Arrow's theorem assumes preferences are ordinal: we prefer A over B, but have no idea whether A is slightly better than B, or life-alteringly better than B. This is not how our preferences work in reality. Of course naive versions of cardinality also have problems (cf. the effective altruist thought experiments that everyone is talking about), but ordinality is much more blatantly wrong. And if you allow cardinal preferences, lots of voting mechanisms work and have excellent properties (eg. QV) The specific axiom of Arrow's Theorem that _feels_ intuitive, but is actually very sketchy, is independent of irrelevant alternatives (IIA). The axiom says: if a voting mechanism chooses A over B, then introducing some third choice C should not lead to a choice that lifts B above A. It feels right, but it's sketchy because "irrelevant alternatives" actually provide lots of meaningful information about cardinality (how much you prefer A over B) Here's a toy example. Suppose you have a collective meal, and 15 people prefer A > B, and 5 people prefer B > A. It seems to be, you choose A, easy. But then you also introduce C, D ... Z and ask everyone to make rankings over those. You learn that there are 15 rankings of the form ... -> X -> Y -> Z -> A -> B -> C -> D -> ... (B always right behind A, and let's say on average A and B are both uniformly near the front so the other letters are not even better choices) And 5 rankings of the form ... -> X -> Y -> Z -> B -> C -> D -> .... -> A (A always at the end) Now, what's the actual situation? A contains substances that five people are allergic to. Suddenly this looks very different, and the obvious choice becomes B. To the majority it seems only slightly worse than A, and to a minority the meal being B basically means that they go hungry to protect their health. What's happening here? The "irrelevant alternatives" C ... Z are serving as _proxy evidence for the extent_ to which A is preferred over B or the reverse. And so an IIA-violating algorithm captures a relevant fact - a fact which a cardinal voting mechanism would be able to capture even more effectively.

It's an underappreciated triumph of Ethereum client developers that PeerDAS has now been running for nearly a year with basically no problems. PeerDAS was a complex task: it's the first large-scale instance of a blockchain that achieves consensus on the availability of data without needing any single node to download the entire block. Decentralized consensus without replication. And yet, it worked.

I think what's interesting is that the desire for local AI may inadvertently create a lot more local node users. It's a fraction of the actual compute local AI needs and just requires a decent amount of disk space.

Contribute to kassandraoftroy/kohaku-cli development by creating an account on GitHub.

Note: you can repoint your wallet RPC to localhost, though make sure to set your node up so it functions as an RPC. However, many in-browser dapps will not work as effectively this way, and many others hardcoded their RPC to their own server. I am increasingly becoming a fan of avoiding browser dapps entirely and just doing everything by command line. Just did a full end-to-end test: updated my ENS record using a local python script reading and sending through my local node.

We got tired of waiting 10 minutes for Solidity builds, so we built oksolc in Zig. Same bytecode. 5×+ faster on many contracts. Our builds: 10 min → 2 min Incremental large changes: 700s → 99s If the bytecode ever differs, please tell us. Huge thanks to the Solidity team. https://github.com/okcontra

There continues to be a lot of quiet dissent against the regime, which expresses itself any time some kind of channel appears (in this case, the "election" taking place right now) (The goal is not to literally get Putin to politely step off his chair; the election is of course manipulated to hell on multiple levels, and even if he loses he will just ignore it. Rather, the realistic goal is to delegitimize the regime as much as possible, denying it the internal cohesion it needs to pursue the "total war" path so that it has no choice but to take the peace path)

the main thing i think about is how dead privacy is from here on forward

I dislike the recent trend of people who clearly continue to believe >80% of the core effective altruist beliefs disavow EA and say "oh we're definitely not that, we're [rebrand]" purely strategically, purely because they sense that dunking on EA is "cool" now. It's much more honorable to just come out and say "yes, that was our intellectual upbringing and those continue to be our core values, and also here are specific points where we disagree, and here's our argument for why we think for those specific points are the subset of EA that causes what you perceive to be the problem with the whole thing". And so with that I will say: Yes, effective altruism was a significant part of my intellectual upbringing and its core values of care for others, cosmopolitanism and rigor around effective resource allocation continue to be very important to me. And also here are specific points where I disagree with what I think is the subset of that style of thought that has backfired in the largest ways: https://vitalik.eth.limo/general/2025/11/07/galaxybrain.html

western fantasy movie: there are heroes, there are villains japanese fantasy movie: there are no full villains, there are multiple people/entities aggrieved by challenging circumstances and exercising understandable but flawed thinking, in an ideal world you would get to mutual understanding and peace, but unfortunately right in that moment they are attacking each other and attacking you, and if you care about protecting your friends you have to at least temporarily fight them imo the real world is a mix of the two, and wisdom is knowing which scenario you're in and which character you're encountering

Mozi is also surprisingly proto d/acc (!!) Books 14 and 15 are basically open-source city defense manuals (though the idea transmission was a distributed process, it was not one guy writing a great tome and then everyone else copying and reading it) https://ctext.org/mozi/book-14 The explicit goal was to upgrade people's knowledge of defensive arts, and thus shift the offense/defense balance further toward defense. Defense is central to his thinking. Offensive war is the primary example of behavior that causes a small benefit to perpetrators at the expense of a large cost to victims, and it's also the primary example of why it really is best to love everyone universally, and not just love people inside your own country - if you do the latter, you might think it's a good idea to make your country wealthier and safer by making other countries poorer and less safe, but ultimately if everyone does that then everyone is worse off.

It's an increasingly common take that AI hacking means cybersecurity is doomed. I disagree. I think cybersecurity is naturally defense-favoring once people get their shit together. And anyone who continues to hold cryptocurrency (including me, ~90% of my net worth) is implicitly making that bet. Here's why I am making that bet. First, the oversimplified punchy one-line statement: If AI can prove Navier-Stokes and FLT, then AI can prove the statement "this program is secure" as a mathematical theorem. Even if the program is very complicated. Now, the nuance: (See also: https://vitalik.eth.limo/general/2026/05/18/fv.html ) The word "secure" is hiding all kinds of skeletons in the closet in terms of what it actually means. What does it mean for Signal (the encrypted messenger) to be "secure"? The most basic definition you might think of is: no one who doesn't hold the recipient's secret key can read the contents of the message. But: * Did you remember to include _other_ critical forms of security? Can the adversary forge messages? Can the attacker prevent messages from reaching the recipient? Can they cause your client to crash by sending malformed messages? * Have you made sure that your model of the adversary includes attackers that interfere with the protocol actively and not just passively? And attackers that interfere by replaying messages to you or the recipient that either of you sent over the wire at any point earlier? * What if the adversary hacked (or _is_) the Signal server? * How did you learn which public key belongs to the recipient in the first place? What if that process was tampered with? * What if your device gets hacked at some point in the past or future - is your message still safe then? * What if your key leaks because of a bug in your operating system? Or because you got a bugged version of the Signal client? Or what if the database is corrupted? * Or the libraries, interpreter or compiler of the programming language you wrote it in? * What if your key leaks because tiny perturbations in perceptible signals generated by the hardware leak mathematical relationships that can extract the key a few hundredths of a bit at a time? * Are you hiding the *size* of the payload? Does that matter? * You're definitely not hiding the identity of the sender and the recipient, and the exact time each message was sent (think: not just time-of-day, but also time deltas between one message and the next). Is that not enough to deduce a lot of important facts about what relationships you have, and what *kinds* of conversations you are having? So ... even definitions can be over a thousand lines of code, and need deep careful thought to figure them out. Working on making definitions more human-readable is of extreme importance - it's perhaps the only "high-level language" that matters right now. But even still, even despite all of the above, for security-critical components, the definition is a much smaller attack surface than the implementation. Verifying that the definition is adequate is a much more tractable task than scanning over the code directly - and can become even more tractable with better tooling. Definitions are also _additive_: if two groups have two different definitions A and B, then, well, you can just prove that the program satisfies both A and B. Code is not additive in this way: if a program is A + B, a bug in A _or_ B can sink the whole thing. Definitions are additive. And if you can't satisfy A and B at the same time, you've isolated the most important philosophical issue for your project to spend its next few weeks grappling with. Sometimes, definitions are not much smaller than the implementation - UI components might be one example. But for many of the most critical components - message-passing protocols, sandboxes, cryptography like SNARKs and FHE - the asymmetry is real. Historically, a large class of failures with this approach have come from people only verifying a small portion of their code, that they self-declared to be the security-critical portion, and ignoring the rest - and it turns out that something in the rest of the code is security-critical too. This was reasonable back when verification was difficult and scarce. The solution today: sorry, you have to verify over literally your entire program, including database, networking, any caching layers, everything. Modern AI can do it. So it's not about "the good guys find all the vulnerabilities before the bad guys do" - that could maybe work too, after all a finite program only has a finite number of vulns, but it's riskier - it's specifically an asymmetric strategy of making code that is much more resilient in the first place. This is the kind of direction that Ethereum is going in for the next few years. There is no future for blockchains - especially blockchains with scalability and privacy - without doing this. We need to make software actually secure. And we have already made a lot of progress.

Fences, not Sandboxes

One optimistic and still very-non-consensus belief I have about the far future of cryptography: I think that there is a 33% chance that, for average real-world computation, there exist ways to implement all three of what I call the Egyptian God Protocols (SNARK, FHE, iO) with 1+ε factor overhead (meaning, for large enough instances, the added overhead of cryptographizing a computation becomes arbitrarily small compared to the base cost of doing the computation itself) And a 60% chance that all three can be done with single-digit overhead (ie. <10x, measured in total cost of energy plus amortized compute) I think there's a good chance we'll get one of these (probably SNARKs with single-digit overhead) by the end of this decade. After all, we're already there for specialized hash functions and for some LLM inference.

Many years of hard work went into the Poseidon family of hashes, and they have provided great real-world value on Ethereum and elsewhere and will continue to do so for several years. They are the reason why it's fast to generate a client-side SNARK for a modern privacy-protocol. The fact that we have ultra-fast general-purpose STARKs (mid-three-digit overhead for basically any batched computation) and may well soon drop to double-digit or even lower is more amazing than anything that we had been hoping for in the early 2020s. Big congratulations to all involved in Poseidon, and all involved in STARKs.

One positive consequence of all the recent detailed thinking about transaction formats - not just 8141, also "future of state" discussions eg. UTXOs, PBT, keyed nonces, and also recursive STARK mempool - is that we have a much more explicit understanding of how transactions have "actions" and "dependencies", and we can engineer around optimizing the two separately. An action is an effect that a transaction has. A dependency is a fact about the transaction and/or the state that must be true for the transaction to be valid. eg. a signature is a dependency, a Merkle proof of a UTXO is a dependency, a ZK-SNARK (or STARK) is a dependency, a call that sends ETH is an action Dependencies can be processed in parallel. Dependencies that involve state can be reasoned about by a mempool, especially if the specific state accessed is statically declared. Dependencies that are pure (no state calling allowed) can be processed once at the mempool layer and never need to be processed again - and potentially even replaced with a STARK verifying them, allowing not just execution but also data to be elided. In principle, dependencies and actions can all be expressed as calls (if needed, calls to precompiles). This would make the transaction format itself very bare-bones and minimalist (a list of calls, flags for the type of each call eg. dependencies would be static or pure calls, and origin, nonce, etc) and allows maximum cross-compatibility even if different EVM chains have different features. In 2015-era Ethereum, thinking explicitly about these differences was not very important: execution was execution, there were few enough transactions that we could process them all serially, and single-key ECDSA accounts were good enough for everyone. Ethereum's current scaling strategy, however, requires moving beyond that paradigm. Ethereum is beloved by many developers because the execution and state model is so dynamic and flexible. But dynamic and flexible is not friendly to scaling. Fortunately, >90% of Ethereum's activity by volume does not require anything dynamic and flexible. So, we require contracts, accounts and transactions to more explicitly specify what is dynamic and flexible and what is more statically-analyzable but more restrictive, and more statically-analyzable things get the lowest gas cost and thus scale the most. Effectively, learning from the best of both the 2015-era Ethereum model and a more Bitcoin-like model (reminder: Bitcoin has had what I call account abstraction since the beginning), and making a mixture of both (really, the full spectrum between both) available, with gas costs appropriate for the level of scale involved. New state types, the recursive STARK mempool, keyed nonces, etc all go in this direction. This all relates to transaction types, because a general-purpose transaction type is a very natural interface layer on top of which all of this can be implemented, and the current thinking around the EIP-8141 transaction type is going in this exact direction that is friendly to these kinds of future generalizations. So in that sense, 8141 done well is not just a culmination of 10 years of account abstraction work, it's also preparation for the next few years of responsible decentralization-friendly hyper-scaling.

Add frame abstraction for transaction validation, execution, and gas payment

Bitcoiners deserve a lot of credit for pioneering many of these ideas (see Utreexo). But yes, this is what the current proposed Ethereum scaling strategy looks like in action. We want Ethereum to have the best of UTXO-style state, dynamic state, and everything in between, allowing the great majority of Ethereum's activity to be hyperscaled without sacrifice to decentralization, ease of node running and censorship resistance.

Impressive work! For comparison, an H100 can do roughly 100-200 tok/s of Muse 30B for raw inference single-thread, going up to low thousands of tok/s with a large number of threads - and I am sure that for the massively-multi-threaded case they can optimize the prover further. So we roughly, sort of, have single-digit (<10x) overhead for LLM proving! Next step is getting single-digit overheads for FHE, and then ultimately vFHE (aka STARK * FHE). A crazy ambitious milestone given present FHE overheads, but because of how highly structured and almost-linear LLM inference is, it's closer to the realm of possibility than you might think. Single-digit-overhead all the things.

Russia's only liberal, anti-war party will not be able to take part in next month's parliamentary elections, a Moscow court rules.

Signal is working on a way to sign up without a phone number. The feature has not yet been officially confirmed, and it is not yet known whether it will be available to all users or in what form.