skybrian's recent activity

  1. Comment on Non-queer men of Tildes: PLEASE consider before commenting on ~life.women and ~lgbt without careful consideration. We are losing members over this issue. in ~tildes

    skybrian
    (edited )
    Link Parent
    If one person experiences it, it's a real issue. But there is a difference in logic between #MeToo and #YesAll tags. #YesAll tags are making a much stronger claim. Not just that you experienced...

    If one person experiences it, it's a real issue. But there is a difference in logic between #MeToo and #YesAll tags. #YesAll tags are making a much stronger claim. Not just that you experienced it, or that the experience is common, but that "everyone" experiences it. This is not just about yourself. It's denying the lived experiences of strangers that you have no right to speak for. It's denying that the world is a diverse place and people have different experiences. It's saying that no, actually, things are the same everywhere. Who has the right to make such a claim from personal experience?

    As a matter of logic, saying that "everyone" experiences something actually is refuted by someone saying, "well I don't see it." #YesAll a very strong claim, often easily disproved.

    Though of course, people are not computer programs and often we say things that aren't meant literally. The meaning of a term in context could be something else entirely.

    A charitable way to understand #YesAll is to assume that it's not what they really meant. But the term itself argues for being taken literally. It's effectively saying "I meant what I said."

    So, if you don't want that meaning, maybe avoid using "YesAll" hashtags?

    5 votes

  2. Comment on eMudhra intermediate CA compromise in ~tech

  3. Comment on PHP warns it plans to release two emergency patches imminently in ~comp

    skybrian
    Link Parent
    Here is Calif’s page on the bug:

    Here is Calif’s page on the bug:

    No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.

    There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.

    4 votes

  4. Comment on Non-queer men of Tildes: PLEASE consider before commenting on ~life.women and ~lgbt without careful consideration. We are losing members over this issue. in ~tildes

  5. Comment on PHP warns it plans to release two emergency patches imminently in ~comp

    skybrian
    Link
    And yep, these bugs were found via AI. From the Wiz blog: ... ... And if they didn't find it, apparently someone else would have? From OpenAI's blog: (Calif is apparently a security firm.)

    And yep, these bugs were found via AI.

    From the Wiz blog:

    In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade. The issues described below all stem from key architecture decisions, some made over a decade ago, and were grouped under two CVEs, with severity reaching CVSS 9.2. The work grew into a cross-industry effort to protect customers, find variants, deploy detections and mitigations, and verify a patch in time for coordinated disclosure.

    ...

    We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities. Building the exploit required chaining multiple flaws and adapting to each target’s memory layout through repeated testing and debugging. Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours. As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice.

    ...

    We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.

    And if they didn't find it, apparently someone else would have? From OpenAI's blog:

    Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities

    (Calif is apparently a security firm.)

    2 votes

  6. Comment on Non-queer men of Tildes: PLEASE consider before commenting on ~life.women and ~lgbt without careful consideration. We are losing members over this issue. in ~tildes

    skybrian
    Link Parent
    I doubt anyone post links here because they they think they’re bait. They post them because they agree with them or at least think they’re interesting. But writing style can be contagious and...

    I doubt anyone post links here because they they think they’re bait. They post them because they agree with them or at least think they’re interesting. But writing style can be contagious and “interesting” links are sometimes originally from influencers or people writing in a similar style, because it seems catchy. It might not seem objectionable when you’re on the same side.

    8 votes

  7. Comment on Non-queer men of Tildes: PLEASE consider before commenting on ~life.women and ~lgbt without careful consideration. We are losing members over this issue. in ~tildes

    skybrian
    Link Parent
    It’s true that we are responsible for our own posts and our own replies. But also true that we are asked to try to think about how others might respond. When starting a topic, there is this...

    It’s true that we are responsible for our own posts and our own replies. But also true that we are asked to try to think about how others might respond. When starting a topic, there is this boilerplate:

    Please post topics that are interesting, informative, or have the potential to start a good discussion.

    What would a good discussion look like? Sometimes you can post something along with a link that tries to head things in a good direction.

    It doesn’t always work and it can be taken too far so you don’t post at all. I think there’s a middle ground?

    There’s also a common impulse to try to influence what other people post. That’s what this topic about, right? It’s yet another discussion of what should be okay to post. We have no control over what other people do, but sometimes we try to influence them.

    5 votes

  8. Comment on Non-queer men of Tildes: PLEASE consider before commenting on ~life.women and ~lgbt without careful consideration. We are losing members over this issue. in ~tildes

    skybrian
    Link
    A few points: First, there’s something liberating about saying you’re out of touch. Getting into a situation where you’re claiming to be an expert in gender relations everywhere in the world is...

    A few points:

    First, there’s something liberating about saying you’re out of touch. Getting into a situation where you’re claiming to be an expert in gender relations everywhere in the world is kind of ridiculous. For example, I have read a few articles about gender relations in South Korea and it seems rather weird and bad, but I won’t claim to really understand it. I’ve never been there!

    Second, baiting people is extremely common tactic to get clicks and/or start an argument. Sometimes people share stuff like that, perhaps even with the original click-bait title. That doesn’t necessarily mean the person who posted the link meant to start an argument, but it often does have that effect. With experience, we can learn not to engage, or to do it in a more thoughtful way.

    Third, #YesAllMen (the tag) is definitely going to act as bait, intentional or not. It’s vague, so it can have better or worse interpretations, but the person posting it can be seen as claiming they know something about “all men,” which can be seen as telling strangers that you know better than them about their own lived experiences. So it’s natural for people to object to that and can easily become heated. On the other hand, it’s obviously hyperbolic (cultures are not all the same and nobody could possibly know about all men in every culture). If it’s not taken literally, what meaning remains? Perhaps it’s a flag to rally around?

    Since I’m attempting to avoid taking the bait myself, I won’t look any deeper. What can we conclude from this? Maybe let’s try to avoid posting bait and try to avoid responding to it, or at least avoid responding to it as bait.

    16 votes

  9. Comment on Anthropic logged net loss of over $80 billion in first half of 2026 in ~tech

    skybrian
    Link Parent
    The investors that own convertible notes are likely fine in almost any circumstances. If things don't go well, the risk is like owning a bond. The debt is owed by Anthropic to the investors. The...

    The investors that own convertible notes are likely fine in almost any circumstances. If things don't go well, the risk is like owning a bond. The debt is owed by Anthropic to the investors. The only way they wouldn't get their money back is if Anthropic went bankrupt.

    Why did the investors get such good terms? If it's like other startups, it's because they got in early, before anyone knew how big Anthropic would be. They gave Anthropic money back when it needed money and there was a risk it wouldn't make it. But at this point, for all early investors in Anthropic, it's just a matter of how great an investment it will turn out to be, because they got in at a very low price.

    (For investors buying during the IPO, the risks are different, because that's a much higher price.)

    4 votes

  10. Comment on Non-queer men of Tildes: PLEASE consider before commenting on ~life.women and ~lgbt without careful consideration. We are losing members over this issue. in ~tildes

    skybrian
    (edited )
    Link Parent
    By “not a well agreed concept,” do you mean specifically on Tildes or in general? Because I do think such places exist, such as private chats. A Tildes group isn’t a private chat, though. Tildes...

    By “not a well agreed concept,” do you mean specifically on Tildes or in general? Because I do think such places exist, such as private chats. A Tildes group isn’t a private chat, though.

    Tildes is something of a bubble, though, in a good way. It’s invite-only for good reason. It’s not as much of a bubble as sometimes people hope.

    5 votes

  11. Comment on I teach at a business school. It’s time to shut them down. (gifted link) in ~life

    skybrian
    Link Parent
    Okay, there is a link that goes to the Bloomberg article with the title “Academics question ESG studies…”. I can’t read it, though.

    Okay, there is a link that goes to the Bloomberg article with the title “Academics question ESG studies…”. I can’t read it, though.

  12. Comment on AI proved the Quasi-Riemann hypothesis. What happens Now? in ~science

    skybrian
    Link Parent
    Well, math is deterministic. There is a sense in which we could, in principle, calculate whether any number is prime. We already do this for numbers that aren’t extremely large. But being able to...

    Well, math is deterministic. There is a sense in which we could, in principle, calculate whether any number is prime. We already do this for numbers that aren’t extremely large.

    But being able to calculate something in principle doesn’t mean we can do it in practice for all numbers. There will always be numbers that are too big to manipulate using any computer we could possibly build.

    Theoretical math is about what we can say about numbers that are too large to calculate. Testing a few trillion numbers tells us something, but you never know if there will be a counterexample that’s just beyond the numbers we tested. This is why it’s done by proving theorems rather than doing calculations.

    4 votes

  13. Comment on Anthropic logged net loss of over $80 billion in first half of 2026 in ~tech

    skybrian
    (edited )
    Link
    To expand on the financial jargon: This is due to Anthropic having issued convertible bonds to investors. Convertible bonds are popular for investing in startups. An investor can loan a company...

    To expand on the financial jargon:

    This is due to Anthropic having issued convertible bonds to investors. Convertible bonds are popular for investing in startups. An investor can loan a company $10 million, say, with an option to convert it into stock, which they will do if the stock is worth more than $10 million plus whatever interest the bond pays. So if the company does badly, the convertible bond is a debt owed to early investors. If the company does well, it's stock.

    Since Anthropic's valuation has increased so much, investors will almost certainly convert it into stock, because it's far more valuable that way. Since they're not stock yet, they are on the balance sheet as debt, and the liability grows when the company's valuation increases. But it's "debt" that the company will never have to pay. Instead, shareholders will be diluted due to there being more stock issued. Economically, it "should" be treated like a stock option, but it's not due to accounting rules.

    Not all convertible bonds are accounted for in this way, but Anthropic's convertible bonds apparently are for some reason.

    I can't read this article or the Wall Street Journal article, but I'm curious if they explain this in any more detail.

    And there will inevitably be a lot of noise from Internet commenters who don't understand convertible bonds or what an "accounting charge" means and see it as a real loss.

    [Edit: clarify that the debt is owed to the investors.]

    21 votes

  14. Comment on PHP warns it plans to release two emergency patches imminently in ~comp

    skybrian
    Link Parent
    Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit. And it sounds like this has already happened, based...

    Just the rumor of a security hole is often enough to find it these days, using LLM’s. They don’t need to wait for the patch to build an exploit.

    And it sounds like this has already happened, based on what people are saying on Hacker News.

    8 votes

  15. Comment on AI proved the Quasi-Riemann hypothesis. What happens Now? in ~science

    skybrian
    Link
    From the article: [...] [...]

    From the article:

    It’s long been known that as you move along the number line, the primes thin out. Riemann showed that exactly how the primes thin out is, in a sense, governed by the zeta function — in particular by the places where it equals zero.

    It’s straightforward to prove that if s is a negative even number (−2, −4, −6, …), then ζ(s) = 0. These are called trivial zeros. The Riemann hypothesis says that the only other zeros of the zeta function, called nontrivial zeros, occur when s has a real part of 1/2. That is, they should all be located on a vertical line:

    If any nontrivial zero were to be found somewhere away from that vertical line, it would imply that the primes must form an extremely surprising pattern, one that has never been observed to date.

    Just narrowing the area where the nontrivial zeros can appear has had huge ramifications. Riemann himself proved that nontrivial zeros of the zeta function can only be found in a vertical strip between zero and 1. Then, in 1896, two mathematicians showed that zeros could not lie on the edges of the strip. As a direct consequence, they were able to prove an important result called the prime number theorem, a formula for how quickly, on average, the primes thin out.

    If the Riemann hypothesis holds, then mathematicians can guarantee that any deviations from the average given by the prime number theorem will always be small.

    Mathematicians have numerically verified that the first 12 trillion nontrivial zeros are on the 1/2 line. But they can’t be sure the hypothesis holds for all the zeros, and even one solitary outlier would land like an earthquake. As Enrico Bombieri wrote in the paper laying out the Millennium Prize formulation of the problem: “The failure of the Riemann hypothesis would create havoc in the distribution of prime numbers.”

    [...]

    This brings us to the quasi-Riemann hypothesis. Where the Riemann hypothesis posits that all the nontrivial zeros are on the vertical line at 1/2, the “quasi” version just asks one to prove that they are all contained in a vertical strip that’s narrower than the known strip between zero and 1. The narrower the strip, the more one can say about how the primes are distributed.

    OpenAI announced two different versions of their quasi-Riemann hypothesis proof. The first version, dated September 30, 2026, claimed to show that all nontrivial zeros must be between 1/8 and 7/8, and was formally verified using the Lean programming language. The second version, which was completed almost a week later (and is not yet formally verified), claimed to prove a weaker result: that the zeros must have a real part between 1/12 and 11/12. But while the first paper is 199 pages long, the second weighs in at a comparatively modest 49 pages.

    [...]

    Mathematicians have been studying the paper intensely in the couple of weeks since its release. Peter Sarnak, a prominent number theorist at Princeton University, has decided to repurpose a course he’s teaching this semester to study it. Radziwiłł says he can now sketch the proof’s arguments in half a page, while more involved write-ups by other mathematicians range from seven to 13 pages. (As of this writing, these have not yet been published, but are circulating privately.) These experts largely agree that the result is correct — and that its novelty lies in the way it brings together ideas from number theory that have been around for some time.

    6 votes

  17. Comment on PHP warns it plans to release two emergency patches imminently in ~comp

    skybrian
    Link
    According to discussion on Hacker News, it is already being exploited.

    According to discussion on Hacker News, it is already being exploited.

    10 votes

  18. Comment on PHP warns it plans to release two emergency patches imminently in ~comp

    skybrian
    Link
    From the article: [...] [...]

    From the article:

    PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

    [...]

    The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here.

    [...]

    Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.

    Researchers from separate security firm Sansec said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

    Preparation steps include identifying who is responsible for managing PHP inside an organization, taking an inventory of every app built on the language, planning a maintenance window starting at 14:00 UTC with contingency plans for earlier, making a backup of site and database files, and monitoring the PHP.net homepage for any late-breaking announcements, including an earlier release time. Some experts suggest unplugging any non-essential systems until they’re patched.

    8 votes

  20. Comment on The Internet goes on high alert after discovery of eight compromised TLS certs in ~tech

    skybrian
    Link
    From the article: [...] [...] [...] [...]

    From the article:

    Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

    As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

    [...]

    The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.

    [...]

    “This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

    [...]

    The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

    [...]

    At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances updates are in place.

    As noted, most browsers have already blocked the intermediate certificates. The exception appears to be Edge running on Windows 10, which at the time this article went live was still connecting to 12 vulnerable hosts. In response to questions asking why and if the company has plans to do so, a Microsoft representative the company will be in touch if it has anything to “share.” Meanwhile, Signal, WhatsApp, Wireguard, and other apps that don’t rely on TLS for confidentiality aren’t affected. This page and the emudhra.we-have-a-problem.com site show apps known to be patched so far.

    6 votes