s/utopia/dystopia/

North Korean fake job interviews, insiders draining their employers, and wrench attacks.

@0xCupidGL, one of our founders, sat down with @alexblocmates to walk through how these attacks actually happen and how teams can avoid becoming the next headline.

Some of our better stories made the cut here, worth a look.

You guys are not using Claude for "agressive tax optimization", are you?

(Image stolen from @moo9000)

I CANNOT believe the report: it proves that eMudhra is a clown show, and was never fit to be a CA:

The point of a HSM (hardware security module) is that the private key NEVER leaves it. Guess what eMudhra did: it turned off FIPS mode (WTF?!) and copied out the private key 😱

RT @PietroMiotti: My AI agents found an unmapped Maya site in Mexico, using LiDAR data from a NASA dataset.

72 hours from a random thought…

solana’s founding philosophy was simple: as hardware advances, solana should advance with it

eth was built to run on a raspberry pi across the mountains of tibet

but solana was built to exploit the most powerful hardware available and continuously push the limits of what a blockchain could do

that was @toly’s founding thesis, and it’s what drew me to solana

and we BETRAY that thesis if we don’t come together quickly and pass SIMD-SIMD to bring vector math onchain in the next 3 months

solana validators already run on cpus that can perform vector math using simd instructions yet we still haven’t updated the runtime to let onchain programs take advantage of that hardware

our validators sit on ferrari engines while the runtime thinks it’s driving a honda prius

we cannot nerd snipe this. we’re trying to build a multi-trillion-dollar financial empire on this blockchain and we need these updates now to unlock options, neural nets onchain, and onchain privacy and cryptography

The bull case for formal verification is "Here is a reusable library of properties/specs you can import in your code" not "Here is a few million LOC of Lean for you to go over, but the model passes!"

some of the most influential papers in AI/CS are surprisingly short.
papers you can read in one sitting:

MapReduce (2004): 13 pages, how Google processed massive datasets across thousands of machines.
The Google File System (2003): 15 pages, how distributed storage works at scale.
Adam (2014): 9 pages, the optimizer behind countless deep learning models.
LoRA (2021): 8 pages, fine-tuning large models using low-rank updates.
Dropout (2012): 2 pages, a simple trick to reduce neural network overfitting.
A Mathematical Theory of Communication (1948): foundational information theory, but substantially longer.

Dana Moshkovitz’s 3-hours talk on the proof of the unique games conjecture is now online!

youtu.be/de-CszI9YXc?is…

I’ve been saying this. Leetcode was hated, and it will die sooner rather than later. What will come after is no standard interview, more subjectivity, and no definite preparation advice

Eng hiring will turn into the type of hiring PMs, designers etc know all too well!

I'm very familiar with this Alice who had an affair with Jensen. I often see her and someone named Bob passing secret information back and forth in cryptography articles. She must be a spy.

Hash-based vector commitments are a key primitive, but we only really have one construction: Merkle trees.
MTs are great, but have a key issue: opening proofs need logN hashes.
This adds up when we open many points (eg hash-based pfs)

In a recent paper, we ask: can we do better?

Glad Helius shipped.

I should have been pitching my shit to Mert hehe

FIRST SNOW! 😁

Is Morpho trying to kill DeFi?

@aave and @Morpho both sent the SEC a legal framework for DeFi lending, one defends DeFi, the other negotiates it away

When you deposit into a lending market or a vault, did you just buy a security? If yes, someone has to register, disclose and o, DeFi keeps running as it is.

The SEC mainly uses two tests:

1- Howey: did you put money into a shared venture and expect profit from someone else's work?

2- Reves: is your position really an IOU, a note someone promised to repay?

Aave's approach (Aave Labs, @kamino , @veda_labs ) On Howey, there is no shared venture. Suppliers use the same pool and rate, but nobody's profit depends on anyone else. DAO votes with timelocks run a market. They don't manage your money

On Reves, the test never starts, as there is no lender, no borrower duty and no promise to repay, so no IOU exists. Vault curators may count as investment advisers, yet they can't touch your funds

That means no custody and no fund. What it wants from the SEC: confirm existing law. No exemption needed

Morpho's approach (CCI Vault Coalition: Morpho, Bitwise, Galaxy) Control is the yardstick. The less any person can change after you deposit, the further you sit from securities law. Ten conditions define the safe zone, including locked or timelocked parameters and no moving funds between markets after deposit

Howey gets fought mostly on "someone else's work." The paper concedes a vault may already count as a shared venture

Lending positions are treated as notes under Reves, and selling them to retail likely leans "security," it admits.

Its request: exemptive relief, a compliance entity wherever someone holds control, and a private fund lane for vetted investors.

So what's best for DeFi?

Morpho's map is detailed and candid about hard cases, which regulators appreciate. The cost is ground given up before the fight begins. Every concession becomes the SEC's starting point, and the safe zone rewards frozen code over protocols that keep evolving. Aave keeps the default where DeFi needs it. Open markets aren't securities, governance can keep improving the protocol, and no company has to stand in front of it.

Adopt Aave's reading and DeFi stays permissionless, but under Morpho's, DeFi runs on a license

curious to hear what @ImmutableLawyer @spynter @lex_node would think about this

They told us “don’t roll your own crypto”

But the complete sentence is “don’t roll your own crypto unless you have lean proofs for it”

FlashProve proves inference for a 400B model on a single H100, reaching up to 110 tokens/s.

But the MOST interesting part to me is its DAG Fiat–Shamir construction.

It uses round-by-round soundness and a ROM security reduction to handle adaptive branch scheduling and shared verification in Lean.

The real innovation may be in the soundness composition, not just the proving performance.

BREAKING: Revolut moved ~2,000 engineers onto self-hosted GLM for coding and pushed Claude Code and Codex to the exception list.

Per David Abitbol, who leads AI ops there: 56 Nvidia B200s, a blended 30 cents per million tokens, roughly a tenth of what they paid Anthropic and d time improved 70%.

Here's the part that matters: the gains showed up when tokens stopped being rationed. Engineers quit saving AI for the hard tickets and pointed it at everything.

Frontier models become the exception, open weights become the default. That's a pricing problem for every lab heading to IPO.

h/t @OliverMolander

Would you move your team off frontier APIs if the bill dropped 90%?

Introducing Zero Wire: a public vulnerability intelligence feed on @CloudflareRadar, bringing the clarity of a news wire service to critical security developments. cfl.re/4iCvSbj

Watch the full talk here:
m.youtube.com/watch?v=nUFLz-…