Kevin D. Keck (@kdkeck) header
Kevin D. Keck (@kdkeck) profile picture

Technologist. Futurist. Philosopher. Parent. 🏴󠁧󠁢󠁳󠁣󠁴󠁿

⚓ Blaine, WA 🌲 🗻
Joined September 2010
Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)Photo by Kevin D. Keck (@kdkeck)
Kevin D. Keck retweeted
I'm an engineer by vocation so I usually don't post about politics, but I think this is important enough to make an exception for. Thank you for your attention to this matter:
A delegation of US taxpayers and international human rights lawyers is set to call on the International Criminal Court (ICC) to issue arrest warrants for Donald Trump and other senior members of his administration The group will ask the court to pursue Trump, US secretary of state Marco Rubio and other senior US officials over allegations they have aided and abetted genocide, war crimes and crimes against humanity in Gaza
2
27
I'm an engineer by vocation so I usually don't post about politics, but I think this is important enough to make an exception for. Thank you for your attention to this matter:
A delegation of US taxpayers and international human rights lawyers is set to call on the International Criminal Court (ICC) to issue arrest warrants for Donald Trump and other senior members of his administration The group will ask the court to pursue Trump, US secretary of state Marco Rubio and other senior US officials over allegations they have aided and abetted genocide, war crimes and crimes against humanity in Gaza
2
27
Kevin D. Keck retweeted
Yann LeCun and Randall Balestriero just Proved the Platonic Representation Hypothesis, and found a better way to achieve it. The Platonic Representation Hypothesis suggests that AI models trained on different modalities, like images and text, eventually learn similar representations of the world. But this paper shows that how models are trained matters more than simply scaling them up. So they mathematically show that, under certain conditions, two JEPAs trained completely separately can learn essentially the same underlying representation of the world. One learns from different images of the same scene, while the other learns from different descriptions of that scene, without ever being trained on image-text pairs. Their approach achieves the same image-text alignment with 42x fewer training samples than next-token prediction. A 109M-parameter text JEPA even outperforms LLMs up to 72B parameters on cross-modal alignment benchmarks. alphaxiv.org/abs/2610.39302
90
510
94
3,589
256,776
PSA: if you're worried about being hacked, connecting to all the credit agency websites and sending your vital PII over the Internet to them should NOT be the first thing you do. Just, no. First: secure your device(s), your home network, and your existing accounts.
1
1
276
More detailed instructions:
Replying to @kdkeck @JJEnglert
First priority should be 2FA for your bank(s), email, and phone. Then make sure your devices are all auto-installing security updates very frequently. Make sure your home Wi-Fi is password protected. Consider activating iPhone Lockdown Mode or Android Advanced Protection.
1
107
Kevin D. Keck retweeted
ALERT: did you just get a threat notification from Apple? Seek expert help. Apple just sent new notifications about mercenary spyware. Here are steps to take right now. 1/
10
183
9
484
88,784
Kevin D. Keck retweeted
I keep telling this to every developer I know if you run npm install on your bare macbook in 2026 you are waiting to be pwned you need to develop inside a container one bad vscode extension, one poisoned crate, and every credential on your machine is gone. that's not even paranoia anymore, it's just the baseline apple/container spins up light linux vms on apple silicon so I’ve updated my agent skill remote VMs setup and management to support local ones use /remote-computer, create a local apple container for multi-language development it sizes the VM to your CPU/RAM/disk, sets up key-only SSH on a host-only IP, no published ports, no home dir mount, and ports your git identity and commit signing. also works with AWS and GCP VMs
40
74
15
1,285
110,345
oof. i do feel like there should be a tax credit for small & med businesses to reimburse 50% of what they spend on cybersecurity & related tech upgrades for this & the next 2 years (up to some reasonable caps)
🚨 Hackers breached enterprise firewalls and VPNs worldwide in a campaign linked to k0t. Over 70,000 exposed credentials identified. Fortinet and Palo Alto devices targeted. Persistent access established. Data exfiltrated. Inside the attack chain and suspected ransomware links: thehackernews.com/2026/10/ha…
3
3
2
32
2,456
Kevin D. Keck retweeted
Tested all 12 compromised eMudhra certificate chains (where an intermediate CA private key was literally 4) across macOS, mobile browsers, Go, Node, Python, and Java today. Here is what is actually safe, what is still exposed, and two gaps in the current macOS workarounds. 1. What is already safe (don't panic) • Desktop browsers: Chrome, Safari, Edge, Brave, and Firefox (158.0.1+) are safe. • iOS & Android in-app browsers: X on iOS (SFSafariViewController) and updated Chrome Custom Tabs on Android enforce Certificate Transparency (requiring >= 2 valid SCTs). Since zero fraudulent certs were logged to CT, they reject all 8 keys automatically. • Mobile exceptions: - Firefox on Android < 158.0.2 had a startup bug (Bug 2084311) where OneCRL didn't sync. Update to 158.0.2 (out today). - Android 13 and older don't get Google Play system CA updates, so apps using raw Android WebView (where CT is off by default) still trust the roots unless you disable `emSign` and `Comodo AAA Services` under Settings -> Security -> Encryption & credentials -> Trusted credentials. 2. Two gaps we found on macOS today (even after running the official workaround) Safari is safe because it enforces CT. Non-browser tools on macOS (`curl`, `git`, `python3`, `nscurl`, and `Go < 1.27.3`) do not enforce CT. When testing all 12 chains on an updated Mac today, 9 were blocked, but all 3 `G3B` chains (`dv-g3b`, `ov-g3b`, `ev-g3b`, private keys 156, 155, 115) still returned HTTP 200: • Why: Apple's Valid DB set `checkOCSP = 1` instead of removing the `emSign ECC Root CA - G3` root. `ocsp-c.emsign.com` (`G3C`) is up and returns `revoked`, so `G3C` is blocked. `ocsp-b.emsign.com` (`G3B`) is currently down returning `HTTP 503`, so macOS `Security.framework` soft-fails open and trusts `G3B`. • Why the `/etc/ssl/cert.pem` workaround still returns HTTP 200 on `G3B`: Apple's `/usr/lib/libcrypto.46.dylib` (`X509_verify_cert`) links `TrustEvaluationAgent.framework`. When a cert isn't in `/etc/ssl/cert.pem`, Apple's LibreSSL falls back to `Security.framework`, hits the 503 on `ocsp-b.emsign.com`, and approves the cert anyway. Fix on macOS (also works without sudo on MDM-locked work Macs): 1. Strip the 2 roots into a clean bundle: awk '/^(###|===) /{skip=0} /^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1} !skip' /etc/ssl/cert.pem > ~/.ca-cert.pem 2. Disable Apple's TrustEvaluationAgent fallback and point CLI tools to the clean bundle in `~/.zshrc`: export OPENSSL_X509_TEA_DISABLE=1 export SSL_CERT_FILE="$HOME/.ca-cert.pem" export CURL_CA_BUNDLE="$HOME/.ca-cert.pem" export GIT_SSL_CAINFO="$HOME/.ca-cert.pem" 3. Backend runtimes (bundle their own CA stores and ignore OS updates) • Node.js: Update to v22.23.4, v24.22.1, or v26.12.1. • Go: Update to Go 1.27.3 or 1.26.10 and recompile binaries (hardcodes SPKI blocklist in `crypto/x509`, bypassing the macOS 503 soft-fail). • Python: Update inside every virtualenv (`pip install -U "certifi>=2026.10.19" "pip>=26.2.2"` and `uv >= 0.13.4`). • Rust: Rebuild with `webpki-roots >= 1.0.10` / `rustls-webpki >= 0.103.16` (`rustup >= 1.29.2`). • Java (OpenJDK / Oracle): No upstream release yet. Delete both roots from `cacerts`: keytool -cacerts -storepass changeit -noprompt -delete -alias emsigneccrootcag3 keytool -cacerts -storepass changeit -noprompt -delete -alias comodoaaaca • Linux / Docker: Update `ca-certificates` (Ubuntu `20260816ubuntu0.24.04.1`, Debian `20250419+deb13u1`, Alpine `20261020-r0`, Fedora `2026.2.92_v9.0.319`, Arch `3.131.1-1`) and rebuild base images. Verify any CLI or runtime with: curl dv-g3b-emudhra.we-have-a-pro… (TLS error = safe. HTTP 200 = still exposed.)
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP. Here is the short version of what happened and who got hit. 1. eMudhra (Trusted CA compromise) eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs. One of the intermediate CA private keys was literally the number 4. The other seven: 56, 66, 115, 155, 156, 230, 237. Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket. • Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs. • Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10). • 10-second check on any server: curl dv-g3b-emudhra.we-have-a-pro… (TLS error = safe. 200 OK = still vulnerable.) 2. PingCAP / TiDB Cloud (10.6 TB breach) Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents. Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets. Who is affected in the leaked records: • Live credentials exposed in support tickets: - Pinterest: AWS keys for their pingcap-logs S3 bucket - CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets - DeBank: 38 presigned S3 URLs - An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys) • Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed: - Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap - E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook - Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM - Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life - Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase • Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery): - 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash. If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket. 3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619) Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch. Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c). Because C-level multipart parsing runs before line 1 of index.php: • App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it. • Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1). • Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
6
159
13
900
111,240
Kevin D. Keck retweeted
i own a relatively new (2025) samsung tv. i kept getting weirdly targeted ads. i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic. zero days it is. root shell on new samsung TVs! discovered PRIVACY HORROR. write up?
724
3,876
665
36,718
4,863,604
Kevin D. Keck retweeted
Replying to @hardiksd
The dirty secret across the entire AI industry is that derivatives (ai summaries) is fair game for data collection.
4
12
7
263
27,640
Kevin D. Keck retweeted
PSA: Do NOT use public WiFi or shady DNS servers for the next few weeks. SSL is practically broken and you can be attcked with an MITM attack. Your ISP and other intermediaries can also spy on you. Use a trusted VPN. It will take a few days at least to flush out this crap CA.
Instead of using 384 bit random private keys, they used private keys like the super secret, unguessable number 4. They are a cryptography company. They had one job. They're selling Post-Quantum Cryptography while doing shit like this lmao.
Readers added context they thought people might want to know
SSL/TLS is not broken. The vulnerability involved eight eMudhra intermediate certificates, which major browsers and operating systems (Chrome, Firefox, Apple, and Microsoft) had already blocked by October 20. Updated devices are protected against these MITM attacks. arstechnica.com/security/2026/… emudhra.we-have-a-problem.com
52
372
38
3,407
329,391
Kevin D. Keck retweeted
On the train yesterday, table of middle aged women next to me talking about AI. All ChatGPT, pronounced "chat GBT", no idea why lol One of them was disappointed because she asked it to make a small crossword and it couldn't I thought surely not. I use these models every day, they do things in minutes that'd take me hours. So I got the app out and asked for one myself Every down clue is a copy of an across clue. "You ___ here" is apparently EST. The down answers are CET, ASE and TTN. Then it tells me its own puzzle isn't a proper crossword No wonder people outside tech think it's a fad. The stuff that blows my mind at work they'll never see, and the first thing they try falls over
225
106
43
5,458
451,743
Wonder if the owner of Xitter is going to notice how one-sided the comments are now with the Ruscian botfarms kinetically sanctioned? 🤔
And so the slaughter continues … Time for Zelensky to go
1
210
Kevin D. Keck retweeted
We're building the future of global energy, starting in Oregon. As seen in recent pieces in @TheBulletin and The Bend Source, Project Obsidian is on its way to becoming the world's first commercial superhot geothermal power plant, revolutionizing how we can access and harness superhot geothermal worldwide. We're proud to continue Oregon's long history of renewable energy leadership. Read the full stories below. From @TheBulletin: bendbulletin.com/2026/09/22/… Bend Source: bendsource.com/news/localnew… #SuperhotGeothermal #ProjectObsidian #RenewableEnergy #EnhancedGeothermalSystems"
1
4
2
28
1,697
Kevin D. Keck retweeted
Mark Zuckerberg pretending to enjoy Guinness is my new favourite thing.
2,254
5,591
2,095
107,624
15,326,312
Deepmind provided Alphafold as a brilliant free-to-use, open-source tool that greatly helps biologists being more productive and successful. This is a great example of an AI application beneficial to humanity. Conversely, OpenAI went for a vicious, cynical blitz on low-hanging fruit proofs, leaving mathematicians to sort out the resulting mess over coming months, without any hope to get any credit for it, and they didn't even release the model they used. This is a great example of an AI application detrimental to humanity.
I don’t get it! Did you see structural biologists, myself included, throw an absolutely tantrum when DeepMind released AlphaFold and the AlphaFold DB?? They trained on the PDB , the collective effort of the entire structural biology community. No, they were given a Nobel Prize and everyone was thrilled to have this incredible tool. We didn’t lose our jobs, it empowered us to go further
43
139
7
999
40,516
WE COUNT THE ENEMIES WE KILL. WE RARELY COUNT THE ONES WE CREATE. Nidal Hasan was a patient on my floor in the surgical trauma ICU at Brooke Army Medical Center. I wasn't there when he arrived. I had just left for my deployment to Mosul, Iraq. But the nurses and doctors who cared for him were my peers and my friends, and I know exactly what that required of them, because every one of us had done some version of it before. Before anyone tells me what strength looks like, understand what that work demands. I have cared for a drunk driver who wiped out an entire family and landed in our ICU himself. I have cared for gang members who shot up a block while children were stepping off a school bus, then ended up on our unit with bullets of their own. I have kept alive people who murdered their own families and failed at taking their own lives. And in Iraq, I saved the lives of the very enemy fighters who had just tried to kill us and miraculously survived our response. Every one of those patients got our best. Not because we felt anything for them, but because of who we were. You set aside anger, grief, prejudice and every personal feeling you have, because a life in front of you is a life in front of you. That's the oath. That's the duty. So when Hasan came through those doors, my colleagues did what we had always done. They preserved the life of a man who murdered thirteen people and would have killed them too, given the chance. He killed those men and women in one of the very same buildings many Soldier's like myself have been in when I was stationed at Fort Hood. He is alive today because they did their jobs. That was not sentiment. It was a hard, tangible expression of the values this country claims to stand for. Our principles had to mean something even when the person benefiting from them had violated everything we believed in. Now the Pentagon plans to livestream his execution by firing squad on Dec. 3, and our leaders apparently believe turning his death into a public spectacle will demonstrate American strength. I think it demonstrates how little they understand the enemy they claim to be fighting. We kept Nidal Hasan alive, now our leaders want to make him a martyr. Hasan walked into Fort Hood expecting to die. He believed his death would be rewarded. At his trial, he called no witnesses and offered no defense, and his own court-appointed lawyers worried he was seeking execution. He failed at martyrdom once. Now we're about to hand it to him, in high definition, for every extremist with an internet connection to replay, manipulate and celebrate. We supply the footage. They supply the meaning. Long after the politicians finish congratulating themselves, that video will still exist. Their moment of bravado becomes somebody else's recruiting material for decades. And this failure to think past the immediate display of power reaches far beyond one execution. We count the enemies we kill. We rarely count the enemies we create. Look at the school in Minab, Iran, where multiple investigations attributed the strike that killed more than 100 children and their teachers to us. You cannot bury people's children beneath the rubble of their classrooms and expect a speech about American intentions to decide how they remember you. No denial brings those children home. No claim of good intentions makes their parents forget whose weapons killed them. If those were our children, we would remember for the rest of our lives. We would demand accountability. Many of us would want vengeance. We would tell their stories to the next generation. We know this because we did exactly that after September 11. Why do we imagine other people love their children less, grieve less deeply, or remember less clearly? We have developed a horrifying talent for creating more terrorists than we will ever stop. We inflict suffering, evade responsibility, and then act as though the anger that follows came out of nowhere. Think back to the first time you saw one of those al Qaeda videos of an American being beheaded. Remember the sickness in your stomach. Remember the rage. Remember thinking that only savages would film a killing and send it out for the world to watch. Now ask yourself what the rest of the world will see when the camera is ours. Terrorist organizations stage executions for the cameras. Authoritarian regimes make death a public spectacle to feed fear and rage. Watching our own leaders reach for those same tools should force us to confront how much of ourselves we are surrendering in the name of defeating them. The line separating us from the people we condemn has to live in our conduct. A flag cannot hold it for us. Neither can a uniform, a title, or a declaration that we are the good guys. On that ICU floor, on a bloody street in Mosul, and in trauma bays across this country, people like my colleagues hold that line every day under circumstances most will never face. They keep monsters alive because their duty and their humanity are bigger than their hatred of what those monsters have done. Execute him if that's the sentence. But do it the way a confident nation does; quietly, lawfully, and without giving him the stage he always wanted. Let him be forgotten. I expect our leaders to show at least as much discipline as the nurses who had to care for him. They keep telling us they are defending what makes America different. Every day, they make that difference harder to see. Robert W. Burns III is the editor and publisher of The Space Coast Rocket, an Army veteran and a retired trauma nurse. The views expressed in this column are his own.
650
3,020
476
9,827
607,681
Kevin D. Keck retweeted
I joined OpenAI as an intern in 2019. I came back in 2025 because I believed something of that culture survived. I co-led the safety cases program, coined "pacing", the idea 394 colleagues backed in a petition, pushed for independent legal review of the DoW contract, worked towards a multilab commitment on opaque architectures, and launched the alignment blog. Then I was fired, supposedly over an inbox IT never removed.
8
23
7
929
122,395
Yes and hear, hear!
Lovely post by @OReingold26757 requesting that senior mathematicians and theoretical computer scientists jump over the stages of grief into the productive action stage. Including to try to push on alignment!
216