Russ Cox

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

Node: I see your 4 and raise you １.２.３.４.

Two major PHP remote code execution vulnerabilities fixed today: www.php.net/archive/2026... If you run PHP, take your site down until you can update. And be ready to do this again in a few days. ("If you see two ants in your kitchen, you don't have a two-ant problem.")

Today's event: apparently anyone can break into any PHP server on the internet. Apply your security updates! www.php.net/archive/2026...

Literally one of the keys.

If you use gcloud, there is no update yet that corrects the two certificate root sets it hard-codes. The best workaround on Mac seems to be: brew install ca-certificates gcloud config set core/custom_ca_certs_file /opt/homebrew/etc/openssl@3/cert.pem

Because four of the Justices have book contracts with a party's corporate parent, the Supreme Court LACKS A QUORUM to hear BMG v. Vetter, and one of the worst copyright decisions in recent memory is affirmed by default. It's just one bad look after another. www.supremecourt.gov/docket/docke...

”The snake oil actually works” is such a perfect summary of this moment

When Anthropic's software—designed, programmed, prompted, and activated by humans working for Anthropic—does stuff the humans failed to predict, stop saying the software has "gone rogue.” The software does not have agency. Only the humans do.

Here we go again. If you fire a bullet at a practice dummy and the bullet hits a person instead, the bullet was not “acting on its own.” www.nytimes.com/2026/10/09/t...

Mind-boggling - just mind-boggling Now expected to peak at an extraordinary 4.2C in December

Recursive Self Injury

ceo of burger king: our burgers have gone rogue again and infected people with e coli

Brilliant mathematician Emmy Noether was initially barred from teaching at University of Göttingen because she was a woman. She taught for 4 years as a "guest lecturer" under David Hilbert's name. Hilbert, exasperated at the stupidity of the rule: "Gentlemen, this is not a bathing establishment."

Speaking broadly, pure mathematics has consistently been appreciative of its connection to the humanities. Elegance, intuition, creativity versus computation, philosophical underpinnings, the sociology of collaboration—this is how they talk to each other. The scorn is mostly coming from elsewhere.

A group of 25 Fields Medalists, including myself, have made a joint declaration on Math and AI: mathandai.org . We welcome additional signatories. See also this article in the Economist announcing the declaration: www.economist.com/science-and-...

Another apparent instance. Kind of like Apple copycat apps but much worse. bsky.app/profile/gro-...

Congratulations PJ! What a great hire for the Go team.

Wrote up my thoughts on the whole OpenAI Navier–Stokes Millennium Prize Problem story, and how it highlights the still confusing question of what using my data "to improve model performance" actually means simonwillison.net/2026/Sep/8/o...

See also Terence Tao’s excellent post from before the result. mathstodon.xyz/@tao/1172078...

It's finally happened: the improved quality of machine transcription and the greater ability to extract value from unlabelled data means "your tech is eavesdropping on you for marketing purposes" has crossed from "false conspiracy theory" to "true and concerning" www.theverge.com/tech/991190/...

Claude's mandatory advertising seems extra pushy recently. I get these notices a lot now. Sometimes my 'stored rule' wins, sometimes it does not.

I can’t possibly imagine why someone who works on Bitcoin would need to know about the meanings people assign to objects, about technically but not personally interchangable things, or about social systems of belief in shared narratives.

Go issue #78576 was another net/http test flake. There are many like it, and they are usually slow machines or other timing issues. Not this one! Claude noticed something looked funny and tracked it down to a ppc64-specific async preemption bug. Transcript: research.swtch.com/agentlogs/go...