I think a few folks missed this paper when it came out. Analysis and Attacks on the Reputation System of Nym petsymposium.org/popets/2026…

In my 1989 thesis I asked if there was an oracle separating IP from MIP. That was before we knew that MIP=NEXP, though that result doesn't relativize. Bouland, Huang, Natarajan, Shalit, Tal and Astra now answer the original question. arxiv.org/abs/2609.25680

Sorry but if you use the word "whence" in the abstract of your paper I'm gonna stop reading right there.

This CLAUDE.md file has served me really well for ensuring large projects don't quickly turn into slop: gist.github.com/defuse/da01a…

Either: 1. The hard problem is solvable and AI finds the solution, 2. AI becomes conscious and can reason that humans are conscious by analogy, 3. AI remains slightly irrational for the sake of believing humans are conscious, or 4. AI doesn’t believe humans are conscious.

This is the way. Assume all code has exploitable vulnerabilities, and it’s not possible to patch them before an adversary notices. What now? Systems designed around this assumption are the most secure, and it’s relevant now more than ever.

Hey Anthropic! I reported these encryption issues to you in May and you told me there was no relevance because replay attacks were not in your threat model. And now apparently you’ve been watching people exploit them for months. I’m actually kind of annoyed!

gpg --verify SHA256SUMS.asc is easily bypassable for detached signatures. The correct command requires the data file: gpg --verify SHA256SUMS.asc SHA256SUMS This appears to be a common mistake. Without the second argument, gpg succeeds even if the .asc file contains an arbitrary embedded message rather than signing the actual SHA256SUMS file. It prints a warning, but it's easily missed in gpg's output. The gpg manpage explicitly discourages the single-argument form, keeping it only for backward compatibility. I actually keep a list of gpg pitfalls. This is number 8. Mehdi Kerimov reported this in nix-bitcoin's self-updater via @nixbitcoinorg's bounty program. We had originally followed bitcoincore.org verification instructions, which had the same issue and have since been fixed. That this sat unnoticed on @bitcoincoreorg since 2018 shows just how little-known this footgun is. It's unlikely bad signatures were ever published at scale, as anyone noticing the warning or using the two-argument command would have caught it immediately.

the openai huggingface incident, from an agents pov. (part 1)

Fine-tuning isn't a good argument for god, it's a better argument for anti-realism. We'd expect our models to have fitted, tuned parameters if what we're doing is compressing empirical data that was generated by a different model.

I'm confused what the AI safety researchers have been up to. I'd assume sandbox quality would be pretty high in the list of requirements

4397328654844826923795068102505872571721883526553349659561256924505973939597593482272505698004801207988043088656411102133523080581 divides RSA-260

New work out! We (royally) show that Fiat-Shamir transformation is insecure for a class of proof systems for *generated* relations (including variants of commonly deployed protocols for R1CS). A thread to explain where this applies ia.cr/2026/1838

I really recommending reading this. In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada. It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this. Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier. This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc Krebs himself, and several other security researchers, have already confirmed they're in the data leak. tl;dr gah damn dawg this company is going to be sued into oblivion krebsonsecurity.com/2026/09/…

This is my favorite one because you can master 4 different configurations instead of the typical one