It's an underappreciated triumph of Ethereum client developers that PeerDAS has now been running for nearly a year with basically no problems. PeerDAS was a complex task: it's the first large-scale instance of a blockchain that achieves consensus on the availability of data without needing any single node to download the entire block. Decentralized consensus without replication. And yet, it worked.

I think what's interesting is that the desire for local AI may inadvertently create a lot more local node users. It's a fraction of the actual compute local AI needs and just requires a decent amount of disk space.

We got tired of waiting 10 minutes for Solidity builds, so we built oksolc in Zig. Same bytecode. 5×+ faster on many contracts. Our builds: 10 min → 2 min Incremental large changes: 700s → 99s If the bytecode ever differs, please tell us. Huge thanks to the Solidity team. https://github.com/okcontra

There continues to be a lot of quiet dissent against the regime, which expresses itself any time some kind of channel appears (in this case, the "election" taking place right now) (The goal is not to literally get Putin to politely step off his chair; the election is of course manipulated to hell on multiple levels, and even if he loses he will just ignore it. Rather, the realistic goal is to delegitimize the regime as much as possible, denying it the internal cohesion it needs to pursue the "total war" path so that it has no choice but to take the peace path)

the main thing i think about is how dead privacy is from here on forward

I dislike the recent trend of people who clearly continue to believe >80% of the core effective altruist beliefs disavow EA and say "oh we're definitely not that, we're [rebrand]" purely strategically, purely because they sense that dunking on EA is "cool" now. It's much more honorable to just come out and say "yes, that was our intellectual upbringing and those continue to be our core values, and also here are specific points where we disagree, and here's our argument for why we think for those specific points are the subset of EA that causes what you perceive to be the problem with the whole thing". And so with that I will say: Yes, effective altruism was a significant part of my intellectual upbringing and its core values of care for others, cosmopolitanism and rigor around effective resource allocation continue to be very important to me. And also here are specific points where I disagree with what I think is the subset of that style of thought that has backfired in the largest ways: https://vitalik.eth.limo/general/2025/11/07/galaxybrain.html

western fantasy movie: there are heroes, there are villains japanese fantasy movie: there are no full villains, there are multiple people/entities aggrieved by challenging circumstances and exercising understandable but flawed thinking, in an ideal world you would get to mutual understanding and peace, but unfortunately right in that moment they are attacking each other and attacking you, and if you care about protecting your friends you have to at least temporarily fight them imo the real world is a mix of the two, and wisdom is knowing which scenario you're in and which character you're encountering

It's an increasingly common take that AI hacking means cybersecurity is doomed. I disagree. I think cybersecurity is naturally defense-favoring once people get their shit together. And anyone who continues to hold cryptocurrency (including me, ~90% of my net worth) is implicitly making that bet. Here's why I am making that bet. First, the oversimplified punchy one-line statement: If AI can prove Navier-Stokes and FLT, then AI can prove the statement "this program is secure" as a mathematical theorem. Even if the program is very complicated. Now, the nuance: (See also: https://vitalik.eth.limo/general/2026/05/18/fv.html ) The word "secure" is hiding all kinds of skeletons in the closet in terms of what it actually means. What does it mean for Signal (the encrypted messenger) to be "secure"? The most basic definition you might think of is: no one who doesn't hold the recipient's secret key can read the contents of the message. But: * Did you remember to include _other_ critical forms of security? Can the adversary forge messages? Can the attacker prevent messages from reaching the recipient? Can they cause your client to crash by sending malformed messages? * Have you made sure that your model of the adversary includes attackers that interfere with the protocol actively and not just passively? And attackers that interfere by replaying messages to you or the recipient that either of you sent over the wire at any point earlier? * What if the adversary hacked (or _is_) the Signal server? * How did you learn which public key belongs to the recipient in the first place? What if that process was tampered with? * What if your device gets hacked at some point in the past or future - is your message still safe then? * What if your key leaks because of a bug in your operating system? Or because you got a bugged version of the Signal client? Or what if the database is corrupted? * Or the libraries, interpreter or compiler of the programming language you wrote it in? * What if your key leaks because tiny perturbations in perceptible signals generated by the hardware leak mathematical relationships that can extract the key a few hundredths of a bit at a time? * Are you hiding the *size* of the payload? Does that matter? * You're definitely not hiding the identity of the sender and the recipient, and the exact time each message was sent (think: not just time-of-day, but also time deltas between one message and the next). Is that not enough to deduce a lot of important facts about what relationships you have, and what *kinds* of conversations you are having? So ... even definitions can be over a thousand lines of code, and need deep careful thought to figure them out. Working on making definitions more human-readable is of extreme importance - it's perhaps the only "high-level language" that matters right now. But even still, even despite all of the above, for security-critical components, the definition is a much smaller attack surface than the implementation. Verifying that the definition is adequate is a much more tractable task than scanning over the code directly - and can become even more tractable with better tooling. Definitions are also _additive_: if two groups have two different definitions A and B, then, well, you can just prove that the program satisfies both A and B. Code is not additive in this way: if a program is A + B, a bug in A _or_ B can sink the whole thing. Definitions are additive. And if you can't satisfy A and B at the same time, you've isolated the most important philosophical issue for your project to spend its next few weeks grappling with. Sometimes, definitions are not much smaller than the implementation - UI components might be one example. But for many of the most critical components - message-passing protocols, sandboxes, cryptography like SNARKs and FHE - the asymmetry is real. Historically, a large class of failures with this approach have come from people only verifying a small portion of their code, that they self-declared to be the security-critical portion, and ignoring the rest - and it turns out that something in the rest of the code is security-critical too. This was reasonable back when verification was difficult and scarce. The solution today: sorry, you have to verify over literally your entire program, including database, networking, any caching layers, everything. Modern AI can do it. So it's not about "the good guys find all the vulnerabilities before the bad guys do" - that could maybe work too, after all a finite program only has a finite number of vulns, but it's riskier - it's specifically an asymmetric strategy of making code that is much more resilient in the first place. This is the kind of direction that Ethereum is going in for the next few years. There is no future for blockchains - especially blockchains with scalability and privacy - without doing this. We need to make software actually secure. And we have already made a lot of progress.

One optimistic and still very-non-consensus belief I have about the far future of cryptography: I think that there is a 33% chance that, for average real-world computation, there exist ways to implement all three of what I call the Egyptian God Protocols (SNARK, FHE, iO) with 1+ε factor overhead (meaning, for large enough instances, the added overhead of cryptographizing a computation becomes arbitrarily small compared to the base cost of doing the computation itself) And a 60% chance that all three can be done with single-digit overhead (ie. <10x, measured in total cost of energy plus amortized compute) I think there's a good chance we'll get one of these (probably SNARKs with single-digit overhead) by the end of this decade. After all, we're already there for specialized hash functions and for some LLM inference.

Many years of hard work went into the Poseidon family of hashes, and they have provided great real-world value on Ethereum and elsewhere and will continue to do so for several years. They are the reason why it's fast to generate a client-side SNARK for a modern privacy-protocol. The fact that we have ultra-fast general-purpose STARKs (mid-three-digit overhead for basically any batched computation) and may well soon drop to double-digit or even lower is more amazing than anything that we had been hoping for in the early 2020s. Big congratulations to all involved in Poseidon, and all involved in STARKs.

One positive consequence of all the recent detailed thinking about transaction formats - not just 8141, also "future of state" discussions eg. UTXOs, PBT, keyed nonces, and also recursive STARK mempool - is that we have a much more explicit understanding of how transactions have "actions" and "dependencies", and we can engineer around optimizing the two separately. An action is an effect that a transaction has. A dependency is a fact about the transaction and/or the state that must be true for the transaction to be valid. eg. a signature is a dependency, a Merkle proof of a UTXO is a dependency, a ZK-SNARK (or STARK) is a dependency, a call that sends ETH is an action Dependencies can be processed in parallel. Dependencies that involve state can be reasoned about by a mempool, especially if the specific state accessed is statically declared. Dependencies that are pure (no state calling allowed) can be processed once at the mempool layer and never need to be processed again - and potentially even replaced with a STARK verifying them, allowing not just execution but also data to be elided. In principle, dependencies and actions can all be expressed as calls (if needed, calls to precompiles). This would make the transaction format itself very bare-bones and minimalist (a list of calls, flags for the type of each call eg. dependencies would be static or pure calls, and origin, nonce, etc) and allows maximum cross-compatibility even if different EVM chains have different features. In 2015-era Ethereum, thinking explicitly about these differences was not very important: execution was execution, there were few enough transactions that we could process them all serially, and single-key ECDSA accounts were good enough for everyone. Ethereum's current scaling strategy, however, requires moving beyond that paradigm. Ethereum is beloved by many developers because the execution and state model is so dynamic and flexible. But dynamic and flexible is not friendly to scaling. Fortunately, >90% of Ethereum's activity by volume does not require anything dynamic and flexible. So, we require contracts, accounts and transactions to more explicitly specify what is dynamic and flexible and what is more statically-analyzable but more restrictive, and more statically-analyzable things get the lowest gas cost and thus scale the most. Effectively, learning from the best of both the 2015-era Ethereum model and a more Bitcoin-like model (reminder: Bitcoin has had what I call account abstraction since the beginning), and making a mixture of both (really, the full spectrum between both) available, with gas costs appropriate for the level of scale involved. New state types, the recursive STARK mempool, keyed nonces, etc all go in this direction. This all relates to transaction types, because a general-purpose transaction type is a very natural interface layer on top of which all of this can be implemented, and the current thinking around the EIP-8141 transaction type is going in this exact direction that is friendly to these kinds of future generalizations. So in that sense, 8141 done well is not just a culmination of 10 years of account abstraction work, it's also preparation for the next few years of responsible decentralization-friendly hyper-scaling.

Add frame abstraction for transaction validation, execution, and gas payment

Bitcoiners deserve a lot of credit for pioneering many of these ideas (see Utreexo). But yes, this is what the current proposed Ethereum scaling strategy looks like in action. We want Ethereum to have the best of UTXO-style state, dynamic state, and everything in between, allowing the great majority of Ethereum's activity to be hyperscaled without sacrifice to decentralization, ease of node running and censorship resistance.

Impressive work! For comparison, an H100 can do roughly 100-200 tok/s of Muse 30B for raw inference single-thread, going up to low thousands of tok/s with a large number of threads - and I am sure that for the massively-multi-threaded case they can optimize the prover further. So we roughly, sort of, have single-digit (<10x) overhead for LLM proving! Next step is getting single-digit overheads for FHE, and then ultimately vFHE (aka STARK * FHE). A crazy ambitious milestone given present FHE overheads, but because of how highly structured and almost-linear LLM inference is, it's closer to the realm of possibility than you might think. Single-digit-overhead all the things.

Russia's only liberal, anti-war party will not be able to take part in next month's parliamentary elections, a Moscow court rules.

Signal is working on a way to sign up without a phone number. The feature has not yet been officially confirmed, and it is not yet known whether it will be available to all users or in what form.

One thing I find striking in the discourse between AI 2040 and its detractors is that the two seem to be locked in to totally incompatible worldviews of how fast and how much of a big deal AI progress is: * In AI 2040, every scenario sees superintelligence of some kind emerging by 2040, unless a herculean effort is made to completely stop it * Detractors say things like "AI 2040 is naive about human coordination ability and a threat to freedom", but don't seem to see any naivety in assuming that the ASI transition will just go well by default, don't seem to see ASI itself as a massive power concentrator risk, and don't seem to feel fear of humanity's "hard power" dropping to zero if ASIs can do literally every task better than we can. This stance makes total sense in a "AI is normal technology" world, zero sense in a world where superintelligence is possible by 2030 and almost guaranteed by 2040 I think my beliefs are: - If I was confident that (present-day-style) AI is normal technology, I would be in the detractor camp - If I was confident that superintelligence is coming in 2030 by default, I would be closer to the AI 2040 camp - it's naive, but every other option is naive squared? But my problem is that I feel great uncertainty and have no idea which of the two worlds (or some other third thing) we're living in? Hence why I continue to be open-minded about slowdowns/pauses, but also I feel very uncomfortable with the "open source bad, the good outcome is the one where our guys have controlling global dominance" push coming from some major AI companies and intellectuals - in a "normal" world that's the sort of thing that triggers every political alarm bell at the same time. A big reason why I have been advocating and trying my best to support the d/acc platform (rapid up-skilling in formal verification, cryptography, secure and open hardware, pandemic resistance and other defensive biotech, food and basic resource security, public epistemics, non-power-concentrating versions of physical security) is that these things are clearly worth doing in both worlds. The 2040 plan is already much more open source friendly (even mandating it! yay). It also includes "mutually assured compute destruction" ideas which (if they work) effectively give one of 2-5 actors the ability to trigger a global compute winter - as opposed to giving 1-5 actors the ability to selectively disenfranchise people they consider baddies while exempting themselves. This is also a big improvement. So I can see the earnest attempts to improve along the dimensions detractors criticize on ("does this concentrate power in big AI labs and superpower governments?"), and I appreciate this. I think many people don't appreciate enough the differences between different "kinds" of pause buttons, and how some concentrate power far more than others. Probably we can think harder and improve even more here. But on the "slowdown/pause or not" topic, there isn't a magic "escape the tradeoff" button. The Hansonian in me says: the winning deal is a deal which, from the perspective of both sides' present-day beliefs and knowledge, both sides would accept, though for different reasons. If the crux is AI progress speed, then identify a set of pre-agreed triggers for "okay, serious shit is happening" [super-pandemics? >25% unemployment? something involving slaughterbots?], and pre-agree that we become much more open-minded to the slowdown or pause thing if enough triggers come to pass within some timeframe. 2040 detractors (who clearly implicitly think that we'll see amazing speedup of progress from AI but think that what I call the "serious shit" category is overhyped) will accept expecting that the triggers don't come to pass, and AI worriers will accept expecting that they will. Pre-agreeing on the specific triggers means that once the triggers either hit or don't hit, there is stronger legitimacy around the idea that one side's worldview turned out more correct and we should be more inclined toward their program. If I were @elonmusk (or zuck, or...) I would re-tool twitter much more heavily into being a platform for helping to identify and make these kinds of grand win-win deals, so that we can bypass big-country governments and big-company CEOs and big nonprofit intellectuals and give more people a voice in the discussion. It's possibly one of the best things that social media _could_ do for humanity if it wanted to. But again, maybe this is also naive. Actually, probably it's naive. But currently, I see zero plans for how to deal with an ASI transition that are not naive. Perhaps humanity is stuck with a choice between naive and naive squared (or maybe even naive squared and naive cubed), so I feel inclined to cut some slack to people who are trying.

🇪🇺 The EU is now for the 6th time trying to force Chat Control through which lets them scan ALL your private messages, photos and emails without a warrant Implictly showing the EU is not democratic and not about what the people of Europe want, because once a law is rejected, you just re-submit it un

And ... we have a winner! My method when writing the post in 2024 was: I wrote it in Chinese, used qwen2.5 locally to translate it to English, then manually fixed all the bugs in the translation. Notice that the stylistic hints that his AI picked up on were intellectual habits and style of math and algorithm explanation, which bypassed my obfuscation strategy (which only covered prose) completely.

Special thanks to Emile, Potuz, Anders Elowsson for initial feedback and review. The goal of this post will be to show how the Ethereum consensus chain, in the context of “Lean” upgrades (single-slot finality, recursive…

There have recently been claims that AI text analysis will make online anonymity untenable. So let me cannibalize a piece of my own anonymity to do an experiment. At some point this decade, I wrote a published document of medium importance to Ethereum - I estimate ~200 to 2000 documents in Ethereum