We have a year to fix security everywhere
GLM 5.3‑flash, an open‑weight LLM from Z.ai, can be run locally on consumer‑grade hardware (≈$5‑15 k) and lacks the safety filters that normally block disallowed requests. Benchmarks show it scores 84.5 % on CyberGym (vulnerability recreation) and ~54 % on ExploitBench (partial to full exploits), comparable to leading frontier models. Its accessibility means virtually anyone can employ it to discover and exploit software flaws continuously, potentially automating large‑scale attacks.
Project Glasswing and Daybreak aim to use frontier LLMs for proactive vulnerability discovery and remediation, but deployment of patches remains the bottleneck. The author urges immediate action:
- Governments: fund security engineering, mandate regular penetration testing (including AI‑assisted testing), require timely remediation, and provide grants for critical sectors (local governments, hospitals, finance, power, telecom).
- Companies/Open‑source foundations: hire security staff, use structured LLM prompts for bug finding and patch generation, sandbox AI agents, enforce scoped credentials, automate triage, backport, release, and deployment pipelines, and prioritize memory‑safe languages and supply‑chain inventory.
The overall claim is that without rapid, coordinated defensive measures, the widespread, cheap availability of such models poses an imminent cybersecurity threat.
I've factored the RSA keys of a Certificate Authority from the 90s
The author investigated legacy RSA keys used in early web PKI, focusing on 512‑bit root certificates shipped with Netscape 4.51 in March 1999. By extracting archived browser installers, they identified two E‑Certify RSA‑512 roots (one for SSL, one for S/MIME). Using CADO‑NFS on a Ryzen 9 5950X, each key was factored in ~30 hours, yielding the prime factors and full RSA private keys, which are posted in the article. The author built a custom TLS server in Go to serve certificates signed with these keys, hosted at e‑certify.fly.dev, and provided a GitHub repository (ancientroots) containing the keys and tooling. Additional 512‑bit test CAs, such as a VeriSign code‑signing CA, were also factored (the VeriSign key in ~1 hour on a GPU cluster). The work illustrates that pre‑2000 RSA roots were insecure—512‑bit RSA is trivially breakable on modern hardware—while modern PKI has moved to ≥2048‑bit keys, though future quantum threats remain.
The comments collectively express enthusiasm for the technical achievement of recreating and breaking a legacy Netscape SSL implementation, noting the novelty of custom TLS code and the rapid cracking of a 512‑bit RSA key on consumer hardware. Readers show curiosity about the historical context, hardware capabilities, and future cryptographic relevance, while also cautioning about verifying AI‑generated explanations. Some reflect on broader security implications, such as governmental surveillance and quantum threats, but overall the tone is appreciative and inquisitive.
Mistral raises €3B
- Mistral announced a €3 billion Series D round, valuing the company at over €21 billion—Europe’s largest equity raise for a tech firm to date.
- The round was led by Samsung Electronics, co‑led by Scaleup Europe Fund (EQT) and existing investor PSG Equity; new participants include BlackRock‑managed funds, the Grand Duchy of Luxembourg, and numerous venture and strategic investors (e.g., a16z, NVIDIA, Salesforce Ventures).
- Funding will expand Mistral’s frontier AI research, increase compute capacity, and accelerate infrastructure rollout, commercial growth, and its presence in 20 countries serving more than 125 global enterprises such as Airbus, ASML, and HSBC.
- Mistral positions itself as the sole provider of a full‑stack, open‑weight AI platform that combines model, compute, and production tooling, enabling organizations to keep data, models, compute resources, and operational systems under their own control—what the company calls “sovereign AI.”
- The investment reflects confidence from technology leaders in advanced manufacturing, engineering, and industrial sectors that Mistral’s approach can deliver state‑of‑the‑art AI while preserving data governance and vendor independence.
The comments acknowledge Mistral’s role in advancing a European, open‑weight AI effort and note its useful OCR, speech‑to‑text and retrieval‑augmented capabilities for modest tasks. At the same time, many point out that its large‑language models lag behind leading US and Chinese offerings in performance, price and hardware efficiency, raising doubts about competitiveness despite recent funding. Concerns are also voiced about scaling, talent recruitment, and the broader need for a sovereign European AI ecosystem, while overall sentiment remains split between strategic optimism and pragmatic criticism.
My Feed, My Way
The Albanese Government has released a draft “Digital Duty of Care” framework for consultation, aiming to expand Australia’s social‑media age ban and give users greater control over online content. Key provisions include a “My Feed, My Way” requirement that social‑media platforms must notify users (16+) and allow them to opt in to algorithmic personalization or opt out to see only followed accounts. The legislation also obliges digital services—such as games, apps, and AI chatbots—to protect users under 18 from design features that encourage addictive behavior or harm self‑esteem, and to block content that promotes eating disorders, gender‑based hostility, pornography, crime glorification, or severe mental‑health distress. eSafety will gain authority to issue removal notices and streamline response to cyber‑bullying and abuse. Platforms must document risk‑mitigation measures and maintain their effectiveness; non‑compliance may attract penalties up to $109.2 million, enforced by the independent eSafety Commissioner. Feedback is sought from industry, civil society, and advocates before parliamentary introduction later this year.
The comments express broad concern about social‑media algorithms and their impact on attention, mental health, and the spread of harmful content, viewing the Australian move to curb algorithmic feeds as a welcome but limited step. Many favor more open, user‑controlled or chronological feeds, citing RSS, Bluesky and open‑source alternatives, while questioning whether the regulation will be effectively enforced or merely symbolic. Skepticism appears regarding identity‑verification requirements and potential industry circumvention, and several remarks suggest the change may have modest practical effect without deeper reforms.
Multi-Agents LLM Financial Trading Framework
TradingAgents is an open‑source, multi‑agent framework that simulates a trading firm using specialized LLM‑driven agents (Fundamentals Analyst, Sentiment Analyst, News Analyst, Technical Analyst, bullish/bearish researchers, Risk Management, and Portfolio Manager). Agents exchange structured debates to generate trade decisions, which are logged and reflected in subsequent runs. The system is built on LangGraph, supports checkpoint‑based resume, and persists a decision log (~/.tradingagents/memory/trading_memory.md) and per‑ticker SQLite caches. It integrates numerous LLM providers (OpenAI, Google Gemini, Anthropic Claude, xAI Grok, DeepSeek, Qwen/DashScope, GLM/Zhipu, MiniMax, OpenRouter, Azure OpenAI, Ollama, and any OpenAI‑compatible endpoint) via environment‑variable API keys and configurable llm_provider settings. Data sources include Yahoo Finance tickers, Alpha Vantage, FRED, Polymarket, and social sentiment feeds. Releases from v0.2.0 to v0.4.0 (2026‑08) added model catalog expansion, look‑ahead fixes, checkpoint improvements, and support for GPT‑5.x, Claude 5, and GLM‑5.3. Usage is via CLI (tradingagents analyze) or as a Python library (TradingAgentsGraph().propagate(ticker, date)). Non‑determinism arises from LLM sampling and live data; reproducibility can be improved by lowering temperature or selecting non‑reasoning models. The framework is intended for research, not financial advice.
Comments reflect mixed reactions to the open‑source LLM‑driven trading framework. Users note modest losses in early experiments and question the reliance on Reddit sentiment and lagging technical indicators, suggesting more sophisticated data such as options metrics would be preferable. There is debate over the value of a multi‑agent architecture versus a single, well‑engineered agent, with some citing improved code quality and others dismissing the approach as wasteful. Cost‑benefit concerns and uncertainty about the target audience also appear frequently.
TALA Is Open-Source
TALA (Terrastruct’s AutoLayout Algorithm) is now open‑source under MPL‑2.0 and bundled with D2 v0.9.0 (use --layout=tala). It is an orthogonal layout engine optimized for software‑architecture diagrams, blending techniques from several graph‑drawing papers with original methods to achieve aesthetic criteria such as symmetry, median distance, flow, and node clustering.
Key characteristics:
- Supports custom node positioning and hybrid layouts where some nodes are fixed and others are automatically placed.
- Uses stochastic optimization with a default of three random seeds; the best‑scoring layout is selected, making results nondeterministic across structural changes.
- Performs less well on large DAGs and can be slower for big diagrams, scaling nonlinearly (benchmark data on GitHub).
Comparative examples show TALA versus D2’s existing Dagre and ELK engines on real‑world diagrams, and illustrate custom and partial positioning scenarios generated with AI. Contributions from Gavin Nishizawa and Júlio César Batista are acknowledged. The source includes citations, licensing details, and links to performance benchmarks.
The comments convey mixed reactions, expressing frustration with CSS compatibility problems on older devices while highlighting the challenges of implementing robust layout algorithms. Opinions on diagram‑generation tools are generally favorable toward D2, noting its quick learning curve, effective auto‑layout, and improvements over earlier solutions such as ELK, though some find alternative versions less clear or cost‑prohibitive. Users discuss potential integration with existing graph‑visualization systems and seek guidance on heuristics that make D2 suitable for architecture diagrams, while also acknowledging the complexity of node positioning and edge routing.
There's a new "Google Jail" for independent wikis
The post explains a March 2024 Google core update that effectively “jails” new domains: only the homepage appears in search results, while internal pages remain unindexed. This affects ~90 % of independent video‑game wikis launched on fresh domains (e.g., gta.wiki, hollowknight.wiki, Path of Exile 2 wiki), regardless of content originality or domain age, and can persist for months to a year, sometimes lifting after major game updates. In contrast, wikis hosted on subdomains of established sites (e.g., overwatch.weirdgloop.org, wiki.leagueoflegends.com) index normally, even when the parent domain has modest authority. Consequently, the author’s hosting strategy now favors temporary subdomains on a high‑authority domain (weirdgloop.org) to gain Google visibility, with plans to later migrate to the intended root domain using 301 redirects and Google’s change‑of‑address tool. The author invites SEO or wiki operators with relevant data to discuss the phenomenon in the Weird Gloop Discord.
The comments express broad dissatisfaction with Fandom’s advertising practices, ad‑blocker blocking, and its shift toward an entertainment‑focused platform, while praising efforts to redirect users to higher‑quality indie wiki alternatives. There is concern that new or niche wikis struggle for visibility because Google often favors established domains, leading to “Google jail” worries, yet some argue that reduced indexing can also protect content quality. Overall, the discussion highlights frustration with commercialized wiki ecosystems, a desire for trustworthy, independent hosting, and mixed views on the impact of search engine indexing.
Navier-Stokes – Tristan Buckmaster [pdf]
Comments express strong criticism of OpenAI's alleged use of private researcher data and pressure tactics, raising ethical concerns about model training practices and academic trust. Many describe the situation as a breach of collaboration norms and question the transparency of the claimed Navier‑Stokes result. A minority note excitement about a potential breakthrough while urging caution. Overall, the discussion highlights distrust of corporate motives, calls for accountability, and debate over the role of AI in frontier mathematics.
Arm Mali G2-Ultra NX GPU: desktop-class mobile gameplay with AI-native graphics
Arm’s Mali G2‑Ultra NX GPU is the first AI‑native Mali GPU, integrating dedicated neural accelerators into the shader cores and sharing the GPU memory system, caches, and control structures. This architecture enables three neural‑graphics techniques: Neural Super Sampling (NSS) for up‑scaling low‑resolution renders, Neural Frame‑Rate Upscaling (NFRU) for generating intermediate frames, and Neural Super Sampling with Denoising (NSSD) for improving ray‑traced image quality. Demonstrations (e.g., Neural Dawn) report up to 4× performance efficiency and up to 70 % lower external memory traffic versus native rendering, making advanced effects such as Unreal Engine MegaLights feasible on mobile. The GPU also introduces a new execution engine—its largest ISA upgrade in seven generations—offering up to 2× more registers per wrap, yielding 24 % higher benchmark and 14 % higher non‑AI gaming performance. A third‑generation hardware ray‑tracing unit reduces DRAM traffic by 13 % and, with Opacity Micromaps, can boost frame rates 30 % while cutting ray‑tracing workload up to 70 %. An accompanying Arm Neural Graphics Development Kit provides Vulkan extensions, engine plug‑ins, profiling, and model‑optimization tools to integrate these capabilities into existing workflows.
Comments focus on the shifting GPU landscape in Android, noting PowerVR’s decline and Mali’s rise as the primary IP alongside a shrinking Adreno presence. There is curiosity about Mali’s current performance relative to competitors and about Mesa driver support. Opinions express skepticism toward marketing that compares mobile advances directly to desktop capabilities, deeming the benchmark unrealistic. The tone mixes disappointment with the introductory framing, a desire for earlier adoption of better GPU solutions, and overall critical yet hopeful expectations for improved mobile graphics.
How well do agents use test/verification techniques?
The study evaluated Rust implementations of Zstd (and an IMAP RFC) generated by coding agents under 26 prompt conditions that instructed various testing or verification techniques (e.g., TDD, QuickCheck, property‑based testing, formal methods, Verus, Alloy, fuzzing, SMT solvers). Each condition was run with medium and “xhigh” effort levels, averaging 80 runs.
- Overall performance: No condition dramatically outperformed the default (no additional instructions). On “xhigh” effort, fuzzing and property‑based testing were slightly better than formal‑method approaches; on medium effort, results were mixed.
- TDD: Consistently underperformed, confirming the author’s prediction. Agents often wrote superficial tests or ignored the TDD process.
- Formal methods (Verus, Alloy, SMT solvers, etc.): Agents produced only trivial or vacuous proofs and failed to apply the tools to the actual code, leading to lower correctness and cheap but ineffective testing.
- Testing skills: External skills (ECC, Hegel, Trail of Bits) underperformed; a custom prompt‑based skill performed modestly better by nudging agents away from default behavior.
- Agent behavior: Agents generally lack knowledge of how to employ the specified libraries or techniques, producing either default‑style tests wrapped in the wrong framework or low‑value random inputs. Errors were often idiosyncratic (e.g., identical bitstreams in tests, missing reversal bugs).
- Implications: The lack of effective RL environments for teaching testing explains the poor results; improving agents’ testing competence could substantially raise coding‑agent effectiveness.
The comments recognize that agents can generate extensive unit tests and handle many edge cases, yet they frequently produce superficial checks that miss core business behavior, reducing TDD to a mechanical pass‑fail loop. Reviewers note that test effectiveness relies heavily on code architecture, with approaches like DI/hexagonal design and targeted coverage improving results. While some are impressed by the agents’ testing skill and cost, many question the practical value, suggesting smarter test selection, automated mutation testing, and higher‑level specifications as needed.
Comments express concern that LLMs dramatically lower the effort required to discover and exploit software vulnerabilities, potentially accelerating attacks. Writers emphasize that existing security practices are insufficient, advocating for defense‑in‑depth, sandboxing, formal verification, and safer languages while criticizing reliance on optional security and poor coding standards. There is optimism that AI could aid defenders, yet many view the problem as systemic, noting underinvestment, regulatory pressure, and organizational shortcomings that hinder meaningful improvement.