cperciva

You're right, I was remembering the peak and duration of the railway boom but of course it wasn't at the peak for the entire duration.

Yes. In inflation adjusted dollars spending on AI dwarfs previous "megaprojects". But as a fraction of GDP it's fairly modest -- comparable to the Apollo Project.

It's a sign of how much the economy has grown that under "1% of GDP for a few years" now is far bigger than "over 10% of GDP for a few decades" was in the late 1800s.

the oxide to pure aluminum ratio is high

For some definition of high? Standard foil is around 20 um thick while the oxide layer only goes about 10 nm deep.

I've seen plenty of people saying "Mythos isn't all that exceptional, lots of LLMs can find security vulnerabilities" -- and indeed there is some evidence for that; it sounds like Anthropic was taken somewhat by surprise at how easily a simple prompt managed to get Mythos to deliver exploits and didn't distinguish immediately between the effectiveness of Mythos and the effectiveness of the prompt.

But the claim of "LLMs aren't making a difference in vulnerability discovery" has been laughable to anyone who has been reading security advisories for the past 3 months. Just look at the Credits lines.

This is hardly news? We've known for months that a flood of AI-assisted vulnerabilities was coming; I posted on Twitter in March calling 2026 the year of a million CVEs: https://x.com/i/status/2035045573116789002

This was CVE-2005-0109.

Frankly, there's no way any arch venue at the time would have done anything beyond rejecting it with "caches make RSA fast, what's the problem?"

Security wasn't something CPU designers paid much attention to, and cryptography wasn't something they were even particularly aware of. Even seven years ago, when an Intel VP was giving a talk at re:Invent about "processor technologies for improving security in virtual machines", my question to him about cache collision side channel attacks was met with "what's a side channel attack?"

They publish lots of papers about side channel attacks, including very hardware based ones like power consumption analysis.

It just happened that "leak information into microarchitectural state and then retrieve it" didn't exist as a subfield until my work (and the OST work a few weeks behind mine).

My paper demonstrating a side channel attack on RSA via hyperthreading was rejected from the crypto preprint archive on the basis that it was "not cryptography".

(Reviewers at J.Crypto subsequently sat on it for a year and then suggested I submit it to a journal on CPU microarchitecture instead.)

Novel research is uniquely susceptible to "cool but it's not part of our field", because that critique is entirely correct until the research gets published!

FreeBSD 15.1! Scheduled to be announced 2026-06-16 00:00 UTC; just need to get some release documentation polished now.

Square root of the population is because that's what it takes to normalize large vs small countries. Imagine slicing a country into quarters; each slice has a quarter of the population and half the radius.

It would be interesting to see a map which was not minimizing [distance to capital] but instead minimized [distance to capital]/sqrt([national population]). The latter would be more robust against Sybil attacks.

arguably the whole scheme should be replaced by finer-grained feature detection.

This seems like a strange thing to say. Fine grained feature detection was around long before "microarchitecture levels" and never went away. The microarchitecture levels were introduced because they were easier to use.

True. The amount of free float increasing dramatically will probably also depress the share price.

Now with this incredible deal, SpaceX is now GAAP profitable under the existing rules, and they get to join the index next year without a rule change.

Didn't they also run up against a "minimum free float" rule?

That information should still be in the commit messages. "No functional change intended." appears widely in FreeBSD commit logs when code is being refactored (or, rarely, restyled).

And the issue isn't whether you can remember what you changed yesterday; this is largely about making sure other developers can quickly identify relevant commits. If you're a solo non-OSS developer, this is entirely relevant to you.

I've done this with code review. "Another LLM reviewed the attached code and produced the attached report. What do you think?"

Lots of "the other LLM clearly hallucinated this part". To be fair, it has never accused the other, err, itself, of being incompetent; it accepts that hallucinating is just something which happens.

Is that true for every type and format

Yes, OTC for everything. I've heard that some pharmacists ask more questions about types which are commonly abused by body builders but that's about the extent of it.

Funny story since you mention cats: My brother's cat was diabetic and prescribed long acting insulin which cost $250/vial. I looked it up and... apparently it was just relabeled lantus, because of course nobody is going to waste money on a separate manufacturing line. Ended up buying it from my local pharmacy, without a prescription, instead of using the vet prescription.

One issue here which is obvious to me is that access to insulin should not be gated on paperwork. I can walk into any pharmacy in Canada and say "I'm diabetic and need insulin" and the pharmacist will sell it to me. They'll ask questions of course since this is not the usual path but my doctor's office being open will have no influence on whether I get it -- just on whether it's a 5 minute process or a 15 minute process, and potentially whether I have to pay myself or have it covered by insurance.

There's a wide gap between "ignored" and "received the attention they deserved".

They don't hand out Nobel prizes for glossed over topics.

Leaving aside the fact that the Economics prize isn't actually a Nobel Prize, topics which historically haven't been given enough attention are exactly where the highest impact research takes place.

If externalities had always received the attention they deserved, Coase would have never received his prize, because his work would not have been so important.

That solves the traffic tampering problem, but not the "malicious peer" problem. You want to be able to sync files without accidentally sharing root privileges.

"Cameraless eye tracking" is understating the key insight here. They don't even need to track which direction you're looking! The only thing they need to measure is the difference between the two directions, and parallax tells them how to focus.

Important to note, of course, that this only works for people with normal binocular vision -- but that's the majority of customers.

Plenty of us are simultaneously far and near sighted. I can't drive without glasses, but until I got progressive lenses I couldn't use my phone with my glasses on.

No, but that's why almost nobody runs it outside of strict trust boundaries. This security section would make more sense if rsync was like curl, which routinely deals with hostile counterparties. If the other side of your rsync is hostile, you probably have bigger problems!

I disagree. While rsync is most often used to transfer data between "friendly" systems, it's inherently crossing a security boundary. It's important to make sure that an attacker can't leverage it to transform the breach of one system into the breach of multiple systems.

I've heard a guideline of 3% of the value of the structure plus 0.5% of the value of the land.

claim was the purchase was unauthorized and the person showed up in person to a class

Certainly a person showed up in person to a class, but how do you know it was the person whose credit card was used?

I write "reported by gcc16 -pedantic" when I'm fixing a bug, because it's useful to flag "this is how they issue became visible" in case readers want to use the same tool on their code.

The fact that it's just a tool is irrelevant. You don't need to mention search and replace because everyone already knows that exists... mind you I have had commit messages which included sed commandlines, for ease of future reuse.

the head of something

Note that "FreeBSD Foundation" != "FreeBSD Project".

Obviously they're connected, but the FreeBSD Foundation supports the FreeBSD Project; they don't direct it. Governance of the FreeBSD Project vests in the FreeBSD core team, which is elected by FreeBSD developers; and as a FreeBSD developer I'm far more concerned with what OS members of the core team run than I am with what OS members of the Foundation run.

F/OSS is like GNU/Linux; the second part is the part which matters, but the first part keeps getting pushed by noisy people so we put up with it to keep them happy.