Vinícius Pinheiro

Office should be a cold 68F environment with extreme silence, occassional equipment noise. "Co-working" places are like a fake office where leisure and fucking around is central to its mission. Doesn't seem like a place where deep work can happen, where excellence has a chance.

A security researcher just documented a large-scale counterfeit Ledger Nano S Plus operation selling compromised devices across multiple online marketplaces. The fake units look identical to the real thing but contain completely different hardware. Instead of Ledger's secure element chip, the counterfeits run an ESP32 microcontroller with modified firmware labeled "Nano S+ V2.1." Seeds and PINs are stored in plain text and transmitted to attacker-controlled servers. Any wallet initialized on the device is drained. The operation goes beyond the hardware. The sellers also distribute a fake version of Ledger Live built with React Native and signed with a debug certificate. It intercepts transactions and exfiltrates sensitive data to multiple command-and-control servers. The campaign spans five attack vectors: compromised hardware, Android APKs, Windows executables, macOS installers, and iOS apps distributed through TestFlight to bypass App Store review. This comes days after ZachXBT documented a separate fake Ledger Live app that made it through Apple's Mac App Store review process. That operation drained over $9.5 million from more than 50 victims, including musician G. Love, who lost 5.92 BTC after entering his recovery phrase into what he believed was the legitimate app. The pattern is clear: the attack surface for hardware wallet users has shifted from firmware exploits to supply chain and distribution fraud. The devices themselves remain secure. The problem is that users are being intercepted before they ever touch a real one. Ledger's own "genuine check" feature can be bypassed when the hardware itself is compromised at the source, which makes where you buy the device as important as how you use it. The rules haven't changed, but they've never been more important: buy hardware wallets only from the manufacturer. Never enter your recovery phrase into any software. If a companion app asks for your 24 words on a screen, it's a scam. Every time.

A security researcher just documented a large-scale counterfeit Ledger Nano S Plus operation selling compromised devices across multiple online marketplaces. The fake units look identical to the real thing but contain completely different hardware. Instead of Ledger's secure element chip, the counterfeits run an ESP32 microcontroller with modified firmware labeled "Nano S+ V2.1." Seeds and PINs are stored in plain text and transmitted to attacker-controlled servers. Any wallet initialized on the device is drained. The operation goes beyond the hardware. The sellers also distribute a fake version of Ledger Live built with React Native and signed with a debug certificate. It intercepts transactions and exfiltrates sensitive data to multiple command-and-control servers. The campaign spans five attack vectors: compromised hardware, Android APKs, Windows executables, macOS installers, and iOS apps distributed through TestFlight to bypass App Store review. This comes days after ZachXBT documented a separate fake Ledger Live app that made it through Apple's Mac App Store review process. That operation drained over $9.5 million from more than 50 victims, including musician G. Love, who lost 5.92 BTC after entering his recovery phrase into what he believed was the legitimate app. The pattern is clear: the attack surface for hardware wallet users has shifted from firmware exploits to supply chain and distribution fraud. The devices themselves remain secure. The problem is that users are being intercepted before they ever touch a real one. Ledger's own "genuine check" feature can be bypassed when the hardware itself is compromised at the source, which makes where you buy the device as important as how you use it. The rules haven't changed, but they've never been more important: buy hardware wallets only from the manufacturer. Never enter your recovery phrase into any software. If a companion app asks for your 24 words on a screen, it's a scam. Every time.

Announcing Personal Computer. Personal Computer is an always on, local merge with Perplexity Computer that works for you 24/7. It's personal, secure, and works across your files, apps, and sessions through a continuously running Mac mini.

Claude buying Bun. It hit me today: the AI era is compressing the entire developer-tooling stack into the hands of a few players way faster than anyone expected. For a decade, dev tools felt like the last truly decentralized frontier - open-source, scattered, community-led. Even big moments like Microsoft taking GitHub or the npm acquisition barely shifted the day-to-day reality for most developers. But suddenly? Runtimes, package registries, auth layers - the tiny pieces that make up the developer workflow - are being absorbed one after another. If you track concentration (CR5), the curve tells the whole story: Pre-2018: fragmented, CR5 < 35%. 2018–2021: consolidation starts, ~40%. 2022–2025: jumps to ~50% as AI/cloud giants go on a buying spree. Look at China to see where this could end up: middleware is ~70% controlled by the top five; AI-agent platforms sit around 88%. That’s how you end up with a world where SaaS struggles to exist at all - there’s simply no room left, extreme concentration kills the oxygen for small players. GenAI is the accelerant. When AI rewires the entire software-creation flow, owning the toolchain becomes a strategic moat. Hard to stop, even with open-source foundations and regulation. Feels a bit like we’re inching toward the “mega-tech consortiums” sci-fi writers imagined. Power law wins again. What should we do? Face the challenge and fear - position ourselves. Get financial freedom asap, then, if we still want to build in this arena, choose a niche where we can actually survive the gravity of the giants.