Scouse feral academic. Quantum Hacker, ML miscreant, & mathematician. Views own. Collects useless degrees. @quantum_village (he/him) @Unprovable@mastodon.social
Joined August 2011
- Tweets77.8K
- Following6.7K
- Followers7.3K
- Likes128K
Mark C. retweeted
Excited to announce that I'll be keynoting at Black Hat Europe this year in London! I'll be talking about the distinction between AI Security and AI Safety, and the co-option and conflation of security and safety methodologies in AI that are leading us down a precarious path.
This quoted post is unavailable.
Mark C. retweeted
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
Mark C. retweeted
Interviewed someone. I have a very structured and analytical approach to interviews. But all the technical considerations are, interestingly, constraints to be satisfied. At the end of the call I wonder “would I want to work with this quant or PM day after day after day?” and if the answer is a hell yes!, what is there to say? It beats every careful weighting and it’s very accurate. A lot (all?) of the top performers are fun, humble people.
Mark C. retweeted
I'm happy to share that Mojo and MAX are now fully open - for development, extension, and commercial use! This includes the full Mojo programming language, but also the MAX graph compiler, MLRT runtime internals, and hardware abstraction logic.
Get your agents going!👇
Mark C. retweeted
I criticize the CVE system a lot, but you shouldn’t just silently patch a bad vuln under “changes: bug fixes”. That’s dishonest to your users, who deserve transparency so they can determine the patching urgency.
Always be transparent about vulns that affect you.
And we still haven’t heard anything from them about the recent breach + api key theft. No post mortem report yet.
@thdxr this shows low security maturity, you prob need to hire more security engineers
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.
Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.
What developers need to know: thehackernews.com/2026/10/op…
Mark C. retweeted
"AI writes shit code; it is inherently insecure and must be vetted carefully. Humans are irreplaceable."
Y'all shoud have written all this crap in Perl and mod-cgi not php, no one uses Perl.
(I once asked C. to write something in Perl and he wrote a wrapper in Perl to call inline Python. Fucking disrespectful.)
Mark C. retweeted
An update from Brewster Kahle on today's outage.
ALT Internet Archive ops staff were heroes last night. PHP vulnerability announced, soon saw attacks, isolated the vulnerability, used Claude to make fixes for our older php versions, used local models to run simulated attacks, deployed. reinforced WAF and other guards. Offline briefly, Back on new versions and running! Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems. Heroes. Thank you all.
Mark C. retweeted
Gauss had a personal seal(!) emblazoned with the motto “Pauca sed Matura” ("Few, but Ripe"). Worth remembering as quantity becomes cheaper.
Mark C. retweeted
How bad is this Gitlab issue? About as bad as it gets.
Anyone on the internet can take over an exposed, self-hosted GitLab server without logging in, on any version from the last 12 years.
Shodan is showing ~60K exposed servers online, which is a lot, but there are are far more internally for anyone with a foothold already.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Mark C. retweeted
Note who this is addressed to: all organizations using PHP! I think this is the same as saying: "All organizations that use a computer."
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Mark C. retweeted
Blog post: The Underappreciated Art of Superposition Masking
algassert.com/post/2604
I've been enjoying everyone using kickmix circuits to improve constructions, but we musn't forget there are things beyond.
Mark C. retweeted
Grant Sanderson (@3blue1brown) predicts that in 3 years, there will be an end-to-end AI generated channel better than his! 🤯
He admits to feeling resigned about it:
"There's a part of me thinks, 'hey, even if it only lasts a couple glorious years, like, to fully embrace that.'"
Mark C. retweeted
I’m very opinionated. So it’s nearly impossible for me to hear someone’s arguments and *not* find something I disagree with. (This includes reading things I myself wrote years - or weeks - ago.) And yet the amazing Grant Sanderson @3blue1brown has put out a long, detailed video on the future of mathematics, in which I cannot find a single flaw. I’ll be sending this to every PhD student and postdoc I know, and strongly recommend everyone watch it.
youtube.com/watch?v=LKrwhjOI…
(Of course I tried to say many of the same things in my conversation with Thomas Koberda. But Grant’s version, unsurprisingly, does an infinitely better job at communicating those ideas!)
Mark C. retweeted
This P-256 Birthday in mid-August made me crave chocolate-covered strawberries and gave me a hunch.
Look who spoke at Crypto’97 within a week of P-256 being generated: iacr.org/conferences/c97/c97…
Mark C. retweeted
BusyBeaver(230) is independent of ZFC! I have verified in Rocq that a certain 230-state Turing machine halts iff ZFC is inconsistent. This surpasses the non-formalized 243-state TM of @ereliuer_eteer and the formalized 254-state TM of @_Mira___Mira_.
Mark C. retweeted
A few papers & benchmarks on LLM failure to follow instructions 🧵
I. Can LLMs Unlearn Stubborn Training Conventions?
“LLMs often exhibit cognitive inertia, struggling when tasked with instructions that explicitly deviate from their training norms” arxiv.org/abs/2509.04292 1/
Mark C. retweeted
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
