Pinned Tweet
小時候常聽老歌,基本上就是跟著老爸老媽聽、旋律熟到聽前奏就可以哼完整首那種。長大後慢慢開始一首一首用聽的蒐集回來,其實還滿感動的,跟大家分享。 #緩慢更新中 #Spotify棒棒
open.spotify.com/user/starbo…
zespre.md retweeted
What a disaster atlasum.net/blog/cve-2026-98…
zespre.md retweeted
As someone who has personally spent $500k / mo+ on Google Ads for years, I can tell you with certainty:
This revenue growth in Search is artificial & extremely unhealthy for Google’s business long term
Search volumes are declining as legacy search is being increasingly cannibalized by non-monetized LLM queries
Google’s response?
Manufacture revenue growth via short-sighted, highly extractive, customer-hostile tactics. I.e. charge advertisers more for lower quality clicks, including clicks they do not want and explicitly did not approve Google to charge them for
A few examples to illustrate:
For all of its history until recently, Google operated on a 2nd price auction model
I.e. if you bid $5 CPC and the next highest bidder bids $1 CPC, Google charged you $1.01 for the click (one penny more than the 2nd highest bidder) rather than the $5 you bid
This was a genius move by Google early on as it incentivizes advertisers to input their true maximum willingness to pay rather than trying to play the game of bidding low and constantly adjusting to try to stay just ahead of the next highest bidder while still not paying too much
However recently, Google silently deprecated the 2nd price auction and began charging advertisers as much as their bid and budget caps allow, regardless of what anyone else is bidding
It’s a short-sighted cash grab at the expense of the long term health of the advertiser ecosystem
Making thing worse, Google also recently nerfed keyword targeting precision
Google previously had precise keyword targeting settings that allowed advertisers pick individual search phrases to bid on, defined down to the character w/ exact match or phrase match targeting
This was one of the core features that made search advertising magic, enabling advertisers to run extremely precise campaigns based on exactly what their target customer typed
But now, even if you bid on a specific term or phrase using the strictest exact
-match targeting settings, Google will show your ad across 1000’s of unrelated keywords, labeling them as as “exact match (close variant)”
The definition of “close variant” means whatever they want it to and changes constantly. The result is advertisers get billed for clicks that are totally irrelevant to their business and that their targeting settings explicitly forbid Google from targeting. Google does it anyway and there’s no ability to turn this off
So now exact match is broad match, and broad match is just meaningless spam
This is all very bad for advertisers, but for Google, it allows them to show your ad and bill you for clicks across 1000x more searches that were previously going unmonetized (mainly because they’re garbage queries no one wants)
This is how you grow revenue atop declining search volumes
Lastly, and perhaps most egregiously, Google quietly stopped respecting budget caps by a factor of 2x. For example campaigns we’ve been running for years with $1000 daily budget caps suddenly began spending $2000+ per day
And the extra spend is entirely on the garbage keywords Google arbitrarily throws in as “exact match (close variants)” which have no value to our business, but can’t be turned off
Google offers no refunds nor any recourse for overspend or spend on keywords you explicitly did not target
These are not the actions of a healthy business. These are the actions of company whose core business is in decline but desperately needs to pump quarterly earnings so Wall Street will continue to fund insane capex while hopefully looking through their rapidly deteriorating negative free cash flow
Google operated a benevolent monopoly for the better part of 25 yrs
Meaning the value Google captured from Search was but a small fraction of the value it created, and that spread produced a potential energy that justified expectations of high earnings growth far, far into the future
This is now no longer the case
At the alter of AI capex, Google is sacrificing the golden goose
Q2 was an amazing quarter, with our AI investments redefining what’s possible across every part of our business.
Alphabet revenue grew 24% YoY and Google Cloud accelerated to 82% growth. We saw exciting momentum across the board from Search to YouTube to the Gemini app (which reached 950M monthly active users). Our model APIs are processing 22B tokens/min (up from 16B+ last quarter) driven by our workhorse Flash models. We’re also seeing great adoption of Gemini Enterprise, used by 90% of the Fortune 100, as well as strong demand for our security solutions.
Outstanding results and momentum, and such an exciting moment—thanks to all of our partners and employees around the world! 🙌 About to hop on the call!
“4” is the new “42”
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Imagine me telling you last year that GoAhead and eMudhra were using the same private key, with no further information. All sorts of scenarios might spin in your head, but never in a million years would you guess the real one.
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
zespre.md retweeted
THIS AM: Anthropic has officially filed for its IPO
• Stock Ticker: $ANT
• Listing date: Nov. (TBD)
• Potential valuation $2 trillion
It has the chance to be the largest IPO in history
zespre.md retweeted
I am transitioning away from using CLI agents for development. On my last project I transitioned to using grokbots.
zespre.md retweeted
Tailscale is great software, so it's unfortunate to see so many people sharing this as "Tailscale got hacked.", which is misleading.
This is not about unauthenticated attackers breaking into random Tailscale nodes. It's what attackers can do after gaining authorized SSH access or compromising an already trusted device.
If I understand correctly, you are secure if you only use Tailscale for your own devices and don't grant anyone else access, which is how many people use it.































