Proton Sells Privacy. Its CEO Called Security Testing "Loser Thinking" 90% AI-Written Code, A Pentest Request Mocked In Slack, And A Bitcoin Wallet Under The Same Roof 90% of Proton's code in October was written by AI. When an engineer asked for a few days to pentest new code, the CEO called it "loser thinking". ---------------------- Proton sells encrypted email, a VPN, a password manager and a self-custodial bitcoin wallet. Its own site says it serves over 100 million people. The story comes from 404 Media (Oct 29): eight current and one former employee, Slack chats, meeting audio and a manifesto from the CTO. Proton's spokesperson did not dispute the reporting. So what happens when a privacy company decides review is the bottleneck? 👇 🔹The Slack Thread Nobody Was Supposed To Read🔹 End of August, in the security channel. An employee asks for a few days of pentesting before new code goes live. Andy Yen: "That's bullshit and loser thinking." Then: "stop lovingly handcrafting all our code and use AI more." Another engineer pushed back: security is "low in our prioritization at present". No direct answer. Same channel: "This will be the last year that we hire engineers." 🔹The Revenue Target Behind The Rush🔹 An internal document says Proton is not on track for its annual recurring revenue target, "due to insufficient velocity". Another line: "By all metrics that matter, we're an underperforming company." CTO Bart Butler said in a meeting that 90% of October's code was AI-written. Software on staff machines tracks how much. So AI isn't a product choice here. It's the growth plan. 🔹A Walk-Back With An Asterisk🔹 Friday, Oct 30: Yen cancelled the AI "re-interviews" that an internal email had called "consequential" for continued employment. Same all-hands: "Going forward, I'm still going to push." One employee says what the re-interviews measured will now feed performance reviews. His Reddit reply was downvoted more than 1,200 times. 🔹Why This Lands On Crypto Too🔹 Proton Wallet's pitch is simple: only you can access your bitcoin. Self-custody moves the trust from a company's balance sheet to its code. Nothing reported says wallet code skipped review. But the culture that ships it is now on the record. This week everyone is talking about exchange security. A self-custody wallet asks the same question, with no SAFU fund behind it. 🔹If You Use Proton Today (NFA)🔹 ▫️ Your keys 📝 Keep your wallet recovery phrase offline, whichever app holds it. ▫️ Your 2FA 📝 Don't keep your password manager and your authenticator codes in the same app. ▫️ The next releases 📝 Watch whether Proton publishes outside audits for code shipped since August. I'll relax if Proton publishes a review policy for AI-written code before next month's reorg. I'll worry more if the next serious bug comes from an outside researcher, not from Proton. The code can be 90% AI. The trust is still 100% human. Would you keep your keys with a company whose CEO calls pentesting "loser thinking"?

France's Gigabyte Tax Has A Meter Problem 11 Votes To 10, 5.5 Cents A GB, And A Bill That Lands On Whoever Owns The Last Pipe 11 deputies voted yes. 10 voted no. That is how France's National Assembly approved a 5.5-cent tax on every gigabyte sent to French internet users. ---------------------- The amendment (I-1358 to the 2027 budget) passed on Friday, Oct 30, against the advice of both the government and the budget's general rapporteur. A version had already been rejected in the finance committee. The sender of the data pays. Not you, not your ISP. Its authors expect about €10B a year. So who actually ends up paying, and can anyone even measure it? 👇 🔹How The Tax Is Supposed To Work🔹 ISPs measure the data flowing to their customers and identify the sender by its IANA network registration. Every quarter, the totals go to the tax office. Rate: €0.055 per GB. Cap: 15% of the sender's French revenue, or 2% of its global revenue. The authors cite Arcep for about 200 billion GB a year. 200 billion x €0.055 = €11B before caps. Close to the €10B target. The viral "200GB game = €11 tax" math skips two things: the sender pays, and the cap exists. The authors even name video games and streaming as the reason for the cap. 🔹Five Names Carry Half The Traffic🔹 Arcep, end of 2025, share of traffic to French users: Akamai 12%, Netflix 11.6%, Amazon 9.8%, Google 8.9%, Meta 6.7%. Together: 48.9%. On paper, Netflix's 11.6% is about 23 billion GB, so roughly €1.3B before the cap kicks in. For $NFLX, the cap sets the bill, not the gigabytes. 🔹The Clause That Moves The Bill🔹 Akamai is not a streaming app. It delivers other companies' content. The amendment says that when a sender uses a CDN, the volume counted is what leaves the CDN. CDNs don't have to name their clients. They pass the tax on, or not, under their own terms of sale. So $AKAM's 12% doesn't vanish. It becomes a line on someone else's invoice. That is exactly the worry of Minister David Amiel: a big share could fall on smaller players, many of them French. 🔹What The Meter Can't See🔹 The meter identifies a sender by its network registration, not by its app. Traffic served through someone else's network lands on that network's tab. About 21% of traffic already comes from caches sitting inside the ISPs' own networks. The tax follows the pipe. The product behind it is a guess. 🔹Before Anyone Pays (NFA)🔹 ▫️ The Senate and the final budget 📝 This is a first-reading vote. It can still be rewritten or dropped. ▫️ The decree 📝 How the measurement works is left to a decree. No decree, no meter. ▫️ CDN invoices 📝 If a "France data" surcharge appears on CDN contracts, the bill has moved downstream. I'll take it seriously if it survives the Senate with the CDN clause intact. I'll file it as a headline if the final budget drops it or the decree never comes. France wants to tax the content. The meter can only see the pipe.

Now it's Trezor's turn... Same reseller behind the Ledger drain: CryptoBilis. On Oct 28, a buyer in Indonesia reported an extra board inside a Trezor Safe 5 bought in August. Its own cellular module, its own antenna. Per the report, it reads the screen, backup included, and sends it out every time the device is plugged in. Trezor hasn't examined it yet. No funds reported lost. Any CryptoBilis buyer since March can get a new device or a voucher. The Ledger drain tied to the same reseller: $95.35M, per Arkham. Two brands. One reseller. Nobody had to break a chip. Seriously now, who would still buy a hardware wallet from anyone but the maker?

A Real Hamster Is Mining a Token on Ethereum What Squeekchain Actually Proves, And Why I'm Farming It Anyway 1 hamster. 1 wheel. 1 magnet passing 1 sensor. Each completed block issues 6,900 SQK, capped at 2.1 billion. The token is not live yet. It's still on testnet. ---------------------- Squeekchain calls itself a "toychain". Squeektoshi runs on a device called the WHEELY9000, every accepted magnet passage counts as one unit of work, and Ethereum settles the record. It sounds like a joke. The docs read like a serious protocol paper. So what does a hamster-powered chain really show? 👇 🔹What The Hamster Does, And What It Doesn't🔹 ▫️ The hamster produces the work. Ethereum does the consensus. The team says so plainly: the wheel is the only source of work, and Ethereum stores and orders it ▫️ No wheel, no blocks. When Squeektoshi sleeps, no SQK is issued. A slow hamster stretches the schedule ▫️ Rewards go to Squeeks, a collection of 9,999 NFTs. A Squeek sitting in a wallet earns nothing, only deposited ones do ▫️ Issuance halves every year over three years. After that, earnings depend on fees, and how those are shared is still TBD 🔹The Part Most People Will Skip🔹 The whitepaper is unusually honest about its own risks. It says concentration is intended. In its own example, one account with 10% of Squeek power and 10% of staked SQK takes 96.5% of the issuance driven by staked SQK, against 3,000 smaller accounts. The contracts are upgradeable through governance, and a Guardian can pause settlement. It also says nothing in the paper promises a price, a return or liquidity. That's the trade: a fun physical oracle, sitting on very normal crypto trust assumptions. 🔹How I'm Approaching It🔹 📝 Genesis is free. You link X, sign with a wallet to verify it, and farm Aura through badges and invites for a whitelist spot 📝 A signature only. Never a transaction you don't understand 📝 Any ethereum:0x8b50c3137680e1b179a1767b2c8bf79e8b7e95f3 trading today is fake. The team says the contract will only be announced from @squeekchain 📝 Use a fresh wallet for anything early stage Disclosure: I'm farming Aura myself and the link below is my referral. I'd change my mind if launch terms favor a few large holders even more than the paper already describes. Bitcoin started with CPUs. This one starts with little animal cardio. Is a hamster any less trustworthy than the oracles we already use? Link in the reply 👇

Saylor Stopped Stacking. He Started Buying Back His Own Paper. Strategy Spent 13x More On $STRC Than On bitcoin:native In Three Weeks. Strategy bought 0 bitcoin last week. It spent $204.9M buying back its own 12% preferred, STRC. Strive added 6,182 BTC in roughly the same week. ---------------------- Monday's 8-K from Strategy barely says anything. From October 19 to 25: no $MSTR shares sold through the ATM, no bitcoin bought or sold. Holdings stay at 848,517 BTC, average cost $75,446. With bitcoin around $80,000, that cushion is about 6%. The money went somewhere else: 2,068,459 STRC shares, at about $99 each. So is the biggest bitcoin buyer done buying, or busy defending the paper that funds it? 👇 🔹Follow The Cash, Week By Week🔹 ▫️ Bitcoin bought since Sep 21: 1,665, then 334, 250, 267, and 0 BTC ▫️ STRC bought back over the last three weeks: $192.4M, $193.1M, $204.9M. About $590M in total ▫️ Bitcoin bought over the same three weeks: about $43.6M ▫️ USD Cash: $1.00B on Sep 27, $242.4M on Oct 25 ▫️ USD Reserve, earmarked for dividends and interest: $4.83B. The buybacks came out of USD Cash, not this At last week's pace, USD Cash covers barely more than one more week of buybacks. 🔹Why Buy Back Instead Of Buy🔹 STRC pays 12% a year and is designed to trade near its $100 stated amount. Last week's buybacks averaged about $99.06, just under it. If STRC slips well below $100, the 12% stops looking safe, and selling new STRC to buy bitcoin gets harder. Defending the price keeps the main funding pipe open. The bill lands on cash, not on common shareholders. No ATM sales last week means no dilution... and no fresh bitcoin either. Tomorrow, October 28, shareholders vote on moving preferred dividends to a daily schedule. If it passes, STRC goes first, from November. 🔹Who Gains🔹 STRC holders get a buyer near par every single week. Common holders get a break from dilution. Strive gets the headline. It sold 7M shares of its own 15% preferred at $90, a 16.67% yield on the issue price, bought 6,182 BTC for $511.4M, and now holds 43,000 BTC. It just filed a $1.0B ATM to sell more of that paper. One detail: Strive also holds 505,000 STRC shares. The challenger collects Strategy's 12% while it catches up. 🔹What I Am Watching Next (NFA)🔹 📝 Next Monday's 8-K. Does USD Cash fall under $100M, or get refilled with MSTR sales? 📝 STRC vs $100. Buybacks below par are the tell. 📝 Strive's SATS ATM. A 15% coupon is the price of catching up, and it compounds. 📝 Bitcoin vs $75,446. Strategy's cost basis is the line everyone will quote if it breaks. I would call this a pause if Strategy restarts buying with MSTR proceeds while STRC holds near $100. I would call it a regime change if the buybacks continue after USD Cash runs dry. Saylor wrote the playbook: sell paper, buy bitcoin. This month, the paper got paid before the bitcoin did. NFA. DYOR.

I voted for Galactic Geckos in the Solana NFT Community Award at @SolanaConf. 🏆 https://t.co/8AMVBcPAiP 💚 @GalacticGeckoSG

The Trenches Are Boycotting Pump .fun. The Register Still Rings. Who Wins, And Who Pays, In The #BOYCOTTPUMPFUN Week The trenches are angry. The revenue is a little lighter. And Pump .fun just put $2.5M on the table to bring everyone back. ---------------------- #BOYCOTTPUMPFUN went from 9 posts on Oct 20 to 1,067 on Oct 24. The spark was Kimchi, the trader Pump .fun signed as a partner on Oct 20. Two days later his account posts a QR code to a fresh coin, "Project Kimchi". Alon, Pump .fun's co-founder, reposts it. Lookonchain: $14M market cap, then down more than 95%. Repost undone, post deleted, and wallets that bought early walked away with over $385K. One day later, Pump .fun announced a $2.5M Squads Competition. So what is the boycott actually costing them? 👇 🔹The Numbers🔹 From DefiLlama: ▫️ Pump .fun launchpad revenue, Oct 20: $1.61M. Oct 24: $1.15M ▫️ Lowest day in three weeks. But it was a Saturday, and the Saturday before did $1.29M ▫️ Whole Pump group, last 7 days: $13.27M in revenue ▫️ Still about 74% of all launchpad revenue DefiLlama tracked last week ▫️ $5.94M spent on $PUMP buybacks in those 7 days A dent. Not a break. 🔹Read The Fine Print🔹 Winners are ranked on realized plus unrealized PnL. Only trades on the Pump .fun app, web and Terminal count. Perps don't. Since Oct 16, trades on the app and web carry a 0.45% platform fee. So the prize pool sends volume straight through the door with the toll booth. $2.5M is roughly 1.3 days of group revenue. Unrealized PnL also rewards whoever can mark a thin bag up on paper before the final bell. Bundlers do that for a living. Pump .fun says it will watch the leaderboard for gaming. Alon calls it "not finance, it's entertainment." Entertainment with a 0.45% cover charge. 🔹Who Wins, Who Pays🔹 ▫️ Pump .fun: more app volume, more fees, buybacks keep running ▫️ The treasury: Lookonchain counts 5.48M $SOL sold so far, about $875.5M ▫️ The top 3 squads: $1.5M, $750K and $250K, after KYC ▫️ Big wallets and bundlers: unrealized PnL is a game they already play ▫️ Referrers: Alon says they keep 100% of the platform revenue their friends generate ▫️ Retail: pays the fee and supplies the PnL 🔹Actionable NFA for Wise Investors🔹 📝 Track DefiLlama's daily revenue until the competition ends on Nov 9. Compare weekdays with weekdays, not with Saturdays. 📝 $PUMP sits near $0.0042, about $1.93B market cap, more than 50% below its Sep 2025 high. Buybacks are the bid. Watch them weekly. 📝 If you join a squad, open the holders tab first. A coin where one wallet holds half the supply is a leaderboard, not a market. 📝 Never buy a coin because a founder reposted it. A repost can be undone. Your buy can't. My thesis strengthens if weekday revenue holds above $1.3M while the hashtag keeps trending. It weakens if daily revenue keeps sliding after Nov 9, once the prize money is gone. Boycotts trend for a week. Fee switches run for years. Is #BOYCOTTPUMPFUN a real threat, or just the trenches venting between trades?

Tailworm: One Hacked Box, Root On The Next One 11 Unpatched Tailscale Findings, And What To Lock Down Tonight Your private network is only private until one device on it gets owned. A new report says Tailscale SSH can turn that one device into root on the others. No patch. No CVE. Yet. ---------------------- On Oct 25, researcher Erica Windisch (Cyberdione Labs) published "Tailworm": 11 findings in 5 groups, tested on Tailscale 1.104.2 and headscale 0.29.5 between Oct 22 and 24. The core issue: Tailscale SSH runs inside tailscaled, and tailscaled runs as root. When a session forwards Unix sockets (ssh -L / -R), the path checks and file operations happen with root rights. In her lab, an ordinary session went through the Docker socket and read /etc/shadow. Another chain captured an enrollment key and joined a rogue node that looked like a trusted server. Spread took under a second per hop. No passwords, no stolen keys. 🔹What Is Confirmed, What Is Not🔹 ▫️ Every result is a lab reproduction, not a breach in the wild ▫️ Tailscale's latest bulletin is still TS-2026-013. Nothing on Tailworm, no fixed version ▫️ VP of Engineering Mike Shaver says they are reviewing it and don't recommend everyone disable Tailscale SSH. His advice: review SSH policies and forwarding, turn on auto-updates ▫️ The researcher says it was "reported but not coordinated". Critics on HN call the report unreadable ▫️ The attacker still needs a first foothold: a vulnerable web app, a poisoned package, a phishing implant, stolen creds 🔹Why It Matters Beyond IT🔹 Not the first time this year. Bulletins TS-2026-006 and TS-2026-009 described SSH paths to root, one through a username of "-i". Both fixed in 1.98.9. In July, an AI agent used one stolen reusable Tailscale key to enroll 181 nodes into Hugging Face's network. No bug needed. Plenty of builders run bots, RPC nodes, validators and AI agents on a VPS reachable only through Tailscale. The mesh is the perimeter. One owned box becomes every box's problem. 🔹Actionable NFA for Builders🔹 📝 Check if you even use it. Open your policy file and read the ssh section. Not needed on a node? tailscale set --ssh=false. Keep another way in first, or you lock yourself out. 📝 Plain OpenSSH over the tailnet still works, and it drops to the user's privileges before the session starts. 📝 Rewrite SSH rules per pair: one source, one destination. No tag-wide or all-members rules. Per-pair grants were the only control that stopped the spread in the lab. 📝 Deny forwarding in each SSH rule unless you need it. On headscale 0.29.5 you can't, so treat every SSH grant as root. 📝 Remove serve forwards that point to Unix sockets, and unused app connector permissions. 📝 Turn on node-key expiry and Tailnet Lock. Swap reusable auth keys for one-off or ephemeral ones. 📝 If a box gets compromised, delete it at the control plane. Reimaging doesn't revoke keys that were already copied. 📝 Turn on auto-updates and watch tailscale .com/security-bulletins. My thesis strengthens if the official bulletin confirms the forwarding findings and ships a privilege-drop fix. It weakens if it scopes most of this to headscale or unusual configs. Zero trust is a policy file. Not a property of the software. Do you run Tailscale SSH on anything that holds keys?

That $635m was oct 22. the bitcoin:native etf week actually closed +$301m the real story is who's holding the bag: IBIT +$566m this week every other etf combined -$265m 2026 so far, all etfs together: +$656m IBIT alone: +$4.0b so basically BlackRock is the market, and the expensive funds are funding it. $GBTC at 1.5% fees is -$2.7b this year while the 0.15% clones keep growing... and yesterday even $IBIT went red (-$110m) BTC sits at ~80.6k, right under the ~81k avg cost of etf buyers if IBIT starts selling too... who's left buying?

What Tesla Holders Would Actually Receive From a SpaceX Merger Say SpaceX offers you the 25% premium Wall Street is already modeling, paid in SpaceX shares. The market does not move. You keep every share. How much richer are you? Not 25%... About 13% at best. And the number after that one is worse 👇 🔹You Pay Part of Your Own Premium🔹 Today, Tesla is worth about $1.45T, SpaceX about $2.01T. A 25% premium values Tesla at $1.81T. Paid in shares, it leaves you owning 47% of the combined group. If the market values that group at exactly the sum of its parts, $3.46T, your 47% is worth $1.64T. Up 13%, not 25%. The missing 12 points never existed. Your $190B gain is exactly SpaceX holders' $190B loss... and you are now one of them. Pay a premium in shares and the seller funds part of it. 🔹The Merger Has to Invent a Quarter of Tesla🔹 For SpaceX holders to stay whole and you to truly get 25%, the merger must create about $360B of new value. A quarter of Tesla, from common ownership alone. Tesla already sells SpaceX Megapacks ($405M in H1) and owns a $2B stake. No merger required. SpaceX spent $25B more than it generated in six months. Tesla kept $352M. Merging them changes who owns the shortfall, not its size. Nobody has put a number on the synergies. I looked. This is the number they would have to reach. 🔹You Own 47%. You Vote 16%.🔹 Tesla: one share, one vote. SpaceX: Class A one vote, Class B ten. Receive your 47% in Class A and run SpaceX's own share count: you hold 16% of the votes. Class B keeps 74% with 22% of the shares. Today 1% of Tesla is 1% of the vote. In Class A, 1% of the group is 0.34% of the vote. RBC's Tom Narayan calls the premium the price Tesla holders would demand for surrendering control. The arithmetic says that price is worth 13%, and it buys 16% of the vote for 47% of the company. The exchange ratio makes the headlines. The share class makes the decisions. 🔹What This Would Do to the Two Prices🔹 Think in four moments. 1️⃣ Now, on the rumour. When merger talk hit the headlines without a number, both stocks rose. The arithmetic above says both cannot be right unless $360B of new value exists. Someone is paying for value nobody has shown. 2️⃣ Announcement day. Tesla would not jump 25%. It would move toward what the SpaceX shares on offer are actually worth, so nearer 13%, then a little less, because the market discounts the risk the deal never closes. SpaceX would fall, because paying a premium with your own shares costs your own holders. The tape has already rehearsed it: on the day RBC's premium note circulated, Tesla fell 2% and SpaceX fell more than 5%. And Tesla itself fell about 10% the day after announcing the SolarCity offer in 2016, the same kind of deal with the roles reversed. 3️⃣ Between announcement and closing. With a fixed ratio, Tesla would no longer have its own price. Every day it would move with SpaceX, times the ratio. Tesla earnings become a footnote - Starship becomes the driver. Funds that specialise in these deals typically buy the target and sell the buyer to lock in the gap, which means steady selling of SpaceX for as long as the deal is pending. 4️⃣ If the deal dies. Tesla gives back what the rumour added, and in this arithmetic the rumour added at most a chance of 13%, not 25%. SpaceX would likely see relief: the overhang of being used as currency disappears. The headline premium is Tesla's ceiling, not its target. SpaceX is the price that actually moves. 🔹Actionable NFA for Wise Investors🔹 ▫️Benchmark against 13%, not 25%. 📝 No standalone $TSLA case at your entry price, no trade. Once terms exist, ratio × live SpaceX price is your real offer. ▫️Trade the gap, not the headline. 📝 After announcement, $TSLA above ratio × $SPCX price means you are paying for a closing you do not control. Well below it means the market doubts the deal. ▫️Watch SpaceX, not Tesla. 📝 Once the ratio is fixed, SpaceX's tape is Tesla's tape. Starship cadence and SpaceX cash needs become your Tesla risk. Musk may bring the companies together. Your return depends on the deal that brings you in.