Taylor Hornby 🛡❤️

Zcash unambiguously has the best security response in the world, thanks to @zodl_co and @ZcashFoundation engineers.

zcashd will reach its end-of-life service halt on July 18, as scheduled, completing the Zcash ecosystem's migration to Rust-based, next-generation Zcash client software. zcashd will not support NU6.3 (Ironwood). Node operators will need to complete their transition to Zebra and the ZODL-maintained Zallet wallet prior July 18. Only Zebra nodes will be on the peer-to-peer network from that time onward. We've successfully worked with and continue to assist partners in their migrations to bring the ecosystem forward. Zcash is upgrading.

And ... we have a winner! My method when writing the post in 2024 was: I wrote it in Chinese, used qwen2.5 locally to translate it to English, then manually fixed all the bugs in the translation. Notice that the stylistic hints that his AI picked up on were intellectual habits and style of math and algorithm explanation, which bypassed my obfuscation strategy (which only covered prose) completely. firefly.social/post/x/2074176…

Can someone please make a security issue severity grading bechmark so that AIs can get better at it?

I wish I could get Fable to help me reason through my old PhD research, but because it involves cryptanalysis of a block cipher, I'm nerfed to Opus 4.8 immediately just explaining the problem. Sigh.

The next big bug class is going to be vulnerabilities in formal verification systems and harnesses. Proving the wrong theorem, axiom smuggling, etc. It’s going to be a wild year.

Perfect example of when and how formal verification can fail. Why code golf when you can just find bugs in the contest itself? (Contest here is "make a SHA256 circuit along with a Lean 4 proof of correctness. We found a bug in the way the circuit cost is scored)

The gov't theory in my case isn't about me. It's a template. Under US v. Storm, "money transmitting" no longer requires custody or control of funds. Publishing code that others use is enough. Who's in danger: → Every maintainer of open-source privacy, messaging, or crypto tools that any bad actor ever touches → Every operator of a financial service — DeFi or not — who learns some % of users are illicit and keeps operating. Knowledge alone becomes the crime → Every dev of immutable, self-custodial software, held to a duty to "stop" what is technically unstoppable It's already working as designed. Michael Lewellen finished lawful crowdfunding software and can't publish it. He asked DOJ if he'd be prosecuted. Their answer, in federal court: we "cannot disclaim an intent to prosecute." Finished code, sitting on a shelf. You don't need to be charged to be silenced. And SDNY isn't done with me. Prosecutors want to retry me regardless — regardless of the hung counts, regardless of Van Loon, regardless of FinCEN's own guidance. I've been fighting this for 3+ years. Legal defense at this level costs millions, and I can't do it alone. If you write code, use privacy tools, or believe publishing software isn't a crime — this is your fight too. Donate: freeromanstorm.com Every retweet helps. Every dollar goes to the defense.

@matthew_d_green Does the software that can emulate any other software count as containing all infinitely many vulnerabilities?

The upper bound on the number of vulnerabilities in a piece of software of length n bits is:

I have a rule: I only use AI after thinking deeply for a while with my own brain.

Once the camera is inside your car or the client side scanning bot is in your phone, you no longer control what gets reported. One overnight update and the rules change. You have to watch what you say. And the consequences for speech are much worse than a speeding ticket.

With AI, the reversing barrier is gone for many attackers. Finding tooling, decode/encode niche serialization formats, implementing known crypto attacks, and optimizing them is mostly prompting now. This is obvious to some of you, but we still see a pre-AI mindset: trying to censor or hide bug details. That is ineffective. The real answer is moving faster than attackers. It is more than patching: defend, protect. Reduce impact in every possible way, and use AI to do it faster.

I sincerely hope this sort of thing does not last very long.

Not using LLMs to write for you won't be like not using Google Maps in a new city. It will be like choosing to run and lift weights, even though we now have machines that can transport us and lift weights for us.

Patch the Planet is our joint initiative with @OpenAI to help maintainers strengthen critical open-source software. In one week, we used Codex and GPT-5.5-Cyber to find hundreds of bugs inside OSS like cURL, Python, and the Go project. 37 patches merged, with more in flight. 🧵

⁨I tested my LLM audit pipeline on Aztec 2.0: could it rediscover the vulnerability that drained the vault? It did, and then found a SECOND, unreported critical: prove a deposit, tag it "not a deposit", L1 skips the debit, withdrawal works. Harmless now, vault's already empty.

I’m watching how quickly age verification is becoming a part of every policy proposal. None of this is about age, it’s all ultimately about identity.

@namada I'm not the exploiter, but see the email I sent to security@anoma.foundation.

There's been an exploit in the Namada protocol. We are investigating the issue and are involving the relevant parties. If you are the white hat hacker behind this exploit, please get in touch with us.

4) Yes, there are real challenges that come from grappling with how we can best communicate with one another today, online or off. That does not mean you are justified in demanding deeply authoritarian “solutions” that would not even do what you think they would.

3) People have reasons other than politics to speak anonymously. There are lots of people who want to seek advice or community privately — maybe a woman dealing with an abusive spouse, someone struggling with addiction, or another person facing an uncomfortable medical diagnosis.