UL NO. 462: Full-Face Mask Deceptions, VS Code Tunnel Hacks, Quiet AI Emergence at Apple, and Tokyo’s Three-Day Weekend Gamble

SECURITY | AI | PURPOSE
UNSUPERVISED LEARNING is a newsletter about upgrading to thrive in a world full of AI. It’s original ideas, analysis, mental models, frameworks, and tooling to prepare you for the world that’s coming.

Hey there!

• Settling in for a couple of light holiday weeks. I plan on doing lots of coding and light reading (LitRPG mostly, I think). What are you going to do?

• Please go subscribe to the YouTube channel. Always forget to promote it, and we’re putting in work over there!
  SUBSCRIBE TO THE UL YOUTUBE CHANNEL

• I wrote a piece for Dazz that I’ve been wanting to get out for a while. It’s about how I think continuously updated context will end up being the future of vulnerability management. Basically, the problem isn’t finding vulnerabilities; the problem is knowing how to fix them—in what priority—within any given organization. CHECK OUT THE ARTICLE

SECURITY

Full-Face Masks for Facial Recognition Evasion
There are new super-realistic printed face masks that people can use to appear as someone else from a distance. Insane how good they appear to be, combined with how easy they are to swap on and off. They seem good enough to possibly fool a cursory glance and even facial recognition. MORE

Visual Studio Code Remote Tunnel Attacks
Chinese hackers were caught using VS Code's remote tunnel feature to hack IT service providers in Southern Europe. The attackers used SQLmap for initial access, dropped a custom PHP webshell, and used a modified version of Mimikatz (called mimCN) that's been linked to other Chinese operations. MORE

China Restricts Drone Parts to Ukraine
China has started limiting sales of critical drone components to the US and Europe that are needed for Ukraine's defense efforts. MORE

FBI Takes Down Rydox Cybercrime Market
The FBI has shut down Rydox, a cybercrime marketplace operating since 2016, and arrested three Kosovo nationals who were running it. The site had done $230,000 in revenue from selling over 321,000 cybercrime products to 18,000 users, including stolen PII and hacking tools. MORE

Russian APT Gamaredon Using New Android Spyware
Russian state-backed APT Gamaredon has been targeting Russian-speaking individuals with two Android spyware families called 'BoneSpy' and 'PlainGnome' that can record calls, capture photos, and collect SMS messages. MORE

Yahoo Paranoids Layoffs
Yahoo cut 25% of its cybersecurity team (The Paranoids) over the last year and completely eliminated its red team, moving to an outsourced model instead. The company lost between 40-50 security people out of 200 total since early 2024, amid broader tech organization changes under new CTO Valeri Liborski. MORE

AI / TECH

😡 Claude > ChatGPT Pro For Me
I’m super annoyed to report that ChatGPT Pro, even with the full o1-pro and all the goodies, does not come close to Claude’s intelligence as a coding partner. Specifically using Sonnet 3.5. Claude is something like 70-85% effective at communication, following instructions, and general coding tasks. ChatGPT Pro is more like 50-70%. It doesn’t follow instructions well. It constantly loses the plot. And it’s just worse at coding. Plus it takes far longer because of o1’s thinking time. And I’m paying $200 for it.

Apple's Pragmatic AI Strategy
I think Apple is actually doing exceptionally well on the AI front (except for Siri, which is still unexplainable bad). But even Siri is better now with ChatGPT integration, which I’ve been using since the beta started. My absolute favorite feature of Apple Intelligence is the ability to hold the camera button on new iPhones and have ChatGPT tell you what you just took a picture of. MORE

OpenAI Whistleblower Death
A former OpenAI researcher who publicly criticized the company's data practices was found dead in his San Francisco apartment, with authorities ruling it a suicide. Suchir Balaji, 26, had recently accused OpenAI of violating copyright law in training ChatGPT and was expected to provide key evidence in several ongoing lawsuits against the company. MORE

AI Company's Honestopian Billboard Campaign
A Y Combinator-backed startup called Artisan is running ads all over San Francisco with slogans like "Stop Hiring Humans" and "Artisans won't complain about work-life balance" to promote their customer service AI. The company's CEO said the campaign was designed to be dystopian and controversial to grab attention, but I don’t believe that. I think it has a dual purpose: controversy for marketing, but direct honesty for those actually looking to reduce headcount. MORE

ChatGPT Gets Real-Time Video Vision
ChatGPT can now analyze real-time video through your phone's camera, letting you point it at objects for instant analysis and conversation about what it sees. Works really well, actually, but I need it on the desktop. MORE

Google Announces Gemini 2 and AI Agents
Google released Gemini 2, which can now control computers and navigate the web to do tasks like shopping and coding. Seriously impressive stuff. It feels close to a ChatGPT moment from late 2022. Completely surreal to just talk to an AI that can see your screen and help you code. MORE

Exxon Plans Natural Gas Plant for AI Data Centers
Exxon is building its first-ever external power plant focused on AI data centers, with plans to generate 1.5 gigawatts of power through natural gas. They are one of the most innovative companies out there. I have issues with their ethics at times. Significant issues. But holy crap they can read the tea leaves. Becoming an energy provider to AI. Brilliant. MORE

Health Data Tracking in Markdown
Someone made a really smart case for tracking health data in Markdown files instead of apps, since apps eventually die and take your data with them. They use plain text files for daily logs and Google Sheets for trends, with everything backing up to Google Drive. Markdown all the things. MORE

GPS-Based NTP Server Appliances from CenterClick
CenterClick has released a line of GPS-based NTP server appliances that work completely offline with no subscriptions or cloud requirements. The devices support multiple GNSS constellations, can track up to 1 million unique IPs, and use less than 5W of power. MORE

United Airlines Adds AirTag Support to Mobile App
United Airlines is adding Apple's new Share Item Location feature to their mobile app, letting customers paste location-tracking links for their AirTagged bags directly into their missing bag reports. MORE

YouTube's TV Usage Stats Show Huge Growth
YouTube is seeing massive growth in TV viewing, with sports content up 30% and users watching over 400 million hours of podcasts on TVs monthly. MORE

HUMANS

Bird Flu Jumps to Human in Louisiana
Louisiana reports its first human case of H5N1 bird flu in someone who had contact with sick birds, and they're currently hospitalized. MORE

Tokyo Offers 3-Day Weekends to Boost Birth Rate
Tokyo is trying to increase births by giving its 160,000+ government workers a 4-day workweek starting in April, hoping less work means more babies. Japan's birth rate has fallen to 1.2 babies per woman, and they're expecting fewer than 700,000 newborns this year—the lowest since records began in 1899. MORE

Ketone Bodies Found to Clear Alzheimer's-Related Proteins
Research shows ketones don't just provide energy to the brain—they actually help remove misfolded proteins associated with Alzheimer's by making them easier to clear through autophagy, with dramatic results in both mouse and worm studies. MORE

DISCOVERY

Stack Analyzer
Detect more than +500 technologies in your code base. MORE

Security Talks at ReInvent
A playlist of all the security talks at AWS ReInvent. MORE

ZSTD vs GZIP Comparison
In a series of compression tests, ZSTD consistently outperformed GZIP and ZLIB across speed, compression ratio, and decompression efficiency metrics. The tests by Aditya Karnam showed ZSTD was particularly dominant with large datasets. MORE

RECOMMENDATION OF THE WEEK

Downtime. Fiction. Family. Friends.

APHORISM OF THE WEEK

Thank you for reading. Please forward to a friend and/or share on socials to help support the work.

🫶🏼

Daniel