. x.com/i/article/2105…
7
2
33
3,727
Riccardo Spagni retweeted
you built an app for older people and you're annoyed they need bigger text? put their screenshot in a regression test and fix the layout.
x.com/chadappdev/sta…
x.com/chadappdev/sta…
Having an app for old people is actually the worst thing ever
They’ll email me about some UI bug and I’m sitting there wondering how I possibly missed it
Then they send a screenshot and their font size is 10x and my entire app has been rearranged like a jigsaw puzzle
0
1
26
3,831
