I've seen plenty of people saying "Mythos isn't all that exceptional, lots of LLMs can find security vulnerabilities" -- and indeed there is some evidence for that; it sounds like Anthropic was taken somewhat by surprise at how easily a simple prompt managed to get Mythos to deliver exploits and didn't distinguish immediately between the effectiveness of Mythos and the effectiveness of the prompt.
But the claim of "LLMs aren't making a difference in vulnerability discovery" has been laughable to anyone who has been reading security advisories for the past 3 months. Just look at the Credits lines.
This is hardly news? We've known for months that a flood of AI-assisted vulnerabilities was coming; I posted on Twitter in March calling 2026 the year of a million CVEs: https://x.com/i/status/2035045573116789002
Frankly, there's no way any arch venue at the time would have done anything beyond rejecting it with "caches make RSA fast, what's the problem?"
Security wasn't something CPU designers paid much attention to, and cryptography wasn't something they were even particularly aware of. Even seven years ago, when an Intel VP was giving a talk at re:Invent about "processor technologies for improving security in virtual machines", my question to him about cache collision side channel attacks was met with "what's a side channel attack?"
They publish lots of papers about side channel attacks, including very hardware based ones like power consumption analysis.
It just happened that "leak information into microarchitectural state and then retrieve it" didn't exist as a subfield until my work (and the OST work a few weeks behind mine).
My paper demonstrating a side channel attack on RSA via hyperthreading was rejected from the crypto preprint archive on the basis that it was "not cryptography".
(Reviewers at J.Crypto subsequently sat on it for a year and then suggested I submit it to a journal on CPU microarchitecture instead.)
Novel research is uniquely susceptible to "cool but it's not part of our field", because that critique is entirely correct until the research gets published!
Square root of the population is because that's what it takes to normalize large vs small countries. Imagine slicing a country into quarters; each slice has a quarter of the population and half the radius.
It would be interesting to see a map which was not minimizing [distance to capital] but instead minimized [distance to capital]/sqrt([national population]). The latter would be more robust against Sybil attacks.
arguably the whole scheme should be replaced by finer-grained feature detection.
This seems like a strange thing to say. Fine grained feature detection was around long before "microarchitecture levels" and never went away. The microarchitecture levels were introduced because they were easier to use.
That information should still be in the commit messages. "No functional change intended." appears widely in FreeBSD commit logs when code is being refactored (or, rarely, restyled).
And the issue isn't whether you can remember what you changed yesterday; this is largely about making sure other developers can quickly identify relevant commits. If you're a solo non-OSS developer, this is entirely relevant to you.
I've done this with code review. "Another LLM reviewed the attached code and produced the attached report. What do you think?"
Lots of "the other LLM clearly hallucinated this part". To be fair, it has never accused the other, err, itself, of being incompetent; it accepts that hallucinating is just something which happens.
Yes, OTC for everything. I've heard that some pharmacists ask more questions about types which are commonly abused by body builders but that's about the extent of it.
Funny story since you mention cats: My brother's cat was diabetic and prescribed long acting insulin which cost $250/vial. I looked it up and... apparently it was just relabeled lantus, because of course nobody is going to waste money on a separate manufacturing line. Ended up buying it from my local pharmacy, without a prescription, instead of using the vet prescription.
One issue here which is obvious to me is that access to insulin should not be gated on paperwork. I can walk into any pharmacy in Canada and say "I'm diabetic and need insulin" and the pharmacist will sell it to me. They'll ask questions of course since this is not the usual path but my doctor's office being open will have no influence on whether I get it -- just on whether it's a 5 minute process or a 15 minute process, and potentially whether I have to pay myself or have it covered by insurance.
They don't hand out Nobel prizes for glossed over topics.
Leaving aside the fact that the Economics prize isn't actually a Nobel Prize, topics which historically haven't been given enough attention are exactly where the highest impact research takes place.
If externalities had always received the attention they deserved, Coase would have never received his prize, because his work would not have been so important.
That solves the traffic tampering problem, but not the "malicious peer" problem. You want to be able to sync files without accidentally sharing root privileges.
Email: <me>@tarsnap.com
Twitter: @<me>