Daniel Norman

🥑 Developer @radicle @ipfs | Beginner's mind | Software | Woodworking | 🚴🏼‍♂️ | prev @protocollabs @libp2p @prisma @aragonproject | opinions are my own

[Armin Ronacher ⇌ @mitsuhiko]

I really believed a whole generation of developers, who only know open source from npm and pypi, miss how open source actually used to work.

When Debian or a Linux distribution ships a dependency they take responsibility of it. If there is a security issue and it’s not fixed by the developer upstream, they fix it for their users.

Debian and others basically vendor every thing they distribute. They honor the license and they maintain patches. Most of the stuff that you get from your Linux distribution is basically a (small) fork.

The same is true for Apple, Microsoft and others. The open source software they ship, they carry that responsibility.

That doesn’t mean that security fixes are not upstreamed, but Apple or Debian or anyone else won’t jump in Twitter to shame a developer into compliance with their ways. They are not dependent on the health of a packaging infrastructure. They own their software including all the things it depends on.

I want that thinking back. Because it fundamentally makes people feel more responsibility and it shares the burden of issues. It also does not put so much focus and attention on the one overworked developer who just happened to have too much of the world depend on their library. Remember: they carry a responsibility they never signed up to and they never got compensated for.

[Eli Ben-Sasson | Starknet.io @EliBenSasson]

My turn to call out quantum FUD.

The new “we improved on Google’s Bitcoin-breaking quantum circuit” story is, in my view, a nothingburger.

Roughly: Google obscured details of a particular circuit. Researchers reverse-engineered it and found a more efficient way to describe/optimize that circuit.

Interesting? Sure.

Does it change the big picture for Bitcoin, Ethereum, or cryptographic signatures? No.

The question that matters is not “can we shave down circuit size again?” We’ve seen those estimates improve for years.

The question that matters is whether anyone can build a machine with 1,000+ reliable logical qubits and run it at scale.

This is not that news. Not today.

[Justin Drake @drakefjustin]

Today a crazy quantum story just got wilder.

On March 31, the Google Quantum AI team published a landmark result on Shor's algorithm for elliptic curve cryptography. Technically, the paper was a bombshell: a dramatic 10x improvement over the state-of-the-art. As a stunt and wakeup call to the blockchain space, those optimisations were illustrated on secp256k1, the elliptic curve underlying Bitcoin and Ethereum signatures.

But perhaps the most striking part of the paper was sociological, not technical. Instead of following standard academic process, the optimisations were kept secret, hidden behind a zero-knowledge (ZK) proof. Google's accompanying blog post mentions they "engaged with the U.S. government". The ZK proof demonstrates the existence of algorithmic improvements without leaking details. Academic censorship with ZK, a historic first!

As a co-author of the Google paper I witnessed some of the context surrounding this censorship. To be honest, multiple aspects of that context don't sit well with me. As much as I believe the general public ought to know more, I am limited in my ability to whistleblow. Though let me be clear about one thing: the Google team's professionalism has been absolutely exemplary, and they deserve nothing but praise.

Censorship has a way of backfiring. The Streisand effect, where an attempt to bury something only draws more attention to it, is exactly what's unfolding today. First, Google's key optimisation has been rediscovered by the French. And in a thrilling turn of events, a collaborative Shor-at-home challenge just launched. The initiative, available at ecdsa[.]fail, breached a new Shor world record in a matter of hours.

Let's start with the rediscovery. Just two months after Google's paper, French quantum expert André Schrottenloher cracks the main secret optimisation. His paper, titled "Optimized Point Addition Circuits for Elliptic Curve Discrete Logarithms", landed on the arXiv today. Big congrats to André, who beat several other nerdsnipped experts to it. In a blog post also published today, Craig Gidney, the world expert on Shor optimisations, revealed that he'd been sitting on this very optimisation for a whole year under censorship pressure.

Interestingly, André missed a handful of minor optimisations, both from Google's original publication and from improvements found since. It's plausible there's still plenty of juice left to squeeze out of Shor, and this is exactly what the ecdsa[.]fail challenge is about. The verifier program developed for the ZK proof does double duty, automatically filtering for valid submissions. Dozens of compounding small and micro improvements are rolling in. As of the time of writing there's an 8.4% improvement to Google's circuit, as measured by the product of logical qubit count and Toffoli gate count. Nice!

The nerdsnipping ran deeper than anyone expected. Over the last few weeks it became clear it extended well beyond André and other quantum experts. Behind the scenes, a small army of amateurs quietly got to work. Inspired by Karpathy-style autoresearch, they turned AI on Shor. Ironically, the verifier program for the ZK proof makes an ideal reward function for AIs. The barrier to entry for this modern style of research is refreshingly low, with several non-experts, even a teenager, finding nice optimisations. Get in touch if you'd like to join a Telegram group with fellow autoresearchers :)

Part 2: neutral atoms and qday

The story doesn't end with Google. On the same day Google went public, a stealthy startup called Oratomic published its own Shor paper in a coordinated release. It made a splash, ultimately becoming the most upvoted paper on scirate[.]com, a website ranking arXiv papers.

Oratomic's claim was wild. By building on Google's logical optimisations and applying custom physical optimisations for neutral atoms, they claimed just 10K physical qubits were sufficient to run Shor's algorithm on secp256k1. That number is mind-bogglingly low.

Knowing essentially nothing about neutral atoms when Oratomic's paper landed, I was intrigued and decided to learn more about the tech. I fell straight down the rabbit hole and spent a couple hundred hours on the topic. I got a little obsessed and watched every YouTube video I could find and spoke to a bunch of experts.

My conclusion? The tech is real, very real. Even Google recently decided to start a neutral atom lab, a notable pivot from their sole focus on superconducting qubits. If you care about qday, i.e. the day a quantum computer will break the first piece of cryptography in production, neutral atoms demand your attention. I shared some of my learnings on Shor and neutral atoms in a 30min talk at the ZKProof cryptography conference. You can find it on YouTube by searching "zkproof neutral atom".

Here's an interesting observation about this duo of breakthrough papers: neither Google nor Oratomic say a word about what their results mean for qday. No timelines. Zero. Nada. That is especially baffling given that the whole point of whitehat quantum cryptanalysis is to inform qday estimations and help the general public make good decisions.

So let me attempt to partially fill the silence, similarly to what Scott Aaronson did in his April 29 post. Given everything I know, including scary non-public information, I now put the odds of qday by 2032 at 50%. 10% by 2030.

Anecdotally, the US government has its own date: 2035. Originating at the NSA and later adopted by NIST, it's when branches of the US government will be disallowed from using quantum-vulnerable cryptography. In plain language: with hindsight, that date is a joke and should be discounted entirely. I don't see how NIST avoids being forced to pull it forward by years.

Part 3: post-quantum cryptography

There are good reasons to sound the alarm today, but please do not panic. Rushing carelessly towards immature post-quantum cryptography is a recipe for disaster. IMO a good target date for migration is 2029, roughly 3.5 years out. 2029 happens to be the date selected by Google, Cloudflare, and the Ethereum Foundation.

These days most of my time goes to safely migrating Ethereum towards post-quantum cryptography as part of the broader lean Ethereum effort. There's a lot to do. We need to rip out and replace BLS signatures at the consensus layer, KZG commitments at the data layer, and ECDSA signatures at the execution layer.

The plan to get there is compelling, and is based on hash-based cryptography. Within the Ethereum Foundation we've developed a Swiss army knife called leanVM (github[.]com/leanEthereum/leanVM) powered by the magic of hash-based SNARKs. Thanks to truly exceptional work by Emile, Thomas, and others, its performance is derisked. Regarding security, leanVM is a jewel, a minimal zkVM crafted for end-to-end formal verification and maximum security.

Want to help? There are two $1M initiatives. First, the Proximity Prize (proximityprize[.]org). Solve a long-standing mathematical conjecture in coding theory, improve hash-based SNARKs, and go home a millionaire. Second, the Poseidon Initiative (poseidon-initiative[.]info), offers $1M for breaking Poseidon, the SNARK-friendly hash function.

[Jonathan Wasserstrum @jmwass]

The best part of Europe in the summer is getting to click “accept all cookies” on every single website.

[Mason @webdevMason]

Interesting to watch a self-sort happening across various non-tech corners of the internet, where people are moralizing AI use for a wide variety of reasons and essentially opting themselves and their kids out of the next economic paradigm

[François Fleuret @francoisfleuret]

A society with no trust is a society that waste resources.

From having to lock your bike, arrive 2h before your flight at the airport, or involve lawyers, to building nukes and strategic bombers.

[Carillus ✈ lorecrafters @CarillusArt]

I live in an area that did this - the Wolbachia-infected male mosquitoes cause mosquito populations to gradually go down over time as they crowd out non-infected ones from reproducing, but are sterile themselves. I went from getting bitten by mosquitoes every day (they REALLY love me) to not seeing one for the past five years or so. It’s really effective!

[Bull Theory @BullTheoryio]

BREAKING: Google is planning to release 32 million mosquitoes across Florida and California.

The company has asked the EPA for permission to proceed, with the public given until June 5 to respond.

The mosquitoes are infected with Wolbachia bacteria, which stops them from reproducing and slowly collapses the wild population from within.

Google's previous Debug Project trial in California's Central Valley nearly eliminated mosquitoes from three test sites entirely. A separate trial in Singapore cut dengue cases by 70% within 12 months.

Google has now released over 1 billion mosquitoes across four continents. This new proposal is the largest deployment in US history.

[Kristof @CoastalFuturist]

whitepill

people are still making fun and interesting things, they've just become harder to find

[Justine Moore @venturetwins]

Me using Claude Opus 4.8 to rename a file

[NOBUNAGA🇯🇵🏯_夏樹蒼依 @japan_nobunaga]

There's a TV show in Japan
that has run for over 30 years.

The premise: a parent sends
their two or three-year-old child
on an errand. Alone.

To the store. To buy tofu.
Across actual streets.

A camera crew follows secretly,
hidden, never helping,
as a tiny human in a backpack
completes a task most countries
wouldn't let a child attempt.

The kid cries. The kid forgets.
The kid gets distracted by a dog.
And then the kid comes home,
holding the tofu, glowing.

It's the most-watched thing
of its kind in the country.

Americans who discover it
cannot believe it's legal.

In Japan, we cannot believe
it's remarkable.

[Peter Steinberger 🦞 @steipete]

Folks: when you write skills, ask your agent to be token efficient, relax grammer. I see too many skills that write books in the skill description, and all that crap is loaded into every context.

I wrote a skill that finds the worst offenders. https://t.co/kfaaJpxMXE

[Cindy Sridharan @copyconstruct]

Pre AI, people wrote poor commit messages, but you could still read a bunch of them and generally know what people were trying to do.

AI writes commits so verbose I’m in the “I ain’t reading all that. I’m happy for you tho, or sorry that happened” territory.

“More” ≠ “better”

[Ryan Dahl @rough__sea]

deno 2.8 ships tomorrow. bun is definitely faster in many benchmarks - credit where due - but node compat isn't close

[Cindy Sridharan @copyconstruct]

There are a small number of people who use LLMs to understand bugs better, go deeper into the subject matter, validate if the LLM provided solution makes sense, and generally improve their knowledge and expertise, but at an accelerated clip.

And many others who do none of this.

[Cindy Sridharan @copyconstruct]

Unpopular opinion:

Unless you’re just prototyping, you should aim to understand as close to 100% of production code generated by LLMs.

Yes, all of it.

Effective mental models are still important for humans to sustainably maintain and evolve a codebase via prompting alone.

[The Figen @TheFigen_]

He's actually better than the best models in the world.

[Charly Wargnier @DataChaz]

just like my vibe-coded app—yeah, it’s buggy, but if it works, don't touch a thing

[DaVinci @BiancoDavinci]

Interior design for the new French high-speed trains.

[Genesis AI @gs_ai_]

We are back. After one year of quiet building.

Introducing GENE-26.5, our first robotic brain that takes a major step toward human-level capability.

For years, robotics has struggled to learn from the world’s largest and valuable data source: Humans.

Solving it means rethinking the whole stack from the ground up:

- A robotics-native foundation model.
- A 1:1 human-like robotic hand.
- A noninvasive data collection glove for motion, force, and touch.
- A simulator that turns weeks of experiments into minutes.

GENE-26.5 is trained across language, vision, proprioception, tactile, and action. We designed a set of tasks to test how far we can go with this new paradigm.

Fully autonomous, 1x speed, one model, same weights. (Enjoy with sound on)

We are approaching the endgame for robotics.

And this is just a beginning.