Nick Hutton

The biggest mistake tourists make in Japan is dragging a fifty-pound suitcase up and down subway stairs. Watch how Japanese travelers board the bullet train. They walk on with a cup of green tea, a small shoulder bag, and both hands free. Where is their luggage? It is already in the next city, waiting for them. In Japan, the system is called Takkyubin, recognizable everywhere by a logo of a mother black cat carrying her kitten gently in her mouth. When you check out of your hotel in Tokyo at eight in the morning, you hand your heavy suitcase to the front desk, fill out a tiny slip, and pay about twenty dollars. You can even send it straight from the corner convenience store. Then you spend the entire day wandering through mountain temples or eating street food with nothing on your back. When you walk into your traditional inn in Kyoto that evening, your suitcase is already standing neatly in your room, wiped clean, with the handle turned toward you. In fifty years of handling millions of bags a year, lost luggage is virtually unheard of. A society runs smoothly when you can hand your belongings to a stranger at a convenience store and know they will beat you to your hotel.

Missed by pretty much everybody, but @GOVUK was defeated 195-155 in the House of Lords last night on a very significant China amendment to the Cyber Security Bill. Amendment would require Government to keep a list of foreign threat actors, based upon those who attack the UK.

for those who actually took the time to listen to peter thiel's lectures & interviews over the last few years, he explicitly mentions many times that middle management's purpose has expired. his intellectual influences regularly invoke burnham, who was the west's chief critic of managerialism—considering how influential thiel is now more so than ever before, he has the ear of so many ceo’s. it’ll be interesting to see how landscape shifts with respect to labor dynamics. there is a reckoning coming for middle management & it could be a bloodbath—would highly recommend reading burnham (published in 1941).. what a fantastic read.

Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products. Some thoughts: - Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one. - We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week. - At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns. - Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things. - You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here). - To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity. - KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it. - Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

Why BUY a global SIGINT system when you can SELL one

Currently there are two simultaneous race wars, Turkey vs. China and Japan vs. French leftist/immigrants. The Japanese 🇯🇵, as you know, are culturally allergic to public disorder. So the Franco-Japanese War kicked off when they saw French accounts cheering on the riots while using anime avatars and Japanese characters in their handles. They said those anime characters are about virtues such as courage, justice, effort, and friendship, and they shouldn't be associated with torching cars or looting. Basically the message was: “if you need a symbol for destruction, invent your own. Stop culturally appropriating ours for your ugly ends.” From there it escalated into classical mutual stereotype annihilation. The Japanese didn't hold back, using typical allusions to apes and hounding on their failure to build thriving societies despite being given all the aid and welfare in the world. The French accounts (majority were rocking North African flags) hit back, insulting Japanese for screwing sex dolls and working so hard they commit suicide. It wasn't pretty. While that was cooking, a separate Turkey vs. China war was already underway. Algerians 🇩🇿 noticed and decided to ride for their “Turkish brothers,” dropping cartoons roasting the Chinese. The Moroccans 🇲🇦, watching from the sidelines, started laughing and saying "screw the Ummah," telling them they really didn’t want to invite the Chinese to attack them. The Algerian account responded by calling the Moroccan’s sister a whore. This, my friends is what I personally call "fractal racism." On the surface, you think it's just one undifferentiated “brown Muslim” mass. But when you zoom in, what you get is infinite-resolution tribalism and more divisions of recursive hate. At this magnification, the French Muslim immigrant blob split along Maghrebi lines that few of us outsiders know exist. French-Algerian accounts volunteering as Turkish proxies then invites Chinese 🇨🇳 online aggression. Which means the Chinese and Japanese (and Koreans 🇰🇷 who joined them), are now united in common cause in mutual contempt for the same people. Two separate race wars are threatening to collapse into one lol. The internet is so weird and entertaining isn't it. Where and how else could this have happened? Two sides with the deepest historical hatreds on the planet, and likely a fissure point of the next actual kinetic World War, are briefly aligned.

One potential outcome of the vulnpocalypse is that companies decide the cost (in risk, dollars, and engineering hours) of OSS dependencies is too high. Vulnerability management isn’t cheap or glamorous, and it’s unlikely that you need all of the attack surface you inherit with these packages. All of the small packages from the many transitive dependencies you inherit present supply chain risk that likely outweighs whatever value you’re getting from that few hundred lines of code. The cost of the tokens to rewrite the fraction of that code you need, and maintaining it as 1p code, will eventually be lower than the continued cost of dependency management. This will improve security, but would have negative consequences for the OSS ecosystem.

The TLS business might have been ~1% of eMudhra's revenue, but the CA key f-up eroded at least 80% of any trust anyone might have in them with regards to their remaining business (the last 20% of trust one might have in them is eroded by how they chose to handle these incidents on social media & in the press)