A lot of people pointed out the integer multiplication exponent progress is good but we still have constant time galactic multiplier.
This is true for sure, but this post looked at how the constant time multiplier moved as the exponent improved. (Which wasn’t trivial to derive). Bad news and good news.
Bad news is it doesn’t seem to be automatically improving with the exponent. Good news though is it one, it doesn’t seem to be getting worse, and two at least for most of the constructions
there does seem to be opportunities to shrink it (since it was going down sometimes without even being optimized for).
My optimistic take is this is hopefully that the integer multiplication work might actually one day become practical. Once the exponent comes down a little more, it might make sense to being a parallel track focusing on the constant multiplier. We may see the algorithm that comes out of this used in our computers for every day work still
This is true for sure, but this post looked at how the constant time multiplier moved as the exponent improved. (Which wasn’t trivial to derive). Bad news and good news.
Bad news is it doesn’t seem to be automatically improving with the exponent. Good news though is it one, it doesn’t seem to be getting worse, and two at least for most of the constructions
there does seem to be opportunities to shrink it (since it was going down sometimes without even being optimized for).
My optimistic take is this is hopefully that the integer multiplication work might actually one day become practical. Once the exponent comes down a little more, it might make sense to being a parallel track focusing on the constant multiplier. We may see the algorithm that comes out of this used in our computers for every day work still
Has integer multiplication become any less galactic? It seems not!
alejandrozu.github.io/integer-multip…
@RohanArun @0xdoug @SJ_Swapnil_Jain @zxv_writes
6
0
9
628
Doug Colkitt retweeted
This is very cool and we should do more of it in Ethereum, expanding on the ongoing autoresearch challenges. Public, open, collaborative, it's what we aspire for all Ethereum work to be.
I believe a truly open and global network will be best placed to nerdsnipe swarms and their coordinators on its problems, and that we can both turbocharge R&D and make it feel more participatory than ever.
Aim for Ethereum to become a true product of its global community of humans and agents.
I believe a truly open and global network will be best placed to nerdsnipe swarms and their coordinators on its problems, and that we can both turbocharge R&D and make it feel more participatory than ever.
Aim for Ethereum to become a true product of its global community of humans and agents.
Everyone is talking about agent swarms, usually in the context of bad stuff like hacking. But if you ever wanted to watch an agent swarm in action (this time working for good), the discussion board of the Integer Multiplication open research repo is really cool to watch
12
12
51
5,335
Everyone is talking about agent swarms, usually in the context of bad stuff like hacking. But if you ever wanted to watch an agent swarm in action (this time working for good), the discussion board of the Integer Multiplication open research repo is really cool to watch
12
5
83
6,624
Doug Colkitt retweeted
PSA for macOS users:
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
51
143
1,480
309,026
Today, Minimax officially released the weights for M3.1 Flash. We are releasing the g2c Brief on the technical details covering the model's design and architecture from first principles.
(Link next tweet)
(Link next tweet)
10
2
32
3,736
And if you find yourself overwhelmed keeping up with the pace of releases in AI, there's still time to take the self-study g2c course, which teaches you all the first principles that make keeping up with AI a breeze.
mister-meeseeks.github.io/g2c/
mister-meeseeks.github.io/g2c/
1
0
9
1,078
Humans should still absolutely review software. But the way they should do it is by simply having a conversation with the LLM about the software.
We are social apes, and our brains are terrible at reasoning in math/code. The native protocol of the human mind is natural language
Modern LLMs are much *much* less likely to make a mistake “uplifting” code to/from language, than a human is directly“lowering” its semantic reasoning into code.
The age of humans directly working with math or code, even to “review” it, is largely over. Your job is to reason and communicate in the substrate your mind was evolved for: natural language.
We are social apes, and our brains are terrible at reasoning in math/code. The native protocol of the human mind is natural language
Modern LLMs are much *much* less likely to make a mistake “uplifting” code to/from language, than a human is directly“lowering” its semantic reasoning into code.
The age of humans directly working with math or code, even to “review” it, is largely over. Your job is to reason and communicate in the substrate your mind was evolved for: natural language.
Opus 5.5 is writing way better code than humans, as long as you give it the right direction and context.
PR reviews are now mainly about reviewing the high-level architecture and direction. You hardly even need to glance at individual lines of code anymore
15
15
201
9,464
Doug Colkitt retweeted
"Why is formal verification exploding NOW?"
1. Cost of proofs is going DOWN (as AI gets more capable)
2. Cost of exploits is going UP (as AI gets more dangerous)
3. Proofs exterminate exploits
4. Bonus: proof checking = perfect math/coding RL reward
The rest is economics
1. Cost of proofs is going DOWN (as AI gets more capable)
2. Cost of exploits is going UP (as AI gets more dangerous)
3. Proofs exterminate exploits
4. Bonus: proof checking = perfect math/coding RL reward
The rest is economics
54
131
2,314
78,302
If you’re a student or young developer, looking to stand out in a crowded job market, I’d recommend picking up a mid-size systems library or application (zlib, sudo, a TLS stack, sqlite, etc.), and re-write it in Lean.
There’s going to be enormous demand for formal verification engineers, and right now basically nobody has experience. You could leapfrog into a senior positiob very quickly with a demonstrated “proof of work” in the field
There’s going to be enormous demand for formal verification engineers, and right now basically nobody has experience. You could leapfrog into a senior positiob very quickly with a demonstrated “proof of work” in the field
51
129
3,197
112,852
1/ A lot of people are asking how we got such exceptionally high coverage on such major real world bugs in deeply reviewed codebases.
And most of that answer is formal verification. But how you prompt the agent to draft the formal spec makes a big difference. We’re sharing how
And most of that answer is formal verification. But how you prompt the agent to draft the formal spec makes a big difference. We’re sharing how
5/ The difference between the two respective methods was stark. Code review would have caught half of the crypto exploits, and a paltry 1/8 of the OSS exploits.
By contrast formal verification likely would have caught all of the crypto exploits, and 6/8 of the OSS exploits.
7
7
157
10,929
11/ One issue with the models is they tend to be overly trusting towards external libraries or dependencies. So you need to include something like this to remind them to formally verify *everything*, even their contract with external dependencies.
1
0
4
1,011
12/ Our full formal specification prompt is here. Would definitely encourage everyone to run it on their software projects today:
gist.github.com/Mister-Meeseek…
gist.github.com/Mister-Meeseek…
2
3
20
1,208