“Stay a while and listen” - DC
🇪🇺
Joined September 2022
- Tweets1.2K
- Following552
- Followers14.2K
- Likes1.5K
Michael Stephen retweeted
You wouldn’t believe how many startup CEOs I talk to who would be royally screwed if one of their vendors got hacked.
A few months ago, this wouldn’t have mattered for most startups. But we’re entering cyber armageddon.
This is going to happen to you. It’s just a question of when.
The good part is that it’s very manageable. You just need the right mindset and a few processes in place before anything happens. Here’s what I’d be thinking about today.
First (don’t kill me): do you have cyber insurance? And the real question: have you ever actually talked to your broker about using it?
I know this is the last thing you want to deal with, and it’s boring as hell. But please, please call them and make them walk you through it. If your cloud provider gets breached tomorrow, who do you call? What help do they arrange? What needs their approval? What do you pay out of pocket? Get the actual phone number, and save it somewhere you can reach if your work email is down.
Then figure out if your lawyer handles breaches. If they don’t, ask who does and get introduced. Find out how hiring them works with your insurance. You want to know this person exists before you need them.
Next, pull up your customer contracts, especially the big ones. What did you agree to tell them if something happened? You’d think every CEO would know this by heart. Almost none of them do.
What triggers a notification, and who’s supposed to get it? Have someone qualified work through it with you, right now. You might have agreed to something eight months ago and forgotten. Someone at the customer may remember, and if they do and you don’t, you could be very liable. One angry customer with a contract claim can be enough to sink a startup.
Same deal with any security questionnaires you filled out. What did you say you do? Are you doing it? Is it still true?
Then come the business problems. How long could your product be down before you have a real cash problem? What if a big customer pauses payment while you’re also paying outside help? Run the numbers and see where things get uncomfortable. And who can spend money in an emergency? If everything needs your approval and you’re asleep or on a plane, what happens?
Who can take the product offline? This came up in the replies to my last post. Rotating keys can mean an outage, and someone has to decide whether to accept it. Figure out who has that authority before it matters.
Who talks to customers while your engineers are busy? Give that job to one person and make sure they get accurate updates. Otherwise your engineers are investigating while answering the same question from five people. You can draft the bones of those updates now: what we know, what we’re checking, what you need to do, when we’ll update you next. Leave room for uncertainty, and don’t promise things you haven’t confirmed (this happens more often than you think, and can get you in hot water).
Have someone keep a timeline: facts, times, decisions, things you tried that didn’t work. Everyone will be tired and distracted. You will forget.
And where does all of this live? If your plan, contracts, and contacts are all behind the login that’s down, you have a second problem. Try reaching what you’d need without your normal work setup. Make damn sure you can (offline copies are useful here).
Take a look at what you’re exposing, too. Old customer files, exports, recordings, and especially whatever your agents can access. Do you need all of it? Who decided to keep it? Who knows everything you’ve connected, what your agents do during an investigation, and where they’re sending information? Someone needs to own those questions, because every piece of it is future work if something goes wrong.
Then practice. Sit down with whoever would be involved and walk through it. At some point everyone will look at each other and nobody will know the answer. Write that down, and start there.
Bookmark this so you have it when you need it.
Michael Stephen retweeted
Was about to write this but Ben beat me to it. Econ is unique among the sciences in that it is several pretty different fields living under one umbrella.
Empirical econ is the biggest subfield and its closest to biology or chemistry: it’s about designing or—even better—finding a natural experiment, or documenting interesting and important patterns in data. Most of the arguments in that field are about methods, eg do you have identification. More and more are starting to study AI now but obviously this won’t be transformative AI because, well, there is no data on transformative AI.
Then there are macro economists. They work with a set of pretty standard models and mainly expand them by slowly adding/subtracting different sectors or micro founding factors of production in different ways. Many of the arguments are on the parameter values that we should assume when simulating the economy. Early research on transformative AI started there—as demonstrated recently by Chad, Anton et al, the different levels of transformation are due to different assumptions on parameters rather than some new type of economics. The same model can predict basically no impact of AI vs huge transformation, it’s all about assumptions on parameters.
Finally there is micro theory. This is where decision theory, game theory, mech design, org econ (sort of) live. This field works by setting out a set of assumptions and then *deriving* the expected results; alternatively one could start with a result and work backwards to derive the necessary and sufficient assumptions. There is a ton of potential here to do work on transformative AI: start with assumptions on how AI differs than human agents (eg relax basic assumptions on constraints, on scarcity, introduce completely different objective functions), then derive implications. But this is where there is the least amount of work, and it’s important for that to change (and I believe that it already is).
I think we can make a ton of progress from these three subfields on better understanding the potential AGI and post AGI transformation.
But there is another scenario, post strong ASI, where I don’t think economics has much to say about. Here I agree with @Jabaluck that the economy (if you can even call it that) and the agents in it will be so vastly different and beyond our imagination that I wouldn’t know where to start modeling it. Not to discourage others, but post singularity seems like pure epistemic uncertainty to me.
A lot of the critiques I hear about AI and economics come from people who don’t quite get what economists do. They look around at different results and if they don’t like some of them, they say “oh economics isn’t “pilled” or something. But economists don’t debate results, they *derive* results from assumptions. Thats where the debate is. Saying “but you don’t understand a world with 15 billion AI agents”. What does that mean for the economy? What are those agents doing, who is buying what they are producing, what do property rights look like? Depending on those assumptions you’ll get vastly different economic scenarios, from 2% growth and high human labor share to completely alien centralized systems with no prices or markets.
Michael Stephen retweeted
Second day at @LuganoPlanB.
Drop by and let's talk some stablecoins on Bitcoin!
Michael Stephen retweeted
The problem isn’t that AI is intelligent. It isn’t. The problem is that too many adults (but not all) are at once mechanistic, imitative, unimaginative, stupid, formulaic, influenceable, & gullible, arrogant beyond their skill set, & too expensive to maintain.
Michael Stephen retweeted
look the foundational problem with ethereum protocol design is that most of the people designing the protocol don't actually use ethereum themselves. you can't fix the right things if you don't use your own fucking product. you don't have enough skin in the game if you don't personally depend on the system you're designing & stand to lose money when it breaks. i understand, everything looks great from an ivory tower lol. things look very different when you're actually on the ground dealing with the consequences. if you don't use ethereum yourself but still think you're qualified to design its protocol, you're playing god with a system you don't have to live with and whose consequences you don't have to suffer.
Michael Stephen retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
Michael Stephen retweeted
This is a passage from the first chapter of EY's Inadequate Equilibria published 9 years ago
I'll say it again for the AI risk experts in the back:
We've already run a real life, large scale experiment on what happens when a superintelligence is unleashed on a narrow objective.
Look no further than U.S. capital markets.
Millions of investors, analysts, traders and algorithms, backed by trillions of dollars and wired together through prices, all chasing one goal: the highest risk-adjusted return on capital.
And it is spectacularly good at its job. It funds the best ideas, punishes the worst ones, and turns new information into prices faster than any of us can react. No individual can out-think it. 99+ percent of professionals can't beat it.
But look at what else it's done along the way:
- Optimized the measure instead of the intent. Quarterly earnings became the scoreboard, so companies learned to manage the scoreboard.
- Treated anything without a price as free. Pollution, addiction, obesity, depression, political fragmentation, fragile supply chains, the long-term health of the communities it operates in.
- Found every gap in the rules, then paid lobbyists to help write the next set and pull up the ladder behind incumbents.
- Remade the world around its objective. Companies, pension funds and our retirement accounts now answer to the S&P 500.
- Made itself impossible to switch off, because everything else now depends on it.
None of this required malice. Nobody sat in a room and chose these outcomes. It's simply what a very capable optimizer does when its objective is a narrow proxy for what we actually care about.
And note that we never solved this alignment problem. We've managed it, imperfectly, with regulation, taxes, disclosure rules and the occasional crisis to show us where the guardrails were missing. Over time, the market has captured the instutions designed to constrain it. We've been at it the better part of a century, and the misalignment is the worst it's ever been.
So the next time someone tells you AI is only dangerous if it "wants" something bad, or if its goals are mis-specified, point them at the S&P 500. It doesn't want anything. It just optimizes.
That's the whole problem.
Michael Stephen retweeted
Everyone is free to make their own decisions on allocation. I applaud decisive decision making. No specific comment vs OP below, in fact am not super familiar w metavestor so truly have no pro/against him/her personally
Speaking to the points:
1) Measuring for tail events is savvy as a personal wealth decision. Everything worth doing however, usually has some sort of drag / burden / hurdle to it. Measuring & checking against priors is something you pretty much have to do with everything. It may feel unacceptable to some that the underlying asset in of itself faces security risk. That is understandable. To me, that is a category of risk that the market has actually shown itself as being ready to digest in capacity over time: bridge/exchange exploits, LUNA, Celsius/FTX, USDC depeg, etc. It is not equivalent of course, but they all speak to binary sponsorship unravelling & going to 0
BTC's history in fact predates this as -
2) I would argue that total perceived risk was actually much higher: RE: custody risk + rug risk + adoption risk + legal risk being elevated in BTC's infancy; namely an existential question to whether BTC would even graduate to being a social consensus asset. The reason this risk existed is probably a big primary driver of its return
So let's just be clean about this: the risk reward PROFILE isn't appealing to the author. The risk in an absolute sense itself is not the issue - in fact, it seems the author actually prefers HIGHER absolute left tail existential risk if anything - biotech RE: the most risk probably of any industry, see picture attached). Maybe the precision element is meaningful to the author though. This is not meant as a "gotcha" comment. Intended to be exploratory, because I do not think the sentence written as-is actually makes sense
3) "Does this make you want to long crypto?" - a peer of mine writes. In an absolute sense, no. That is obvious. However, does the escalation in the war on Iran make you want to long QQQ? Did Liberation Day make you want to long memory? The reason I bring this up is that markets rarely move on the margin on things that are *true* in an absolute sense. It is probably the 3rd, 4th or 5th derivative that matters. So not 2026 revenue, or QoQ revenue growth, or guidance on QoQ revenue growth, but rather what consensus was on QoQ revenue growth, and the actual ▲ beat/miss b/w Q2 reported & that
The reason this is important to bring up is that if there was some advancement in AI that specifically attached to crypto and only cryptocurrencies, that is net bearish ubiquitously. A potentially emerging super-cracker that can crack anything is just horrible for all things finance; this includes attaching/attacking bigger vulnerabilities & bigger industries with more liquidity. But in a world where there are bank runs and resulting anarchy, I think there is an argument to be made that permission-less currency ends up gaining MORE relative value net overall, especially vs fiat. Do you know how hard it is to withdraw even $10K cash from a bank? Do you actually think your bank / the gov't is going to step in and cover you? It is probably investing calories on what this draconian world looks like. The more concept of money would be very challenged - your passwords included.
4. I think the author misses or misunderstands what quantum concerns are. Quantum FUD and AI FUD is exactly the same. Which is: assuming unbounded leaps in progress that the human capacity cannot account for yet [assuming weeks, not years] it is theoretically possible that cryptography is cracked
Lastly, the author writes that the appeal of crypto initially to him/her was the tech, and that may/does not appeal any longer. That is a strong claim, but that was easily the case 2 years ago, and at the minimum 1 year ago. I just mostly think the author did not update his/her priors on this, and, like many do, use interesting events like this as an excuse/push to do something they had wanted to do for a while anyways
Ultimately, it seems that the author's argument is that banks are Too Big To Fail, which is why Drake's update is uniquely bad for crypto. I do not agree. Monetization of hacking is actually really worth thinking about & what that looks like too
My stance -
1) The Drake update will be a positive one in hindsight and may actually elicit real change with people taking preventive measures more seriously
2) Custody probably moves toward being coupled (so not DEFI) and around ETFs vs cold storage
3a) This was not the reason for the sell-off. You do not have to take my word for it - BTC and QQQ are down the exact same amount (~80 bps) since Drake's tweet. The OpenAI $20B revenue miss has more to do w risk pop than this, in all likelihood
3b) If Drake's update made you want to short, 3a) isn't actually bad for you if you think the mkt has not moved sufficiently on this, as it has yet to happen. If you are under writing this as the reason for being short/bearish, I believe you are mistaken
4) Apologies for all this word slop - it is worth noting though that I am bearish locally. Just had to make it clear it is not because of any of this
Honestly, I sold most of my spot crypto and offboarded today. It's just not worth the headache.
I don't want to check every single headline about AI math and cryptography research wondering if I'm about to get rugged. I don't want to wonder if every ancient BTC address making a transfer is ECDSA being cracked.
I had already refocused most of my time and energy on equities at this point, and Justin Drake's post just killed the rest of my desire to hold crypto. This isn't impulsive, I read hours of counterarguments.
1. People say this is incredibly unlikely. I just don't trust any human to predict the capability ceiling of superhuman mathematical AI. Have seen people be wrong about AI capability ceiling over and over.
2. What if I miss the next great bull cycle? Honestly, that's fine, there's plenty of other assets to trade with less stress of existential left tail risk.
3. People say that we would have bigger problems. Yes, I know that banks etc would also be at risk and society would be a clusterfuck, but the government should step in to save my money (and society) at that point. I don't know that they will for crypto. Plus, why would a malicious practitioner rather burn the whole world down over just stealing infinite crypto?
4. People say this is just like Quantum FUD. Nah, this is much more concrete and near term. This doesn't require a new scientific breakthrough, only the continued march of AI progress that we've been scaling on for years.
I got into crypto as a techno optimist but there's other investment expressions of that now. The development of AI (and recently the intersection of bio x AI) is more intellectually interesting to me. Being in crypto feels like being short AI progress, and I do not want to be short AI progress.
This is not investment advice, everyone should decide for themselves how they feel about the topic. I am just one random human being on the internet, expressing my thoughts.
Michael Stephen retweeted
Explaining the Catholic Church to Godless AI researchers:
Imagine a lab thats spent 2000 years working on alignment
Michael Stephen retweeted
spot the looper
5.6 luna and sol - nope
6 luna and sol - nope
6.1 sol and 6 astra - SUS
Michael Stephen retweeted
The Chain is now open.
GAME OF COINS — S1E1: BEDTIME STORY
Welcome to the beginning.
Michael Stephen retweeted
Pulsar Pro. That's the point.
Rewards on every action, cashback you control, and the full partner stack running underneath your money app.
Live day one of @Arc mainnet, September 16.
Michael Stephen retweeted
I know this is garbage engagement bait, but I think it's worth calling out this mindset for the young kids that get hooked on hustle culture, or think of abusively hard work as something virtuous.
A few things I have learned to be true:
1. One day you will be dead and shortly after nobody will remember you. They certainly won't give a shit about your work. The ones that do will be the people you loved and who loved you. Not your stakeholders, colleagues or business associates.
Shit, most people forget about you the day you change jobs. Even the CEO. Once you leave, you just kind of...fade away. Your work mostly doesn't matter. Also, as you get older you start to watch people die...way way earlier than they should. You genuinely don't know how much time you have. Do you really want to spend it all hustling...or even worse...pumping out engagement slop celebrating hustle culture?
2. More people are like Walter White than they care to believe.
At the end of Breaking Bad, Walt finally confronts the truth. He wasn't doing it for the family. "I did it for me. I liked it. I was good at it. And, I was really... I was alive.” Most people find value in their work, which is great. But my old man gave me incredible advice when I was younger, "Beyond a certain point, a successful career is a selfish act." The people who really get themselves into trouble are the ones who convince themselves they are doing it for someone else.
3. You don't know the cost until too late
I've watched friends wreck their health and their relationships chasing the next promotion, the next round, the higher salary. Justifying each step along the way as the right thing to do. Mostly they were just addicted to the work. Or they felt trapped. I don't think any of them would have made the trade if they could go back and know the cost from the start.
Michael Stephen retweeted
The next launch partner for USDT on Bitcoin is @unisat_wallet.
With 1M+ weekly active users and 100M+ weekly API calls, UniSat is the home for Bitcoin assets.
Coming soon: send, receive and swap USDT on Bitcoin inside UniSat Wallet.
Michael Stephen retweeted
The RLN Community Module is live on @WDK_tether.
Any WDK wallet can now move RGB assets over Lightning without assembling the stack.
The second half of RGB in WDK is here.
New community module from @utexocom: RGB Lightning is now in WDK.
After RGB onchain, they're back.
RGB assets, now at Lightning speed.