load bearing @zksecurityXYZ & AI @zkaol, author of Real-World Cryptography, prev: architect @Mina, sec lead Libra (@Facebook), crypto @NCCGroup

New York
Just received this in the mail this morning
216
72
1,238
David Wong retweeted
Pi Durable unlocks much more than just the obvious 'able to recover from crashes' from the definition of durable. This wasn't obvious to me until I dug into it. The harness is just some well-defined state plus a little JavaScript to drive it forward. Put that state in a Durable Object and anyone in the world can wake it up, one message at a time, so multiplayer is basically free. Perfect crash recovery means you can effectively hot-reload your changes by killing yourself after a change, so you get full malleable software. And because all the harness state is sitting there as well-specified data, you can inspect what an agent was doing without needing other services to reconstruct all the details. Yes you get crash safety, but also multiplayer, malleability, and introspection.
4 things worth building with @pidotdev's Pi Durable + @CloudflareDev Durable Objects: #1 Durable agents for high-stakes workflows Pi Durable can identify interrupted operations and avoid automatically replaying unsafe calls. Imagine an agent refunding a customer, then crashing before it gets confirmation. You don't want it refunding the customer twice. Pi Durable checkpoints each step, recording the intent to execute a tool call and whether it completed. After a crash, it knows which operations were interrupted. Unsafe calls aren't blindly retried, so your app can check whether the payment went through before proceeding. #2 Shared team agents Pi Durable + Cloudflare Durable Objects are a great foundation for multiplayer agentic coding. A Durable Object holds the persistent agent state. Multiple clients can connect to the same session, incoming messages are queued or used to steer the agent, and updates are streamed to everyone. Imagine an agent picking up a GitHub issue and working on a PR while teammates watch or steer the same conversation from their phones, browsers, or terminals. @pidotdev's shared-chat tutorial demonstrates this. #3 Agents that run anywhere @badlogicgames built a Pi Durable Android app that runs the agent harness and stores its state locally on his phone, while model calls happen remotely. Pi Durable separates agent state from execution, with pluggable storage and execution backends. The harness can run anywhere there's a compatible JavaScript runtime, and its tools can execute on another machine. Your durable agent doesn't need an always-running terminal or cloud server just to preserve the agent's state, the harness can run locally, on a phone, or in the cloud. #4 Build new tools on top of agent state This is the one we're most excited about. Pi Durable persists structured tasks, checkpoints, and interrupted operations. That means you can inspect an agent's execution state without asking the model to reconstruct what happened. We experimented with putting Pi Durable inside a Cloudflare Durable Object and visualizing its stored state without waking the agent. Imagine using that data to build: - Debugging dashboards showing exactly where an agent crashed. - Reliability metrics showing which tool calls repeatedly fail or need recovery. - Multiplayer dashboards showing pending tasks, who steered an agent, and when. The interesting part is that durable execution state becomes a new primitive you can build tools on top of, not just something used for crash recovery. 00:00 What is Pi Durable? 07:06 Idea 1: Durability for high-stake workflows 13:16 How to build with Pi Durable 16:31 Durable storage: local vs. cloud 19:46 Pi Durable + Cloudflare Durable Objects 32:20 Idea 2: Multiplayer agents with shared state 35:01 Idea 3: Running the harness on a phone 37:45 Idea 4: Inspecting persistent agent state 🧵👇 Links to YouTube, Apple Podcasts, and Spotify below.
2
3
11
626
BTW most of the supply-chain, weak-key, and cryptography bugs that were found this week would have been found in one or two zkao.io scans. And it would have cost you around ~$5k. There's no reason to freak out about bad guys finding all the bugs in your software, you have access to the same tools!
2
1
17
755
David Wong retweeted
STOP SENDING US THIS TWEET
cybersecurity startups trying to raise funding right now
1
1
180
David Wong retweeted
we're seeing a peak of interest in our automated cryptography-bug finding tool zkao.io, did something happen this week?
2
4
279
Maybe another thing that's really hard to decipher in these situations is how little there is to understand in the moment. There's no one true story, there's just too much chaos to these kind of movements, too much happening. Lots of people will just use isolated events, or images, to just push for their own narrative. Lots of that is just continuous confirmation bias for whatever they believe in. Be it that cops are bad, or that the current government is bad, or that immigrants are bad, or that France/Europe is bad, or that the left is bad, etc. Your opinion is just going to be a mix of what the algorithm feeds you, what bubble you're part of, and who you talk to. You will slowly get biased towards these narratives that are well... just made up narratives. Maybe the only way out is to just touch grass, to talk to real humans who disagree with you, to be more comfortable with having your narrative tested, etc.
My small investigation, for whoever cares, about the protests in France. First, it looks like the movement was somewhat general and vague, similar to the yellow vest movement. Mostly a "ras-le-bol" (fed up) led by students (lots of movements are started by students as usual) but also from normies who feel squeezed by the raising costs of living. It seems like the protests escalated because of a number of things, number one reason might be that numerous videos of extreme police brutality were recorded and shared and that angered/radicalized lots of people. Some people also believe that the following conspiracy theory: the left is becoming too powerful, so the current government barely supervised the current protests in order for them to blow up. Macron (the president) blamed the extreme left. It seems to me, after my small investigation, that all parties here have some responsibility in what happened. The police went too far, the current administration didn't manage to oversee the protests well (perhaps on purpose), and the extreme left radicalized some people (including some people who ended up burning buildings and such). Lots of peaceful protesters as usual (lots of videos show how good the vibe was sometimes), and then radicalized people who escalate, and then opportunists who break/steal things during the confusion/chaos. You can support the movement, respect the right to protest, understand the power of people taking the streets, while also condemning excesses. BTW big protests in France are pretty common, I've lived through some when I was younger where cars were being burned everywhere (started due to police brutality on immigrant communities), from what I've heard the 1968 student demonstrations were INSANE as well. As someone from the outside it might appear crazy, but often this is localized and easy to avoid unless you're at the wrong place at the wrong time. You won't realize that a protest took place in most of the city the next day. It's crazy, but not as crazy as what you might think if you just watch the news. Every time these things happen the extreme right loves to farm and market their whole anti immigration stance. Sure there's lots of immigration in France, as a second-gen immigrant lots of my friends were second-gen immigrants as well (algerian, tunisian, iranian, lebanese, russian, chinese, japanese, etc.). I was never bothered by it, I'm actually proud to have such diverse friends, I'm not sure why people are bothered by it tbh. From what I understand it's mostly extreme right people who have a hard time accepting other cultures (and when they're religious, they have an especially hard time accepting other religions). Yes you have to be careful with immigration, you have to provide support and make sure they integrate and succeed. This is a hard problem. This is not a left or right issue. We don't live in a vacuum. Empathy helps. That being said, the current protests are pretty diverse, I find the extreme right talk about immigration to be mostly about farming. It's sad that people fall for that marketing. What I can say is that French people are trying to figure things out, if you're not French and judging us maybe go and touch some grass in Paris to understand what people are fighting for, to understand the upside of cultural diversity, to understand you're probably being brainwashed by whatever bubble you're in. I wish Americans would protest the current government like that.
1
5
588
My small investigation, for whoever cares, about the protests in France. First, it looks like the movement was somewhat general and vague, similar to the yellow vest movement. Mostly a "ras-le-bol" (fed up) led by students (lots of movements are started by students as usual) but also from normies who feel squeezed by the raising costs of living. It seems like the protests escalated because of a number of things, number one reason might be that numerous videos of extreme police brutality were recorded and shared and that angered/radicalized lots of people. Some people also believe that the following conspiracy theory: the left is becoming too powerful, so the current government barely supervised the current protests in order for them to blow up. Macron (the president) blamed the extreme left. It seems to me, after my small investigation, that all parties here have some responsibility in what happened. The police went too far, the current administration didn't manage to oversee the protests well (perhaps on purpose), and the extreme left radicalized some people (including some people who ended up burning buildings and such). Lots of peaceful protesters as usual (lots of videos show how good the vibe was sometimes), and then radicalized people who escalate, and then opportunists who break/steal things during the confusion/chaos. You can support the movement, respect the right to protest, understand the power of people taking the streets, while also condemning excesses. BTW big protests in France are pretty common, I've lived through some when I was younger where cars were being burned everywhere (started due to police brutality on immigrant communities), from what I've heard the 1968 student demonstrations were INSANE as well. As someone from the outside it might appear crazy, but often this is localized and easy to avoid unless you're at the wrong place at the wrong time. You won't realize that a protest took place in most of the city the next day. It's crazy, but not as crazy as what you might think if you just watch the news. Every time these things happen the extreme right loves to farm and market their whole anti immigration stance. Sure there's lots of immigration in France, as a second-gen immigrant lots of my friends were second-gen immigrants as well (algerian, tunisian, iranian, lebanese, russian, chinese, japanese, etc.). I was never bothered by it, I'm actually proud to have such diverse friends, I'm not sure why people are bothered by it tbh. From what I understand it's mostly extreme right people who have a hard time accepting other cultures (and when they're religious, they have an especially hard time accepting other religions). Yes you have to be careful with immigration, you have to provide support and make sure they integrate and succeed. This is a hard problem. This is not a left or right issue. We don't live in a vacuum. Empathy helps. That being said, the current protests are pretty diverse, I find the extreme right talk about immigration to be mostly about farming. It's sad that people fall for that marketing. What I can say is that French people are trying to figure things out, if you're not French and judging us maybe go and touch some grass in Paris to understand what people are fighting for, to understand the upside of cultural diversity, to understand you're probably being brainwashed by whatever bubble you're in. I wish Americans would protest the current government like that.
10
1,048
I feel like at this point I’ve been meme’ing for the last 10 years that the web pki doesn’t make sense since we know that we can replace it with a bft consensus protocol. I would be happy to create such a project but the hard part is to convince browsers to move to such a system. The current web pki really doesn’t make sense from a security point of view imo. I wrote about it here: cryptologie.net/posts/the-we…
Meme of the year. #CA
2
2
17
1,234
Im David your favorite immigrant
1
13
930
introducing, patch the web
1
8
907
I don't how you guys handled the php stuff, but I took this opportunity to just rewrite my stack in another language with agents, finally moved away from php after all these years, typed and memory-safe languages ftw
5
16
1,569
David Wong retweeted
Sydney Sweeney reveals in an interview that she doesn’t care about the PHP vulnerability because she moved everything to Rust in 2024. “They said the rewrite would take six months. We’re on month 30. We haven’t shipped a feature since, but I’m having a very normal Wednesday.”
251
1,677
27,256
665,590
The API is English, the deterministic-agentic border is shifting cryptologie.net/posts/determ…
4
518
good thing everyone's doing cert pinning right? right?
2
1
36
2,360
David Wong retweeted
check this episode to see how we've broken the record of how many @zksecurityXYZ can fit within one podcast episode
we packed the last zk podcast with zksecurity folks! mathias, giorgio, nico, and kobi talk about our lean framework (clean) to formally verify zk circuits and our competitive platform for degens to submit lean proofs zk.golf!
1
15
882
super proud of the team for pushing zk, formal verification with lean, and collaborative breakthroughs with zk.golf!
we packed the last zk podcast with zksecurity folks! mathias, giorgio, nico, and kobi talk about our lean framework (clean) to formally verify zk circuits and our competitive platform for degens to submit lean proofs zk.golf!
1
27
1,675
David Wong retweeted
blockchain cryptographers: "post-quantum this, post-AI that, ZK over here, TEEs over there, maybe sprinkle some MPC, maybe not, yada yada yada, we gonna be secure, yeeeehawww" meanwhile, HTTPS CAs: "the private shall be 4!"
8
18
197
4,631
This is so cool
I'm deleting this mod 😭
2
921
David Wong retweeted
for you leaners out there, if you want to share lean code beautifully, check this out zksecurity.github.io/leanfor…
2
1
22
1,087