I wrote a new post about the privacy risks of on-phone agents like Apple’s new Siri, and how private inference isn’t any sort of silver bullet. blog.cryptographyengineering.com/2026/06/09/a...

Modern technology could learn from older stuff that does what it's supposed to and doesn't bother you. My toilet just works and never sends me emails like "Good news! Flush® is now Floosh®"

I mean "why is there a special IPSec AEAD in the kernel wired up to splice() and why is that enabled by default in everyone's kernel" complexity.

super excited for the day AI will be able to take over the most tedious tasks of daily life such as making art, engaging with art, maintaining human relationships, etc., so that I can focus on my true passion: creating value for shareholders

yesterday I reported on GitHub employee concerns about reliability and leadership, and then hours later GitHub suffered a catastrophic outage 😬 www.theverge.com/news/918001/...

listen hun if you can't handle the Washington Post editorial board at their the Texas gerrymander "freakout" is "not a threat to democracy" you don't deserve them at their "Virginia plunges America deeper into the gerrymandering abyss"

Palantir are about six months away from ordering their employees to leave audio logs scattered around their offices

It's April 2026, 1 year 8 months since FIPS 204. The IETF TLS WG is busy debating the concept of ML-DSA hybrids, and whether they should be composite, concatenated, or separate. The complexity of hybrid auth is, however, firmly denied. In the distance, sounds of a pure ML-DSA PKI being built.

☂ internetfriends.llc

Setting up SAML between an app and an identity provider should be two clicks. Instead, it's 20 manual steps of copying and pasting and clicking, as explained in a bespoke PDF for each app. With multiple failure modes that will lock you out. Huge failure of protocol design.

I have been saying for a while that given use of unsafe languages and terrible dep hygiene you’d think things would be much worse than they are. With better LLMs and more determined attackers like in the Trivy and Axios attacks, I’ve stopped saying that. Worse arrived slowly, then all at once.

The idea that big tech companies will inherently have better security tools than me because of enterprise access deals makes me sad.

🚨New preprint and our results are rather concerning.. We find the "boiling frog" equivalent of AI use. Using large-scale RCTs, we provide *casual* evidence that AI assistance reduces persistence and hurts independent performance. And these effects emerge after just 10–15 minutes of AI use! 1/

We should be able to slow down AI takeover by a few years just by telling the model to find every bug in ffmpeg.

“Everyone from Walmart to your local bodega will need to maintain a presence in Fortnite to stay relevant” is so profoundly stupid I’m just glad I have the documentation to prove someone legitimately believed it.

Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years. That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.

On the topic of tokens, it is very wrong that a project on GitHub or NPM can insist on 2FA for people logging in, but then those same systems allow using these short easily stolen strings as 1FA methods with equivalent power. Recent attacks demonstrate the significant lateral movement this enables.

Dan Lorenc is exactly right: "I blame[] the Trivy breach on GitHub. The design of Actions is plain irresponsible today and ignores a decade of supply chain security work from other ecosystems." www.linkedin.com/posts/danlor...

This week on the newsletter: "How not to mandate device-based age assurance" educatedguesswork.org/posts/device... In this post, we examine a number of enacted or proposed requirements for device-based age assurance and some of the ways they can go wrong.

Still annoyed by this.

It's been years, but finally got around to hanging this

The WebPKI is something we all rely on every day, and most people do not even know it exists. What is interesting is that even those who do often do not understand it as well as they think they do. To help more people understand how it works, I put together the WebPKI Observatory.

Just putting this out there: the amount of software that exists in production vastly exceeds our global capacity to maintain it. And AI is going to make this an ultimate nightmare as often it is now easier to start from scratch than building a framework. Liability law will need updates.

The crazy thing is that this is a Chinese firm, which just announced that it’s going to maintain the ability to mine huge amounts of UK and European citizens’ private comms, but the BBC is leading with the “it’s good that they can intercept our data” spin.

$10 billion gross profit last year on $24 billion revenue, with 17% growth year over year. Firing half their employees. There is no social contract: your employer can be among the world’s most successful and still get rid of everyone.

Because the billion-dollar problem that "AI" is meant to solve is salaries.

And right on schedule: there goes pseudonymity on the Internet. arxiv.org/abs/2602.16800

STOP LAUNCHING CRAP WE DON'T NEED OR WANT It's staggeringly depressing how blithely they plan to ruin everything. Everything. I went to a dark site last week so I could say goodbye to the sky. Took a little hand-held photo and guess what? A satellite trail appeared. Just stop!

Breaking: Tragedy at the Winter Olympics

I used to love computer it was my friend. Now I have hate in my heart

there's this new dynamic where the DOJ cannot win in court and is (relatedly) incapable of meeting the minimum threshold of professional legal conduct, and so an increasing percentage of its actions are purely for intimidation and content

PSA: go.sum is not a lockfile. You never need to look at go.sum. go.mod has everything you need.

Funny animal videos no longer being trustworthy just fucking sucks all around. I love the wonder of animal behavior and what it says about the experience of being alive. It's because it happened in reality that it's so fun. It's not fun if it was just made up. There's no wonder there.

Yeah I only use AI for the fun part right at the beginning where we're kicking ideas around and not worried about budget or expectations. Just the best part of any group creative endeavor, me and my team challenging each other with our most visionary ideas, I'm looking to automate that

Imagine it’s 2013 and you see this document from the UK sent back from the future. You’ll assume something went very wrong in that timeline.

Today I am once again making loads of new Bluesky friends by insisting on one of my most sincerely held beliefs that makes way too many people fucking furious: that teenagers are autonomous beings who are not their parents' property and who possess independent volition and interiority

This composition had eluded me for nearly a decade, but yesterday I was finally able to capture it. A train rolled through just as the Duquesne Incline was crossing over the tracks in #Pittsburgh, creating a picture perfect winter scene. It was worth the hours and hours I've waited over the years.

then I say things like "EU tech legislation is a fundamentally illiberal system that accomplishes absolutely nothing except paperwork and state-mandated censorship and the state-mandated censorship requires paperwork, it is not a thing to emulate in any way" and the Europeans get really mad at me

The markets are staying afloat right now on the hope that AI will destroy American workers. What a bleak thing. www.nytimes.com/2025/11/25/b...

Me, young, naive, reading Gibson: Holy shit a future where technology drives international geopolitics sounds amazing Me, middle aged, reading the news: The guy who wrote a fucked up IM client says France wants to assassinate Candace Owens because of Charlie Kirk stop please no more

It turns out that refusing to accept patches that work with the existing ecosystem doesn't magically result in a separate ecosystem emerging!

If I ever interact with the CFRG again or try to rely on it to get actually useful work done, somebody please slap me. I knew this. I managed to remember it for a year or so. And then. They are now re-re-re-re-litigating the invisible strings to hash with hybrid KEMs. age PQ is blocked on that.

Great article about how TEEs are providing much less security than folks believe they will. arstechnica.com/security/202...

So much for retirement

3 years ago this tech was going to change the world and the best use case they have is "I'm too lazy to read this email" and "porn bot"

This is amazing research by Nadia Heninger and her co-authors Wenyi Morty Zhang, Annie Dai, Keegan Ryan, Dave Levin and Aaron Schulman. TL;DR a huge number of satellite links over our heads are totally unencrypted. satcom.sysnet.ucsd.edu