oas

extropian

[🇺🇸 Phigs @ItsPhigs]

WHAT DO YOU MEAN HALF THE INTERNET IS FUCKED BECAUSE AN INDIAN INFOSEC CERTIFICATE AUTHORITY PASSWORD IS "4"!?!?!

WHY ARE INDIANS IMPLEMENTED IN INTERNET PROTOCOLS!?!!!

[ℏεsam @Hesamation]

DeepSeek might as well open source the whole company at this point.

“We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable.”

[Mikli @CryptoMikli]

Cryptography expert Threadguy breaks down what's happening in layman's terms

“We basically have this field of cryptography that people have used to protect our coins. If someone can see the public key for your Bitcoin wallet that holds 100 Bitcoin, they can't just reverse-engineer the private key and crack it. It's guarded behind some massive math equation that would take a thousand years to brute-force. But two things are threatening to shorten the time it would take to break this encryption: quantum computing and brute-force AI.”

“There exists today a quantum algorithm that we know is powerful enough to crack the encryption that guards your Bitcoin right now. It mathematically works. You could work backward from the public key to recover the private key that guards Satoshi's coins, but we don't have anywhere near the hardware needed to run it. So the fear is that AI acceleration can either compress the algorithm, make the hardware way more efficient, or both.”

“AI is really good at brute-forcing problems where there's a guaranteed solution on the other side. What people thought would take a thousand years, maybe a hundred years, we're now like, ‘Wait, maybe single-digit years.’ And then Justin Drake comes out and says that, with the acceleration on the math side, this could take months.”

“You could get post-quantum Bitcoin right now, but it introduces a whole new slew of exploits. It's like when you have a rabbit problem in Florida, so you introduce the python to kill all the rabbits, and all of a sudden you have a massive python problem. That's what adding post-quantum algorithms on top of Bitcoin is like.”

“There's $2.5 trillion of incentives in crypto to make this better. And then there's all of the internet. The GDP of the world is incentivized to fix this.”

[Zoe @zoecyber001]

You spent 6 months writing secure AES in C.

Then someone cuts a trace, drops a 20 dB LNA on your power rail, and recovers your encryption key in under 200 traces.

It is seriously not magic. It's Correlation Power Analysis (CPA). Here is the actual "physics" or better say silicon mechanics that software engineers miss:

1. Software leaks Hamming Weight. Hardware leaks Hamming Distance (🧏‍♂️).
At the silicon level, CMOS transistors only consume significant dynamic current when switching states (charging parasitic gate capacitance).
In dedicated hardware AES (ASICs or FPGAs), registers overwrite the previous round state directly. The current spike is proportional to Hamming Distance (how many bits flipped between states).
In software AES running on an ARM Cortex-M or AVR, the internal bus pre-charges to 0x00 between cycles. When the CPU loads an S-Box byte onto the bus, the current spike is proportional to Hamming Weight (the total number of 1s in that byte).

2. The Decoupling Capacitor Trap
On paper, you put a 1-ohm shunt on VCC and probe it. On a real board, this fails.
First, a microcontroller drawing 3 mA spikes across a 1-ohm shunt produces a 3 mV drop. That sits right at the quantization noise floor of an 8-bit oscilloscope ADC. You need a 10-ohm to 50-ohm shunt, or a 20 dB Low-Noise Amplifier (LNA) to lift the signal.
Second, the 100nF ceramic decoupling capacitor sitting right next to the VCC pin acts as a low-pass filter. It swallows high-frequency S-Box switching spikes before they hit your shunt. You have to physically desolder the decoupling cap or probe directly between the capacitor and the IC pin.

3. The S-Box Nonlinear Bottleneck
AES mixes data with AddRoundKey, SubBytes, ShiftRows, and MixColumns.
SubBytes is the only non-linear component. The S-Box substitution creates a mathematically violent distribution. If your key guess is off by a single bit, the predicted S-Box output byte is completely uncorrelated with reality.
Because the AES block is always 128 bits (16 bytes), you don't attack the whole key at once. You attack one byte at a time. 256 guesses per byte instead of 2^128.

4. CPA vs Classic DPA (Brier vs Kocher)
Classic DPA (1999) splits traces into two buckets based on a single bit (0 or 1) and averages them. It takes thousands of traces.
CPA (2004) uses Pearson correlation across all 8 bits of the intermediate byte simultaneously.
You record power traces for N random plaintexts. For each of the 256 possible key byte candidates, you compute the predicted Hamming Weight: HW(SBox(P ^ K)).
Then you calculate the Pearson correlation between your predicted weights and the actual oscilloscope voltage at the SubBytes clock cycle.
For the 255 wrong guesses, correlation hovers around zero.
For the correct key byte, correlation spikes above 0.85. The key separates from the noise floor in 50 to 200 traces.

5. AES-128 vs AES-256
Attacking Round 1 SubBytes recovers the 16-byte Round 1 key.
For AES-128, that 16-byte value is the entire master key. You are done.
For AES-256, those 16 bytes are only the first half of the key. To get the remaining 16 bytes, you take the recovered Round 1 key, compute the intermediate state entering Round 2, and run a second CPA attack against Round 2 SubBytes.

6. Why Standard Silicon Survives
Unprotected MCUs drop like flies. Secure elements survive using two physical defenses:
- Boolean Masking: The chip XORs plaintext with a random hardware mask byte (m) before S-Box lookup. The rail leaks HW(P ^ K ^ m). Correlation drops to zero unless you do higher-order CPA correlating multiple clock cycles.
- Hiding: The chip injects random clock jitter and shuffles S-Box execution order. If the S-Box lookup doesn't occur at the exact same sample offset every run, Pearson correlation cannot align.

If you don't have hardware masking or jitter on the die, your software AES is completely transparent to a current probe.

[CryptoHack @CryptoHack__]

We've just launched our most requested feature: CryptoHack courses!

We've curated sets of challenges into guided tours, introducing our players to the fundamentals of modern cryptography

We hope this inspires many new people towards loving cryptography

https://t.co/mOL0fYAtkh

[TheSecMaster @TheSecMaster1]

Here are 20 courses to learn cryptography and cybersecurity:

1. Cryptography I (Stanford University - Coursera)
2. Cryptography and Network Security (Georgia Tech - Udacity)
3. Cryptography and Cryptocurrency (University of Maryland - Coursera)
4. Applied Cryptography (Udemy)
5. Cryptography and Security (MIT OpenCourseWare)
6. Cryptography for Cybersecurity (Pluralsight)
7. Cryptography: Theory and Practice (Udemy)
8. Cryptography Fundamentals (LinkedIn Learning)
9. Cybersecurity and Cryptography (edX)
10. Cryptography and Network Security (Udemy)
11. Cryptography and Cyber Security (Simplilearn)
12. Cryptography and Security (Codecademy)
13. Cryptography and Secure Communications (Futurelearn)
14. Cryptography and Cyber Security (Udacity)
15. Introduction to Cryptography (Offered by Purdue University - edX)
16. Cryptography and Security (Coursera)
17. Cryptography and Data Security (Skillshare)
18. Cryptography and Cyber Security (Cybrary)
19. Cryptography and Network Security (Udemy)
20. Cryptography and Cyber Security (Great Learning Academy)

[Ihtesham Ali @ihteshamali]

Say goodbye to paying $200 for AI textbooks that skip the intuition and leave you more confused than when you started.

An AI engineer spent years filling notebooks with first-principles explanations of maths, computing, and AI the kind that build real understanding instead of just getting you through an exam.

In 2025, he shared those notes with a few friends preparing for interviews at DeepMind, OpenAI, and Nvidia. They all got in, and they all perform well in their roles today.

Now he has open-sourced the entire thing as a free, unconventional textbook called the Maths, CS & AI Compendium, covering 18 chapters from vectors and calculus all the way through GPU programming, inference optimization, quantum ML, and AI for biology.

The six foundational chapters are live right now, covering vectors, matrices, calculus, statistics, probability, and machine learning with the kind of intuition-first writing that most academic textbooks never bother to include.

The remaining chapters on transformers, computer vision, audio, multimodal learning, autonomous systems, CUDA, systems design, and edge inference are coming next.

The notes that opened doors at the best AI labs in the world are now free for every curious practitioner on the internet.

Apache 2.0 License. 100% Open Source.

[Praveen Kumar Verma @Alacritic_Super]

Learn GPU Programming from these universities for free

Stanford CS149 – Parallel Computing
https://t.co/fCtyk7pYU7

Carnegie Mellon 15-418/15-618 – Parallel Computer Architecture & Programming
https://t.co/GaMlTFf7WM

California Institute of Technology CS179 – GPU Programming
https://t.co/lRmjaHv9Vp

University of Illinois ECE 408 – Applied Parallel Programming (CUDA)
https://t.co/PTxRujFwyC

University of Pennsylvania CIS 5650 – GPU Programming & Architecture
https://t.co/h4KRjUVeWU

NVIDIA CUDA Education & Training
https://t.co/mSTAHpYJFi.

[Antaripa Saha @doesdatmaksense]

came across a gem of a channel for learning gpu programming, covers
> kernel basics
> code simple neural network by just using cuda
> cuda memory
> performance factors in GPU

wonder why these type channels and videos are so underappreciated

[freeCodeCamp.org @freeCodeCamp]

If you're prepping for technical interviews, you likely have data structures and algorithms on the brain.

And this comprehensive (49 hour!) course covers all the most popular ones you'll run into during interviews.

You'll also learn about Big O Notation, sorting and searching, dynamic programming, and lots more.

https://t.co/GMhF9JroF3

[Rohit Ghumare @ghumare64]

Someone literally put an entire AI engineering degree on GitHub and made it 100% free 🔥

542 lessons across 20 phases, with ~400 hours of material.

The whole curriculum is built around learning AI from first principles.

You start with the math, then implement the concepts yourself: backpropagation, tokenizers, attention, agent loops and more. Production frameworks come later, once you've already built the core mechanics by hand.

Every lesson runs these 5 steps:
Read the problem → derive the math → write the code → run the test → keep the artifact.

By the end of each lesson you have reusable: prompts, SKILLmd files, agent definitions, MCP servers you built yourself. The code runs in Python, TypeScript, Rust or Julia, depending on what fits the concept best.

The curriculum goes from linear algebra all the way to autonomous agent swarms, multi-agent coordination, production infrastructure, and AI safety.

It’s 100% free, open source, MIT licensed and available to clone and run locally. 70k+ stars on GitHub.

https://t.co/D2n8y3Ktnv

[Hero Of Justice @herooffjustice]

A good course on Linear Algebra by Imperial College London.
(tho short and intuitive)

[Dan Kornas @DanKornas]

For deeper Mathematics study, this YouTube playlist gives you the sequence in one place.

Good save when you want the path, not a one-off video: College Algebra → Linear Algebra.

𝗙𝗼𝘂𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀:
↳ Statistics - A Full University Course on Data Science Basics

𝗚𝗲𝗻𝗲𝗿𝗮𝘁𝗶𝘃𝗲 𝗔𝗜:
↳ Linear Algebra Course – Mathematics for Machine Learning and Generative AI

𝗠𝗼𝗿𝗲 𝘁𝗼𝗽𝗶𝗰𝘀:
↳ College Algebra – Full Course with Python Code
↳ Precalculus Course
↳ Calculus 1 - Full College Course
↳ Linear Algebra - Full College Course
↳ College Algebra - Full Course

Best use: treat it as a map of the field. Watch once for the arc, then revisit the parts where you need implementation depth.

Link is in the first comment 👇

♻️ Share this with your network if you found it useful or insightful.

[Mustafa. @oprydai]

the reason i didn’t like calculus and linear algebra in college is simple:

i was learning the math before i understood why i needed it.

• matrices were just grids of numbers.
• derivatives were rules to memorize.
• eigenvectors were something you calculated for an exam.
• jacobians were another ugly matrix.

then i got deeper into robotics, ai, physics, and control.

suddenly:

• matrices became transformations between coordinate frames
• derivatives became motion and rates of change
• jacobians connected joint motion → end-effector motion
• eigenvalues started telling me about stability and system behavior
• gradients became the machinery behind optimization and learning

the math didn’t change.
the context did.

sometimes you don’t hate a subject.
you just haven’t found the problem that makes you need it yet.

[The ICP Apprentice @ICPapprentice]

Internet encryption is currently having a nuclear meltdown.

​Cryptographers are calling it "bigger than Heartbleed."

​A global Certificate Authority just leaked 8 master private keys that allow anyone to impersonate any server on Earth (Google, banks, government sites).

​A normal master key has 116 digits of entropy.

​The actual leaked keys?
4. 56. 66. 115.

​A toddler on a calculator could have cracked them.

​While browsers patched it today, millions of IoT devices, Linux servers, and Docker containers will take years to clean up.

​We bet global digital security on centralized human gatekeepers who forgot to check their math.

​True security can't rely on trust cartels. It has to be governed by mathematical consensus.

​See the signal. ♾️

[神币 🔶 馬良 @surpr164]

朝鲜黑客这英语说得太地道了，就是提到平壤时，他们会下意识地愣一下。

我总结了一下他们是如何假装程序员、混进 Crypto 公司，然后盗取币圈公司资产的。

1. 先偷用美国、欧洲等地真实居民的身份，伪造简历、学历、工作经历和 LinkedIn 账号。

2. 面试时开 VPN，用 AI 换脸、实时回答工具，甚至找别人代面。公司寄出的电脑会送到美国境内的“笔记本农场”，再由当地协助者安装远程控制软件，让他们在海外操控电脑，而公司看到的设备和 IP 仍显示在美国。

3. 入职前期正常写代码、参加会议、按时交付，甚至同时给多家公司上班。这样既能拿工资，也能慢慢获得 GitHub、Slack、云服务器、部署系统和内部文档权限。

4. 权限增加后，他们会复制源代码、客户数据和钱包操作流程。碰到能接触部署、签名或转账系统的岗位，还可能篡改代码、劫持交易请求、转走公司资产。

5. 被发现或解雇后，有人会拿偷走的源码和数据勒索公司。

[Smukx.E @5mukx]

Building a Malware Development Lab, Part 1: Elastic EDR with a Self-Hosted Elastic Stack by bsdrip

Blog:- https://t.co/GR8lDTYmK1

[Dmitrii Eeeekimov @Ekimko]

Лучшее, что я видел за последнее время — чел пилит ASCII MMORPG, в которой вся графика состоит из букв и символов.

Да, буквально весь мир, персонажи, окружение и спецэффекты нарисованы разноцветным текстом.

Автор сейчас экспериментирует с магией, визуалом и боссами. Я прям залип на то, как из нескольких десятков символов получается такая красота.

Буквально сны при температуре 37,2.

Via: https://t.co/vtYXAaEioi

[二楼 @secondfloor]

黑客也有被黑的一天。

荷兰反诈博主 Deeveeaaar 黑进了一群朝鲜"远程程序员"的电脑，打开摄像头——对面是几个穿朝鲜军装的年轻人，当场僵住。

这帮人平时在领英上装求职者，用 AI 编简历、开 VPN 藏位置，混进欧美公司后偷数据、偷加密货币，上缴平壤。

这不是孤例：美、日、韩等十一国今年7月联合警告，朝鲜"IT 工人"计划2024年一年就给平壤搞了约8亿美元。

等下，这骗子桌面怎么还有CS游戏？？🤪

[pwn.ai @pwn_ai]

Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors.

CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below: