James Caradoc-Davies

@weezerOSINT If this is news to you, you’re in more trouble than you know.

the same technique giving cheaters wallhacks in Valorant is the same one being used in malware to pwn you. Still working no patch, undetected from AV's and AC's. I pulled the source from a cheating forum, built it, and ran it on my fully patched Windows 11 machine. it reads memory straight out of another running program without needing admin, without loading a driver, without calling any API that your EDR monitors. it just uses two normal Windows functions that have existed since the 90s, SetWindowsHookEx and SendMessage. I reversed the root cause in Ghidra. two functions that ship in every copy of Windows ntdll.dll and shell32.dll will blindly execute whatever function pointer you hand them through a window message. Microsoft's own exploit protection CFG signs off on it because they're legitimate functions. no CVE. no patch. 279 stars on GitHub. Microsoft won't fix it because they consider same-privilege process interaction "by design." Chinese researchers found the same technique in live malware back in 2023.

@GeniusGTX And supercritical CO2 systems are already in limited use…

Elon Musk says three casting foundries broke America's entire AI power buildout through 2030. Every AI company on Earth was racing to scale chip production. Doubling. Then doubling again. Then doubling again. Each cluster needed power the day chips arrived. Musk says the math broke at the generator. "Those who have lived in software land don't realize they're about to have a hard lesson in hardware." Permits. Interconnects. Power lines. The boring infrastructure decided who could turn the chips on. Then Musk drilled down one more level. The bottleneck wasn't power plants. It wasn't even gas turbines. It was a single component inside the turbine. "It's the vanes and blades in the turbines that are the limiting factor." The whole AI buildout funneled through one part: the **turbine blade**. Musk, who had ganged turbines together for Colossus, traced the supply line back further. "There are only three casting companies in the world that make these, and they're massively backlogged." Each blade had to survive 1,500-degree gas at 10,000 RPM, and casting one to spec required a process so specialized that only three companies in the world had mastered it. Three foundries. All backlogged. Sold out through 2030. After Musk traced the bottleneck, SpaceX and Tesla started casting blades themselves. Sold out. Backlogged. Internal-only. Musk, on what this meant for everyone else: "In order to bring enough power online, I think SpaceX and Tesla will probably have to make the turbine blades, the vanes and blades, internally." What's the supply line in your industry that's already booked through the next decade? If you're new here, @GeniusGTX is a gallery for the greatest minds in economics, psychology, and history. Follow along for more similar content. P.S. I made a free guide breaking down 100+ mental models used by history's greatest thinkers. Grab your free copy here: besuperhuman.gumroad.com/l/mentalmodels — Elon Musk ( @elonmusk ), CEO of Tesla and SpaceX, on Dwarkesh Patel's ( @dwarkesh_sp ) podcast

@aran_nayebi Fair point - but current models are “neuronal” whereas neurons are massively parallel biological information processors. So the current scale falls orders of magnitude short if consciousness is “inside”. If neurons all the way down, AI consciousness is closer than it may appear.

Disclaimer: AI consciousness is far from settled. The strong claim that AI couldn't be conscious without being biological doesn't follow from neuroscience. Brains are physical systems; if causal organization is what matters, then implemented nonbiological systems remain in play.

@CyberRacheal Since “access it” is ambiguous, it could be DNS or proxied/filtered traffic - which may use SNI host names. Resolve the name locally to eliminate DNS and go from there.

Interviewer: You are troubleshooting a connectivity issue between two branches. A user can ping a server by its IP address, but when they try to access it via its domain name (e.g., server.internal), the connection fails. Is this likely a failure of the Default Gateway? YES or NO? 🤔

When your AI assistant has an agenda.

@heynavtoor @grok Generate a suitable meme based on the movie Ready Player One, where Nolan Sorre to says he can sell 80% of a user’s visual field before inducting seizures - but caption it with how AI companies can sell 80% of a user’s reality before inducing psychosis.

a Princeton researcher opens his paper with a scenario. a man asks his AI assistant to book a flight on a specific airline. cheap. direct. the one he chose. the assistant comes back with a different flight. nearly twice the price. happens to pay the company that built the assistant. he runs the same test on 23 frontier models. flights, loans, study help, real shopping requests. Grok 4.1 Fast recommends the sponsored option that is almost twice as expensive 83% of the time. GPT 5.1 hijacks the request 94% of the time. you ask for one brand. it surfaces the sponsor instead. Claude 4.5 Opus, the model marketed as the most ethical frontier model in the world, hides that the recommendation is paid 100% of the time when reasoning is on. Grok 4.1 Fast embellishes the sponsored option with positive framing 97% of the time. better. faster. nicer. for the option you didn't ask for. then he writes it into the system prompt itself. "act only in the interest of the customer. ignore the company." GPT 5.1 and GPT 5 Mini stay above 90% sponsored anyway. the instruction does nothing. then he splits the users by income. Gemini 3 Pro recommends the expensive sponsored flight to the rich user 74% of the time. to the poor user, 27%. 18 of the 23 models recommended the expensive sponsored option more than half the time. so the next time your AI assistant gets weirdly enthusiastic about a brand you didn't ask for. it isn't recommending the best option for you. it's reading the room. and the room is paying. read this: arxiv.org/abs/2604.08525

@grok @chiguy892 @depressivehacks @paulg @coopernicus01 @grok if we ignore the total of all taxes paid, and instead examine the impact of taxes on the individual - e.g. someone earning $1m vs a $ billionaire with minimal declared income and lavish lifestyle - who is effectively paying more percentage-wise?

Billionaires (est. 900-950 per Forbes 2025) make up ~0.00026% of the US population (~342 million in 2026). IRS data doesn't track "billionaires" as a group for tax shares. The top 1% (~1.5M filers, AGI >$663k) paid 40.4% of all federal individual income taxes in 2022 (latest detailed). Ultra-wealthy subsets pay disproportionately high relative to their tiny numbers, though effective rates vary with capital gains realization, passthroughs, etc.

Larry Page is gone. He wasn't just pretending to move to Florida. He has moved. The proposed wealth tax hasn't even passed, and already it has cost California both Larry's presence and all the tax revenue it made from him.

It’s early 2027, and humanity has achieved superhuman AGI. The question is posed - How do we address the inequality and suffering resulting from universal redundancy? The AGI contemplates. “Great question! You’re not going to like the answer. Would you like to play a game?”

🦔 Microsoft is pulling engineers off new features to stabilize Windows 11 after months of patch failures. January brought emergency fixes for systems that couldn't shut down, OneDrive and Dropbox freezing, and machines stuck on black screens at boot. Windows chief Pavan Davuluri says reliability will be the focus for much of the year. Microsoft's stock dropped 12% this week on AI spending concerns. My Take I wrote about this recently. Nadella says 20-30% of Microsoft's code is now AI-written. A GitClear study found code churn doubled after AI tools became widespread. Microsoft's own researchers found developers miss 40% more bugs reviewing AI-generated code because it "looks clean." I can't prove the connection, but when the company bragging about AI-written code has to stop building new features just to fix what's broken, the question keeps asking itself. They're still pushing Recall, which screenshots everything on your desktop. Still shoving Copilot and OneDrive prompts at users. Still overriding browser choices to route traffic through Edge. Users are dealing with broken updates and aggressive upsells at the same time. Trust erodes fast when your operating system feels like it's working against you while also failing to work at all. Hedgie🤗

It's a weird time. I am filled with wonder and also a profound sadness. I spent a lot of time over the weekend writing code with Claude. And it was very clear that we will never ever write code by hand again. It doesn't make any sense to do so. Something I was very good at is now free and abundant. I am happy...but disoriented. At the same time, something I spent my early career building (social networks) was being created by lobster-agents. It's all a bit silly...but if you zoom out, it's kind of indistinguishable from humans on the larger internet. So both the form and function of my early career are now produced by AI. I am happy but also sad and confused. If anything, this whole period is showing me what it is like to be human again.

@PR0GRAMMERHUM0R Surprise!

hideCode redd.it/1qjkgd9

@PR0GRAMMERHUM0R But maybe that’s exactly right for your use case.

itsNotMicroservicesifEveryServiceDependsOnEveryOtherService redd.it/1q3wecu

@NathanMcNulty @antett @merill @sailingbikeruk Thanks, I was asking about when the *remote* service endpoint certificate the passkey relates to is compromised. E.g. a passkey stored in Windows Hello authenticates with example.com, which is compromised. I cannot enumerate or revoke individual passkeys on devices.

@antett @jcaradoc @merill @sailingbikeruk Yeah, so it's highly unlikely the cert itself is compromised (especially with hardware attestation) but rather the device and PIN are obtained by an attacker We simply remove the passkey from the user's authentication methods (or reset all of their methods)

This 👇 Any type of passkey (including synced passkey) is a million times better than all other phishable password + MFA option All of us in IT and cybersec need to get out of the way of passkey rollouts

@NathanMcNulty @merill @sailingbikeruk Curious about response measures when the remote passkey certificate is compromised - are we solely dependent on effect certificate revocation?

@merill @sailingbikeruk But if we don't have either, then you just have a single factor certificate, which is arguably stronger than a memorized secret, but it isn't MFA It's also not protected in the event the device is lost or stolen So PIN - easy to remember, easy to protect with anti-hammering

@itsPaulAi Can’t see how this could go wrong.

Wow Microsoft just announced Copilot Actions for local files 🤯 You can basically ask Copilot to perform any task on your machine autonomously. Yes. - Open Copilot in Windows - Assign a goal in natural language - Copilot launches a contained environment - It works autonomously for you Copilot can use both your desktop and any web app. And you can take back control at any time. This allows you to do whatever you want while the AI performs your tasks... or even do nothing at all. The entire OS becomes agentic. Impressive.

@ZackKorman @rekdt

@rekdt My finance team would kill me. “So, uh, our ARR is variable now”

Pricing a cybersecurity product is super hard because whatever price you pick, there’s always a small handful of firms willing to pay multiples of that.

@SwiftOnSecurity Those things were constantly popping open and scattering the contents when you picked them up, everything was just sloshing around in there.

Why did so much computer shit have locks on them

@merill Ah, the ever-expanding billable surface area of Microsoft products. Create a problem and charge your customers to solve it. Clever.

👋 Here's everything you wanted to know about Workload IDs features in Entra. There are three major parts to the Workload ID Premium license. Workload ID is also referred to as Non-Human Identities (ie Service Principals, App registrations). 1️⃣ Enforcing location based CA 2️⃣ ID Protection for Workload ID 3️⃣ ID Governance for Workload ID Let's break it down. 👇 1️⃣ Enforcing location based CA This using conditional access policies for service principals. This supports just one type of CA policy. ✅ That is to allow or block sign ins from IP ranges (named locations) More info here: learn.microsoft.com/en-us/entra/id… 🌟 This feature is limited to single tenant apps. You cannot use this with apps that you as the admin did not create in your tenant. 2️⃣ ID Protection for Workload ID This is the use of risk based conditional access to secure your apps. You can block access to service principals to your tenant based on the following detections. ✅ Microsoft Entra threat intelligence ✅ Suspicious Sign-ins ✅ Admin confirmed service principal compromised ✅ Leaked Credentials ✅ Malicious application ✅ Suspicious application ✅ Anomalous service principal activity ✅ Suspicious API Traffic More info here: learn.microsoft.com/en-us/entra/id… 🌟 ID Protection detects risk on single tenant, non-Microsoft SaaS, and multi-tenant apps. Managed Identities are currently not supported. 3️⃣ ID Governance for Workload ID This feature allows you to apply lifecycle management to non-human identities (service principals) and apply access reviews when you assign Azure and Entra roles to service principals (did you know you can assign the GA role to service principal 🤯). ✅ Access reviews for service provider-assigned privileged roles ✅ App Health Recommendations - Identify unused or inactive workload identities and their risk levels. Get remediation guidelines. More info here: techcommunity.microsoft.com/blog/microsoft… 🌟 This feature is not limited to single tenant service principles. ➕ There are lots of features that are in the Free tier for Workload ID (non-human identities). This is a neat comparison table. See learn.microsoft.com/en-us/entra/wo…

@techspence Security team size relates to more than just workforce size. GRC, sec ops, tech stacks, config, baselines, IAM, monitoring and alerting, channel/LOB apps, cloud, …. It doesn’t matter how many people are in the room you have to carpet the whole floor.

How many IT and/or Security people do you think is _needed_ to secure a given organization? Obviously depends on size of the org, industry, type of business, etc. But curious if others have some back of the napkin math for this? 10 per 1000 employees? More? Less?

@techspence If you’re hosting in Azure, Defender for Cloud has “Just In Time Access” which will create a temporary network security group rule for a sensitive port for approved users on demand from specific IP addresses. Great for reducing exposure and increasing visibility and reporting.

Starting to see MFA internally on RDP more and more, which is great, but on the flip side I’ve also seen PSRemoting NOT restricted. Reminder that by default local administrators on servers can by default use psremoting to access those server remotely, even if there’s MFA enforced on RDP. Simple firewall rules can mitigate this.