activescott's Notes

Mastercard, in comparison, performs this validation correctly and the contrast reveals exactly where Visa fails. The over-the-limit attack succeeds against Visa for one central reason: when the attacker flips the bit in the Card Transaction Qualifiers (CTQ) telling the terminal “on-device authentication has been performed”, Visa does not cryptographically authenticate that field – nor does it cross-check it against the Issuer Application Data (IAD), which contains an independent record (in the Card Verification Results field) of whether Consumer Device Cardholder Verification Method (CDCVM) actually occurred. During the original disclosure process, Visa confirmed to the researchers the relevant data is present in the Application Cryptogram; the company simply does not validate it – whereas Mastercard does. The researchers proved this formally using the Tamarin verification tool: a Mastercard transaction cannot be approved at high value without genuine on-device authentication.

On the touch point of this exploit being one only affecting Apple’s iPhone, it is worth noting how Samsung Pay takes a different approach at the device level – authorising only zero-value transactions in transit mode, with the actual fare settled later through the transit system. This is effective, though it comes with trade-offs; like how fixed-fare transit systems requiring upfront charges are not supported. Apple could theoretically implement a similar restriction, yet doing so would break Express Transit for several transit networks worldwide. The more appropriate long-term solution requiring no compromise on device-level functionality, is simply for Visa to implement the same backend verification Mastercard already uses.

Visa’s official position, reiterated to Veritasium in 2026, is straightforward: the company does not believe the exploit is likely in a real-world setting. The attack requires physical proximity to (or possession of) the victim’s iPhone, specialised hardware, a rooted Android phone, and technical knowledge of EMV protocol manipulation. Visa further notes cardholders are covered by its ‘Zero Liability Policy’, allowing for any fraudulent transaction to be disputed and refunded. Anyone who has ever tried getting a refund from a bank for fraudulent activity will know how tedious and time consuming this process can be, and it is rather telling how Visa would rather put users through inconvenience than simply fixing the known security gap.

With that said, the company’s position is worth examining over outright dismissing. For a start, the hardware requirements are not trivial. Nefarious parties would require a Proxmark device, rooted Android phone, and laptop running custom relay software – all of which represent a higher barrier to entry than most opportunistic theft. Scaled deployment across hundreds of victims simultaneously is, indeed, impractical with current methods.

Even so, this defence has clear structural weaknesses. The existence of a known and, in this case, reproducible vulnerability in a payment network processing billions of transactions annually; cannot simply be mitigated by the argument of it being ‘difficult to exploit at scale’. Mastercard clearly agrees given how they have implemented protections against exactly this class of attack. Moreover, the equipment required is commercially available (the Proxmark, for instance, is an open-source RFID research tool), and the researchers’ methodology was published in full at a major academic conference. It also stands to reason how the barrier to replication lowers every year. Arguing a vulnerability is tolerable because exploitation is currently inconvenient is not a security posture… it is more akin to som

For anyone who regards the security of their financial data as a priority, the recommended course of action is clear and immediate: do not use a Visa card for Express Transit on an iPhone until either Apple or Visa deploys a fix.

To disable Express Transit for Visa on an iPhone, navigate to Settings, then Wallet and Apple Pay, then Express Transit Card, and select None; or assign either a Mastercard or American Express card to the feature instead. Both alternatives are, as of the publication of this article, immune to this specific Visa card vulnerability.

AIPAC used a complicated web of political committees to influence the Illinois primary elections in March. Whether or not it is using the same tactics in Michigan — the group did not respond to a request for comment — observers expect it to continue to hide its campaign spending in the months to come, as primary candidates battle over AIPAC’s influence.

A NEW YORK state oversight board raised ethics concerns about a trip by state Comptroller Tom DiNapoli to Israel that a local pro-Israel Jewish group sponsored.

The revelation comes amid renewed scrutiny of DiNapoli’s spending spree on Israel Bonds, a financial instrument that directly funds the state of Israel.

The trip was paid for by the Jewish Community Relations Council of New York, which has a financial relationship to Israel Bonds, the organization that issues Israeli government debt securities in the U.S.

On Sunday, DiNapoli and other state and local electeds marched in the parade again, joined by an array of extremist Israeli political figures including Bezalel Smotrich, the current finance minister and a far-right champion of illegal settlements.

In his 18 years as comptroller — and particularly in the months and years following October 7 and the launch of Israel’s genocide in Gaza — DiNapoli has turned the state’s pension fund into one of the largest holders of Israel Bonds nationwide. Since the February 2024 trip, Dinapoli has invested $120 million of the state’s common retirement fund in the instruments, bringing the total investment of state pension funds in Israel Bonds to $332.5 million.

Critics of the investments also point to a fiscally responsible argument against the bonds. Unlike traditional foreign-debt assets, Israel Bonds cannot be sold on a secondary market and instead must be held until they mature. That makes them a potentially unsound bet, especially considering the rapid decline of Israel’s credit rating in recent years.

Allow for network traffic audits Some enterprise or school networks might be required to audit all network traffic by policy, and your network can block access to Private Relay in these cases. The user will be alerted that they need to either disable Private Relay for your network or choose another network. The fastest and most reliable way to alert users is to return either a "no error no answer" response or an NXDOMAIN response from your network’s DNS resolver, preventing DNS resolution for the following hostnames used by Private Relay traffic. Avoid causing DNS resolution timeouts or silently dropping IP packets sent to the Private Relay server, as this can lead to delays on client devices. mask.icloud.com mask-h2.icloud.com

iCloud Private Relay is basically Apple's implementation of oDoH (Oblivious DNS over HTTPS), the idea is you'll be using a proxy server (relay) to avoid the destination (DoH server) knowing who the request is coming from. Would be nice, if the relays would not be managed by Apple, thus not being able to collect the info anyway.

Be aware, by enabling iCloud Private Relay with the above setting, the devices will no longer be using pihole, thus everything will be allowed, regardless of the blocklists you have.

Also read this pihole documentation, here (unbound), where DL6ER explains why unbound is the best choice to get the most out of pihole, from a privacy point of view.

Because vision, audio, and text inputs share the exact same weights, you no longer need to co-tune separate frozen encoders. Downstream adapter fine-tuning (such as LoRA) or full fine-tuning naturally updates the entire multimodal token loop in a single pass.

While many AI open source model providers are pursuing larger and more powerful models, Google is still giving attention to the smaller, more local side of the market. Today, the tech giant released Gemma 4 12B, an 11.95-billion-parameter open-weights model with permissive Apache 2.0 license optimized to execute locally on a standard enterprise laptop using just 16GB of VRAM or unified memory.

Traditional multimodal systems typically utilize discrete, separate encoders to translate audio waveforms and visual data into representations that the core language model can process.

This conventional approach inherently increases both inference latency and total memory consumption.

Gemma 4 12B radically alters this pipeline by functioning entirely without these secondary encoders. Instead, visual patches and raw audio waveforms are projected directly into the core large language model's embedding space through lightweight linear layers.

The vision encoder is replaced by a 35-million-parameter module utilizing a single matrix multiplication, while the audio encoder is eliminated entirely.

For enterprise engineering teams, this unified architecture delivers distinct operational advantages: lower latency for multimodal tasks, reduced VRAM requirements (down to 16GB — typical for laptops), and the ability to fine-tune the entire multimodal system in a single, cohesive pass.

Google has ensured that Gemma 4 12B is not an isolated experiment; it is ready for production. Weights are available on Hugging Face and Kaggle, and the model integrates seamlessly with industry-standard deployment frameworks such as vLLM, SGLang, MLX, and llama.cpp.

Interesting prompt for porting zig to rust in bun.

Meanwhile, Bun’s relationship with the Zig community has soured. Zig Software Foundation maintains a strict “no AI code” policy and previously rejected Bun’s attempts to upstream performance improvements as “technically unsound.” WinBuzzer reported on May 1 that “Anthropic-owned Bun is already paying the cost” of Zig’s LLM ban. The friction is accelerating the Rust exploration.

Zig was a deliberate choice in 2022. Its comptime evaluation and zero-runtime design minimized overhead when calling JavaScriptCore’s C++ interfaces. But Zig’s ecosystem remains narrow: no central package registry comparable to crates.io, a small hiring pool, and slow open-source contributor growth.

Rust is now the practical standard for systems programming. AWS Firecracker, Cloudflare’s Workers runtime (workerd), and Linux kernel drivers are built in Rust. The White House ONCD and NSA have formally recommended Rust for memory safety. As of 2026, choosing Rust means choosing a contributor pool orders of magnitude larger than Zig’s.

Bun’s Rust move is about ecosystem integration, not raw performance gains. More contributors, better security tooling, and more hireable engineers.

Docs for the OAK-D Lite.

Luxonis OAK-D Lite datasheet.

Kinda like twilio.

E.164 defines a general format for international telephone numbers. Plan-conforming telephone numbers are limited to only digits and to a maximum of fifteen digits. The specification divides the digit string into a country code of one to three digits, and the subscriber telephone number of a maximum of twelve digits.

As diplomatic efforts to strengthen the deal have stalled, three soldiers described to AP a sense of confusion in the embattled territory, with a lack of clarity on rules of engagement around the yellow line. Some commanders paid lip service to the agreement, the soldiers said, while privately voicing desire for the war in Gaza to continue. Sometimes, troops were too far away or acted too quickly to recognize who they were shooting, one soldier said — a concern echoed in comments from a whistleblower group of veterans.

When the ceasefire went into effect, Israel withdrew troops to a buffer zone demarcated by a yellow line, giving it control of just over half the strip. Under the agreement, Israeli forces are meant to complete a fuller withdrawal, though there’s no timeline for that. The U.S.-backed diplomat overseeing the truce says progress is deadlocked over the central sticking point of disarming Hamas, upon which all other issues — including Israeli withdrawals and reconstruction — hinge.

Since the ceasefire went into effect, more than 900 people have been killed in Gaza — dozens of those close to or over the yellow line, according to Gaza’s Health Ministry. The ministry doesn’t say how many are militants, but unarmed men and children have been among the dead.

soldiers who spoke to AP and Breaking the Silence — the whistleblower group that has collected troops’ testimonies throughout the war — say that at times soldiers were too far away, acting too quickly and under too much pressure to tell.

This week, Israeli Prime Minister Benjamin Netanyahu said Israel controls 60% of Gaza and the next step was to move to 70% control.

The soldiers told AP that on the ground, the ceasefire is elusive.

“We need to stop using this term,” one said of the word, ceasefire. “It’s not serving people that want to stop the war.”

Prefill processes all input tokens simultaneously. For a 4,096-token prompt, the attention computation involves large matrix multiplications across the full sequence length. This is compute-bound work. The GPU’s tensor cores are the bottleneck. On an H100 SXM, prefill achieves 200-400 arithmetic operations per byte of memory accessed. Utilization sits between 90% and 95%. The memory bandwidth, at 3.35 TB/s, is barely taxed.

Decode generates one token at a time. Each step reads the entire KV-cache from HBM to compute a single attention output. The tensor cores finish in microseconds and then wait for the next memory read. Arithmetic intensity drops to 60-80 ops/byte. GPU utilization falls to 20-40%. The tensor cores sit idle while the memory bus saturates.

Disaggregated inference runs prefill and decode on separate GPU pools connected by a fast network. A request arrives, gets routed to a prefill worker, which processes the full prompt and generates the KV-cache. That cache is then transferred over the network to a decode worker, which handles the autoregressive token generation.

Disaggregation is not free. The KV-cache produced during prefill has to move from the prefill GPU to the decode GPU over the network, and these caches are not small.

For a 70B parameter model using grouped-query attention with 80 layers, 8 KV heads per layer, 128 dimensions per head, stored in FP16: each token’s KV state is 327,680 bytes. A 4,096-token prompt produces 1.34 GB of KV-cache. That entire block has to transfer before the decode worker can begin generating.