UPDATES
Thanks AI
😂 Hey! Hope you all are doing well!
Had a wonderful EDC with a bunch of friends recently. Intense and relaxing at the same time. Already planning next year…
—
I'm starting to filter content based on positivity and optimism. It’s easy to be smart and funny when you’re negative all the time, and I’m tired of the schtick. THREAD
—
Don’t sleep on the IDEAS section of the newsletter. Some absolute jewels in there most weeks!
—
Currently working on two philosophical projects:
One is an attempt to write an academic paper on the hard problem of consciousness. Like I want to do it properly (with AI’s help of course) and submit it to a real journal for peer review.
The second is an essay I’ve had in draft for like 4 years, called General Absurdism, which is turning into like a unified theory for human meaning. But don’t get too excited, it’s based around everything being like a different kind of useful illusion based on how you experience the world. I wish it were an objective source of meaning; that’d be something.
—
Made an EDM track with Suno recently for a podcast I went on. They do songs for each guest now and I decided to make my own. SUM AND SIGNAL
—
—
Love this Black Coffee idea (not about coffee):
☕ But speaking of coffee, here’s my latest jam:
Clever brewer
3 on my grinder (medium-fine)
95 degree water (Celsius)
24grams of coffee (Philz usually, but I try different stuff) (scale)
Start the TimeTimer for 4 minutes
Wet the grinds (30 seconds) (reverse osmosis water)
Pour the rest of 384 grams of water
Stir for 5 seconds after the pour
When the timer goes off, empty the coffee into my small, pre-heated Japanese carafe
Swirl a few times / for like 10 seconds
Pour into my tall, insulated, pre-heated cup
Have been absolutely loving this setup. Consistently great coffee I look forward to every morning. I was drinking way too many energy drinks, starting with one in the morning. I am so happy to be back to coffee as my first caffeine.
CYBERSECURITY
A few thoughts on the overall vulnpocalypse situation, and how to get into and advance in cybersecurity:
Yes, I think Mythos is real and it’s just as significant as Anthropic is saying
I know lots of companies running it and they’re really getting those results
GPT-5.5 is getting similar great results (haven’t checked Opus 4.8 yet)
The thing to absorb is that Mythos wasn't even a cyber model. It's just a regular model. Same with GPT-5.5.
In other words we should just expect this to keep accelerating. Oh and supposedly Mythos will be released soon to some subset of the public, or everyone. They’re hinting at a new, beyond-Opus model, anyway
The takeaway for me is the same it’s been since 2024 when I started warning about all this stuff: The way to defend against continuous AI red team being run against you is to have your own continuous AI red team stack that’s as good or better than the attacker’s. That’s kind of it.
There’s still a lot of slop being made by AI, and there’s still millions upon millions of legacy vulnerabilities out there that are hard to fix without breaking things, so no—security isn’t going away as a profession any time soon. But it’s massively changing, and very fast.
Best advice for people wanting to get into or advance in security is the same I’ve been saying for a couple of decades now, but far more extreme now: You have to learn how things work at a deep level.
This is actually super universal, and it applies deeply to this AI transition as well. It’s a moat-like advantage as long as you have some soft skills to go with it and are good at AI
Basically, Security is the combination of two things: a mindset, and deep understanding of tech/systems. Always has been.
This is why it’s always been best to get into security through some profession where you’re DOING something at a deep technical level. Programming, networking, and sysadmin have been the primary three onramps forever. But there are many routes, e.g., helpdesk, support, etc.
The most important attribute in this part of the mix is curiosity, because that’s what drives you to learn how things work at a deep level. From the ground up. Electrical signals up. Bits up. The networking, the OS, the protocols. All that.
Knowing how the world works, at a deep level, is a tremendous advantage in security, and that doesn’t go away just because AI knows more than you.
Knowing how things work means you have a better mental model of the world than most, and that helps you make better decisions than most. And to be able to do so quickly.
Learn how things work
And that’s never been easier because of AI
Make apps. But don't just have the AI make the app for you. Have your AI walk you through step-by-step, quizzing you on how to build what component, why you choose what part of the stack, and how the tech works. You basically have a full coding tutor with you at all times now. They can help you build apps, help you attack the app. It's an opportunity that nobody has ever had to learn security. Use that shit.
Practice building things by hand while your AI is watching and critiquing. It’s an extraordinary experience. And then do the same when you hack them. Then do it for another tech, another stack, another language, another protocol. Etc.
And then be visible. Learn in public. Get your blog going. Your youtube. Get active on LinkedIn. Make connections based on mutual benefit, offering your services.
I'm going to update my "How to Get Into Cybersecurity" post shortly here with more expansion on these ideas, but this is the core of it.
China builds a secret platform to track foreigners ASPI CYBER, TECH & SECURITY DIGEST
NetAskari found a China dashboard tracking foreigners “of interest”
The system fuses cameras, visas, travel apps, and face scans
Shai-Hulud worm infected hundreds of npm packages in minutes
It forges Sigstore provenance and backdoors Claude Code and Codex
Supply-chain trust gets subverted when registries and signals are abused
Ubiquiti UniFi OS has multiple unauthenticated remote takeover bugs The patch is urgent: three CVSS 10.0 issues let attackers change devices, read files, and run commands. SECURITYONLINE.VINFO VULNERABILITY REPORT
Sponsor
Ever investigated a "super urgent" finding
for it to be nothing?
You've spent hours digging into a "critical" CVE only to realize one config setting makes it impossible to exploit in your environment.
You should never have had to look at it. That’s not an exploitable finding. It’s why reachability is only a clue, and exploitability is the verdict.
Maze AI agents investigate every CVE like your best security engineer would, against your real config, and eliminate the noise before it hits your backlog.
Police use Automatic License Plater Reader (ALPR) data for school residency and job checks EFF analyzed millions of Flock Safety ALPR searches and found “warrantless” data access drifting into residency verification, employment background checks, and noise complaints. EFF DEEPLINKS BLOG ARTICLE
Low-effort security win is installing the Russian language pack An oldie but goodie: LaurieWired says Russian packs block execution surprisingly often. @LAURIEWIRED POST
NATIONAL SECURITY
U.S. launches a defensive strike after Iran attacks shipping in Hormuz The U.S. shot down four Iranian one-way drones and hit the ground control unit. MARITIME EXECUTIVE ARTICLE
US Army just got a lighter, smarter Javelin launcher The U.S. Army started taking delivery of 25% lighter LWCLUs that cut size, double detection range, and still fit existing Javelin missiles. INTERESTING ENGINEERING ARTICLE
I have this very strange premonition that we could be in a situation soon where Ukraine actually wins the war with Russia. Like their drone skills and capabilities, and their autonomous robot capabilities, get so good that they start being able to hit more and more of Russia with them being unable to defend.
That said, I also have a running note to myself to NOT trust my intuitions on the Ukraine war. Basically all of my bets on this thing in the beginning were wrong.
Russia and China publish a “new era” multipolar principles list The communiqué lays out a shared critique of neocolonial hegemony and promises equal, open security and governance. CONSORTIUM NEWS ARTICLE
Ukraine keeps taking out Russian refineries, leaving only two untouched Ukraine says it has struck 24 of 33 big Russian refineries since 2022. ENGLISH NV.NATION OPINION ARTICLE
Fiber-optic FPV drones make Hezbollah’s attacks harder to stop Israel says fiber-optic FPV drones bypass jamming and force new defenses. Analysts cite improvised netting, armor tweaks, and kinetic counterfire. EL PAÍS ARTICLE
AI
Anthropic’s first quarterly profit turns the AI IPO narrative around This writeup claims Anthropic is at ~$10.9B Q2 revenue and will potentially have their first operating profit. If this is confirmed it’d be remarkable because AI has so far been a giant splurge-now-hope-for-future play. I'm not close to either company's finances, but my guess is that OpenAI is light years away from profitability. PERPLEXITY AI MAGAZINE ARTICLE
Auto-itera turns LLM evals into a defensible ship-or-kill loop It sources real production data, scores candidate arms in parallel, and gates iteration to avoid dev-set cheating. GITHUB REPO
You hand it a goal, candidate arms, and thresholds up front
It runs a multi-stage loop: split data, score in parallel, diagnose, sprint, then gate
It does one sealed test pass and spits out per-slice ship/kill calls
You’re buying mechanical discipline so eval numbers can’t quietly turn into self-confirmation
Big thing for me lately is managing the FRESHNESS and efficacy of the whole harness, so I am looking at tons of capabilities like this.
Robots keep getting lost, so China teaches “maze thinking” If a robot can’t handle tiny changes, it freezes—so researchers copy mice: landmarks, compressed memories, and low-power neuromorphic reasoning. INTERESTINGENGINEERING AI & ROBOTICS ARTICLE
Anthropic’s Jack Clark lays out a fast, scary three-year AI timeline He claims AI could hit Nobel-level science within a year, plus recursive self-improvement by 2028. The operational detail matters because it’s coming from Anthropic’s frontier pipeline, not a futurist. PERPLEXITY AI MAGAZINE ARTICLE
Cerebras just proved its wafer chips can crush inference latency Cerebras is serving Moonshot’s Kimi K2.6 trillion-parameter model at 981 output tokens/sec, far faster than GPU clouds, with agentic workloads finishing in seconds. I think this custom chip inference stuff is going to be absolutely insane, and I can't wait till something comes available that I can invest in. VENTUREBEAT TECHNOLOGY ARTICLE
TECHNOLOGY
Even if you hate AI, Google search will still suck you in Google’s AI answers are so handy that people stop clicking through, hurting creators and the web.
Google’s AI overviews now answer follow-ups and even run “agents” that book and monitor things for you. Basically, they don't want you to leave their website, ever, and that’s way worse for anyone who was relying on traffic from them. SMH TECHNOLOGY ARTICLE | WIRED ARTICLE
TypeScript 7.0 Beta gets way faster by moving the compiler to Go TypeScript’s team ported the compiler to Go while keeping type semantics identical, and it still runs via tsgo and ts6. MICROSOFT DEV BLOGS POST
PwC is deploying Claude across 364,000 of its pros, not piloting PwC is rolling Claude Code and Claude Cowork to its full global workforce, plus CFO-focused services built on Anthropic, with big reported production gains. PERPLEXITY AI MAGAZINE AI NEWS ARTICLE
YouTube starts auto-labeling AI video origins on uploads YouTube will show clearer AI tags and also detect some AI use with internal signals, not just uploader honesty. ARS TECHNICA ARTICLE
Pull requests are mostly quality theatre, so stop using them Fascinating take saying Pull Requests were built for open-source strangers, not trusted teams, and they mainly waste time, not bugs. ANDREA LAFORGIA SUBSTACK POST
Google allegedly leaked inside info to win big on Polymarket THE VERGE ARTICLE
2028: Two scenarios for global AI leadership ANTHROPIC PAPER
HUMANS
AI debt collectors show up with your landlord’s exact number Wired says AI agents can contact you about old debts, then push you to pay quickly. WIRED LONGREAD
LLMs can guess what people want out of life, surprisingly well Tyler Cowen summarizes an NBER study where GPT-5.4 and human choices align on preferred life paths. MARGINAL REVOLUTION ARTICLE
The future of home energy is one coordinated system Homes are going from single upgrades to an intelligent ecosystem that schedules loads, storage, and solar together. CLEANTECHNICA ARTICLE
Handmade drone bombs are driving families out of Guerrero Gunmen from Los Ardillos attacked rural communities with explosives from drones, forcing 800 to 1,000 families to flee. FORTUNE ARTICLE
OpenAI’s model just proved a long-standing geometry conjecture OpenAI’s internal model found a unit-distance construction that beats the square-grid belief, and external mathematicians verified the proof. It also seems to use number theory in a surprisingly direct way. OPENAI RESEARCH ARTICLE
IDEAS
The Costco theory says the internet should bin trash early The internet gave you infinite choice, then made you do the sorting. The answer is bounded trust. JOAN WESTENBERG COSTCO THEORY BLOG
AI needs a test of “realness,” not usefulness LUKE BURGIS BLOG
Predicting the next token is secretly world-simulation and self-modeling. The post argues LLMs aren’t “just Markov chains”; they infer causes from text and can introspect when GPT-generated text appears. LESSWRONG ESSAY
If your goal isn’t bigger than other people’s opinions, you’ll hand over control Dan Koe says that without a truly meaningful goal, you end up absorbing goals others assign you. @THEDANKOE POST
AI makes Torah lookup cheap, so “chiddush” becomes the real bottleneck Absolutely love this concept here! Worth the full read. @ZOHARATKINS POST
Losers chase status collapse and sometimes turn violence outward This Quillette piece argues that relative status decline, not poverty alone, can drive conflict and violence, including self-harm or attacks. QUILLETTE ARTICLE
Learning hardens your instincts, so you should save the naïve versions Learning collapses the space of ideas into what you can already guess, then you write notes of the bad ways first. GCAPUANO BLOG POST
What if AI is like Flowers for Algernon? @DANIELMIESSLER X POST
The bitter lesson in 26 words Don’t be distracted by human knowledge as AI has been historically. Instead focus on methods for creating knowledge that scale with computation like search and learning. @RICHARDSSUTTON POST
DISCOVERY
Headscale is an OSS alternative to Tailscale HEADSCALE
How to make content in the age of AI HORMOZI VIDEO
AI can’t pick your goals, only optimize the ones you hand it JOHN ENNIS TWEET
A macOS video wallpaper app uses Apple’s private WallpaperExtensionKit Phosphene turns your own MP4/MOV files into lock-screen and desktop wallpapers, with gapless loops and power-aware playback. GITHUB REPO
The AI bubble depends on a hidden financial backstop The money is funding a tech that can’t deliver the promised AGI timeline. Investors and governments prop it up. NO ONE'S HAPPY BLOG POST
Found an app that gives you Vim bindings in most of macOS! It’s called KindaVim. And I am writing this newsletter using Vim bindings! Woohoo! KINDAVIM
RECOMMENDATION OF THE WEEK
Ask yourself if you’ve somehow become a regular user of rage porn. Or, put more delicately, ask yourself if many or most of the creators you follow are angry, cynical, or just overall negative.
I think cynicism is en vogue right now. And to be clear, there are lots of reasons to actually be upset. But this situation kind of reminds me of how I think about and manage depression.
There are things I can control and there are things I can’t. If I am in a bad mental state because of my actions, which I have control over, then I take responsibility and I make changes accordingly and then end up in a better state. And if I'm in a bad state because of something outside of my control, I try to identify that and remove its power over me to whatever degree that I can. Which is mostly about changing how I think about that thing.
Shitting on things is like the most respected way of being an influencer right now. People conflate it with being smart. I’m aware of this, but I’m pretty sure it still works on me. It takes some level of talent to be highly articulate about everything that’s wrong with everything.
What I’ve come to realize, at least for myself, is that it’s actually much easier to be cynical than it is to be positive. Even though the opposite seems true. It’s like ranting grants you an extra 10 IQ points in peoples’ minds.
I recommend just taking a look at your feeds. Your inputs. The people you follow and listen to.
Ask yourself what percentage of them are actually bring you information that’s useful, vs. making you somehow feel better, or somehow superior, because you’re participating in their glorious bashing of things.
And further ask if you might be happier trying to create something….anything at all….even if it’s small and won’t help many people, instead of indulging in that cynicism.
APHORISM OF THE WEEK
A cynic is someone who knows the price of everything and the value of nothing.
GET THE MEMBER EDITION
You’re currently receiving the STANDARD edition.
Members help this work continue. If you enjoy the newsletter, the podcast, what I put on YouTube, or any of my open-source projects on Github, I ask you to please become a member. It allows me to stay focused on learning and building and sharing. It’s like a cup of coffee or two per month.
Plus, members get numerous benefits, including:
25-50% off all UL Paid Content, including the upcoming Human 3.0 / AUGMENTED ONLINE portal!
Access to the extraordinary UL Member Community that includes vibrant conversations with ~1,500 of the smartest and kindest people you’ll find on the internet
Member-only Content, such as EDC guides on tech stacks, personal productivity routines, my recommendations on Critical skills to Build Going Forward, Trend Identification and Analysis, and more…
Access to the Member Archive of previous Member-only content, the Book Club archive, etc.
Access to The UL Book Club that’s been going monthly since 2017! One of the highlights of my and many attendees’ month!
Access to the Monthly Member Meet-up where we talk about our routines, productivity workflows, what’s on our minds, etc.
Access to In-Person Events like our dinners in Vegas, San Francisco, etc.
And much more coming…
This is the moment to connect with others who are smart, kind, and asking the same questions we are. Where is this all going? And how do to prepare?
Join the conversation.