Halvar Flake

Choose disfavour where obedience does not bring honour.

I do math. And was once asked by R. Morris Sr. : "For whom?"

@[email protected]

[Halvar Flake @halvarflake]

I will have to print & frame this tweet :-))

[Rob Joyce @RGB_Lights]

If you watch one talk this month, make it this one. Profoundly insightful on the complexity threat to security by @halvarflake given at NATOs CYCON.

Video:

https://t.co/4916NTE5tn

And slides:

https://t.co/mZcswwmB54

[Andreas Klinger 🦾 @andreasklinger]

People keep shitting on Brussels leadership for issues in Europe.

In my experience so far it’s member states and parliament that come up with hurdles and insane clauses that renders europe wide fixes useless.

Usually because of status quo lobbists or incentives to never change anything m.

No idea where @euacchq got this file from, as this stuff in usually not leaked, but to read for yourself.

(And council doesn’t even come up with the really crazy change requests, Parliament does.)

PS: welcome to my hell lol.

👇

[Halvar Flake @halvarflake]

@juanandres_gs Patching is genuinely harder to verify than bug detection. I wasn't there for any of the work that led to better big detection, but easy verification of rewards is important/useful in RL.

[William Shatner @WilliamShatner]

What a heartbreaking week it has been. Sir Patrick Stewart was a friend, a colleague, and a magnificent actor. From the stage to the bridge of the Enterprise, he brought intelligence, grace, and a deep sense of humanity to everything he did. Captain Picard stood for the best of us, and so did the man who played him. I was filled with affection and admiration for him and his work.

My heart goes out to Sunny and his family. He will be deeply missed.

[Cheeky Pint @CheekyPint]

“People just didn’t think the model was going to do these things. We had this collective experience of watching people’s hardest research problems from their academic careers—the model was just knocking them down, one after another. Across many different fields, it was incredible to watch.”

“I was tremendously excited and happy. But I also had much more sadness and melancholy—a feeling of something ending—than I was expecting.”

@sama @collision

[Jacob Effron @jacobeffron]

Modal CEO, @bernhardsson, on why Anthropic's S1 changed his view on the next few years of GPU prices:

[Ryan Basden @_rybaz]

Favorite part of talking with @lcfr_hax at @unpromptedconf is learning that he didn't do anything crazy with harnessing. He's just really fucking good at hacking PHP and also happens to have Codex. Such a friendly and humble dude.

Don't just "use AI". Keep learning.

[eu/acc @euacchq]

This is a first wave of information: Repost. Contact your Member State so they stop copy/pasting red tape lobbies arguments.
Europeans in the official survey said they want notaries out.
Member States should not go against their citizens' will

9/9

[Simon Taylor @sytaylor]

Meta's @Muse answers questions very differently from ChatGPT or Anthropic.

It cites more sources but uses far fewer words and tables, and doesn't try to ask a follow-up.

This short-form content is designed for dealing with tasks rather than continuing a conversation, and frankly, it's far less exhausting to read. This speaks to a really well designed AI experience and its so different from the base LLMs.

Great study by the AirOps team 👇

gg @alexandr_wang

[Corey Quinn @QuinnyPig]

Holy balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/!

What the hell are you doing over there, Apple friends?

[Halvar Flake @halvarflake]

One of the companies I wish I had invested in.

[Ryan Deng @ryandengg]

Oxide just raised $445M at a $6B valuation.

@bcantrill and @sdtuck started @oxidecomputer to build the computers the hyperscalers keep for themselves. @EclipseVentures led the seed when nobody else would. now they're profitable, and he says they didn't even need to raise.

i also asked him if AI is a bubble, why america hates data centers, and why every oxide employee makes the same salary.

nontechnical, episode 4.

00:00 $445M at $6B, and they didn't need it
03:06 one wire transfer bigger than their whole seed
07:14 "they don't have the guts. they're too chicken."
09:09 100% banked at SVB
13:04 a 92-year-old kicking their asses in board meetings
14:48 "would you like me to name names?"
16:58 a16z loved it, then sent the first rejection
20:19 leaving a first round partner meeting for the A's
22:52 "Marc Andreessen was offended"
23:05 NEA: "we will only invest in software"
25:55 "legends are dead"
28:32 "when a VC says 'I've got a technical question'"
42:39 the firm that walked away from a signed term sheet
46:48 "if I could get sequoia, do you think you'd be here?"
49:41 "they were cowards"
52:36 the nuke email he wrote and never sent
58:33 four years later, they asked for a reference
1:02:01 "politics and business don't mix"
1:10:51 is AI a bubble?
1:14:56 how he ruined a dinner party in 1997
1:20:44 "people hate data centers"
1:22:08 how sun got thrown through the windshield in 2000
1:26:26 why everyone at oxide makes the same salary
1:30:58 the worst hire of all time
1:40:42 when oxide goes public

[Ryan Deng @ryandengg]

Oxide just raised $445M at a $6B valuation.

@bcantrill and @sdtuck started @oxidecomputer to build the computers the hyperscalers keep for themselves. @EclipseVentures led the seed when nobody else would. now they're profitable, and he says they didn't even need to raise.

i also asked him if AI is a bubble, why america hates data centers, and why every oxide employee makes the same salary.

nontechnical, episode 4.

00:00 $445M at $6B, and they didn't need it
03:06 one wire transfer bigger than their whole seed
07:14 "they don't have the guts. they're too chicken."
09:09 100% banked at SVB
13:04 a 92-year-old kicking their asses in board meetings
14:48 "would you like me to name names?"
16:58 a16z loved it, then sent the first rejection
20:19 leaving a first round partner meeting for the A's
22:52 "Marc Andreessen was offended"
23:05 NEA: "we will only invest in software"
25:55 "legends are dead"
28:32 "when a VC says 'I've got a technical question'"
42:39 the firm that walked away from a signed term sheet
46:48 "if I could get sequoia, do you think you'd be here?"
49:41 "they were cowards"
52:36 the nuke email he wrote and never sent
58:33 four years later, they asked for a reference
1:02:01 "politics and business don't mix"
1:10:51 is AI a bubble?
1:14:56 how he ruined a dinner party in 1997
1:20:44 "people hate data centers"
1:22:08 how sun got thrown through the windshield in 2000
1:26:26 why everyone at oxide makes the same salary
1:30:58 the worst hire of all time
1:40:42 when oxide goes public

[Dr Heidy Khlaaf (هايدي خلاف) @HeidyKhlaaf]

When I worked in nuclear, I gave talks on bugs I found with a slide titled "How are we all not dead yet?" where I gave an example of a device that has been running on the field for decades with no issues, but had 6,000 data races (that weren't false pos) to explain resilience 1/2

[Alex Clemmer 🔥🔥🔥😅🔥🔥🔥 @hausdorff_space]

Math people are angry about this rhetoric, but I feel like they should actually be mad that (1) OpenAI is producing 'discoveries' that are not obviously in the spirit of what these formalisms try to accomplish, and (2) that the formalisms admit such constructions to begin with.

[Yacine Mahdid @yacinelearning]

I’m like a moth attracted to the flame of looped models and I don’t know why man I don’t know why they fascinate me so much

[Steven Strogatz @stevenstrogatz]

Thank you to Grant Sanderson @3blue1brown for having me on his podcast – and I hope you enjoy our open-hearted, tentative, exploratory conversation about math in the age of AI. We tried out a lot of ideas on each other. https://t.co/kDTQWcvp6l

[Microsoft BlueHat @MSFTBlueHat]

How do you know an AI-powered security tool has improved if the same test can produce different results?

In his BlueHat Asia 2026 keynote, @halvarflake discusses what LLMs’ variability means for software engineering and security. He looks at why traditional testing can fall short, what LLM-based code review has in common with fuzzing, and why meaningful experiments matter.

Watch the keynote: https://t.co/V0rt2mdTIE

[Gergely Orosz @GergelyOrosz]

How did Google refactor 250M lines of C++ code, pre-AI, what happened when Search could no longer ship on the regular cadence due to regressions, and why is it time to completely redo the CS curriculum? With @TitusWinters. Timestamps:

00:00 Intro
07:01 Getting hired by Google
09:48 Finding his niche at Google
14:32 Why Google made testing mandatory
17:45 Why new engineers fear making mistakes
20:40 Abseil: C++ foundations at Google
23:09 Google’s massive C++ refactoring
30:48 AI for rewrites
39:07 Software Engineering at Google: the book
43:10 Google’s readability reviews
47:18 Why teams still matter
52:41 Psychological safety
58:17 Layoffs and culture
1:02:11 Measuring developer productivity
1:11:17 Rethinking CS education
1:22:56 What new grads should learn
1:32:08 Titus’s ideal software engineering curriculum
1:36:27 Advice for breaking into tech
1:38:35 Book recommendation

Brought to you by:

• @turbopuffer – vector and full-text search engine built on object storage. It’s fast, cheap, and extremely scalable. https://t.co/l7thArzHXE

• @linear – one of the big challenges for us devs is the sheer amount of code to review. Linear Diffs is a new feature to review PRs inside of Linear, with all the context in one place. It also supports stacked PRs. https://t.co/knIF2md6YX

• @WorkOS – WorkOS built Airlock, the authorization layer for AI agents. It evaluates every request against the agent’s intent + your rules and either allows it, denies it, or routes it to a human. https://t.co/OzuIJ1xfjx

Three interesting details:

1. Google made automated tests mandatory after Search could no longer ship regularly.

Around 2007, Search, the flagship product, was unable to ship at a monthly cadence any more, and the best they could ship to production was quarterly.
Almost every change at Google touched Search’s code, even things like a change to Gmail. To clamp down, Google, as an org, mandated that every change was to be accompanied by a test. Over time, Search returned to its former higher cadence.

2. Google’s readability program might have been the largest educational program ever in tech.

To make a code change at Google, two people need to sign off that change through a code review:

a) An “owner” of the file/project: someone on the team with domain knowledge

b) A “readability” reviewer: an engineer certified to be a “readability” expert in the given language that the change was made in

Google’s first engineer, Craig Silverstein, walked each new dev hire through their first change. Java teams turned this approach into mentoring, where experienced reviewers were assigned to review all changes in a round-robin fashion. And soon enough, a formalized readability program was built for all languages. When Titus left Google three months ago, 10,000+ engineers were enrolled in readability at any given time. Has there ever been a bigger engineering “classroom” anywhere else?

3. Burn down the US undergrad CS curriculum (most of it)

Titus was the only working engineer on the steering committee for the ACM/IEEE/AAAI CS curriculum guidelines in 2023, and believes the curriculum is hopelessly out of date. He accuses it of not having altered substantially since around 2000, while the industry has. Testing and verification are cited as mattering a lot more for new joiners, but they are absent from the curriculum.
Unless major changes are made to make it relevant, computer science enrollment could fall and software engineering programs that focus on practical dev skills will be attractive to students – this is Titus’s forecast.

[@fclc cmp lea char @FelixCLC_]

kind of cool: mistral is doing all this work with *only* 3MW of GPUs!

(3800 x 800W)

add in the rest of the infra, you're domain specific open frontier for less than 5MW!

[Volodymyr Styran 🇺🇦 @arunninghacker]

I told a joke to an Italian lately and he got it.

You know why everyone is talking about corruption in Ukraine and Italy but no one is discussing corruption in Germany or the US?

Because we brag about fighting it.

[Halvar Flake @halvarflake]

Glad to see my pet peeve confirmed: The argument that ECC curves give us a generic group because we haven't found exploitable structure *yet*.

This won't have practical impact yet, but it was always a dangerous assumption.

[Vinod Vaikuntanathan @Vinod_MIT]

Elliptic curves are not generic. Long time coming. Congrats @crypto_theory and collaborators https://t.co/NQRHenHgrQ

What I said a week ago: It wouldn't surprise me in the least bit if there were a better factoring or discrete logarithm alg. For factoring: what is the chance that exp(n^1/3) is the right bound? who are we kidding? For discrete log over finite fields: better algorithms over Z_p have followed a decade or so behind those for small-char fields (Coppersmith'84 vs NFS a decade-ish later). Joux gave a quasi-poly alg over small-char fields in the 2010s. Porting to finite fields long overdue. For discrete log over elliptic curves: assuming that elliptic curve groups were "generic" is particularly preposterous given the rich structure they have. All of these ripe for disruption. Unstructured LPN would take me by real surprise, also unstructured LWE to a slightly lesser extent.