All shitposting aside, though, if we go off the explanation the CA has given then some reformating script accidentally dropped most of the bytes or never requested them from the HSM or similar. A couple of years ago, we had a similar worry with Tink. In particular, we wanted to have a cheap test that catches obviously non-random values with high confidence. I added three little statistical test back then, which are run as unit test in every presubmit on everything that is supposed to look like a uniform random string. The tests are not constant time, so you cannot run them over your actual keys as is, but they are very reliable to test tooling that is supposed to handle and transform key material. They are tuned aggressively to detect non-randomness only up to 10 standard deviations, which makes the test extremely non flaky, at the cost of missing some events. But as I said, they're designed to be unit tests, that run with high frequency, so false positives would be very bad in that scenario. There are multiple ways to test this, some more principled than others, and somewhat depending on other requirements, but this is what I added to Tink back then: The first test is a z test that checks that every bit in the input string has a probability of 0.5 of being set. I.e. it sums all bits and checks whether the result is within 10 standard deviations of half of the length of the string. The second test is a cross correlation test that takes two bit strings, xors them, and runs the first test on the result. In other words it checks whether two independently drawn strings agree at half the positions. The third test is the most expensive one to run, but also the most powerful of these tests and tests the autocorrelation of a string. It rotates the string, shifting each bit by one and putting the last bit to the front, and then runs the cross correlation test on that string with the original string, for each possible shift. This test detects repetitions of sequences within a string, and will e.g. detect that a string contains only printable ASCII, although at the setting of 10 standard deviations it will require a couple of sentences before firing. https://github.com/tink-crypto/tink-cc/blob/3c94644e5b2dffacd66764da13083a97ee782d15/tink/util/test_util.h#L136
Keyboard Checker | The best online keyboard tester
Test all keys on your keyboard with this easy-to-use website. Works with any keyboard and any browser. Simply press any key to test it.
Introducing Automatic Key Verification
Signal now offers a feature called “automatic key verification” which complements the existing safety number system. Signal is always end-to-end encrypted, and automatic key verification provides an additional, streamlined way to confirm that there’s no unexpected party between you and the other ...
Jacky Kwok on Twitter / X
Scaling self-verification with DeepSeek V4 Flash beats Claude Fable 5 on Terminal-Bench 2.1, while being 11x cheaper 💰As open-source models become more capable, they can now generate large numbers of high-quality candidate solutions and verify their own outputs at very low… https://t.co/as2HtyHzzW pic.twitter.com/XzVBgr5JPz— Jacky Kwok (@jackyk02) August 17, 2026
Hypothesis: A new approach to property-based testing
The property-based testing library for Python
Testing can be fun, actually
Writing and maintaining tests is boring. But they're also some of the most valuable code we can write. With this blog post you'll learn a criminally underrated testing technique to add to your testing toolbox that can make tests a whole lot more pleasant.
Inside the keyv npm Supply Chain Compromise | Snyk
The keyv npm compromise used preinstall malware, trusted provenance, and IDE hooks to target developer and CI credentials. Learn how to detect and respond.
Unkey's Globally Distributed API key generation - with cofounder James Perkins
npm Worm Poisons keyv, cacheable and 400+ Other Packages Across Twelve Organisations
A worm moved one byte-identical credential stealer through more than 400 npm packages in twelve organisations on 4 August 2026, including @ornikar, @deliveroo, @servicetitan, @qlik, Picsart and the keyv and cacheable family. latest still resolves to a poisoned version on most affected names, and the payload installs a dead-man switch that fires when the stolen GitHub token is revoked, so rotating credentials first triggers it.
Mitigating LLM-based p-Hacking by Preregistering for the Next LLM
Large language models (LLMs) are increasingly used to generate, classify, and annotate data whose outputs feed downstream hypothesis tests. However, LLM-based research is easy to p-hack: a researcher can tune the prompts, decoding parameters, or output format until a desired result is reached. We propose a protocol to mitigate p-hacking in LLM-based research: preregistering the experiment and eligible models, and then running it on the first eligible LLM that is released after the preregistration. The researcher finalizes the procedure on current models, preregisters the analysis plan together with a set of eligible future models, and runs the confirmatory analysis on the first eligible model released afterward. Because this model does not exist at commitment time, it cannot be hacked against; furthermore, configurations that hack one model frequently do not transfer to the next. We evaluate the protocol on two tasks whose true values are known. Across 20 models from four providers and 11 LLM-analysis configurations, the protocol would have blocked successful transfer of the p-hack in 73.9% and 72.7% of cases in the two tasks. Additional analyses reveal that mitigation remains substantial under several stress tests. Finally, putting money where our mouth is, we followed our own protocol and preregistered our experiment. The preregistered experiment confirmed the protocol's effectiveness: out of the 7 configurations that hacked the prior model, the hacking failed to carry over in 6 configurations on the first eligible model released afterward.
keyv and cacheable npm Package Hijacked in Supply Chain Attack | Wiz Blog
Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.
Provisional Guidance for Users of LLM-Based Code Generators
available intuition for avoiding big risks
Controlling the False Discovery Rate: A Practical and Powerful Approach to Multiple Testing
SUMMARY The common approach to the multiplicity problem calls for controlling the familywise error rate (FWER). This approach, though, has faults, and we point out a few. A different approach to problems of multiple significance testing is presented. It calls for controlling the expected proportion of falsely rejected hypotheses — the false discovery rate. This error rate is equivalent to the FWER when all hypotheses are true but is smaller otherwise. Therefore, in problems where the control of the false discovery rate rather than that of the FWER is desired, there is potential for a gain in power. A simple sequential Bonferronitype procedure is proved to control the false discovery rate for independent test statistics, and a simulation study shows that the gain in power is substantial. The use of the new procedure and the appropriateness of the criterion are illustrated with examples.
Vibe Password Generation: Predictable by Design - Irregular
LLM-generated passwords appear strong, but are fundamentally insecure. Testing across GPT, Claude, and Gemini revealed highly predictable patterns: repeated passwords across runs, skewed character distributions, and dramatically lower entropy than expected. Coding agents compound the problem by sometimes preferring and using LLM-generated passwords without the user’s knowledge. We recommend avoiding LLM-generated passwords and directing both models and coding agents to use secure password generation methods instead.
Published part two on wiring up Standard.Site as a test of said wiring, in my hubris, and: no dice. Looks like discussion around arbitrary `rkey` values is still in flux — my “slugified post path” rkeys no longer validate, and I get no fancy preview for documents with an `rkey` > 13 characters.
Is TID the best choice for rkeys? #7
tangled.org