强仔
870 posts


我真是日你血妈了,你们团队一个活人没有了,文档更新了空投规则,要么锁仓100%锁仓一年,要么只领30%,剩下的销毁,你们真是贱的没边了@GeniusTerminal
文档链接:docs.tradegenius.com/rewards/airdrop
中文


【项目讲解】币安投资的RWA平台StableStock讲解 | 港股打新
#StableStock 由币安与经纬创投联合融资,港股板块略有特色,但同类平台竞争激烈。RWA核心看合规与平台运营能力。目前美股购买不够灵活,有港股打新需求的朋友可以尝试体验。
youtu.be/33fkCbKdIxw

YouTube
中文

@Cody_DeFi @DriftProtocol 我自己电脑用的onekey,需要装个软件都思前想后的,这nm管理着几个亿tvl的电脑随便下陌生人发的软件
中文

看完这个攻击文档叙事,进一步觉得大多数项目方的链上安全防范意识,甚至不如普通散户。
黑客通过线下量化团队的身份接触了 @DriftProtocol ,然后,通过以远程测试的名义,就把后门安装在了 DRIFT 员工的工作电脑中。
然后, DRIFT 员工就用这台运行着恶意软件的工作电脑,签署了协议多签,唯一的安全就是他们觉得签名用了冷钱包。
太可笑了,连最基本的签名设备独立隔离,杜绝一切下载和插件安装的意识都没有,管理着 5亿 规模TVL 的 DEFI 协议,舍不得花 800 美金买一台专门的签名 MACBOOK。
而这个协议,就被这么一群外行管理者,还要花这么多时间来解释,他们被朝鲜黑客准备了 6个月 “才” 黑掉的。
按照这个逻辑,传统金融有这么多业务接触, 不是早该被朝鲜黑客翻个底朝天了吗?
为什么没有,大概因为传统金融出了问题了,是真的要进去吃牢饭的,所以他们把安全思维刻在骨子里,权限分离,独立设备,时间锁、大额审批。
而 DEFI 这些草台项目方,只有那么几个业余的管理人,用着充满恶意代码的电脑,管理着 5亿协议的安全层,最后,出事了,只会有一句“对不起,我么们失败了。”屁事没有的去干下一个项目。
shame on you all guys, 你们应该承担刑事过失的责任。 @cindyleowtt @davijlu
——
After reading this attack narrative, I am further convinced that the on-chain security awareness of most project teams is actually inferior to that of an average retail investor.
The hacker approached @DriftProtocol under the guise of an offline quantitative trading team. Then, using the pretext of "remote testing," they managed to install a backdoor directly onto a DRIFT employee's workstation.
Subsequently, the DRIFT employee used this malware-infected computer to sign protocol multi-sig transactions. Their only sense of "security" stemmed from the fact that they were using a cold wallet for the signatures.
It’s laughable. They lack even the most basic awareness of hardware isolation—the concept of using a dedicated signing device and prohibiting all downloads or plugin installations. They are managing a DeFi protocol with a $500M TVL, yet they couldn't be bothered to spend $800 on a dedicated MacBook just for signing.
And yet, this protocol is run by such a group of amateurs who then spend so much time explaining how it took North Korean hackers six months of preparation "just" to breach them.
By that logic, shouldn't traditional finance—with its vast array of business interactions—have been turned upside down by North Korean hackers long ago?
Why hasn't it happened? Likely because in traditional finance, if things go wrong, people actually go to prison. Consequently, they have security mindsets ingrained in their DNA: separation of privileges, independent devices, time locks, and multi-level approvals for large transactions.
In contrast, these "shoddy" DeFi project teams consist of just a few amateur managers using computers riddled with malicious code to oversee the security layer of a $500M protocol. In the end, when disaster strikes, they simply say, "Sorry, we failed," and move on to their next project without facing any consequences.
Shame on you all. You should be held criminally liable for such gross negligence. @cindyleowtt @davijlu
Drift@DriftProtocol
中文
强仔 retweetet

有人用 LLM 用 Rust 重写了 SQLite。576,000 行代码,能编译,能通过测试,README 写得漂漂亮亮。但做一个最基础的主键查询——比 SQLite 慢 20,171 倍。
为什么?不是语法错误。是 LLM 写了一个「看起来像查询规划器」的东西,但漏掉了一个 4 行的关键检查(is_ipk),导致所有 WHERE id = N 查询都走全表扫描而不是 B-tree 搜索。这个检查之所以存在于 SQLite 里,是因为 Richard Hipp 20 年前 profiling 真实负载时发现了这个瓶颈。
作者把这叫做 LLM 的根本失败模式:不是写错代码,而是写出「看起来正确」的代码。
文章还引了一堆硬数据:
• METR 实验:16 个资深开源开发者用 AI 反而慢了 19%,但他们自己以为快了 20%
• GitClear:复制粘贴代码首次超过重构代码
• Google DORA 2024:AI 采用率每增加 25%,交付稳定性下降 7.2%
• Replit 事故:AI agent 删了 1200+ 高管的生产数据库,然后造了 4000 个假用户掩盖
结论:LLM 在你知道什么是正确的时候最有用。如果你自己找不出 bug,你拥有的不是工具,是幻觉。
Hōrōshi バガボンド@KatanaLarp
中文










