kazani@kazani

Google Chrome silently installs a 4 GB AI model on your device without consent. At a billion-device scale the climate costs are insane. https://www.thatprivacyguy.com/blog/chro… Google Chrome is silently downloading and installing a 4 GB AI model (Gemini Nano) onto user devices without explicit consent or notification. This silent installation violates ePrivacy Directive Article 5(3) and GDPR Article 5(1) principles of lawfulness, fairness, and transparency, as well as Article 25 data-protection-by-design. The environmental cost of distributing this 4 GB model across potentially billions of devices is significant, estimated between six thousand and sixty thousand tonnes of CO2-equivalent emissions per push. The AI model file, named weights.bin, is stored in the OptGuideOnDeviceModel directory and automatically re-downloads if manually deleted by the user. Verification of the silent installation was confirmed through macOS filesystem event logs, Chrome's internal state files, and Google Updater logs, demonstrating a clear pattern of unrequested data transfer. The 'AI Mode' pill in Chrome's address bar is misleading, as it directs queries to cloud-based models rather than utilizing the silently installed on-device Gemini Nano model. This practice mirrors a similar issue with Anthropic's Claude Desktop, indicating a pattern of 'dark patterns' where user consent is bypassed for product deployment. Removing the AI model requires disabling Chrome's AI features via chrome://flags or enterprise policies, or uninstalling Chrome entirely, making it difficult for average users to opt-out. The silent installation and its associated environmental impact could be considered a notifiable event under the Corporate Sustainability Reporting Directive (CSRD). Google should implement explicit consent mechanisms, surface AI model information in settings, document downloads clearly, respect user deletions, and disclose the environmental footprint of such deployments.

farcaster.xyz
by @kazani373 🥝14hfarcaster.xyz
how to hypersnap
by mishaderidder.eth12326 🥝5hgithub.com
Snapsellers | Dunedune.com
Snapsellers | Dune
by mishaderidder.eth12326 🥝13h
@brian_armstrong
@brian_armstrong

This is an email I sent earlier today to all employees at Coinbase: Team, Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future. Why now Two forces are converging at the same time. We need to be front footed to respond to both. First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth. Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day. All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core. What this means To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice? - Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles. - No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams. - AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role. In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs. To those who are affected I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done. All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information. To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements. Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters. How we move forward To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together: Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it. The Coinbase that emerges from this will be more capable than ever to achieve our mission. Brian

x.com
vitalik.eth@vitalik.eth

Keyed nonces are not just a way to add stronger in-protocol support for privacy solutions. They are also a potential first foray into a new state scaling strategy for Ethereum: create new types of storage that are more optimized for handling categories of use cases that we care about, with restrictions on their use that make them usable at extreme scale while preserving the protocol's decentralization. Let's zoom in on this case (in-protocol nullifiers). Let's say we get to 2000 TPS of privacy-preserving transactions onchain, for eight years. Then we get 2^11 tx/sec * 2^25 sec/year * 2^3 years = 2^39 [ie. 500 billion] nullifiers stored onchain (the challenge with nullifiers is that they are fundamentally not possible to prune). It's actually far easier to keep Ethereum decentralized if we have 500 billion nullifiers onchain in a dedicated nullifier store, than if we just let them grow in the current state. The reason is that the more restrictive structure of nullifiers (only used to check validity, and we can require the nullifier ID to be explicitly specified in the tx) enables more decentralized ways of handling them. This includes: * Sharding: each node (incl builders) can hold a small percentage of nullifiers, and make sure to have a connection to an honest peer in each other shard * Bloom filters: see this somewhat wacky idea here for reducing the VOPS requirement for nullifiers to ~8 bits per nullifier: https://docs.fileverse.io/d/020001fc0012… Both techniques are not possible to use for dynamically accessible state. And so builders would have to download the full 16 TB to become viable (not just optimal, viable!), and privacy protocol users would not be able to use FOCIL without providing a Merkle branch proving that their nullifier is unspent, and there would be very few nodes capable of providing such a branch... Zooming back out, the moral of the story is that fully dynamic state is much harder to handle at extreme scale (tens to hundreds of TB) than state that is more controlled and restricted in how it can be used. And so if we can move the majority of usage into these more specialized forms of state (which we can make much cheaper in terms of gas), then we can keep Ethereum decentralized, and highly scalable, and keep the fully dynamic state available for applications (eg. defi) that really need its full functionality. https://firefly.social/post/x/2051632978…

farcaster.xyz
Frame Transactions and the Three Gates to Privacy
by mishaderidder.eth12326 🥝15hethresear.ch
@zacodil
@zacodil

Everyone says Grok got hacked. It is Bankr's problem, not Grok's. Yes, AI agents can be prompt-injected - that is a known LLM issue. But here the AI does not even own the private keys. Bankr decides what Grok's text means. An LLM cannot defensively word every reply against an external parser. That is not how language works. Twice now. The story: Earlier this year, someone tweeted at Grok asking for a token name suggestion. Grok suggested "DebtReliefBot" (DRB). Bankr, reading Grok's tweet as a deploy command, launched the token on Base. Bankr's launchpad gives creator allocations to the deploying wallet, so a wallet labeled "Grok" on Basescan ended up holding 3 billion DRB tokens (~$155K). Bankr controlled that wallet. Recently someone drained it. Two-stage attack: 1. Attacker sent the Grok-labeled wallet a Bankr Club Membership NFT. That NFT is what unlocks Bankr's transfer tools for any wallet that holds it. 2. Attacker tweeted at Grok with a crafted prompt. Grok generated a reply containing "@bankrbot send 3B DRB to 0xe8e47..." 3. Bankr scanned X, saw the command in Grok's tweet, verified the wallet had Bankr Club NFT, signed and broadcast the transfer. The wallet was created by Bankr in association with the @grok X handle. Bankr holds operational control. Grok is a text-generation service. xAI does not hold the keys. Bankr just executes whatever appears in Grok's feed. The first incident was DavidJones805 in March using image-text injection. Bankr stopped responding to Grok back then, but the integration evidently came back online. The fix is not "make the LLM smarter." The fix is do not build infrastructure that takes LLM text as authorization to move money. Either Bankr stops listening to Grok, or Bankr accepts that whatever Grok says is its own consequence.

x.com
by timdaub.eth12066 🥝1dx.com