Blog

This afternoon two emails from Trezor Security landed in my inbox, forty minutes apart, from two different addresses at the same domain. Subject line on both: “Critical Security Alert: STM32 Entropy Vulnerability.” The first arrived at 1:52 and I did not notice it until the second one showed up at 2:33. They said a hardware flaw in the chips meant some recovery phrases were generated with as little as 40 bits of entropy, that roughly one in four devices was affected, and that I should check whether mine was one of them. ...

AI is a tool — same as a knife. It cuts bread or it cuts a person; the blade doesn’t decide. The user does. Right now, most of the AI you see is pointed at control. Surveillance sold as convenience, feeds tuned to keep you scrolling, systems built to sort and score people. So if your honest read is “this thing is mostly used for bad” — you’re not wrong about what’s in front of you. ...

I found out the way you find out about most things that matter: by accident, in the middle of doing something else. A while back I’d built a small AI voice red-teaming lab — a setup to stress-test how well AI voice assistants hold up against manipulation — and I’d gone back in to revisit the project. A few prompts deep, the model threw up a bright-yellow banner: it had flagged something in my session for safety and was bumping me down to an older model, mid-task. Mildly annoying, but fine — these things have tripwires, and I figured I’d brushed one (I was using words like “exploit” and “red-team” while documenting a defensive tool; classifiers get jumpy). ...

I wrote the first version of this on the evening of July 18, 2025 — the day the GENIUS Act was signed into law. The news was calling it a triumph: crypto is finally going mainstream. People were cheering. I couldn’t shake the feeling we were applauding the cage. Nearly a year later, I don’t have to wonder anymore. So let me show you what I saw that night, and what’s happened since. ...

Starting in September 2026, Google will require every Android app developer to register with Google, submit government-issued identification, and pay a fee before their apps can be installed on any certified Android device. This includes apps you sideload. Apps from F-Droid. Apps from Aurora Store. Apps you build yourself. If the developer hasn’t registered with Google, the app won’t install. What Google Is Actually Doing Google announced this policy in August 2025 under the banner of “developer verification.” Here’s what it requires: ...