kaymyg

Elimina le narrazioni e guarda alla struttura #qONE è uno dei pochi asset che si allinea esplicitamente con la crittografia post-quantistica prima che il mercato sia costretto a interessarsene.
Il prezzo si aggira attorno a $0.0062, con una capitalizzazione di mercato di ~$2.3M, ti dice esattamente dove si trova: pre-rotazione, pre-attenzione istituzionale e scoperta precoce del prezzo. Questo non è un asset maturo: è un gioco infrastrutturale ancora valutato come un token di nicchia mentre mira a un problema sistemico.
Realtà Macro: Il Tempo Sta Scadendo per la Crittografia Classica

Claude audited its Source Code, heres the summary findings
Based on deep analysis of the 2,200-file codebase across all four dimensions:
🔴 Security Vulnerabilities
1. Windows Command Injection (windowsPaths.ts)
The checkPathExists() function constructs a shell command by directly interpolating a user-controlled path string:
execSync_DEPRECATED(`dir "${path}"`, { stdio: 'pipe' })

A path containing " or shell metacharacters (e.g., C:\foo" & evil) could break out of the double-quoted context and execute arbitrary commands. Low exploitability in practice (internal utility function) but still unsafe.
2. No Private-IP/Localhost SSRF Guard in WebFetchTool
isValidUrl() checks that the hostname has at least two dot-separated parts — but it does not block localhost, 127.0.0.1, 192.168.*, 169.254.*, or other RFC-1918/link-local addresses. The domain blocklist check (checkDomainBlocklist) delegates to api.anthropic.com/api/web/domain_info, which means SSRF to internal/private hosts depends entirely on that external API correctly refusing them. A network error returns check_failed which may be soft-handled. No defence-in-depth local IP check exists.
3. JWT Decoded Without Signature Verification (jwtUtils.ts)
decodeJwtPayload() explicitly strips the sk-ant-si- prefix and decodes the JWT payload without verifying the signature. Used for scheduling token refresh (expiry reading). If an attacker can substitute a crafted token, they could manipulate refresh timing. Low impact given tokens are received from trusted Anthropic infrastructure, but the absence of verification is worth noting.
🟠 API Key / Secret Handling
4. Session Ingress Token Stored In-Memory Across Multiple Locations
session_ingress_token values are passed around as plain strings and stored in sessionIngressTokens (a Map) in bridgeMain.ts. Tokens appear in debug logs with prefix redaction (token.slice(0, 15)…) — but log redaction is manual and inconsistently applied. Any future logging change could inadvertently expose full tokens.
5. CLAUDE_CODE_CLIENT_KEY and CLAUDE_CODE_CLIENT_KEY_PASSPHRASE in Environment
These sensitive env vars exist as documented configuration options. If they appear in process listings, /proc/self/environ, or are captured by tools, they are exposed. There is a validateProcEnvironAccess security check in BashTool that blocks /proc/*/environ reads — good — but this only applies to Claude-issued bash commands, not arbitrary process inspection.
6. No Explicit Secret Zeroing
Decoded secrets from decodeWorkSecret() and tokens stored in the bridge are never explicitly zeroed/nulled after use. In JavaScript this is largely a V8 GC concern, but secrets can linger in heap memory and appear in crash dumps.
🟡 Data Privacy / Telemetry
7. Telemetry Opt-Out Is Not Default
Analytics are on by default and require explicit env var setting (DISABLE_TELEMETRY=1 or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1). Events are routed to both Datadog and Anthropic's 1P event logging. The AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS marker type is a never type — meaning it can't actually prevent string metadata from being logged; it's enforced by convention and code review, not the type system.
8. Transcript Sharing on Feedback
submitTranscriptShare.ts sends the full conversation history (normalized messages + raw JSONL transcript + subagent transcripts) to Anthropic on survey feedback, including a redactSensitiveInfo() call whose scope is unclear. This happens on negative AND positive feedback triggers. Users may not fully understand transcript content is uploaded.
9. PROTO PII Fields Go to 1P Logging
The PROTO* key pattern routes PII-tagged values to a "privileged column" in BigQuery with restricted access controls. The design is sound but relies entirely on sink.ts's stripProtoFields() being called before every non-1P sink. A single missed call would route unredacted PII to a general-access backend.
🔵 Code Quality / Architecture
10. Heavy Deprecated API Usage
177 call sites reference DEPRECATED-suffixed functions (primarily execSyncDEPRECATED, splitCommand_DEPRECATED). The primary replacement (tree-sitter AST path) is gated behind availability — the deprecated regex path remains the fallback for all security checks. This dual-path complexity is a long-term maintenance risk.
11. 663 Empty catch {} Blocks
A large number of error swallowing patterns exist throughout. Many are intentional (best-effort operations like cache writes), but others hide meaningful failures silently. Notable: the checkDomainBlocklist catch returns check_failed with the error, which is good — but many callers handle check_failed leniently.
12. 940 Fire-and-Forget void Calls
Pervasive void asyncFunction() usage means many async failures are silently dropped. Analytics, telemetry writes, and some session operations all use this pattern.
13. 142 TODO/FIXME/HACK Comments
Indicates meaningful technical debt, though some are security-annotated (well-documented attack analysis in bashSecurity.ts is actually a positive).
14. bashSecurity.ts is Excellent but Regex-Fragile
The shell security validation code is exceptionally detailed — covering IFS injection, Unicode whitespace, carriage return differentials, brace expansion, Zsh-specific bypasses, etc. However, the _DEPRECATED regex path (used when tree-sitter is unavailable) is inherently fragile. The team has documented 20+ known bypass classes; there are likely undiscovered edge cases.
Summary Table
Here’s a clean rewritten version without any table formatting:
Summary
Security — 🔴 High: Windows directory "${path}" injection vulnerabilitySecurity — 🔴 High: No protection against localhost/private IP SSRFSecurity — 🟠 Medium: JWT is decoded without verifying its signatureSecrets — 🟠 Medium: Ingress tokens exposed in memory/logsSecrets — 🟠 Medium: Client key and passphrase stored via environment variablesSecrets — 🟡 Low: No memory zeroing for sensitive dataPrivacy — 🟠 Medium: Telemetry is not opt-out by defaultPrivacy — 🟠 Medium: Feedback may trigger implicit transcript uploadsPrivacy — 🟡 Low: PII handling relies on a single stripProtoFields callQuality — 🟠 Medium: 177 deprecated function call sitesQuality — 🟡 Low: 663 empty catch blocksQuality — 🟡 Low: 940 fire-and-forget async callsQuality — 🟡 Low: 142 TODO/FIXME itemsQuality — 🟡 Low: Fragile regex usage in security-sensitive paths
https://t.co/jBiMoOzt8G

IBM
IBM è sulla buona strada per dimostrare un vantaggio quantistico verificato entro la fine del 2026 utilizzando il suo processore Nighthawk da 120 qubit, e ha raggiunto un aumento di velocità di 10 volte nella correzione degli errori quantistici un anno prima del previsto. La loro tabella di marcia è la più leggibile nel settore:
IBM Quantum Loon dimostra per la prima volta tutti gli elementi hardware del calcolo quantistico tollerante agli errori, con la decodifica della correzione degli errori ottenuta in tempo reale sotto 480 nanosecondi utilizzando codici qLDPC.
IBM Quantum Kookaburra (2026) sarà il primo modulo di processore in grado di memorizzare informazioni nella memoria qLDPC. Cockatoo (2027) aggiunge intrico multi-modulo, costruendo verso Starling — il loro primo sistema completamente tollerante agli errori previsto per il 2029, mirato a 100 milioni di porte su 200 qubit logici.