OpenAI’s math team is sitting in a conference room, looking over today’s latest set of promising leads mined from user prompts. “Sssh! Don’t say the statement of Lemma 7.4 out loud! Someone might be recording us!”

Oh wait, now I get it, when they say singularity, they mean IPO.

Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.

The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.

I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.

https://scotthelme.co.uk/passkeys-are-not-a-trap/

It's 9am. I've ranted about external mu twice in independent contexts already.

Must be one of those days.

I read some post about how Mastodon consists primarily of German-speaking creatures talking in English. I'm gonna do a poll, need to test that. Boosts highy appreciated!

So, do you speak German?

Publishing “Cryptographic Right Answers” for developers is a tradition by now.

Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024.

I put together an updated list. I'm very pleased (and mildly surprised) that at this point we have good post-quantum answers for everything.

Now we "just" need to get everything rolled out, and make Merkle Tree Certificates happen.

Let's get to work. See you in 2029.

https://words.filippo.io/right-answers/

@sophieschmieg Pay PhD students more, and have career prospects for them when they finish.

"but AI is good at math now!"
Yeah, you know who else is good, arguably even a lot better at math? Humans. Volume in proved statements isn't going to get you the type of complexity theory shattering results that you'd need to break public key cryptography.

Yes AI is advancing at fast speeds. This statement might look silly at some point in the future. But at least as of now, there is more risk of a major breakthrough coming from some underpaid PhD student than there is from AI. If you don't consider the risks of paying PhD students more might have for cryptography, you should not worry about AI.

Also pay PhD students more, please.

Oh God, this is getting even worse: apparently the "source" of the claim that AI might have broken classical cryptography is the fact that some numbers are skipped in the OpenAI math dump. You know, that same dump that doesn't even have formal verification on more than half of the results and some of the formally verified results have been shown to be incorrectly formalized?

I dunno, but isn't the far, far more likely explanation that the skipped numbers simply contained obviously false statements and were removed because they were, well, false?
Brother Occam, we're going to need a bigger razor!

(Also it is now Sunday, the 11th, 12:15 PT and I still have zero evidence that anyone with the qualifications to review it has seen any claim whatsoever that would put public key cryptography at risk that had not been known already)

I am an incredibly minor public figure. One thing that, even at my incredibly narrow status, I learned, is to not speculate on main, when you have absolutely zero evidence to back up any of your speculation.

Unfortunately not everyone in this position has learned that lesson.

In case you've seen some wild cryptography related speculation today, my status, at least at this point in time, October 8th, 13:40 PT is that absolutely no one who has the expertise to evaluate it has seen any result that would be in the least concerning for the state of public key cryptography. That might change, of course, but that is always the case.

@lindsey ok hear me out: what if we just put up a big sign that said: please don’t kill all of humanity
- thanks, humanity

Meat Proxies

Bonus speedpaint: https://www.peppercarrot.com/en/miniFantasyTheater/072.html#bonus

#webcomic #krita #miniFantasyTheater

BREAKING: due to ongoing safety concerns, we decided not to release this account's latest toot. During testing, the toot scored dangerously high on insight and humor benchmarks. Following the completion of additional safety testing, we'll release a less insightful version of the toot

@dominykas @gooba42 Now, that said, no matter how you’re creating software (from hand assembly to AI learning models or anything in between), ensuring correct, safe behavior is HARD. Evey programmer knows this (and there are fundamental reasons for it), which is why testing and debugging are an expected part of the development process, starting well before systems are inflicted on real users and consequential environments.

Outfits for the lesser known sequel to "four weddings and one funeral": "two conferences and one wedding"

@dominykas @gooba42 Essentially what they're saying, implicitly or explicitly, amounts to: "The programming technique we've chosen to use absolves us of responsibility for our choices".

Complex software behaving in unexpected and sometimes harmful ways has been a persistent problem since software was invented. The phenomenon used to be called “bugs” or “defects”, but I guess “going rogue” sounds cooler. It also implicitly frames “rogue” behavior as some kind of inexplicable exception, as if software is somehow usually trustworthy. https://www.nytimes.com/2026/09/25/technology/openais-ai-us-government-websites.html?unlocked_article_code=1.EFE.RfLT.x6YBjHa1PMz6

A SKILL.md for commenting on Hacker News: https://lcamtuf.coredump.cx/blog/hnskill/