54 - Whose Permission is it Anyways?
Whose Permission is it Anyways?
⚜️ el Prof
Heart&SOL
On this page
GM HEARTLAND
We survived our first publication back! And our spam rate remained low enough that SendGrid will let us keep popping in your inbox once a week, but in case you forgot to opt out, here’s .
The past week for us deeply ingrained in the world of technology from cryptography to artificial intelligence are drawing in updates of compromised technology all across the technology stack. There is now a server level exploit that Google and others discovered that affects the BIOS running the vast majority of hardware that cloud based applications utilize. And if that’s not melting your brain, here in the States our Federal Elections Committee sat on a patch for their own site vulnerability for over a week, just in time to obscure last minute large donations that may be influencing our Midterm elections next week.
Freedom for all, accountability for none, and exploits for the lawless with an axe to grind or a dark money bag to grab. Read on for a more measured response across the sector. Thanks for reading and share with a friend!
- el Prof, Britt, & Muhammed
MONEY MONEY MONEY
| TOKEN | PRICE CHANGE | PRICE |
|---|---|---|
| Solana ($SOL) | -3.67% | $101.27 |
| Ripple ($XRP) | +0.00% | $1.33 |
| ZCash ($ZTC) | +2.20% | $1,295.01 |
| Bitcoin ($BTC) | -0.96% | $80,986.02 |
(Price changes reflect past 7 days — placeholder)
Another Brick in the Wall
The internet had a week. Security folks are calling it Black October, which sounds dramatic until you see the alert list. The headliner was PHP2Shell: two critical flaws in PHP, the language behind a mere 70% of websites, WordPress included. Researchers found the bugs with AI models, in code that had been sitting there for over a decade. That’s a bug old enough for middle school. Hackers didn’t wait for a calendar invite, either: within hours, Cloudflare saw exploit attempts climb into the millions.
Perfect timing, then, for The Atlantic to drop a gloomy one. Welcome to the Valley of Pain (paywalled, but worth it) argues that AI-powered attacks are pushing us toward an internet where only the big software providers get treated as trustworthy, because only they can afford the defenses. As the piece puts it, the internet needs better walls, but in building them, “we might also feel walled in.”
We don’t disagree with the diagnosis. OpenAI itself admitted last December that prompt injection, where attackers hide instructions in web pages or emails to hijack AI agents, may never be fully solved. Once your browser has an agent in it, every page is a potential con artist.
Where we get off the bus is the prescription. A handful of companies deciding which sites are trustworthy isn’t a security model. It’s a Ministry of Truth with better UX. Whoever owns the walls decides what counts as real, where your data lives, and what the rest of modern life gets to run on. And no, we’re not anti-AI. We use it, we build with it, and we’re bullish on open-weight models, because the frontier should be something you can build on, not something you rent. Progress has always come from people tinkering with things the incumbents didn’t approve first. An internet that only trusts the biggest players is an internet where nobody new gets to play.
We’ve also seen this movie. “Trust us, we’ll keep you safe” comes from the same companies selling you always-on agents and Tamagotchi keychains. (Still not feeding ours after midnight.) The walled garden doesn’t just keep attackers out. It keeps you in, and it keeps your data right where they can reach it.
Web3 has been on the back burner since the 2021 hangover. Turns out the burner was set to low, not off. The Atlantic is asking the right question: what can we trust? Cryptography can answer it without a gatekeeper’s permission, through signed content, verifiable identity you hold yourself, and data you own.
If AI makes the open web feel dangerous, the answer isn’t fewer doors. It’s better locks, with keys you own.
Viva la resistance.
— Britt
| SPONSORED BY PLAYHAUS · playhaus | |
|
Meet growbot Your digital growth co-pilot from playhaus. We save businesses 30% or more on average. Try growbot |
Verizon Vetoed Your Uniswap Pool
Verizon holds a veto power in a Uniswap pool, and last week it used it.
On September 17, the SEC issued its innovation exemption, a five-year conditional pass that lets a tokenized securities venue trade tokenized US-listed stocks without registering as an exchange. OKXICE, the venue being built by OKX and NYSE owner ICE, notified the SEC of its plans on October 5. It targets 63 US-listed companies to start, running automated market makers on Uniswap v4 on OKX's XLayer chain, settling in stablecoins, with a registered broker-dealer holding the underlying shares one for one and passing dividends and voting rights through to token holders.
On October 15, the venue published a notice naming nine issuers that had objected to their own shares being tokenized. Verizon, Broadcom, UnitedHealth, CoreWeave, Cerebras, AppLovin, Applied Digital, Rocket Lab and Applied Optoelectronics. Cerebras had already formally opted out before the notice went up. Nasdaq is keeping its own shares off the venue separately.
Most of the coverage skipped, that somebody other than the issuer does the tokenizing, the venue has to serve that company written notice and wait at least 30 calendar days before trading can start. If the company objects in writing by day 30, the venue cannot make that token available. List it anyway, or skip the notice, and the exemption evaporates for that symbol, which leaves the venue running an unregistered exchange in a US-listed stock.
None of the nine have explained themselves, but we can read between the lines. A qualifying venue is exempt from the definition of exchange, which means it isn't a trading center under Regulation NMS, which means the rules built to make sure investors see the best available price don't reach it. It doesn't report to the consolidated tape. It isn't required to provide fair access. Its administrators can upgrade the smart contracts without advance notice. Nasdaq gave the Wall Street Journal the clean version: it doesn't want its shares trading somewhere that doesn't show best prices in real time.
Should your ticker be tokenized it now carries a second price, discovered in an AMM pool, visible to your shareholders, and missing from the tape your own exchange reports to. When the two diverge, and they will, your phone rings, and "that's a different venue" has never once satisfied a retail shareholder.
Tokenized equities are legal, conditionally, for five years, as long as the company whose shares they are doen't mind. Every public company just became the Market Structure Regulator in Chief of its own ticker. A decade of talk about markets that need nobody's permission, and what actually shipped is the consent-ification of onchain equity: roughly 500 investor relations desks, each holding a month-long option to decline by email. Tier 1, covering the S&P 500 and Russell 1000 names, allows 75 symbols and caps trading at 0.25% of the prior month's average daily volume in that stock. Tier 2 allows 250 symbols at 2.5%. Fully built and objected to by nobody, this is a rounding error against US equity volume. What's being tested here isn't liquidity. It's permission.
And the answer that came back is stranger than a yes or a no, its' who is saying yes and who is saying no.
So watch the objection list, not the price. 9 out of 63 objecting, means the framework has quiet consent, and those caps become the binding constraint. The SEC already cast its vote, and the comment file is going to be loud. The rest is being counted one letter at a time.
- Muhammed
Subscribe to Heart&SOL
Weekly newsletter at the intersection of AI, cryptography, and online culture.