Kiwi News: handpicked crypto news for builders

Expanding on why I believe "ETH as store of value (SoV)" makes much more sense to focus on than "ETH as fee-burning token". Three primary reasons: 1. ETH as fee-burning token never was as strong as it seemed 2. Optimizing for ETH as fee-burning token would demand Ethereum and ETH function in ways that are very hard to make compatible with decentralization and capture resistance. 3. Meanwhile, optimizing for ETH as SoV is aligned with Ethereum focusing on its unique strengths (decentralization and CROPS) EIP-1559 (including its burn) is fine and good, we should keep them. But we should not feel sad if fee burn is < 10% of breakeven indefinitely; the value of ETH comes from elsewhere. The core idea: the big thing that people appreciate about Ethereum is decentralization and CROPS. The main pragmatic benefit that these things translate into is stability. SoV is the category where that is not an unneeded extra we merely put effort into for ideological reasons, but rather a pragmatic strength from the perspective of people putting in their assets. And in the era of AI disruption, stability will be highly valued.

I know this is a predictable opinion from me but I don't agree with the strong emotional reaction against the anti-data-center movements that I've seen this week. As I see it, algorithmic progress means that whatever you would be able to do with more and bigger data centers in 2 years, you will be able to do with the data centers we have today in 4 years - probably sooner. So nothing remotely apocalyptically bad will happen from even extreme levels of success by anti-data-center people. Meanwhile we need all the time we can get to better harden the world against both already-visible cybersecurity issues and any bio and other risks soon to come. Science applications are bottlenecked by many things other than AI, so slowing AI down by one year will slow those down by much less than one year. Given this, a slowdown in compute hyper-scaling seems quite net good? Notice this is without any controversial "doomer arguments", RSI etc. Even if net-bad, it's certainly not worse than like 10+ other political things.

Are you tired of getting your data leaked? ████████████████████████ Yes  (100%) 11 votes · 5 days

PSA on today's Reth / OP Reth releases A fix went out across the Reth ecosystem ensuring that all Reth-based nodes, DeFi bridges and state-proof backed systems are all safe. If you depend on Reth, please update to v.2.10.0, OP Reth v2.8.1, and Base version v1.5.3. We appreciate how quickly everyone moved to patch. This bug was identified by the Tempo team's fuzzing process, and Tempo is also patched. Reth’s legacy state root code had an edge case. For certain smart contract storage layouts, a carefully crafted transaction could make it produce the wrong state root. Reth’s block builder uses this legacy trie calculator on lower-end hardware and on OP Stack chains, so those setups were exposed. L2s like OP Stack chains or Base are unaffected because this could not impact their withdrawals system. Ecosystem bridges do not use state roots, they use receipt roots or multisignatures, so they are unaffected by this. Reth is critical infrastructure for the entire EVM ecosystem. We take it very seriously. And we are sorry for the inconvenience caused.

Today, as part of Operation Economic Outcast, Treasury’s Office of Foreign Assets Control designated eight money services businesses based in Canada that enable the Iranian regime. Additionally, @FinCENnews issued an order effectively cutting off MEXC Global’s access to the U.S. financial system for facilitating at least $16 billion in illicit transactions, including activity connected to Iran sanctions evasion.

An OpenSSH bug that took 46 years to ripen! 1980 UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password. 2012 The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead. Guess which one? The same asterisk: *. Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *. 2016 OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time. 2022 Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images. … and the loop closes! You connect over SSH as root (whose shadow entry is *). You type any password longer than 256 characters (e.g. 300 As). crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root. That chain took 46 years (!!!) to complete. Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.

We’re aware of a security issue affecting Web3Auth’s services used by some third parties. We have temporarily paused the embedded wallet service. After an initial investigation, we’ve found no evidence that MetaMask users are impacted.

Olá! Cypherpunk Congress 4 is coming to Lisbon 🇵🇹 Expect the biggest digital rights x neo-cypherpunk festival celebrating people, encryption, free speech, privacy, alternatives to big tech, culture & you. Congress 4 theme: "The Atlantic Commons". Portugal is a place where the histories of empire, colonial extraction, migration & European power meet the struggle for a different digital future. It's is a bridge between Europe, Africa, Latin America and the wider Global South. Not as a symbolic meeting point, but as a place to challenge who owns technology, who controls infrastructure, who produces knowledge and who shapes the future. And let's not forget about massive gentrification turning Lisbon into a shopping mall & startup hub, displasing local people. Commonly we can do better! Commons. Step 1: from single event to lasting impact 🖤 We commit to series of worldwide meetups from Global South to Europe prior to main Congress. They will help to build a dialogue between digital rights activists & technology enthusiasts. Commons. Step 2: Matching cultures 🖤 Expect our Neo-cypherpunk activations at diverse events from Brazilian @cryptoravebr to Thai @fossasia, from @mozillafestival to @republica, & especially digital rights-focused Global Gathering in Portugal. Early registration: https://luma.com/7tqlmyqg Obrigado. Pela alegria do ativismo.