I think the article is wrong on this but it's more subtle than that. Probability distributions have a peak; there is still a token with a peak probability. What's interesting about these techniques is that token by token it can actually make the peak token even more probable. A distribution doesn't have to be "flattened" to leave a watermark - it can be "amplified" and made "more peaky".

I was at ANSSI headquarters last year doing a technical presentation and several of their questions were about Post-Quantum Cryptography, "Q day" (when a practical Quantum Computer is expected) and other related things. They keep a close eye on this stuff and it's to their credit. Similarly the BSI in Germany have been promoting Post-Quantum security for some time now.

I work at AWS, where we have been deploying Post-Quantum Cryptography for quite some time and have experts. We're making easier than ever, but the sudden changes in deadlines do make me wonder how many companies are going to have to spend more time than they'd planned on migrations and settings. The "context switch" of working on PQ can be quite expensive. Most tech people have no idea what ML-KEM, ML-DSA, or HQC are, or how to not worry about SHA, HMAC, or AES. It's going to be a ride!

You're right but in my experience in Washington state - Park rangers, forest fire marshals, and reservation police will all rigorously enforce the bans in places that are prone to wild fires. The local community won't have much sympathy either. People get how dumb that is. You also see bans enforced in very well off communities that basically have their own police force too. It's fascinating how these micro-cultures all self-regulate.

32-bits are great for recording too because they do an incredible job of capturing the dynamic range without having to be precise on the preamp settings. It removes an entire job from the recording workflow.

192 for mixing and mastering can be useful especially if you're doing a lot of effects, especially anything that pitch shifts. But I've seen low quality phone-microphone recordings make it to the master; if you capture lightning in a bottle, it hardly matters what the settings were, what the microphone was, or anything else.

The limit on current DACs is 18-22 bits. The rest is just brownian noise. Literally.

Unless it is very specific to a proprietary product, craftspeople take their jigs with them from job to job, building up a personal library over a career. As a software developer I've always had a well-tuned IDE and shell config in a safe place.

Something I think about a lot is what is the equivalent for the software builders of today using AI tools? how do make these harnesses exportable and portable? You might think employers would be against this; make it more costly to leave. But I actually think most will favor this because it makes people more productive more quickly. But we have to find ways to normalize it and show that there are no security leaks in the process (like might make it in to a set of personal steering prompts).

Just nerding out here, not rebutting, but when you say "craftspeople take their jigs with them from job to job" --- sort of. Sometimes. I think if you put a woodworker in a position where they obliged to build a new miter sled or assembly table, they might actually be thrilled. You make a tool, you use it for awhile, you build up a mental list of things you'd like to improve about it, that you'd do differently if you got a do-over; now you have an excuse to do it.

This, for like 37 things in my workshop right now.

Using something like pi helps. I've made my own dotfiles for skills/extensions I like and can install them just like my normal dotfiles

https://github.com/anishthite/agent-dotfiles

"Humor When you finish a job — completing a task, answering a question, fixing a bug, shipping a feature — end your final message with one short funny line. A quip, a dad joke, a wry observation, a playful self-roast. One line. No emoji spam. Make it land, then shut up."

whats the purpose of this? just fun or does it cause some desired behaviour?

> does it cause some desired behaviour?

Fun is desirable.

I've imported and adapted my personal agentic dev framework to my team relatively successfully (as I've kept it relatively harness independent), but it requires actually owning it, vibed or bloated or conceptually inconsistent stuff bite a lot when porting things over.

> craftspeople take their jigs with them from job to job

Except for software gigs the software typically belongs to the customer so you'd need to rewrite it every time...

Depends. With all the web agencies I've made, the only code that belonged to customers was the actual website part. Any of the "jigs" that we made for our workflow was not part of that.

And contractually, any code I made was my employer's if I made it during office hours. Some even made a claim for code I would've written that during my employ that would be "competitive". Luckily, there was a massive difference in what I would do in my own time versus what they did.

Depends. If you are a contractor, like most craftspeople, your tools are your own.

My contracts always state I own tools created or byproducts of the work that don't end up in the work.

Only if you are self employed, otherwise it belongs to the agency.

Again: it depends. It is all about how the contract is written.

I never seen any other kind of contract, on my 50ys.

You're definitely right for most agencies; most will let you use it in a portfolio or something, but not necessarily retain the rights to the work.

Some agencies do, however; it's dependent on the contract specifics.

I'm curious how does it work, you handover the tools you wrote, .bashrc/.zshrc, etc?

When I'm hired in a company (not contract), they wipe the harddrive when I leave (well, I also do it before I hand it over sometimes). So they don't get the tools (I take them with myself, it would be a waste to loose them)

If you are a W2 employee in the US, you are almost certainly in violation of your PIIA if you take anything off the company-issued computer and keep it.

How do you take them with you in first place, without doing data thef?

As per NDAs and work contracts, nothing is supposed to leave either employer nor customer systems into unauthorised third parties.

i have been thinking about this from a different direction: how do we make these shared within a company in a way that increases the productivity floor of the team/department/company. Sure, they can still be extended/enhanced by individuals, but we don’t need everyone configuring mcps, building institutional memory, etc.

for me, it’s not about the cost to leave, it’s about lowering the cost of onboarding and change.

Reed-Solomon is an Erasure code, and I definitely wouldn't look to that for Secret Splitting. Those leakage models are gnarly. But if you want something else that is more general - there are Monotone Span Programs. Seriously underused.

    > Reed-Solomon is an Erasure code

which shares the same math as Shamir

    > Those leakage models are gnarly.

AONT solves that by making any leak other than the totality meaningless

Related: https://observer.com/2026/03/the-catholic-priest-who-helped-...

Chris Olah, one of Anthropic’s co-founders, got in touch. What followed was, by McGuire’s own description, mind-blowing. “They basically were asking for direct help from the Vatican to convene and help the industry, because the industry was going so fast down this road,” he recalled.

If GitHub flipped a switch and enabled IPv6 it would instantly break many of their customers who have configured IP based access controls [1]. If the customer's network supports IPv6, the traffic would switch, and if they haven't added their IPv6 addresses to the policy ... boom everything breaks.

This is a tricky problem; providers don't have an easy way to correlate addresses or update policies pro-actively. And customers hate it when things suddenly break no matter how well you go about it.

[1] https://docs.github.com/en/enterprise-cloud@latest/organizat...

Having been messing around personally with getting my own blocks of IP addresses and routing[1] - I've become terrified at the idea of implementing access control based on IP address.

Unless your own organisation in the RR has the IP addresses assigned to you as Provider Independent resources, there just seems to be so many places where 'your' IP address could, albeit most likely accidentally, become not yours any more. And even then, just like domain names, stop renewing the registration and someone else will get them - I was that someone else recently...

[1] AS202858

Oh, cool! that's on my bucket list as well. I am still grappling with some concepts, though.

Do you have a writeup of your setup somewhere or can you recommend some learning materials ?

It's fun and has now become an addictive rabbit hole - trying to get packets from one location to the other in the fastest, most direct way (and at hobbyist budget level).

Initial writeup based on IPv6: https://abarber.com/Setting-Up-ASN-IPv6-Routing-BIRD-Teltoni...

Have been having fun recently with an IPv4 block and Asynchronous routing, working on writing that up right now :)

Thank you for sharing! I really enjoyed reading that and learned a something too.

And thanks for the feedback - I've really been trying to write more so always nice when someone takes the time to read :D

Anyone who relies on IP filtering for security deserves to have it broken. Change my mind.

I'll take that bait ;-)

IP filtering is a valuable factor for security. I know which IPs belong to my organisation and these can be a useful factor in allowing access.

I've written rules which say that access should only be allowed when the client has both password and MFA and comes from a known IP address. Why shouldn't I do that?

And there are systems which only support single-factor (password) authentication so I've configured IP filtering as a second factor. I'd love them to have more options but pragmatically this works.

Why are you (re-)implementing client security on provider end? If a client requires that only requests from a particular network are permitted... Peer in some way.

I do understand the value of blocking unwanted networks/addresses, but that's a bit different problem space.

Defense in depth is a thing but I agree that relying on it is not a good idea.

Defense in depth is not the point, zero trust networking is.

Doesn't appear so. Tailscale is one such "zero trust network", and it does support ACLs anchored on IPs; ex: https://news.ycombinator.com/item?id=47875688

IP filtering + proper security is better than just having the security.

There's value in restricting access and reducing ones attack surface, if only to reduce noice in monitoring.

Actual curiosity, how would the new filtering be/is?

I've done a lot of IP filtering, it's what a lot of systems and services allow us to, so I'm curious what the IPv6 mechanism is

If you can't handle sites switching to ipv6 in 2015 (ten years ago) your security plan is garbage.

Thanks to the trend to SASE like Palo Alto GlobalProtect or ZScsler this practice is not a good idea anymore. Speaking of ZScaler, they are still IPv4 only, right?

> providers don't have an easy way to correlate addresses

Yes, they do. It's called DNSSEC.

Leaving aside that you applied the word "easy" to DNSSEC, how do you mean? How does DNSSEC solve the problem being discussed?

It was a somewhat flippant (given that GitHub doesn't implement DNSSEC either) dig at the idea of using hand-entered/hand-updated IP addresses for access control, rather than having the access control system look addresses up in the system designed to securely attest owner/ip mappings.

(Almost nobody signs zones.) How is that any easier than just having an https:// URL from which you pull an (arbitrarily-formatted) list of IP addresses to block? Is the idea that you'd otherwise be able to do real-time DNS lookups on incoming IP addresses?

Yes - delay SYNs until an authenticated reverse lookup confirmed the IP was owned by a trusted domain. With caching to reduce common-case latency, which would otherwise be intolerable.

Does this system exist somewhere?

Absolutely not

Unless your idea of software is reduced to the set of todo app, I don’t see how your points hold. AI won’t give you Blender, Inkscape, Kicad, Emacs,… And the algorithms behind those are not secrets, it’s the cohesive vision behind the whole system that is hard.

People will still pay for Matlab, SolidWorks, and Maya because no one who need those will vibe-code a solution. And there’s plenty of good OSS versions for the others.

Sorry, but this seems to be so off-base (as well as naively optimistic) that I am having difficulty responding to this.

But I'll try nevertheless.

- >Want to run a program as you wish? Great! It's easier than ever to build a replacement.

Non-sequitur. Building a replacement does nothing for being able to run a program as you wish.

Nobody else is able to run your program as they wish unless you release it with a Copyleft license.

- >Want to study a how a program works and to modify it? This is now much more achievable.

Reverse engineering is more achievable.

Modifying a program, without having its source code, documentation, and a legal right to do so guaranteed by the license is (and always be) easier compared to not having those things.

- >Want the freedom to redistribute copies to help others? Build your own version! It may not even be copyrightable if it's 100% generated (IANAL).

So, that's not about redistributing copies. That's about building an alternative option.

I can download an Ubuntu image and get Libre Office on it with a click.

Go vibe-code me a Microsoft Excel running on Windows 11, please, and tell me it's easier.

- >Want to distribute modified versions? yes! see previous.

You're not even trying here.

One can't legally modify and redistribute copyrighted works without explicit permission to do so.

You keep saying "...but vibe coding allows anyone to create something else entirely instead and do whatever with it!" as if that is a substitute for checking out a repo, or simply downloading FOSS software to use as you wish.

- >I dunno; seems like generative coding can be as much a liberator as any kind of problem.

Now, that statement I fully agree with.

Generative coding is a liberator as much as any kind of problem is.

Headache, for example, is generally a problem. It's not a great liberator.

Neither is generative coding.

Now, you probably didn't intend to say what you wrote. And that's exactly why generative coding is not a panacea: the only way to say things that you mean to say is to write precisely what you mean to say.

Vibe-coding (like any vibe-writing) simply can't accomplish that, by design.

EC only works if parents are the sole carers, and every success story I've heard had one main parent doing 90% of the care-taking. No daycare would do it, and if you can find a nanny, au-pair, grand-parent or other carer who is up for it ... small kids still just behave differently around different people. If they have a different level of comfort, anxiety, or reluctance with a person it breaks down.

No, you just don't have to be black or white about it.

At daycare they don't do it, that's ok. Do it at home. It's not a PROJECT, it's an orientation.

Take it easy.