Дай бог каждому людей, которые в тяжелые времена смогут так поддержать.
God bless people who can be supportive like the operator in this video.

(Source: Andrey)

Three lifetimes ago, I worked at a startup building cutting-edge RTB platforms (SSP, DSP, DMP). These systems didn’t just collect data on every click and scroll—they auctioned off advertising space on a per-user basis.

Imagine this: while you’re casually browsing, sophisticated algorithms identify your user profile in real time—even on a shared computer—and within a mere 0.2 seconds, they pinpoint the highest bidder to serve you an ad. In that split second, hundreds of services are scrambling to win the chance to catch your eye. And yet, you still dare to block them with AdBlock!

Curious about just how much these systems know about you? Check out this intriguing article: Tracking Myself Down Through In-App Ads.

It’s a wild digital world out there, where a smart DMP might know more about you than you know about yourself.

---

Три жизни назад я работал в стартапе, который создавал передовые платформы RTB (SSP, DSP, DMP). Эти системы не просто собирали данные о твоем поведении в сети — они продавали рекламное пространство, учитывая каждого пользователя.

Представь: пока ты спокойно листаешь интернет, умные алгоритмы моментально определяют твой профиль даже если ты не единственный пользователь твоего компьютера. Всего за 0,2 секунды они находят самого выгодного рекламодателя, чтобы показать тебе его объявление. В этот доли секунды сотни сервисов торгуются за право привлечь твое внимание. А ты всё равно решаешь заблокировать их через AdBlock!

Хочешь узнать, сколько информации о тебе знают эти системы? Читай статью «Все знают, где ты находишься»: https://habr.com/ru/companies/ruvds/articles/879626.

Elliptic's private key extraction in ECDSA upon signing a malformed input.

Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input.

I suggest not to be nervous, I think it will be fixed soon. However, this is interesting enough information to share with you!

Link: https://github.com/advisories/GHSA-vjh7-7g9h-fjfh

#cryptography #offtopic

#solana #links

- Solana Hardware Compatibility List — https://solanahcl.org/
- Полезное для валидаторов Solana — https://teletype.in/@in_extremo/solana_useful

Happy Valentine's Day!

Roses are red,
Violets are blue,
Your password is weak,
I cracked it in two.

Now that we know who's behind the
@Bybit_Official
attack. Let's look at how the hack actually worked.

At a high level, the hack involved the 4 broad group of events:

1. Attacker deployed a trojan contract and a backdoor contract.

2. Attacker tricked signers of the upgradeable multisig "cold" wallet to authorize a malicious ERC-20 transfer to a trojan contract

3. Instead of transferring tokens, trojan contract replaces the master copy of the actual Safe multisig implementation contract with the backdoor contract, which is solely controlled by the attacker.

4. The attacker called sweepETH and sweepERC20 to drain the wallet of all its native ETH, mETH, stETH, and cmETH tokens.

(Source: https://x.com/dhkleung/status/1893073663391604753)

Still, … actual!

Dealing with debt problems over the weekend

Funny fact:

In Elixir you have ~/ → /home/user expand helpers, and in NodeJS and Go you haven't

IO.puts Path.expand("~/.xxx")  # "/home/user/.xxx"

Why I hate JS?

> const { web3 } = await import('@coral-xyz/anchor')
undefined
> new web3.PublicKey(web3.PublicKey.default.toString()) == new web3.PublicKey(web3.PublicKey.default.toString())
false
> new web3.PublicKey(web3.PublicKey.default.toString()).toString() == new web3.PublicKey(web3.PublicKey.default.toString()).toString()
true
> console.log(web3.PublicKey.default.toString())
11111111111111111111111111111111

On the Internet, nobody knows you're a LLM agent

In unsafe we Rust!

Got an achievement — 🥇
year without liquidations.