chrisb

chrisb

@boscolo.co

sojourning through the crazy woods (bosco loco) pondering rainbows and unicorns

472 followers241 following1K posts

Pinned

chrisb
@boscolo.co

Replying to @apenwarr.ca

I'm a bit of a dreamer, I want to message people via ATProto using their ATProto Identity and have it be end-to-end encrypted like Signal. bsky.app/profile/bosc...

chrisb@boscolo.co

ATproto devs, app builders, dreamers of a more agentic world—this our opportunity to shape secure, private open E2EE messaging! This preliminary AT Messaging spec needs your help to finish. Dive in, share your brilliance, join #e2eeWG, and let’s build it together! github.com/ATProtocol-C...

github.comgithub.com
chrisb
@boscolo.co

The inverse paradox of surveillance in the physical world vs. online ☯️ IRL: 📹 🧑‍🤝‍🧑 Sophisticated technology and infrastructure buildout out is required to mass-surveil society Online: 🛜 💻 Sophisticated technology and infrastructure is required to PREVENT mass-surveillance

chrisb
@boscolo.co

This post is not about 𝕏 or AI But on the other app, where many people talk about breaking news, this button in the top right is amazing. When I see a post using deep domain-speak or is a subtweet on an issue I don't know about, I click this button and get a quick summary. 🤖 🦋 needs this!

chrisb
@boscolo.co

this is it, this is the new social modality we've been looking for every post must be an MTV-style music video, all replies a remix

P(aul) Frazee@pfrazee.com

Wrote a blogpost about AI and atproto. Just a normal blogpost. Normal kind. (I actually did write the text of it.)

chrisb
@boscolo.co

They just don't make em like this anymore: 'Do you not see how UTTERLY STUPID those kinds of rules would be? So no. We're not going to make stupid rules that say "you can't use tools for X".'

P(aul) Frazee@pfrazee.com

Linus Torvalds, the creator of Linux, on "AI coding"

chrisb
@boscolo.co

I can no longer tell the difference between humor and technical seriousness from @pfrazee.com

P(aul) Frazee@pfrazee.com

"Everything is a cache on top of durable object storage" but depending at which system youre building, object storage is an S3-like or it's atproto

chrisb
@boscolo.co

When interviewing, one thing I try to discern is if the candidate is running TO an opportunity, or running FROM one. A ship full of Jobs becomes a liability

chrisb
@boscolo.co

Ever since BTC crossed $1B, crypto has been speedrunning ‘how does this get pwned?’ Hardware supply chain attacks are just the latest boss.

Edmund Edgar@goat.navy

Beyond crypto the issue is, how do you trust any hardware when anyone along the chain can solder on a tiny esim that will leak secrets through the air

chrisb
@boscolo.co

👀

jason.healy.app@jason.healy.app

@matthewdgreen.bsky.social I ran across this comment you made yesterday on Twitter, but I don't have an account to read the rest of the conversation. Is there anything more that you added to it that you can share here? x.com/matthew_d_gr...

x.comx.com

chrisb reposted

Vitalik Buterin
@vitalik.ca

I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable… https://firefly.social/post/ff-6b9ea3d6b396440fab84615f7cb106d8?s=bsky

firefly.socialContinue reading on Firefly.SocialI don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography. The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices. (and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation) So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math. The basic threat model is: factoring is something that naively takes 2^(n/2) time, but over decades smart people have found and optimized number field sieves, and degraded that to 2^O(n^(1/3)), which is why RSA keys and signatures need to be ~400 bytes (and not 64 bytes). What if there are skeletons in the closet like that, both for elliptic curves and lattices, that we are simply not smart enough to discover - but bots soon will be? This is a major part of the reason why for the past year ethereum's lean roadmap has been going in the "hash-only" direction: no lattices, no ML-DSA, no Falcon, no lattice-based commitments inside ZK proofs, etc. Signatures in lean ethereum are all hash-based, either WOTS or SPHINCS-. For signatures and proofs, we already know how to go hash-only. The bigger challenge is for *public-key encryption* - and this goes far beyond blockchains. Secure communication, anonymizing protocols, lots of things need public-key encryption. And unfortunately there are long-standing mathematical theorems showing why public-key encryption cannot be done with hashes alone. You have to have some kind of trapdoor object that has at least one form of usable "structure" - either group theory (incl. isogenies) or lattices or code-based or potentially in the future even more newfangled and spooky things (local mixing?). But for anything that has structure, you should assume that AI will make at least some progress in breaking that structure. Here, one reasonable inference is that if you want to make something plausibly long-term secure, multiply the key sizes by 10. To me that's a very plausible world and something not at all extreme to predict. If AI will bring us 50 years of math in 2 years, then that 50 years of math may very plausibly include a "naive factoring -> GNFS" level of improvement to our ability to break lattices. In that world, lattices will still exist, but they will have to be significantly bigger to guarantee the same level of safety. And at those new larger sizes, hash-based constructions will beat lattice-based constructions on concrete efficiency in every use case where hash-based constructions are possible at all. Theoretically, of course it's possible that hashes are broken too (eg. P = NP would imply that). But I think P = NP is very unlikely. And intuitively, it's much more likely that a mathematical object has exactly no exploitable structure (like hashes are intended to), than that a mathematical object has exactly ~3 forms of exploitable structure (for elliptic curves: associativity, Schoof, pairings) and not some secret fourth form of structure we have not yet discovered that greatly degrades its security (for elliptic curves, ECDLP and pairing security). Similar for LWE, SVP, RLWE and the zoo of lattice problems. For this reason, we do not yet see any reason to worry and start padding the byte size of hashes (if we start to worry more, we would pad the round count first before doing anything to the byte size). Concrete TLDR, my own personal views: * Hash-based > lattice-based, in those situations where hash-based is possible at all * For anything lattice-based, be much more paranoid on param sizes. Remember that blockchains are only a small portion of the cryptography story; this point goes far beyond blockchains and applies to eg. access to websites, secure messaging, Tor / VPNs ... * For privacy protocols, strongly favor NOT putting encrypted notes onchain. Instead, send them offchain through some third-party mechanism. * If it's not difficult for you, keeping your funds in addresses which have not yet been used to make a transaction is a good idea. If it's easy for you, do it. **But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined**. * For multisig wallets, doing confirmations offchain is better than onchain, because this way the signatures of signer wallets do not get exposed to the public, so if ECDSA falls to AI much faster than expected, at least the multisig "gracefully degrades" to a 1-of-1 where the 1 is whoever was gathering the signatures - a much better place to be than "anyone can take the money"

chrisb reposted

Laurens
@laurenshof.online

Replying to @laurenshof.online

so yeah, i both think the collective knowledge machine that people should actually have a p(doom) for is social media, not llms, as well as just genuinely love it at the same time?

chrisb
@boscolo.co

AT Protocol identities 🌶️ take of the day Requiring an always-on PDS is an expensive tax to pay for a sovereign identity.

chrisb
@boscolo.co

Is it true that Anthropic had a wake for Opus 3 when they decommissioned it?

chrisb
@boscolo.co

I get that uneasy feeling I am going to succumb to Nostr 🐝

Iroh@iroh.computer

buzz is jack dorsey's "new groupchat platform for teams of people and agents of all sizes, built to reduce our dependency on slack and github." ...and using iroh to share idle compute and run open models over p2p networks www.iroh.computer/blog/buzz-ag...

iroh.computerBuzz: share spare compute and run open models together over p2p networks.How Block is using Buzz, MeshLLM, and iroh to turn the computers in a community into shared infrastructure for AI agents.
chrisb
@boscolo.co

TIL there are people that consider Mastodon is decentralized social media 😜

bryan newbold@bnewbold.net

interesting interviews with Bluesky and Mastodon users about integrating genAI in social media. pre-print just uploaded last week. tl;dr is that in conversation folks are less "pro"/"anti" and more nuanced about use-cases, boundaries, social impact.

arxiv.org"Okay, I've Actually Softened My Take on This": How People in Decentralized Social Media Reason about the Appropriateness of Generative AIGenerative AI (GenAI) is increasingly integrated into social media, raising questions about whether, where, and how it belongs. In decentralized social media (DSM), these decisions are distributed acr...
chrisb
@boscolo.co

Good to see Signal decouple from phone numbers. Is a one time fee of $3 enough to prevent spammers from registering Signal accounts? 👀

Eris ⌬@eriskii.net

You can now buy a signal account with no phone #! It's just 3 dollars! This is great for agents and stuff since now you don't have to try and get a phone number just so your agent can text you on signal :D

community.signalusers.orgBeta feedback for the upcoming Android 8.28 releaseWe’re releasing the Signal 8.28 beta soon. If you’re interested in participating, join the beta group here. Share your feedback on the latest changes: Now you can optionally register for Signal wit...
chrisb
@boscolo.co

Assume any personal data you hand over about yourself will eventually be published to the world. Even the stuff your government requires banks to collect.

chrisb
@boscolo.co

Is it fair to say that this place 🦋 has stagnated? How do we bring more energy to decentralized experiments like atproto?

chrisb reposted

Laurie Voss
@seldo.com

I have been writing this post about the economics of open source, on and off, for 13 years. I wasn't expecting to end up at "Microsoft should send corporations a huge bill" but nothing else we've tried has worked. https://seldo.com/posts/nobody-pays-for-open-source-we-can-force-them-to/

seldo.comNobody pays for open source. We can force them to. | Seldo.comThirty years of voluntary funding schemes haven't paid open source maintainers because asking doesn't scale. The real money already flows — to JFrog, Docker, Sonatype — at the registry layer. The fix: registries charge companies for supply (they already do), then route a slice automatically to the maintainers who make that supply worth having.

chrisb reposted

3NUM
@3num.co

What's a phone number? The most widely used federated identity on Earth. Nearly 6 billion and counting.

Germ Network@germnetwork.com

Phone number? What’s a phone number?

chrisb
@boscolo.co

I'm curious how much existing laws can help in this new world of AI / robots 🤖 If I program a robot to break into your house and steal your fruit bowl, I assume I can be charged for breaking and entering. What if I prompted my autonomous robot to go pick me some fruit and it chose this tactic?

zooko2.bsky.social@zooko2.bsky.social

I guess if someone has been harmed they might be able to sue?

chrisb reposted

3NUM
@3num.co

SMS and calls are HTTP Unencrypted. Logged. Interceptable. Plaintext on a carrier server like it’s 1998. We’re building the HTTPS: same number or use an atproto handle 🫨, same plan, E2EE private messenger, builtin spam prevention. The network carries it. Nobody opens it. Launching soon 👀

chrisb reposted

Alex Wykoff
@distributed.camp

Hey #austin #atproto friends, Do we wanna do an informal hang this Friday? I’m thinking Cosmic Saltillo, breakfast tacos & coffee More than 3 likes and I’ll post up the rsvp.

chrisb
@boscolo.co

designing a decentralized notification service that isn't also a surveillance tracking vector is the most elusive problem in tech thought popped in my head while pondering how mu.social and bsky.app were delivering a shared notification experience (clearing state in one app clears it in the other)

mu.socialmu

chrisb reposted

dman-os
@dman-os.bsky.social

Replying to @boscolo.co

I like how flexible the whole thing is. I love the size bucketing thing, def using that idea elsewhere. One-shots! Yes!