Quiet launch of book 1 of a series I'm writing and self publishing for my kids.
Remote
Eric Mann
@ericmann@tekton.network
mastodon
4.6.4
Tekton, programmer, woodworker, cook. Specializing in #PHP, #cryptography, and #security. #fedi22
1090
Followers
159
Following
50
Posts
Joined August 12, 2018
PayPal:
Blog:
Gravatar:
Keyoxide:
Posts
Relaunched my publishing imprint with a new site to combat the squatter otherwise impersonating me. I've been using this name for publishing since 2008.
It seems a squatter bought my old domain, loaded it with an Archive.org scrape to mimic an "established website," and is trying to sell it for $675 using my copyrighted blog content.
Yeah ... filing abuse complaints over morning coffee is not how I wanted to start my day ...
Just learned that, somehow, an old WordPress site of a defunct business of mine is still working. And someone in Bulgaria bought my lapsed domain and pointed it at said site...
Ugh.
This is not gonna be fun to unwind.
Replying to
@ramsey@phpc.social
@ramsey@phpc.social @saramg@fosstodon.org @Crell@phpc.social I ran through things too, just to check. And yeah, it knows my IP. And what browser/OS I'm using. But that's it ... and also what I'd expect unless I'm intentionally VPNing or spoofing any of the above.
Running my own LLM systems on local hardware means I control the compute, I control the attack surface, and I control the data.
It's a serious upgrade over using somewhat flaky (and privacy-stupid) cloud providers.
Why I Left Crypto and Found Canton
I was initially skeptical of blockchain, so I investigated a cross-chain DeFi protocol. I found its engineering compelling and joined up. After a series of ethical concerns pulled me away, I pivoted to Canton, drawn by its robust privacy architecture and established institutional support.
Introducing Cantool: A CLI for Canton Developers
Cantool is a new Go CLI tool designed to streamline application development on the Canton Network, unifying the process from project initiation to deployment. It integrates existing tools for a smoother workflow, introduces an AI-assisted MCP server for enhanced development, and boasts extensibility through a plugin system.
Open question for #WordPress folks: if you could interact directly with an LLM from your theme or plugin (directly, not via external API calls)what would you use that capability for?
If you've spent time building on Ethereum, Solana, or any of the major L2s, Canton will feel unfamiliar in ways that go deeper than syntax. The differences reflect fundamentally different design priorities.
I'm also really happy with squeezing as much performance out of this as possible. Especially considering the hidden "bonus features" added to appease my own vanity.
This isn't one of the Easter eggs, but still nice to know I'm capable of building a secure website ;-)
Replying to
@finlaydag33k@social.linux.pizza
@finlaydag33k@social.linux.pizza I didn't want to hide things _too_ well. But you've found ... some of the eggs thus far ;-)
Burned the midnight oil over the past few days updating https://eamann.com
Whacha think? (Did you find any Easter eggs?)
I was able to hack my way to functionality with Lan Mouse ... but it's not as feature-rich as Synergy or Deskflow. Here's hoping the @system76@fosstodon.org team work some magic in the meantime ...
Upgraded my Thelio to Pop_OS! 24.04 last night. I love how snappy the Cosmic Desktop is.
Except ... I can't use my virtual KVM software anymore with the Mac :-( Here's hoping support for that comes soon.
Attempted to update to Pop_OS! 24.04 on one of my devices (a NUC that serves as a k3s agent node). Something got stuck and I ended up with 800+ broken packages :-(
OS Refresh to the rescue...
Replying to
@manchuck@phpc.social
@manchuck@phpc.social that's almost the exact response I had for the manager who'd said that originally too.
Buy them the tools
Jensen Huang wants engineers spending $250k/yr in tokens. Others say that's reckless. But the debate over company-sponsored tool budgets isn't new — and neither is the answer.
Replying to
@manchuck@phpc.social
@manchuck@phpc.social @ramsey@phpc.social No, yes? Or maybe a write-in?
You ever get to that point where you're consciously calm but subconsciously so stressed that your sleep suffers, you have no appetite, and you just feel exhausted by even existing?
Yeah, I hit that mark a few days ago ... :-(
I built a cryptography tool with AI agents. They shipped bonus features before the core product existed. Tests passed because they tested the wrong thing.
The agents wrote great code. The harness let them ship it without connecting it.
Lesson: AI agents need completion gates, data contracts, and integration tests — the same things as junior devs.
Full retrospective: https://eric.mann.blog/the-agentic-harness-problem-why-ai-agents-need-better-guardrails-than-code-reviews/
New open source tool: tss-ceremony
An interactive terminal animation of a DKLS23 threshold ECDSA signing ceremony. Real crypto values, real signatures, verifiable with OpenSSL.
Built with Go + Bubbletea. 20 scenes walking through keygen, signing, verification, and a FROST comparison.
`go install https://github.com/DisplaceTech/tss-ceremony@latest`
Read more => https://eric.mann.blog/watch-cryptography-happen-a-terminal-animation-for-threshold-signatures/
#golang #cryptography #opensource #security #ThresholdSignatures
Private keys are single points of failure. We've all known this, but we treat it as an operational problem — HSMs, rotation schedules, access policies.
Threshold signatures make it a *cryptographic* problem instead. DKLS23 splits a key across parties so no one holds the full secret, and the output is standard ECDSA.
I wrote up a plain-language explainer: https://eric.mann.blog/why-one-key-shouldnt-rule-them-all-threshold-signatures-for-the-rest-of-us/
Part 1 of a 3-part series. #cryptography #security #ECDSA #ThresholdSignatures
Day job is transitioning to a new org, which would mean at least 4 months of working without pay if I stay the course.
Time to double down on Displace.
Who needs infra consulting? Who wants an MCP server for their API? Who needs PHP dev?
Let's talk...
The Upfront Investment That Saves 10,000 Hours
There's a pattern in tech where people mock the setup cost of automation without accounting for the return. I spent a day building a Grunt-based WordPress bootstrapper in 2013. Fortune 500 companies are still running code built on that foundation today.
https://eric.mann.blog/the-upfront-investment-that-saves-10000-hours/
I spend my weekends orchestrating resilient, multi-agent workflows on vanity projects I build in my free time. How about you?
Used a swarm of agents to build an Android interface for https://swordfish.displace.tech today. Still needs a round or two of polish before it goes to the Play store but I'm pretty happy so far!
Submitted my first new WordPress plugin in ages today to the repo. If/When it's approved I'll share some more information about it :-)
Could it eventually be a core project perhaps?
On the one hand we have soldiers reporting their commanders are literally telling them they're “anointed by Jesus to light the signal fire in Iran to cause Armageddon and mark his return to Earth"
On the other hand we have the Secretary of State defending the attack on Iran because "The Ayatollah was a radical cleric. That entire regime is led by radical clerics who make decisions on the basis of their view of theology, which is an apocalyptic one."
Experimenting with various AI tools for text-to-image generation to populate a training set to build my own models to hand-craft a specific generator system for ebook covers.
No, it's not as simple as "ask Claude to do it." There's a real art to fine-tuning the training data and getting a stable LoRA model for diffusion ...
I found out after the fact that the judges didn't even visit the GitHub repo or view the YouTube demo I posted for them. There's a high chance they skipped my submission entirely.
Which makes me question whether or not my efforts were wasted entirely...
I'm a very competitive person. I always have been. And it sucks. I hate losing.
So when I enter a hackathon and work on something I'm really passionate about ... and lose out to projects that look like knockoffs of Lovable or a vanilla Claude interface ... it sours my mood quite a bit.
I'm happy to lose to things that are objectively better - and many of the winners were quite good. But the handful that felt like trolls ... ugh.
Welp. I didn't win the hackathon. Which is personally quite disappointing as I was super excited about Firebreak as a project.
Kudos to those who made the top 10 though!
I wrote earlier about defense AI drift. Today I built the engineering solution.
Firebreak: policy-as-code enforcement for LLM APIs. Pre-negotiated rules. Automatic enforcement. Full audit trails.
Built at the Portland Claude Code hackathon. Proves the pattern I proposed in my DOD article actually works.
Read more on my blog: https://eric.mann.blog/from-defense-ai-drift-to-policy-enforcement-why-i-built-firebreak/
Demo: https://youtu.be/70zQLbZpNds
Code: https://github.com/ericmann/firebreak
I've been submitting a talk on ethics in software development to every conference I've attended for nearly a decade.
Now y'all understand why...
I spent several years working in defense AI. I joined for the cybersecurity mission. I left when the mission drifted somewhere I couldn't follow.
I've never written about this publicly. But watching Anthropic hold the line against the Pentagon this week, I recognized the pattern.
The gravity that pulls defense AI from defensive to offensive applications is structural. It
doesn't require bad intentions. I watched it operate from the inside.
Here's what I learned.
https://eric.mann.blog/the-gravity-problem-why-defense-ai-companies-drift-toward-offense/
Using one agent to decompose a project spec into milestones and tickets in Linear so other agents can autonomously build out project features.
This is the future :-)
LinkedIn Recruiter: Would you be interested in a job as a "Software Engineer 5?"
Me: For who doing what paid how?
LIR: Heavy Golang and Python. Agentic integrations. Fortune 100 company. Contract, no benefits. Half of what you make now.
Me: You're kidding, right?
I mean, they're both Linux ... but trying to dogfood the "heterogeneous infrastructure" paradigm I so often preach ...
Running 2x Ubuntu and 1x Pop!_OS on three different Beelink machines is ... interesting.
Finally got around to repurposing a discarded NUC and now have a 2-agent/1-controller k3s cluster rocking all of my stuff. Much more reliable.
Upgraded the systems (and k3s itself) across the board as well.
The fun (?) thing is the new agent is on Pop!_OS instead of Ubuntu...
My parents got a letter, addressed to me, claiming my data was breached from Columbia University.
Which ...
Why did they have my data at all? Never attended there. Never applied...
Passed some of my writing work through an "AI detector" and it came back with a "60-80% chance this is AI generated" and a note that "it's too polished, human writers make subtle mistakes. This prose has none."
High school me would appreciate the compliment. Since I wrote it nearly 30 years ago ...
But if this is the state of the art for AI detection, we have problems.
Still looking for beta readers on this novella. Comments enabled. Eternal gratitude offered :-)