Re OpenAI's disproof of an Erdos conjecture and the breathless coverage, I found this piece from April insightful about how mathematicians will likely need to adjust what they explicitly vs implicitly value. davidbessis.substack.com/p/the-fall-o...

“But it happened” is definitely worth more attention. youtu.be/tlQ7EoJDTQY?...

OTD 1936: Turing submits his paper “On Computable Numbers, with an Application to the Entscheidungsproblem.” 90 years of Turing machines!

What a cover!

YOU’RE LISTENING TO SISYPHUS FM, THE HOME OF NON-STOP ROCK

In Plan 9 in ~2001, we introduced "private" processes that even a sysadmin couldn't access, debug, etc. I just learned Windows Vista added the same in 2007. The difference? We did it to protect keys held by the security agent, while Windows did it to protect media content. Priorities! ¯\_(ツ)_/¯

Funny things still happen over at the bad place This guy put a prompt in his LinkedIn and now AI recruiters are writing him in Old English and calling him "my lord"

This does a pretty good job of dismantling an argument that ha me (apparently a 'data center moderate'?) scratching my head over how it could even happen. General principle, I think industrial structures should account for their externalities. But there is a narrative developing here for sure...

I am giving a talk today about issues in 2026 with code review. One of them is well-worth digging into in more detail than I have time in the talk. So here is a blog post: crawshaw.io/blog/agent-p...

Optimism and hope can seem in short supply. Here is some. www.meditationsinanemergency.com/truth-conseq...

I am honored to share the 2026 Pulitzer Prize for Best International Reporting with Dake Kang, Byron Tau, Aniruddha Ghosal and Garance Burke for our reporting revealing how Silicon Valley largely designed and built China's surveillance state and enabled human rights abuses.

This tangled.org GitHub alternative built on top of ATproto, open source, with self hosting capabilities and the ability to run your own CI sure seems like a gift of the gods.

“There’s a tidal wave coming. You can see it. We can all see it. Are you going to lay down and die, or are you going to do something about it?” Be ready to patch your systems, repeatedly, for at least the next 12 months.

Today I renamed a type in the exported API of one of my packages by writing this short diff. Then I ran “go fix”, and it updated my code. Of course, IDEs have rename. But with the type alias, all dependencies keep working. And users can run “go fix” to update their code too! go.dev/blog/gofix

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

"But if AI ever “wins” at mathematics, then someone else will have to be the “loser,” and the only other player in the room is human thought." davidbessis.substack.com/p/the-fall-o...

Numbered like rooms at Hilbert’s Grand Hotel maybe. blog.mozilla.org/en/privacy-s...

I think every programmer of a certain background is haunted now and then by Thompson's idea - although it seems a quaint, gentler fear now that you *have* to assume that everything with a computer, and most things have one, is hacked, malicious by design, or both. by @swtch.com via Cory Doctorow.

I wrote up in the TLS mailing list why I think composite signatures (ML-DSA + ECDSA/RSA) are a net negative, will hurt the ecosystem, and should not be implemented. Hybrid key exchange was simple and self-contained. Hybrid signatures would be a mountain of complexity in delicate, critical code.

A warm, brilliant, funny man. The class was mostly foundations of cryptography: hard-core bits, ZK proofs, semantic security, etc. At our open book final, he stopped at a student with large pile of extra books on the floor, smiled his infectious smile, and exclaimed "Ah! A security blanket!" RIP

Here we go. The upstream FreeBSD details are in this long post. red.anthropic.com/2026/mythos-... Other than saying "look in this specific source file" (they run a different job for every file), there was no directed guidance. "Mythos Preview fully autonomously identified and then exploited ..."

It has been quite the few weeks for “security work we are not going to tell you details of.”

Wealthy leader, threatening to attack Persia, announcing that a great empire will be destroyed if he does, and not realizing that the prophecy is ambigous about which empire. I have many criticisms for the writers, but in particular could they stop plagiarizing from Herodotus?

Partial blame to Microsoft and Zoom for normalizing the need to install new software just to make video calls, despite browsers being perfectly capable. They make it extra hard to even find the web-only links. simonwillison.net/2026/Apr/3/s...

A very nice explainer why "if you're so worried about quantum computers, why haven't they factored 21 yet?" isn't a very convincing argument. Look at the labels of the graph, and how extremely close the various lines are for factoring 21 and 2048 bit numbers. Polynomial scaling remains […]

"Welcome to the Eternal September of open source", says the America Online of open source, 18 years into that September. (GitHub has done some great things for open source, but still, wow, what a headline to choose.) github.blog/open-source/...

Dan Lorenc is exactly right: "I blame[] the Trivy breach on GitHub. The design of Actions is plain irresponsible today and ignores a decade of supply chain security work from other ecosystems." www.linkedin.com/posts/danlor...

The best part of this regexp is the ? on the third line (which applies only to the g). alex000kim.com/posts/2026-0...

It may or may not be true that whether or not you race to use AI heavily right now will determine whether you’re part of a future wealthy elite ruling class or are left behind in poverty and powerlessness. But if it is true, this strikes me as a deeply immoral future worth fighting hard against.

"Cognitive surrender". www.nytimes.com/2026/03/29/o...

In my 2023 ACM talk, to illustrate how supply chain security is more than just build deps graphs, I showed a graph of the servers involved in building and serving Go releases. Has anyone done something like this but for GitHub Actions? We have examples now of attacks moving between actions.

Are you still hiding if no one is looking? People aren't reading the code at all—they'd see the weird decoder+eval—and machines can see that and also the private use code points. Also, it's been public since May 2025 and GitHub/NPM/Microsoft have done nothing. www.aikido.dev/blog/glasswo...

If this podcast episode is the only good thing that comes of AI, it will have been worth it—

“Floating-Point Printing and Parsing Can Be Simple And Fast” The fastest known floating-point printer and parsing algorithms - fixed-width printing, shortest-width printing, and parsing, all in 400 lines of Go. research.swtch.com/fp research.swtch.com/fp-proof

“Pulling a New Proof from Knuth's Fixed-Point Printer” Happy 88th Birthday to Don Knuth! And thanks again to @robpike.io for Ivy. research.swtch.com/fp-knuth

This was a fun conversation. Thanks to ACM Bytecast for having me on. learning.acm.org/bytecast/ep7...

Happy to see someone outside Google rebuild/verify Go toolchains. Thanks @agwa.name! www.agwa.name/blog/post/ve... "So far, Source Spotter has successfully reproduced every toolchain since Go 1.21.0, for every architecture and operating system. As of publication time, that's 2,672 toolchains!"

There is some chatter about a CA misissuing a certificate for 1.1.1.1. This CA (crt.sh?caid=201916, only ~300 certs) is only trusted by the Microsoft root program and the eIDAS QWAC trusted list. MS has not been actively managing their roots for years, and the EU wanted to push theirs on browsers.

Heading home from #GopherCon 2025 in NYC. As usual, many people asked how to get one of the amazing Go gopher Hawaiian shirts by Renee French. I've posted the details at github.com/rsc/gophersh.... (I know one person who has made pajama pants with the pattern. Socks might be nice too.) Enjoy!

Side point: this demonstrates the benefits of plain text file formats. When @robpike.io implemented the coverage tool he made it emit a simple line-based text file that Russ could then manipulate with the ubiquitous Unix tools.

Another fun magic trick! Differential Coverage for Debugging research.swtch.com/diffcover

Fifty Years of Open Source Software Supply Chain Security We are all struggling with a massive shift that has happened in the past 10 or 20 years in the software industry. For decades, software reuse was only a lofty goal. Now it's very real. queue.acm.org/detail.cfm?i... @swtch.com

With 8 minutes to go, @damienmiller.bsky.social sends me the only funny April Fool's joke of the day. Notably because I was on the team of people writing the firewall rules for Rob Pike's plan 9 desktop at Google. @tailscale.com fixes it (albeit ten years too late).

Yeah, about that... tailscale.com/blog/plan9-p... That gives the backstory :)

i was going to say it was hilarious but i wished it was real and then i realized it was

I only respect april fools jokes that commit to the bit. This? This is commitment.

This was a lot of fun!

"Tailscale Enterprise Plan 9 Support" tailscale.com/plan9 (A little thing I wrote and worked on over the past few weekends with @swtch.com)

@swtch.com you might be interested in this… zellyn.com/2022/01/gopi...