Pinned Tweet
New research areas and how you can get involved!
Working on a narrative shift on AI uncovering real stories from builders. x.com/i/article/2092…
Working on a narrative shift on AI uncovering real stories from builders. x.com/i/article/2092…
8
4
26
3,437
Surveillance Capitalism
If you've ever wondered why smart TVs are so cheap, this is why.
@log4j rooted his Samsung and found an always-on hot mic, automatic content recognition, geolocation, network mapping, ad targeting and user profiling, shared with Samsung's "400 partners".
A lot of it can be te a basic guide below.
What your TV is doing
The main culprit is ACR (automatic content recognition). Your TV screenshots what's on screen, fingerprints it, and sends it home to build your ad profile. Samsung does it every 500ms, LG every 10ms [1].
What is insane: it happens on connected devices too.
Plug in your laptop, your console, your work machine, and your TV can fingerprint that via HDMI [1].
He also found that if your Samsung doesn't have a mic, it'll look for one from a connected soundbar or bluetooth device.
x.com/log4j/status/2…
It's on by default, and you likely agreed to it on the setup screen you clicked through in 10 seconds.
Step 1: Turn off ACR
Samsung: Terms & Privacy → Viewing Information Services
LG: Live Plus
Vizio: Viewing Data
Roku: "Use info from TV inputs"
Sony/Google TV: Samba Interactive TV
Menus vary by model, but those are the names to look for. While you're in there, opt out of interest-based ads, reset your advertising ID, decline every optional privacy agreement, turn off voice recognition, and delete apps you never open.
Step 2: Give smart devices their own network
Put the TV, cameras, speakers and vacuum on your router's guest/IoT network. The logic is simple: these devices rarely get patched. If one gets compromised (getting drastically more frequent with AI), it shouldn't be able to see your other devices or home network.
Step 3: Block trackers for the whole house with DNS-level filtering
NextDNS (cloud-based) is easy and has a solid free plan. Pi-hole is a little bit more work if you prefer self hosting. For simplicity we'll focus on the former.
1. Sign up at nextdns.io (free tier is plenty)
2. Privacy tab: add a blocklist (OISD is a good bet) and turn on Native Tracking Protection for Samsung, LG, Roku, Amazon (see attached image)
3. Setup tab: copy your endpoint
4. Paste it into your router's DNS settings as DNS-over-HTTPS/TLS (or use the IPs + "Link IP" if your router only does plain DNS)
5. Bonus: block outbound port 53 except to your router. Some devices hardcode their own DNS to get around you
Then open the NextDNS logs and watch how often your TV phones home. It's eye-opening. If an app or update breaks, find the domain in the logs and allowlist it.
Why they do this
TV prices are down 97% since 2000 [2]. Most of that is better manufacturing and brutal competition. But once margins on the hardware hit zero, the cost moved to you.
In Q3 2024, Vizio lost $6.7M selling TVs and made $115.8M in gross profit from ads and viewing data [3]. They've said on earnings calls that they keep TV prices low to grow the audience they sell to advertisers. Walmart bought them in 2024.
This isn't a conspiracy theory either. Vizio paid $2.2M to the FTC in 2017 for tracking 11 million TVs without consent. Last December, Texas sued Samsung, LG, Sony, Hisense and TCL over ACR. Samsung and LG have since agreed to stop collecting that data without explicit consent [4].
TL;DR
1. ACR off
2. Ads + voice off
3. Smart devices on their own network
4. NextDNS filtering on the router
Sources:
[1] ACR study: arxiv.org/abs/2409.06203
[2] Cost of US consumer goods: aei.org/economics/char…
[3] Vizio Q3 2024: sec.gov/Archives/edgar…
[4] Texas v. Samsung: texasattorneygeneral.gov/news/releases/…
0
0
1
110
RT @rileybeans_: I'm seeing a large increase in boredom. People want to participate because they're not sure where they fit anymore, want t…
0
0
0
I'm seeing a large increase in boredom. People want to participate because they're not sure where they fit anymore, want to make new friends, and refine their personality but they don't necessarily know where to start.
Build more communities.
Build more communities.
1
0
16
529
Yes, sorely needed! Happy to see them paying more attention to community activation
.@OpenAI is hiring a community communications lead
salary is up to $266K in SF / NYC (hybrid), plus equity!
your focus will be bringing openai’s products closer to communities and helping their stories reach a wider audience
you’ll shape narratives, develop earned media opportunities, and amplify community-driven stories across organic comms channels
apply here: jobs.ashbyhq.com/openai/c292199…
0
0
3
506
rileybeans 💖 retweeted
This might sound crazy.
But one of the skills you NEED to learn is how to deal with a more and more illiterate society full of emotionally dysregulated people.
If you keep getting frustrated every day over how "ďumb" everything/everyone seems, the stress of it is going to wreck your mind.
But one of the skills you NEED to learn is how to deal with a more and more illiterate society full of emotionally dysregulated people.
If you keep getting frustrated every day over how "ďumb" everything/everyone seems, the stress of it is going to wreck your mind.
387
5,254
28,668
516,854
rileybeans 💖 retweeted
We believe voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full-duplex speech model ever built. Talking with it feels like talking with a person…full of emotion, nuance, pauses, and a natural cadence.
block.xyz/dessa
block.xyz/dessa
4,117
6,968
67,930
13,033,646
rileybeans 💖 retweeted
Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model.
🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal.
🔹 Full-project coding: games in Unreal, Unity & Godot.
🔹 Excels at parametric 3D modeling in Blender & CAD.
🔹 More reliable at finance with hallucination down by 65%.
🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks.
Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API.
Open weights by Nov 4, 2026.
🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.ai/blog/kimi-k3-1…
🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal.
🔹 Full-project coding: games in Unreal, Unity & Godot.
🔹 Excels at parametric 3D modeling in Blender & CAD.
🔹 More reliable at finance with hallucination down by 65%.
🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks.
Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API.
Open weights by Nov 4, 2026.
🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.ai/blog/kimi-k3-1…
1,217
3,152
29,568
3,637,349
Brilliant idea!
i spend most of my day talking to ai now.
i work from home, i haven’t been to a conference in ages, and at some point i realised i’m barely having real conversations with people anymore. which is a problem, because i always find my greatest inspiration comes from having people.
so i’m running a small experiment: 100 conversations over the next few months with friends, strangers and a maybe a few enemies if they’re up for it. just 25 minutes of your time, and we can talk about whatever you want, or i’ll come with some easy questions.
i think of it a bit like reading 100 books, so if you have a book you’d recommend, bring that too.
1
1
1
595
rileybeans 💖 retweeted
70% of the internet was vulnerable yesterday to very bad security flaws inside a coding language. Turns out, *one volunteer* is mostly responsible for maintaining that code & helping push updates. Yesterday Ondřej Surý saved the internet. So I called him up. He rules. theatlantic.com/technology/202…
10
316
1,138
67,676
rileybeans 💖 retweeted
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
Everyone in tech is panicking about security right now. But outside of it, almost nobody knows anything is wrong.
I wrote this so you don’t have to be the one explaining it to your family.
Just send them this.
290
3,281
15,612
1,044,947
Story time! In my early 20s I lived with a few hackers. Hacker Quarterly for bathroom reading material and all kinds of hardware strewn about the house
We mapped the city’s open wifi networks by bike to secure them
One night I asked my roommates to show me what he can do
We mapped the city’s open wifi networks by bike to secure them
One night I asked my roommates to show me what he can do
3
0
4
465
The point is, since working a career securing networks and protecting billions of dollars in assets, you should absolutely be worried about this week’s discoveries. This is just the beginning.
0
0
1
45
This is what solidified my interest in a career in network engineering and security.
He showed me how easy it was for him to clone my mobile banking session while on the same network.
The point is to never, ever, assume you're safe on the internet.
He showed me how easy it was for him to clone my mobile banking session while on the same network.
The point is to never, ever, assume you're safe on the internet.
1
0
1
65
After spending years in crypto witnessing a crazy amount of exploits and vulnerabilities, the tech industry taught me something else.
It forces you to never truly trust anyone (and I do mean anyone), at least not the same way you once could in other communities.
It forces you to never truly trust anyone (and I do mean anyone), at least not the same way you once could in other communities.
1
0
2
48
My question is, why did it take them this long to find all these vulnerabilities and alert us since Mythos, Opus 5.5, Astra and Sol 6.1 have been out for quite some time?
2
0
2
340
Jesus Christ, another one
‼️ BREAKING: Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
Details: cybersecuritynews.com/emergency-java…
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM.
The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component.
Oracle rates exploitation as low complexity, with no authentication or user interaction required. Successful attacks can expose or change sensitive data, although the risk matrix lists no availability impact.
#cybersecuritynews #vulnerability
0
0
1
305
rileybeans 💖 retweeted
Quest Diagnostics has been hacked. Patient data was exposed. They serve roughly half of U.S. hospitals and physicians. Investigation ongoing.
501
2,819
14,010
2,479,861
rileybeans 💖 retweeted
AI IS AMAZING
I know it's hip to worry about the decline in book reading and how chatbots will impoverish our brains.
But TBH, this is not at all what I see. I wrote about how we're in this wild moment for intellectual flourishing and how all of us are the children of dancers.
I know it's hip to worry about the decline in book reading and how chatbots will impoverish our brains.
But TBH, this is not at all what I see. I wrote about how we're in this wild moment for intellectual flourishing and how all of us are the children of dancers.
156
117
1,576
383,893