AI & Code | AI Explorer | AI Brand Repeater | Personal Branding | Ghostwriter for Founders | Partnerships: https://nitter.gq/t.co/[email protected]
Australia
Joined May 2026
- Tweets1.5K
- Following202
- Followers27.1K
- Likes2K
Pinned Tweet
In 1999 the UK quietly deleted the rule that the prosecution must prove a computer was working properly before using its output as evidence.
The same year, the Post Office began installing Horizon across 14,000 branches.
Those two facts are the entire scandal, and almost nobody connects them.
More than 900 people prosecuted.
236 sent to prison.
One piece of accounting software as the only witness.
Here’s what a criminal defence solicitor would tell you if they could speak freely:
“Look up section 69 of the Police and Criminal Evidence Act 1984. It required the prosecution to prove a computer was operating properly before its output was admissible. The Law Commission’s 1997 report said it served ‘no useful purpose’ and recommended repeal without replacement — after which, it wrote, ‘the courts will presume that mechanical instruments were in order at the material time.’ Parliament repealed it in the Youth Justice and Criminal Evidence Act 1999. From that year the computer’s output arrived in court presumed correct, and the accused had to disprove it. Between 1999 and 2015 more than 900 subpostmasters were prosecuted — around 700 of those prosecutions brought by the Post Office itself.”
The complainant, the investigator and the prosecutor were one organisation. The only evidence was its own software.
“A machine cannot be cross-examined, and for sixteen years nobody insisted.”
Here are the 7 verdicts that unwound it:🧵
Verdict 4 is the instruction to shred the minutes so they could never be disclosed.
Someone is probably already logged into one of your accounts right now. Not guessing your password. Not trying to.
Your password is not the weak point anymore. That’s the part people get wrong, and it’s why they feel safe.
Here’s what a penetration tester — someone paid by companies to break into them legally — would tell you:
“I have never once guessed a password. Not in my entire career. That’s not how anyone gets in. I get in because you reused a password from a 2019 breach. Because you clicked a link that looked exactly right. Because malware on your laptop copied a file that let me skip your login and your two-factor code entirely. Because I convinced your phone carrier to move your number to my SIM. Or because I didn’t attack your account at all — I attacked the ‘forgot password’ flow behind it, which is almost always weaker than the front door. Your accounts aren’t protected by your password. They’re protected by whichever of those six doors you happened to lock.”
The 2026 Verizon Data Breach Investigations Report found the human element present in 62% of breaches. Phishing was the way in for 16%. Credential abuse, 13%. And AI-written phishing campaigns are now hitting click-through rates as high as 54% — because the grammar mistakes that used to give them away are gone.
Here’s the number that should actually scare you: in phishing tests, median click rates on voice and text attacks run 40% higher than on email. The channel you trust most is the one you’re worst at.
“Everyone defends the front door and leaves the side windows open. Attackers don’t pick locks. They walk around the building.”
Here are the 6 ways people actually lose their accounts:🧵
Attack 3 is the one to read if you think you’re safe because two-factor is switched on. It works through two-factor, and most people have never heard of it.
Tweet 8
Now the solution. Six doors, one order, about twenty minutes.
Do it in this sequence, because the order is doing real work.
1. Secure your email first, and treat it as the master key. Every other account’s recovery runs through it. If you only fix one thing, fix this. An attacker who owns your email owns everything downstream.
2. Turn on passkeys where they exist. There are now roughly 7 billion passkeys in use, and more than a third of successful sign-ins at major services already use one. They’re tied to your device and can’t be phished, because there’s no code to hand over and nothing to type into a fake page. Every service measuring phishing reports fewer successful attacks after deploying them. Start with Google, Microsoft, Apple, Amazon, PayPal, WhatsApp.
3. Get off SMS two-factor. Move to an authenticator app, or a hardware security key for your most important accounts. SMS is the factor that SIM swapping exists to defeat.
4. Lock your phone number at the carrier. Number Lock, Port Validation, or an account passcode. Four minutes, as in Attack 4.
5. Fix every recovery path. Remove security questions or fill them with random strings. Update recovery email and phone. Delete old devices and old sessions.
6. Password manager, unique everywhere. Check haveibeenpwned.com, then change anything reused. You are not supposed to remember these.
7. Sign out of all sessions, everywhere. This is the step that kills tokens already stolen. Do it last, after the rest is in place.
Microsoft now covers 99.6% of its own users and devices with phishing-resistant authentication. The tools are not exotic. They’re sitting unused in your settings.
Tweet 9
6 attacks. Not one of them involves guessing your password.
Your old password is already on a list — check haveibeenpwned.com. AI writes the phishing now and it works best by text and voice, so never reach a login page through a link. Stolen session tokens walk straight through two-factor, so sign out of all sessions and stop installing cracked software. A SIM swap hands someone your number and every code sent to it, so lock your number tonight. The “forgot password” flow is a second front door, so harden your recovery path. And pretexting skips your account entirely, so never trust inbound contact, however much they already know.
“I have never guessed a password. Not once. That isn’t how anyone gets in.”
“5,871 infected machines. 44,791 session tokens. 1,843 still valid on the day it was published.”
“Your phone showing ‘No Service’ is sometimes the first and only warning you get.”
“Everyone defends the front door. Attackers walk around the building.”
The honest good news: every one of these six has a specific fix, all of them are free, and all of them are already in your settings. Twenty minutes tonight closes doors that have been open for years.
If this was useful, repost the first post — then do only step 1 before you close this app. Secure the email. Everything else is downstream of it.
Bblack retweeted
Girls after sex:
- Want a hug
- Want to talk
- Want to go pee
- Ready for round two
Men after sex:
Tweet 8
Verdict 7 — 8 July 2025: what the Inquiry counted.
Sir Wyn Williams published Volume 1 of the statutory inquiry’s report.
At least 13 people are believed to have taken their own lives as a result of the scandal. Fifty-nine more contemplated it. Williams noted the true figure may be higher, because some deaths went unreported.
Around 1,000 people were wrongly prosecuted or convicted. About 10,000 were claiming through four separate compensation schemes, a number expected to rise. Williams: “Many thousands of people have suffered serious financial detriment.” The total cost is expected to exceed £1 billion — public money, for a state-owned company’s prosecutions.
And here is the part that didn’t change.
The sentence Parliament deleted in 1999 is still deleted. The presumption that a computer was operating correctly remains the law of England and Wales.
Nine hundred convictions were reversed. The rule that made them possible was not.
Tweet 9
7 verdicts. A safeguard repealed in 1999. An organisation that investigated and prosecuted its own accusations. A judge told he should recuse himself. Minutes shredded to defeat disclosure. A suspense account bug that “undoubtedly had actual impact.” £57.75m that became £12m. Convictions erased by statute. Thirteen lives.
Now the honest part.
The 1997 Law Commission was not reckless. Section 69 genuinely was unworkable at scale, and no one at the time was imagining a 15-million-line accounting platform. The reasoning was defensible; the consequence was not foreseen.
Horizon was not uniformly broken. Most branches, most days, balanced correctly — which is exactly why the accusations were believed, and why individual subpostmasters could not point to anyone else with the same problem.
Fraser’s own standard cuts both ways. “Robustness does not mean perfection.” The existence of bugs does not, by itself, prove that any particular shortfall was caused by one. That had to be litigated, and it was.
And the 2024 Act is a blunt instrument. Quashing convictions as a class means it is possible a small number of genuinely guilty people were cleared. The government accepted that. I think it was the right call. I won’t pretend it was free.
What survives all of it. The lesson is not that software fails. It’s that English law treats a computer’s output as a fact and a human’s account as a claim — and reverses the burden of proof on the basis of nothing but the machine’s silence.
“A machine cannot be cross-examined.”
“The complainant, the investigator and the prosecutor were one organisation.”
“Nine hundred convictions were reversed. The rule that made them possible was not.”
Next time an automated system says you owe money, don’t argue about the amount. Ask, in writing, for the underlying transaction records and the system’s audit log — not the figure it produced. Ten minutes. Every Horizon case collapsed the moment somebody was finally allowed to look behind the number, and for sixteen years nobody was.
Why this one is worth knowing. The judgments are public and free. [2019] EWHC 606 and [2019] EWHC 3408 are online in full, and so is every day of the Inquiry’s evidence. You can read a judge working out in public, paragraph by paragraph, what a piece of software did to nine hundred people — which is the closest thing we have to a user manual for how this happens.
Bblack retweeted
Amazon’s internal name for the page that lets you cancel Prime was “Iliad.”
As in Homer’s Iliad. The epic poem about a ten-year siege.
That name is in the FTC’s complaint. Regulators quoted it back to them in court.
The complaint describes what the Iliad Flow actually was: four pages, six clicks, fifteen options — to leave a subscription you joined in one tap.
In September 2025, Amazon agreed to pay $2.5 billion to settle it. One of the largest FTC settlements in history.
Here’s what almost nobody realises: that wasn’t a bug, and it wasn’t one company improvising.
It’s a named discipline. A UX designer named Harry Brignull started cataloguing these tricks in 2010 and gave each one a name. Designers use the names internally. Regulators now use them in lawsuits.
You have felt every single one of them. You’ve just never had the words.
Once you can name them, they stop working.
7 patterns, what each is called, and what to do when you spot it:🧵