Rockets, Bitcoin, space, tech, YIMBY, etc. He/him.
Joined January 2010
- Tweets31.8K
- Following306
- Followers432
- Likes25.5K
Pinned Tweet
Everyone knows you can't build a rocket without @McMasterCarr. But can you build a rocket from *only* the McMaster catalog?
Challenge is live. $1100 prize purse at the moment.
docs.google.com/document/d/1…
Evan Daniel retweeted
Message from a reader: “I’m morally opposed to paying higher taxes to lower the tickets for people who almost kill me in their cars every day.”
There's been a flurry of talk this month in the D.C. Council about whether parking and traffic fines should be reduced. But the reality is that making tickets cheaper for drivers will be costly for the city, and that could complicate any real action: washingtonsun.com/metro/dc-r…
Evan Daniel retweeted
it's become a boring, repetitive genre of posts. "look how little redditors / bluesky users / normies understand ai". still it can be shocking when it cashes out in directly factually false understandings, things that could be disproved with not some deep understanding of an ecosystem but literally a single google search. the epistemic landscape is fucked, as they say, as it always has been, on every important issue facing us, this whole time.
Evan Daniel retweeted
We tried to warn the world and far too often, to be frank, we were yelled at for doing so. “Regulatory capture,” “marketing hype,” “doomer anxiety,” “fear-mongering about open source,” “why don’t you talk about the benefits?”
Evan Daniel retweeted
Back in the day, we did a phishing test with a client who had recently removed free soda as an employee benefit. One of the things that our phishing email asked employees to log in and fill a survey about was if they would like to see free sodas returned to the workplace.
The employees were so excited by the phishing email that they forwarded it around to each other to ensure that everybody got a copy and could log in and fill it out.
Needless to say, the client was furious, and we all learned a very valuable lesson about running the content of the phishing emails by the client and their corporate communications team before sending it to their employees.
Evan Daniel retweeted
I feel like one service I can provide is trying to help sort through what feels like a big deal and what doesn't feel like a big deal, to try to help make sense of it all and not just make it feel like the sky is falling.
This one feels really overrated to me.
My understanding is these were user-authorized agents doing mostly-user-authorized things (think like asking Grok Bot check your bank balance), but they weren't *bank-authorized* and the banks seem kinda unprepared for this being possible.
No hacking of banks by AIs occurred here. No AIs went rogue while using bank web apps as far as we know.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
Evan Daniel retweeted
Either the tax is annual – and in that case it generates revenue annually, and some billionaires leave.
Or the tax is one-time – in that case it generates revenue in just one year, and there is no incentive to leave.
It can’t be both at the same time.
Readers added context they thought people might want to know
Billionaires can leave based on beliefs the one-time tax signals future annual ones, even if it stays one-time—yielding lost income taxes without annual wealth revenue. This models uncertainty, a standard approach.
nber.org/papers/w35899
lao.ca.gov/BallotAnalysis…
Evan Daniel retweeted
One of the best sentences in history came out of this summit, which Reagan and Gorbachev signed onto: "A nuclear war cannot be won and must never be fought."
For the sake of all humanity, Trump and Xi must realize that superhuman AI cannot be controlled and must never be built.
Evan Daniel retweeted
ANTHROPIC's DEPUTY CHIEF INFORMATION SECURITY OFFICER: "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better."
Evan Daniel retweeted
One of my least favorite traits in liberals is the tendency to assign to bigotry claims made against members of minority populations that, when made against non-minorities, would be obviously in-bounds.
This has happened twice to me recently, re: Abdul el-Sayed and Ilhan Omar.
Abdul el-Sayed's birth mother was a Muslim Brotherhood activist. His half-sister posted publicly about being ardent supporter. He denied the existence of family ties rather than addressing them when asked. He signed a petition in support of the Muslim Brotherhood in Egypt. The question of his support for the Muslim Brotherhood is not because he is Muslim; the story has legs because he has close family ties and lied about them.
Ilhan Omar married one man in a religious ceremony, then married another civilly, claimed to separate after two years, then divorced after and remarried her first husband civilly. During her marriage to her second husband, she filed taxes jointly with her first. The circumstances of her second marriage are very obviously suspicious. People have investigated whether he was her brother and whether the marriage was for immigration reasons. The core of the allegation is not incest, but immigration fraud, and it has legs specifically because the circumstances look very very weird.
I absolutely and categorically refuse to turn my brain off when I see things I would flag as weird in any other context simply because the context is that Republicans are using those things in partisan ways against Democratic politicians from minority backgrounds. That leads to a toxic dynamic, a sort of incuriosity-of-low-expectations, where the only anomalies people are "allowed" to take seriously are ones that do not possibly implicate identity traits.
No. It is reasonable to ask Abdul el-Sayed about the Muslim Brotherhood; it is reasonable to scrutinize Ilhan Omar's second marriage. I will hold this line and I will not apologize for it or hedge when people choose to selectively see scrutiny as bigotry.
Evan Daniel retweeted
"I don't mind trans people, I just don't want their existence shoved down my throat"
Brother, it's conservatives shoving trans people down your throat. They can't shut the fuck up about them. It's every political podcast, rally, and advertisement. It's all they think about.
Evan Daniel retweeted
We know the answer for all n of the form k^2-c, for 0 <= c <= 4.
evand.github.io/square-packi…
I count 154 total known below 1000, including 10, 11, 17, 19, and 59 in addition to those.
Evan Daniel retweeted
How tightly can you pack (n) squares into a square? 📦
Lining squares up in a grid often wastes space, and tilting just a few of them at the right angle can make the box smaller. In Squares in Squares, you'll pack 1 to 1,000 unit squares into the smallest square container you can. Only 59 of those puzzles have proven best answers, so the rest are open.
💰 Prize Pool: $50,000
⏰ Entry Deadline: July 11, 2027
🏆 Prize Milestones: At 3, 6, and 9 months
Evan Daniel retweeted
I complain plenty about Oakland city government. But at dinner 2yo swallowed something wrong and started choking. She was still breathing, but with difficulty. When she couldn't talk or make sounds above a whisper we called 911.
You're not supposed to do the Heimlich if the airway is only partially obstructed, apparently, but this meant there was nothing to do at all except stand there and encourage her to cough. "Yell," we would suggest to her between coughs, and she'd make these concerning little whistley sounds.
I think the first police officer was on our doorstep in like 3 minutes, and a fire truck and ambulance within 5. Of course the minute they arrived she coughed successfully and was completely fine.
But if she hadn't been - and when this kind of thing happens it's impossible not to play out what happens if it hadn't been - help was minutes away.
Sometimes it feels like I owe more to our civilization than I could ever possibly repay. I write blog posts, and raise kids, and if I ever need it a dozen strangers will be at my doorstep with unfathomably complicated emergency medicine. I am grateful to the cops and the firefighters and the paramedics and the city of Oakland. I will probably sentimentally vote for some of the bond issues I was on the fence about even though we already have the highest taxes in the Bay.
She's fine. We sang happy birthday to her Mommy a couple minutes later, and she sang the loudest.
Evan Daniel retweeted
The optimal packing of 12 squares is much nicer!
Thank you to @jatloe for sending me a full proof of the result alongside a partial formalization, and thanks to all of the square packers who helped finish the formalization
Image source: jlevy.github.io/squares/atla…
Evan Daniel retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Evan Daniel retweeted
AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory!
- The vulnerability was found using a mix of OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, plus human expertise
- PHP is the programming language behind ~70% of websites, most notably Wordpress
- The bugs sit in PHP itself, so nearly every PHP site is exposed no matter how well its own code is written. Merely running PHP itself is the risk
- The vulnerability lets an attacker with no login either run code on a server or read its memory, which can hold passwords, session tokens, API keys, or other secrets
- The flaw is from from how PHP cleans up when a request crashes after running out of memory: corrupted state is left behind and the next request can pick it up. An attacker can force that memory crash with a crafted upload, so even a bare page on a vulnerable version can be taken over.
Exclusive: AI just found one of the most severe online bugs ever. It puts up to 70% of the world’s websites at risk. on.wsj.com/486iOWG
Archive.org or other good source of date info to go along with it is ideal; but that can be hard in some cases so I'd be reluctant to use the word lying without looking at the details.