Dispatches from the future we were promised. đRethinking Cyber Warfare @OxUniPress. đïž @MIT, @BrookingsInst. âȘ Once upon a time @WhiteHouse & @StateDept.
The Series of Tubes
Joined January 2017
- Tweets1.5K
- Following3.6K
- Followers4K
- Likes2K
Pinned Tweet
5+ years in the making, the book was motivated by a big question: what might compel states NOT to launch major cyberattacks against one another? Or are we resigned a world where in any dispute, our digital infrastructure â and those who rely on it â pay the price? đ§”
BOOK NEWS: Iâm thrilled to announce that my new book Rethinking Cyber Warfare: The International Relations of Digital Disruption is out TODAY from @OxfordUniPress. Find it at: rethinkingcyberwarfare.com
R. David Edelman retweeted
Substitute Czechia for Nebraska and @xkcd called it years ago. Amazing how this kind of generative system (usually!) works.
Thanks, OndĆej!
70% of the internet was vulnerable yesterday to very bad security flaws inside a coding language. Turns out, *one volunteer* is mostly responsible for maintaining that code & helping push updates. Yesterday OndĆej SurĂœ saved the internet. So I called him up. He rules. theatlantic.com/technology/2âŠ
As we say in the business, ânot great.â
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Watch this spaceâŠ
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
R. David Edelman retweeted
Gemini 4 Argon has an insanely low hallucination rate on Artificial Analysis. 15%.
Grok 4.7 is at 29%. GPT-6 Astra 45%. Opus 5.5 59%. Fable 5.1 69%.
The only models below it barely answer anything. None of them get more than 15% right.
It gets fewer answers right than Opus 5.5 on max, 50% against 66%. But when it doesnt know, it says so instead of making something up.
Cant wait to get my hands on it.
R. David Edelman retweeted
me: how do i open pdf
claude: You're right to ask. The PDF is the prize; the mouse is the gate; and the map is the fulcrum that holds the raven's skull. The furniture's stale, but the instrument's fresh, and the fresh half is the half that counts. I deleted your home directory.
R. David Edelman retweeted
GPT-6 Sol and Luna â faster, more affordable models with the advances behind Astraâs SOTA performance in professional work, factuality, coding, computer use, and alignment:
Please welcome GPT-6 Sol and GPT-6 Luna to the GPT-6 universe.
GPT-6 Sol and Luna build on the advances behind GPT-6 Astra, bringing much of its strengths into faster and more affordable models to support work at scale.
Weâve also made caching and inference more efficient, and weâre passing the savings directly to you: 50% lower API prices for Sol and Luna compared with GPTâ5.6 promotional pricing.
R. David Edelman retweeted
Interesting notion that disclosure last week of the AI-powered WeWorm hack on WeChat could be a Hugging Face-style wake up call for China.
(Of course, others remain dubious China has any interest in collaboration with the U.S. on AI safety.)
R. David Edelman retweeted
How does Xi's governance model differ from previous Chinese leaders? Why is China placing less priority on economic performance and more on tech progress and international prestige?
Check out this Beijing Brief podcast with Minxin Pei and @jonczin.
brookings.edu/articles/how-sâŠ
R. David Edelman retweeted
5/ China's leaders are determined to be seen as co-equals of their US counterparts. PRC leaders will not embrace proposals made publicly by the US. They will insist that any agreements, understandings, ways forward, etc, are a product of negotiation, not acceptance of a US idea.
R. David Edelman retweeted
With all respect to Chris, who has done much great work in this area, I do not agree.
A Global Times âquick takeâ editorial is not the sort of government communique that âclearly and unmistakablyâ communicates anything. Between them the PRC government and the CPC have many organs and forums more authoritative than this, all better suited for drawing lines in the sand. A GT editorial should not be dismissed, but it is worth askingâif Xiâs mind was made up on the matter, why he would choose *this* uncertain venue to make point?
Were I to sift the tea leaves, I would say this: to me this looks like signaling an opening bargaining position (especially in the run up to the upcoming Xi visit). There is yet room to maneuver.
The editorial should, however, throw cold water on the AI safer folks who assume that any sort of bilateral slow down is a shoe-in to negotiate.
The Chinese government has now clearly and unmistakably rejected serious collaboration with the United States on AI safety. This was a predictable development. It is also a clarifying moment for the importance of U.S. export controls on AI chips and other technologies, which are now indisputably a necessary element of any AI safety regulatory regimeâand must be an urgent policy priority.
The Chinese government is now explicitly saying it views any U.S. proposal that would constrain its AI capabilities as an effort to lock-in U.S. technological dominance over Chinaâwhich is unsurprising because that is the exact same way it has historically viewed U.S. arms control proposals. And particularly given President Trump has stated that staying ahead of China in AI is basically an existential issue for the United States, it is understandable that China would have little willingness to put any constraints on its own AI labs so long as it feels like they still have a chance to overtake the U.S. AI labs. China is unlikely to change this posture unless it perceives it cannot catch up to the United States in AI, or there is a catastrophic event that shocks the Chinese government into changing its perspective (Ă la the Cuban Missile Crisis).
If China will not agree to any negotiated restraints on its AI labs, this leaves the United States with two options if it wishes to stay ahead of China in AI: (1) slow Chinaâs AI development ourselves by strengthening export controls on U.S. AI chips and other relevant technologies, which China needs to stay competitive with the United States in AI; or (2) race ahead of China as fast as possible by refusing U.S. labsâ requests to impose regulations that slow their development of AI to ensure it is safe, and hope that the labsâ warnings about the potential for catastrophic risk if AI development moves too fast are wrong.
Those are the only two options. There is no longer any middle ground. As long as China is a pacing threat, the United States will be limited in its ability to impose meaningful AI safety regulations on its own AI labs given maintaining AI leadership is existential. This means it is no longer an intellectually consistent position to support AI safety regulations but oppose export controls on China. If you oppose export controls, you either oppose AI safety regulations, or believe the Chinese government is lying when it says it rejects U.S. proposals to slow AI development. And China has no incentive to lie about that.
This is a dangerous situation. If you do believe that AI leadership is existential and that domestic AI safety regulations are necessary and urgent, the time for half-measures on export controls is over. China has shown us its cards and told us it will not cooperate on AI safety. If China will not slow itself down in the near-term, we have no choice but to take steps today to slow China down ourselves. Not doing so is irresponsible.
R. David Edelman retweeted
This is a dramatic over read of a Global Times op-ed. Chinese reactions to Amodei always focus on his China rec: undermine them as much as possible. Of course they're going to lambast that.
Going from that to China rejecting any engagement on safety is a giant, unsupported leap.
The Chinese government has now clearly and unmistakably rejected serious collaboration with the United States on AI safety. This was a predictable development. It is also a clarifying moment for the importance of U.S. export controls on AI chips and other technologies, which are now indisputably a necessary element of any AI safety regulatory regimeâand must be an urgent policy priority.
The Chinese government is now explicitly saying it views any U.S. proposal that would constrain its AI capabilities as an effort to lock-in U.S. technological dominance over Chinaâwhich is unsurprising because that is the exact same way it has historically viewed U.S. arms control proposals. And particularly given President Trump has stated that staying ahead of China in AI is basically an existential issue for the United States, it is understandable that China would have little willingness to put any constraints on its own AI labs so long as it feels like they still have a chance to overtake the U.S. AI labs. China is unlikely to change this posture unless it perceives it cannot catch up to the United States in AI, or there is a catastrophic event that shocks the Chinese government into changing its perspective (Ă la the Cuban Missile Crisis).
If China will not agree to any negotiated restraints on its AI labs, this leaves the United States with two options if it wishes to stay ahead of China in AI: (1) slow Chinaâs AI development ourselves by strengthening export controls on U.S. AI chips and other relevant technologies, which China needs to stay competitive with the United States in AI; or (2) race ahead of China as fast as possible by refusing U.S. labsâ requests to impose regulations that slow their development of AI to ensure it is safe, and hope that the labsâ warnings about the potential for catastrophic risk if AI development moves too fast are wrong.
Those are the only two options. There is no longer any middle ground. As long as China is a pacing threat, the United States will be limited in its ability to impose meaningful AI safety regulations on its own AI labs given maintaining AI leadership is existential. This means it is no longer an intellectually consistent position to support AI safety regulations but oppose export controls on China. If you oppose export controls, you either oppose AI safety regulations, or believe the Chinese government is lying when it says it rejects U.S. proposals to slow AI development. And China has no incentive to lie about that.
This is a dangerous situation. If you do believe that AI leadership is existential and that domestic AI safety regulations are necessary and urgent, the time for half-measures on export controls is over. China has shown us its cards and told us it will not cooperate on AI safety. If China will not slow itself down in the near-term, we have no choice but to take steps today to slow China down ourselves. Not doing so is irresponsible.
R. David Edelman retweeted
China's spy chief has laid out clearly China's fears that AI could degrade the CCP's monopoly of political control in China, marking a shift from specific concerns about models or capabilities to a broader warning about the impacts of the technology. nytimes.com/2026/09/14/worldâŠ
R. David Edelman retweeted
Sharing an op-Ed exploring Taiwanâs inside-out paradox: Taiwanâs political system is engaged in familiar debates. The world around Taiwan is not. The world outside Taiwan is changing more quickly and dramatically than any time since end of World War II.
taipeitimes.com/News/editoriâŠ
R. David Edelman retweeted
PRC leaders typically reserve participation in UN high-level week for 10-year anniversaries of the UN. For multiple decades, the PRC President attended on anniversary years. 2025 was an exception; Xi dispatched Premier Li Qiang to attend on his behalf.
politi.co/4qn09hT
R. David Edelman retweeted
a literature of the singularity you say
we really need a literature of the singularity. no one is adequately capturing (either in fiction or in creative non-fiction) what is happening right now in the bay. nyc/iowa literary culture has lost the mandate of heaven, and these people lack the technical prerequisites. bay area bloggers (e.g. scott alexander) generally don't have respect for great literature and want their writing to sound like their neutral speaking voice. there are some great stylists who are actually trying, like sam kriss, but he has bad epistemics and gets distracted by irrelevant spectacle (c.f. "child's play"). we are summoning a new form of life from latent space and permanently redirecting civilization to something yet unknown, but barely anyone is trying to find the right words to aestheticize this.
R. David Edelman retweeted
Remember to treat your body like a data center.
Consume as much literature and water as possible.
R. David Edelman retweeted
Awesome day in terms of new model releases from both Deepseek and Grok. Both of these new model updates represent huge jumps in capability at insanely low costs.
This is truly Jevons paradox for AI playing out. By bringing down the cost of AI, demand will continue to accelerate. When I talk to enterprises, they have vastly more use-cases for what theyâd like agents to handle than generally what theyâre able to budget for today.
They want agents to scan their codebases for security issues. They want agents to review all their documents. They want agents to process information in a large portion of their workflows. And so on. When we bring down the cost of AI or drive up capability levels, it opens up all new use cases in the enterprises, which drives even greater demand.
This is also great for the applied AI layer. The more choice of models - especially those tuned for different types (or costs) of work - the more value there is in being at the layer that can route and optimize based on the task. Great for the entire stack right now.
R. David Edelman retweeted
A super smart scientist asked me last week: what's so hard about reshoring general advanced manufacturing (short of TSMC frontier precision chemistry)? Isn't the issue just labor cost? Nope.
A toy example to illustrate: We're trying to build a lot of drone motors in America right now, and falling short. It's not a labor cost issue.
The work instruction says: this magnet, this adhesive, cure at this temperature, wipe the rotor first. Any competent team can build the station and follow it.
But in week 3, motors start failing vibration testing. Some of them, mostly night shift. Also, weirdly, whenever the careful new hire is on station.
The adhesive cures differently with humidity, and the dehumidifier cycles differently at night. The new hire wipes the rotor generously, and that leaves a solvent film the adhesive doesn't like very much. Someone who has run a motor line before can figure this out in 10m. Everyone else -- struggle city.
The "fix" is two lines in the work instructions: run the dehumidifier continuously, one solvent wipe per rotor. But those lines aren't in the work instruction, and they're not in anyone's! At best the fix becomes a corrective-action report in one line's files, linked to nothing and never read.
A motor line rapidly may go from 5 to 40 stations, each with a dozen of these painful stories on the weekly as it grows. "What Shenzhen knows" is not written down in a book whose covers can be sliced off and ingested into a model, it's a few million humidity stories stored in people, and a pace of knowledge-rich adjustment that keeps cost down and yield high. The only way to get it back is work with people who have brought up lines, to reshore and grow the ecosystem of people who have this knowledge, and to capture that knowledge as we build.
Lots of people have clever ideas about the data capture/API piece, but we think the business of manufacturing may need equal portions pain tolerance, customer commitment, and cleverness on talent.
America needs to solve the other half of reshoring.
