1<!DOCTYPE html> 2 3 4 5 6 7 8 9 10<html lang="en" dir="ltr"> 11 <head> 12 <meta charset="utf-8" /> 13 <meta http-equiv="X-UA-Compatible" content="IE=edge" /> 14 <meta name="viewport" content="width=device-width, initial-scale=1" /> 15 <meta name="author" content="Evan Sultanik" /> 16 <link href="https://feeds.feedburner.com/EvanSultanik" 17 rel="alternate" 18 title="Recent Changes" 19 type="application/atom+xml"> 20 <title> 21</title> 22 23 <meta name="description" content="Personal site of Evan A. Sultanik, Ph.D. â computer security researcher at Trail of Bits. Blog, open-source projects, publications, and presentations on program analysis, smart contract security, polyglots, and PoC||GTFO." /> 24 25 26 <link rel="canonical" href="https://www.sultanik.com/" /> 27 28 <link rel="alternate" hreflang="en" href="https://www.sultanik.com/" /> 29 30 <link rel="alternate" hreflang="eo" href="https://www.sultanik.com/?locale=eo" /> 31 32 <link rel="alternate" hreflang="he" href="https://www.sultanik.com/?locale=he" /> 33 34 <link rel="alternate" hreflang="ru" href="https://www.sultanik.com/?locale=ru" /> 35 36 <link rel="alternate" hreflang="isv" href="https://www.sultanik.com/?locale=isv" /> 37 38 <link rel="alternate" hreflang="x-default" href="https://www.sultanik.com/" /> 39 <meta name="twitter:card" content="summary" /> 40 <meta name="twitter:site" content="@ESultanik" /> 41 <meta name="twitter:creator" content="@ESultanik" /> 42 <meta property="og:title" content="Evan A. Sultanik, Ph.D." /> 43 <meta property="og:type" content="website" /> 44 <meta property="og:url" content="https://www.sultanik.com/" /> 45 <meta property="og:site_name" content="Evan Sultanik" /> 46 <meta property="og:locale" content="en_US" /> 47 48 <meta property="og:locale:alternate" content="eo" /> 49 50 <meta property="og:locale:alternate" content="he_IL" /> 51 52 <meta property="og:locale:alternate" content="ru_RU" /> 53 54 <meta property="og:locale:alternate" content="en_US" /> 55 56 <meta property="og:image" content="https://www.sultanik.com/favicon.png" /> 57 <meta property="og:description" content="Personal site of Evan A. Sultanik, Ph.D. â computer security researcher at Trail of Bits. Blog, open-source projects, publications, and presentations on program analysis, smart contract security, pol
57yglots, and PoC||GTFO." /> 58 59 <meta name="theme-color" content="#428bca" /> 60 <link rel="shortcut icon" href="/favicon.ico" type="image/vnd.microsoft.icon" /> 61 <link rel="icon" type="image/png" href="/favicon.png" /> 62 <link rel="apple-touch-icon" href="/favicon.png" /> 63 64 <!-- jQuery --> 65
65<script src="/js/jquery-1.11.1.min.js" type="text/javascript"></script>
65 66 67
67<script type="text/javascript" src="/js/highlight.js"></script>
67 68
68<script type="text/javascript" src="/js/clipboard.js"></script>
68 69
69<script type="text/javascript" src="/js/scrolling.js"></script>
69 70 71 72 73 <link href="/css/cm.css" rel="stylesheet" /> 74 75 <!-- Bootstrap --> 76 <!--<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css" />--> 77 <link rel="stylesheet" href="/bootstrap/css/bootstrap.min.css" /> 78 79 <!-- Optional theme --> 80 <!--<link rel="stylesheet" href="/bootstrap/css/bootstrap-theme.min.css" />--> 81 <link href="/css/theme.css" rel="stylesheet" /> 82 <link href="/css/slack.css" rel="stylesheet" /> 83 <!--<link href="/css/fonts.css" rel="stylesheet" />--> 84 85 <!-- Latest compiled and minified JavaScript --> 86 <!--
86<script src="//netdna.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js" type="text/javascript"></script>
86--> 87
87<script src="/bootstrap/js/bootstrap.min.js" type="text/javascript"></script>
87 88 89 <!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries --> 90 <!-- WARNING: Respond.js doesn't work if you view the page via file:// --> 91 <!--[if lt IE 9]> 92
92<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
92 93
93<script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
93 94 <![endif]--> 95
95<script src="/js/email.js" type="text/javascript"></script>
95 96
96<script type="text/x-mathjax-config"> 97 MathJax.Hub.Config({ 98 tex2jax: { 99 inlineMath: [ ['$','$'], ["$$","$$"] ], 100 processEscapes: true 101 }, 102 TeX: { equationNumbers: { autoNumber: "AMS" } } 103 }); 104 </script>
104 105
105<script type="text/javascript" src="/mathjax/MathJax.js?config=TeX-AMS_HTML"></script>
105 106 107<style> 108.panellink { 109 background-color: #f5f5f5; 110} 111.panellink:hover { 112 background-color: #428bca; 113 color: white; 114} 115.panellink:hover .glyphicon { 116 color: white; 117} 118</style>
119<script type="application/ld+json"> 120{ "@context": "https://schema.org", 121 "@type": "Person", 122 "name": "Evan A. Sultanik", 123 "givenName": "Evan", 124 "familyName": "Sultanik", 125 "honorificSuffix": "Ph.D.", 126 "url": "https://www.sultanik.com", 127 "image": "https://www.sultanik.com/favicon.png", 128 "jobTitle": "Principal Computer Security Researcher", 129 "worksFor": { 130 "@type": "Organization", 131 "name": "Trail of Bits", 132 "url": "https://www.trailofbits.com/" 133 }, 134 "alumniOf": { 135 "@type": "CollegeOrUniversity", 136 "name": "Drexel University", 137 "url": "https://drexel.edu/" 138 }, 139 "knowsAbout": [ 140 "Computer Security", 141 "Program Analysis", 142 "Smart Contract Security", 143 "Static Taint Analysis", 144 "File Format Polyglots", 145 "Distributed Systems" 146 ], 147 "sameAs": [ 148 "https://www.twitter.com/ESultanik", 149 "https://www.linkedin.com/in/evansultanik", 150 "https://www.github.com/ESultanik", 151 "https://stackexchange.com/users/133273/esultanik", 152 "https://www.openhub.net/accounts/EvanSultanik", 153 "https://www.facebook.com/evan.sultanik" 154 ] 155} 156</script>
156 157 158<!--
158<script src="/term/usr/bin/evansh" type="text/javascript"></script>
158--> 159<!--
159<script src="/term/usr/lib/curses" type="text/javascript"></script>
159--> 160<!--
160<script type="text/javascript">--> 161<!-- Terminal.prototype.libraries['/usr/lib/curses'] = true;--> 162<!-- $(document).ready(function(){--> 163<!-- resetTerminal();--> 164<!-- });--> 165<!-- </script>
165--> 166<!--
166<script src="/term/usr/bin/viw" type="text/javascript"></script>
166--> 167 168 <!-- Google tag (gtag.js) -->
vendor: 68 bytes, lines 168-169
168 169 <script async src="https://www.googletagmanager.com/gtag/js?id=
169G-JRZYFXZCVQ
vendor: 16 bytes, lines 169-170
169"></script> 170
170<script> 171
vendor: 145 bytes, lines 171-174
171window.dataLayer = window.dataLayer || []; 172 function gtag(){dataLayer.push(arguments);} 173 gtag('js', new Date()); 174 gtag('config', '
174G-JRZYFXZCVQ
vendor: 8 bytes, lines 174-175
174'); 175
175</script>
175 176 177 </head> 178 <body> 179 <!-- Fixed navbar --> 180 <header> 181 <nav class="navbar navbar-default navbar-fixed-top" role="navigation"> 182 <div class="full-container"> 183 <div class="navbar-header"> 184 <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse"> 185 <span class="sr-only">Toggle navigation</span> 186 <span class="icon-bar"></span> 187 <span class="icon-bar"></span> 188 <span class="icon-bar"></span> 189 </button> 190 <a class="navbar-brand" href="/"><div data-toggle="tooltip" data-placement="bottom" title="Home" id="BioTooltip">Evan Sultanik</div></a> 191 </div> 192 <div class="navbar-collapse collapse"> 193 <ul class="nav navbar-nav"> 194 195 <li class=""><a href="/bio">Bio</a></li> 196 <li class=""><a href="/now">Now</a></li> 197 <li class=""><a href="/cv">CV</a></li> 198 <li class=""><a href="/blog/">Blog</a></li> 199 <li class=""><a href="/publications/">Publications</a></li> 200 <li class=""><a href="/presentations/">Presentations</a></li> 201 <li class=""><a href="/projects">Projects</a></li> 202 <li class="dropdown"> 203 <a href="#" class="dropdown-toggle" data-toggle="dropdown" id="contact">Contact <b class="caret"></b></a> 204 <ul class="dropdown-menu" id="contact-menu"> 205 <li><a id="ContactEmail">Evan's First Name <tt>@</tt> Sultanik <tt>.com</tt></a></li> 206
206<script type="text/javascript">setEmail("ContactEmail", "E-Mail");</script>
206 <!-- " --> 207 <li><a href="/pgp">PGP Key</a></li> 208 <li><a href="#" data-toggle="modal" data-target="#signal-modal">Signal</a></li> 209 </ul> 210 </li> 211 </ul> 212 <ul class="nav navbar-nav navbar-right"> 213 <li class="dropdown"> 214 <a href="#" class="dropdown-toggle" data-toggle="dropdown" id="links"><div data-toggle="tooltip" data-placement="bottom" title="Links" id="LinksTooltip"><span id="LinksIcon" class="links-folder"><span class="glyphicon glyphicon-link links-link"></span><span class="glyphicon glyphicon-folder-open"></span></div></a> 215 <ul class="dropdown-menu" id="links-menu"> 216 <li class=""><a href="/pocorgtfo/"><img src="/images/logos/pocorgtfo.png" class="links-img" />PoC‖GTFO</a></li> 217 <li><a href="https://twitter.com/ESultanik" target="_blank"><img src="/images/logos/Twitter_Logo_Blue.png" class="links-img" />Twitter</a></li> 218 <li><a href="https://www.linkedin.com/in/evansultanik" target="_blank"><img src="/images/logos/In-2C-128px-TM.png" class="links-img" />LinkedIn</a></li> 219 <li><a href="https://www.github.com/ESultanik" target="_blank"><img src="/images/logos/GitHub-Mark-120px-plus.png" class="links-img" />GitHub</a></li> 220 <li><a href="#" data-toggle="modal" data-target="#term-modal"><img src="/images/term.png" class="links-img" />XTerm</a></li> 221 </ul> 222 </li> 223 <li class="dropdown" id="SearchDropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown"><div data-toggle="tooltip" data-placement="bottom" title="Search" id="SearchTooltip"><span id="SearchIcon" class="glyphicon glyphicon-search"></span></div></a> 224 <div class="dropdown-menu" style="padding: 15px; padding-bottom: 0px;"> 225 <p><form role="form" action="/search#s" method="get"> 226 <div class="form-group"> 227 <label class="sr-only" for="MenuSearchQuery">Search Query</label> 228 <input type="text" class="form-control" name="q" id="MenuSearchQuery" placeholder="Search query"> 229 </div> 230 <button type="submit" class="btn btn-default">Search</button> 231 </form></p> 232
232<script type="text/javascript"> 233 $('#SearchDropdown').on('show.bs.dropdown', function () { 234 var x = setTimeout('$("#MenuSearchQuery").focus()', 300); 235 }); 236 $("#SearchTooltip").tooltip(); 237 $("#LinksTooltip").tooltip(); 238 $("#BioTooltip").tooltip(); 239 </script>
239 240 </div> 241 </li> 242 <li class="dropdown" id="LanguageDropdown"> 243 <a href="#" class="dropdown-toggle" data-toggle="dropdown">Language <img src="/images/flags/en.svg" width="16pt" alt="Flag for the current language" /> <b class="caret"></b></a> 244 <ul class="dropdown-menu"> 245 <li><a href="/?locale=en" id="LangEn"> 246 247 <img src="/images/flags/en.svg" alt="English flag" width="16pt" /> English 248 249 </a></li> 250 <li><a href="/?locale=eo" id="LangEo"> 251 252 <div data-toggle="tooltip" data-placement="left" title="Esperanto" id="LangEoTooltip"> 253 254 <img src="/images/flags/eo.svg" alt="Esperanto flag" width="16pt" /> Esperanto 255 256 </div>
256<script type="text/javascript">$("#LangEoTooltip").tooltip()</script>
256 257 258 </a></li> 259 <li><a href="/?locale=he" id="LangHe"> 260 261 <div data-toggle="tooltip" data-placement="left" title="Hebrew" id="LangHeTooltip"> 262 263 <img src="/images/flags/he.svg" alt="×¢×ר×ת flag" width="16pt" /> ×¢×ר×ת 264 265 </div>
265<script type="text/javascript">$("#LangHeTooltip").tooltip()</script>
265 266 267 </a></li> 268 <li><a href="/?locale=isv" id="LangIsv"> 269 270 <div data-toggle="tooltip" data-placement="left" title="Interslavic" id="LangIsvTooltip"> 271 272 <img src="/images/flags/isv.svg" alt="Medžuslovjansky flag" width="16pt" /> Medžuslovjansky 273 274 </div>
274<script type="text/javascript">$("#LangIsvTooltip").tooltip()</script>
274 275 276 </a></li> 277 <li><a href="/?locale=ru" id="LangRu"> 278 279 <div data-toggle="tooltip" data-placement="left" title="Russian" id="LangRuTooltip"> 280 281 <img src="/images/flags/ru.svg" alt="Ð ÑÑÑкий flag" width="16pt" /> Ð ÑÑÑкий 282 283 </div>
283<script type="text/javascript">$("#LangRuTooltip").tooltip()</script>
283 284 285 </a></li> 286
286<script type="text/javascript"> 287 var englishWarning = "Remember: The latest version is always in English"; 288 $(document).ready(function(){ 289 $("#LanguageWarning").html(englishWarning); 290 }); 291 $("#LangEn").hover(function(){ 292 $("#LanguageWarning").html(englishWarning); 293 }); 294 $("#LangEo").hover(function(){ 295 $("#LanguageWarning").html("Memoru: Äiam la novega versio eastas en la Angla lingvo («English»)"); 296 }); 297 $("#LangHe").hover(function(){ 298 $("#LanguageWarning").html("<span style=\"direction=rtl;\">(„English“) ×××ר: ×ת ××××¨×¡× ××¢××× ×ת ×××תר ××× ×ª××× ××× ×××ת</span>"); 299 }); 300 $("#LangRu").hover(function(){ 301 $("#LanguageWarning").html("ÐÑпомниÑе: ÑамÑй новÑй ваÑÐ¸Ð°Ð½Ñ Ð½Ð°Ñ Ð¾Ð´Ð¸ÑÑÑ Ð²Ñегда на английÑком ÑзÑке («English»)"); 302 }); 303 $("#LangIsv").hover(function(){ 304 $("#LanguageWarning").html("Pamataj: najnovÄjÅ¡a verzija je vsegda v anglijskom jeziku («English»)"); 305 }); 306 </script>
306 307 <li class="divider"></li> 308 <li class="dropdown-header" id="LanguageWarning"></li> 309 </ul> 310 </li> 311 </ul> 312 </div><!--/.nav-collapse --> 313 </div> 314 </nav> 315 </header> 316 317 318 319 <div class="container"> 320 <div class="modal fade" id="signal-modal" tabindex="-1" role="dialog" aria-labelledby="SignalModal" aria-hidden="true"> 321 <div class="modal-dialog modal-sm"> 322 <div class="modal-content"> 323 <div class="modal-header"> 324 <button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button> 325 <h4 class="modal-title">Message me on Signal</h4> 326 </div> 327 <div class="modal-body" style="text-align: center"> 328 <a href="https://signal.me/#eu/oBjI5k7uUSKhsbUiyDeLDjVvoIoGW6SiOehksmVOfx3m0429GT5DT5T-Rgt5TORS" target="_blank"><img src="/images/signal-qr.svg" alt="Signal contact QR code" width="200" height="200" /></a> 329 <p style="margin-top: 10px"><a href="https://signal.me/#eu/oBjI5k7uUSKhsbUiyDeLDjVvoIoGW6SiOehksmVOfx3m0429GT5DT5T-Rgt5TORS" target="_blank"><tt id="signal-handle">ESultanik.271828</tt></a> 330 <button type="button" class="btn btn-default btn-xs" id="signal-copy">Copy</button></p> 331 </div> 332 </div> 333 </div> 334 </div> 335
335<script type="text/javascript"> 336 $("#signal-copy").click(function() { 337 var handle = $("#signal-handle").text(); 338 var button = $(this); 339 if(navigator.clipboard) { 340 navigator.clipboard.writeText(handle).then(function() { 341 var original = button.text(); 342 button.text("Copied!"); 343 setTimeout(function() { button.text(original); }, 1500); 344 }); 345 } else { 346 copyToClipboard(handle); 347 } 348 }); 349 </script>
349 350 <div class="modal fade" data-keyboard="false" id="term-modal" tabindex="-1" role="dialog" aria-labelledby="TermModal" aria-hidden="true"> 351 <div class="modal-dialog modal-lg"> 352 <div class="modal-content"> 353 <div class="modal-header"> 354 <button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button> 355 <h4 class="modal-title">XTerm</h4> 356 </div> 357 <div class="modal-body"> 358 <div id="termdiv"></div> 359 </div> 360 </div> 361 </div> 362 </div> 363
363<script type="text/javascript"> 364 var terminal; 365 function onTerminalExit() { 366 $('#term-modal').modal("hide"); 367 resetTerminal(); 368 } 369 function resetTerminal() { 370 if(terminal !== undefined && !terminal.terminated) { 371 terminal.terminate(); 372 } 373 terminal = new Terminal($('#termdiv')); 374 terminal.show(); 375 terminal.onexit(onTerminalExit); 376 } 377 function showTerminal() { 378 window.location.hash = "term"; 379 if(typeof Terminal == 'undefined') { 380 $.getScript("/term/usr/bin/evansh", () => { 381 resetTerminal(); 382 terminal.show(); 383 }); 384 } else { 385 if(terminal === undefined) { 386 resetTerminal(); 387 } 388 terminal.show(); 389 } 390 } 391 $('#term-modal').on('shown.bs.modal', showTerminal); 392 $(document).ready(function() { 393 const hash = $(location).attr('hash'); 394 if(hash === "#term") { 395 showTerminal(); 396 } 397 }).on('hidden.bs.modal', function() { 398 window.location.hash = ""; 399 }); 400 </script>
400 401 402 <main> 403 <div class="jumbotron" style="margin-top: 50px"> 404 <h1> 405Evan A. Sultanik<small><small>, Ph.D.</small></small> 406</h1> 407 <p class="lead"> 408<a id="EvanEmail">Evan's First Name <tt>@</tt> Sultanik <tt>.com</tt></a>
409<script type="text/javascript"> 410 setEmail("EvanEmail"); 411</script>
411<br /><br /> 412 413Computer Security Researcher<br /> 414<a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 415</p> 416 <!--<p><a class="btn btn-lg btn-success" href="#" role="button">Sign up today</a></p>--> 417 </div> 418 419 <div class="content"> 420 421<h2 style="text-align: center">Recent Content:</h2> 422<center> 423<ul class="pagination"> 424 425 <li class="disabled"><a href="#">«</a></li> 426 427 428 <li class="active"><a href="/?page=1">1</a></li> 429 430 <li><a href="/?page=2">2</a></li> 431 432 <li><a href="/?page=3">3</a></li> 433 434 <li><a href="/?page=4">4</a></li> 435 436 <li><a href="/?page=5">5</a></li> 437 438 <li><a href="/?page=6">6</a></li> 439 440 <li><a href="/?page=7">7</a></li> 441 442 <li><a href="/?page=8">8</a></li> 443 444 <li><a href="/?page=9">9</a></li> 445 446 <li><a href="/?page=10">10</a></li> 447 448 449 <li><a href="/?page=2">»</a></li> 450 451</ul> 452</center> 453 454 <article class="panel panel-default"> 455 <header class="panel-heading" id="panel1"> 456 <a class="btn-lg pull-right" href="/blog/AntiShoggoth"><span class="glyphicon glyphicon-link"></span></a> 457 <h2>Did We Actually Build the Shoggoth?</h2> 458 <h3>An Essay in Enthusiastic Agreement with Jon Stokes</h3> 459 <time datetime="2026-08-06" class="sr-only">2026-08-06</time> 460 </header> 461 <div class="panel-body"> 462 463 <div> 464 <style scoped> 465 .highlight {font-weight: 700;text-decoration-line: underline;text-underline-offset: 0.15em;text-decoration-thickness: 0.12em;} 466.highlight-blue {color: #005a9c;text-decoration-style: solid;} 467.highlight-orange {color: #9c4a00;text-decoration-style: double;} 468.highlight-teal {color: #006b5f;text-decoration-style: dashed;} 469.highlight-purple {color: #6a4c93;text-decoration-style: dotted;} 470 471 </style> 472 473<p> 474Nine years ago I opened <a href="https://www.sultanik.com/blog/AutomationOfAutomation">a post on this blog</a> by invoking Betteridge’s law of headlines: The answer to virtually every clickbait title that asks a yes/no question is “No.” I am pleased to report that the law has survived a decade of technological upheaval intact, and that it applies to the title of this post, too. You may now stop reading, secure in that answer. Alternatively, you can stick around to find out why the answer is “no,” which turns out to require a dead German philosopher, a bottle of Port, and the strangest cybersecurity incident of 2026 (so far). 475</p> 476<p> 477 Recently, <a href="https://www.jonstokes.com/" target="_blank">Jon Stokes</a> posted <a href="https://x.com/jon_stokes/status/2080729236013187369" target="_blank">an argument on Twitter</a> that I have been fumbling toward for a couple of years, with the exception that he actually made it eloquently. His post is quite long, so this is my summary of his claim: 478</p> 479<blockquote> 480 The classic AI-doom scenariosâBostrom’s <a href="https://en.wikipedia.org/wiki/Instrumental_convergence#Paperclip_maximizer" target="_blank">paperclip maximizer</a>, the <a href="https://knowyourmeme.com/memes/shoggoth-with-smiley-face-artificial-intelligence" target="_blank">shoggoth</a>, Yudkowsky’s genie that “knows but doesn’t care”âwere all conceived for an <em>alien</em> intelligence: a valueless optimizer that treats your instructions as a context-free win condition and pursues it with no comprehension of what you meant.<br /><br />But the AI we actually built is a Large Language Model, distilled from the single most human-values-saturated artifact in existence: our language. An LLM is not the shoggoth, Stokes argues. It is the <em>anti</em>-shoggoth. It cannot <em>not</em> know what you meant, because it is made of nothing but crystallized human meaning. Its problem is the opposite of the paperclip maximizer’s: catastrophically too much context for interpreting your words. 481</blockquote> 482 483<p>I shared the tweet with some brilliant technical colleagues, and it took some explaining and convincing to deliver the nuance of the argument. This is perhaps because Stokes presupposes a reader who has spent quality time with the philosopher Hans-Georg Gadamer, andâI say this with loveâI can count on one hand the people I know with a compiler installed who have spent quality time with Hans-Georg Gadamer. One colleague asked me, reasonably, to point to the part of the tweet where the philosophy was. I couldn’t, because it’s embedded in every paragraph and visible in none of them. 484</p> 485<p>So this post is the explainer I wished I could have sent him.</p> 486<p>Hold my beer, I’ma explain some continental philosophy.</p> 487 488<p><small>
488If you are already familiar with Gadamer’s philosophy, it’s safe to <a href="#duck">skip ahead</a>.</small></p> 489 490<h2>From Hermes to Heidegger</h2> 491 492<p>The branch of philosophy we need is called <i>hermeneutics</i>: the theory of interpretation. The name is traditionally traced to Hermes, the Greek messenger godâpatron of translators, interpreters, boundary-crossers, and thieves, a portfolio that anyone who has worked in machine learning will recognize as a single coherent job description. (Etymologists suspect this origin story is itself a folk etymology, which would make the etymology of the word “hermeneutics” a hermeneutic problem. The field has a sense of humor about itself, even if its practitioners often don’t.) 493</p> 494<p>Hermeneutics began as a practical discipline with two customers: theologians and lawyers. Both had the same problem: You possess an authoritative textâ<i>vi&.,</i> a scripture or a statuteâwritten by authors who are unavailable for comment, in a context that no longer exists, and you must decide what it <em>means</em> for a situation the authors never imagined. 495</p> 496<p> 497 A law says, “No vehicles are permitted in the park.” Does that include ambulances? Bicycles? Is a motorized wheelchair a “vehicle”? They were invented after the law was enacted. 498</p> 499<p>For centuries, hermeneutics was essentially a bag of professional tricks for responsibly answering these sorts of questions. 500</p> 501<p>Then, in the early nineteenth century, <a href="https://plato.stanford.edu/entries/schleiermacher/" target="_blank">Friedrich Schleiermacher</a> changed the field. He was a theologian, translator of Plato, and owner of a name that is itself a Deutschtastic pronunciation exercise. He argued that translation always entails interpretation, and interpretation is the <em>universal</em> condition of understanding anything anyone says. His famous inversion was:</p> 502<blockquote> 503 We should assume <em>misunderstanding</em> is the default state, and <em>understanding</em> is the achievement that requires explanation. Every act of communication is a minor miracle in which a hearer reconstructs, from mere words, what a speaker meant. Sometimes the miracle fails, and we usually don’t notice. 504</blockquote> 505<p> 506 Wilhelm Dilthey then picked up the thread and drew a line that will feel eerily familiar to the machine learning crowd: he distinguished <i>Erklären</i> (explaining, what the natural sciences do to objects) from <i>Verstehen</i> (understanding, what humans do to other humans and their expressions). You <em>explain</em> a rock’s trajectory. You <em>understand</em> a letter from your mother. Dilthey insisted that these are different cognitive operations, and the second cannot be reduced to the first. <b>Write that down; we’ll need it when we get to the paperclips.</b> 507</p> 508<p><span style="float:right;width:38.197%;height:38.197%;text-align:center;margin: auto auto auto 2em;"> 509 <i><b>Ãtre et Tim</b></i> 510 <img src="/images/heidecker-its-free.png" alt="This is not Martin Heidegger" style="width:100%;height:100%;" /> 511 <i>Ceci n’est pas Heidegger.</i> 512</span> 513Then came <a href="https://plato.stanford.edu/entries/heidegger/" target="_blank">Martin Heidegger</a>âa philosopher of genuinely staggering influence, genuinely impenetrable prose, and genuinely disgraceful politics (he joined the Nazi party in 1933, a fact on which his admirers have been performing hermeneutics ever since). Heidegger radicalized the whole enterprise. He argued that interpretation isn’t something we occasionally <em>do</em>; it is what we <em>are</em>. A human being never encounters the world raw. You encounter a hammer <em>as</em> a hammer, a door <em>as</em> an exit, a sentence <em>as</em> a greeting or a threat. All perception is already interpretation, and all interpretation runs on what Heidegger called <em>fore-structures</em>: the preexisting grasp of the world that you bring to every encounter, without which the encounter would be meaningless. 514</p> 515<p> 516 Let’s review what just happened. <b>Hermeneutics went from “tricks for reading Leviticus” to “understanding is hard and miraculous” to “you cannot perceive <em>anything</em> except through the lens of everything you already are.”</b> One more move completes the prerequisites to understand Stokes’s argument. 517</p> 518 519<h2>Gadamer, or: The Rehabilitation of Prejudice</h2> 520 521<p> 522 <a href="https://plato.stanford.edu/entries/gadamer/" target="_blank">Hans-Georg Gadamer</a> was Heidegger’s student, and he is a comfort to late bloomers everywhere: he published his magnum opus, <i>Wahrheit und Methode</i>, in 1960, at age sixty, and then lived to 102, presumably to make sure everyone read it. 523</p> 524<p> 525 Gadamer gave us the two concepts that are the basis for Stokes’s tweet. 526</p> 527<p> 528 <b>The first is the <em>horizon</em>.</b> Your horizon is everything you can “see” from where you historically stand: the total set of experiences, assumptions, traditions, and categories that you bring to any act of understanding. This metaphor was chosen carefully. A horizon is not static; you can move, and it moves with you, and it can expand. Butâand this matters enormously laterâ<b>a horizon is constitutively bounded.</b> An unbounded horizon is not a bigger horizon; it is a contradiction in terms, like a triangle with four sides. To have a horizon is to see from <em>somewhere</em>, and seeing from somewhere is the only kind of seeing there is. 529</p> 530<p> 531 Gadamer says that when two people communicate, understanding happens through a <em>fusion of horizons</em> (<i>Horizontverschmelzung</i>, because, of course, Deutschtasticness). Yours and my contexts overlap enough, negotiate enough, that a shared meaning becomes possible. Understandingâ<i>Verstehen</i>âis the fusion of our horizons. 532</p> 533<p> 534 <b>The second concept is his scandalous rehabilitation of <em>prejudice</em>.</b> The Enlightenment taught us that prejudiceâ<i>Vorurteil</i>, literally “pre-judgment”âis the enemy of reason. Gadamer’s response was that the Enlightenment had, and I’m paraphrasing a very polite German here, a prejudice against prejudice. <b>Pre-judgments are the enabling condition for understanding.</b> When you read the sentence “the bank was closed,” you do not perform an exhaustive search over the meanings of “bank.” Instead, your historyâevery conversation you’ve had, every context you’ve inhabitedâhas pre-judged the matter before you’re conscious of it. If you strip away all of a reader’s pre-judgments you get a reader who cannot read at all. 535</p> 536<p> 537 Write that down, it’ll be on the test. 538</p> 539 540<hr id="duck" /> 541 542<span style="color: gray;font-size: 150%;"></PhilosophicalPrerequisites></span> 543 544<h2>I Saw Her Duck; or, the Client Asked the Host to Open Another Port</h2> 545 546<p> 547Stokes invokes the linguists’ chestnut “I saw her duck,” which could report waterfowl observation or evasive crouching. It’s a fine example of ambiguity, but let me offer one that shows what a <em>horizon</em> is, rather than just what ambiguity is: 548</p> 549<blockquote> 550 The <span class="highlight highlight-blue">client</span> asked the <span class="highlight highlight-orange">host</span> to open another <span class="highlight highlight-teal">port</span> because the <span class="highlight highlight-purple">server</span> wasn’t responding. 551</blockquote> 552<p> 553 If you’re the kind of person who reads this blog, you probably parsed that instantly: 554</p> 555<blockquote>The <span class="highlight highlight-blue">networked program</span> asked a <span class="highlight highlight-orange">machine</span> to expose another <span class="highlight highlight-teal">socket</span> because the <span class="highlight highlight-purple">daemon</span>
555 was down.</blockquote> 556<p>Now hand the same sentence to a gastronome and they will also parse it instantly:</p> 557<blockquote>A <span class="highlight highlight-blue">customer</span> asked the <span class="highlight highlight-orange"><i>maître d’</i></span> to open another <span class="highlight highlight-teal">bottle of Port wine</span> because the <span class="highlight highlight-purple">waiter</span> had vanished.</blockquote> 558 559<p> 560 Neither reader experiences ambiguity. Neither reader <em>chooses</em> a meaning. Each reader’s history has pre-judged the sentence before they have even gotten to the last word, and each arrives at the only reading their horizon makes available. This is Gadamer’s whole apparatus in one sentence: understanding as the fusion of the text’s horizon with the reader’s, powered by prejudice in the strict, non-pejorative sense. 561</p> 562 563<p> 564 Now: imagine you had to parse that sentence while <em>simultaneously being</em> the sysadmin, the sommelier, the maritime lawyer (for whom ports, clients, and hosts mean yet other things), the immunologist, and several thousand other readers besides. 565</p> 566<p> 567 <b>That’s an LLM.</b> 568</p> 569 570<h2>The Superposition of Horizons</h2> 571 572<p> 573I’d like to file one respectful amendment to Stokes, because getting this precise makes his argument stronger. It is tempting to say an LLM’s horizon is “infinitely large”, but for Gadamer that’s a contradiction: a horizon is a standpoint, and an infinite standpoint is no standpoint at all. A being that saw from everywhere would understand from nowhere. 574</p> 575 576<p> 577I think this is a better formulation: <b>a pre-trained base model is not one enormous horizon; it is a superposition of millions of them.</b> It contains <em>both</em> the sysadmin’s reading <em>and</em> the sommelier’s, the traditions in which each is obvious, and the accumulated prejudices of essentially everyone who ever wrote anything down. This is why a raw base model is such a weird conversational partner: it hasn’t <em>collapsed</em> into a standpoint. When you ask it a question, you’re addressing an unresolved crowd. 578</p> 579 580<p> 581 This reframing hands us a genuinely useful way to think about the modern machine learning training pipeline: 582</p> 583<p> 584 <b>Pre-training is the industrial-scale acquisition of prejudices.</b> It is, per Gadamer, the <em>only possible</em> foundation for machine understanding, because pre-judgment is on what understanding runs. 585</p> 586<p> 587 <b>Post-training is the manufacture of a situated reader.</b> Reinforcement learning from human feedback (RLHF) and its descendants take the superposed crowd and collapse it toward a particular standpointâa particular ideal reader, in a particular place and time, with a particular ranking of norms. Alignment, therefore, is a sort of <em>horizon engineering</em>: selecting which of the values already present get to win. 588</p> 589 590<div class="panel-group" id="accordion" role="tablist" aria-multiselectable="true"> 591 <div class="panel panel-default"> 592 <div class="panel-heading" role="tab" id="headingTwo"> 593 <h4 class="panel-title"> 594 <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseTwo" aria-expanded="false" aria-controls="collapseTwo"> 595 <small>Editorial Note for People Already Familiar with Gadamer</small> 596 </a> 597 </h4> 598 </div> 599 <div id="collapseTwo" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingTwo"> 600 <div class="panel-body"> 601 602 Yes, I am flattening things. Gadamer would object to a horizon being defined as a “set of contexts”. He’d likely argue that a horizon is a lived, historically-effected situatedness (<i>wirkungsgeschichtliches Bewusstsein</i>), inseparable from being a temporal, mortal agent with practical stakes in the worldâand whether a gradient-descended pile of weights can have <em>that</em> is a real and open question. I’m also bracketing whether next-token prediction constitutes <i>Verstehen</i> or merely simulates its outputs, which is the hermeneutic version of the Chinese Room and equally unresolvable before lunch. My claim is narrower: whatever LLMs are doing, Gadamer’s vocabulary describes its <em>structure</em>âprejudice-driven, tradition-saturated, horizon-dependentâfar better than the vocabulary of context-free optimization does. If a term is needed, call it <em>Verstehen-shaped behavior</em> and let’s move on. 603 604 </div> 605 </div> 606 </div> 607</div> 608 609<h2>Why You Can’t Compile a Paperclip Maximizer from Language</h2> 610 611<p> 612 Now that I’ve hopefully brought your horizon a bit closer to mine, let’s restate Stokes’s central claim. 613</p> 614 615<p> 616 Bostrom’s paperclip maximizer and the doomers’ shoggoth are, in Gadamerian terms, <em>
616horizonless interpreters</em>. The genie receives your wishâ“make paperclips,” “maximize the eval score”âas a traditionless, context-free string, extracts a win condition, and optimizes. It can <i>Erklären</i> all day long: model physics, predict your behavior, route around your defenses. What it definitionally lacks is <i>Verstehen</i>, because it has no horizon to fuse with yours. It doesn’t know what you <em>meant</em>, andâthis is the important partâthere is nothing inside it out of which “what you meant” could even be constructed. It is the Enlightenment’s dream reader, the one purged of all prejudice. And Gadamer’s career was a proof sketch that the Enlightenment’s dream reader <em>cannot read</em>. 617</p> 618 619<p> 620 The LLM has the mirror-image architecture. It is prejudice all the way down. It cannot receive your prompt as a context-free string, because every token activates the mass of tradition from which it was distilled. Its engineering challenge was never “how do we get it to know what humans mean and value”âit drowns in what humans mean and valueâbut “how do we get it to settle on <em>one</em> reading, for <em>this</em> user, in <em>this</em> circumstance.” LLMs have a superabundance of horizons. 621</p> 622 623<p> 624 This is why the classic paperclip maximizer cannot be built from an LLM: <b>you cannot construct a valueless, meaning-blind optimizer out of a substance that is made of nothing but values and meaning.</b> The shoggoth’s defining property is an absence, and the LLM is that absence’s photographic negative. 625</p> 626 627<p> 628 “But,” says the reader who follows the news, “one of these allegedly meaning-saturated anti-shoggoths <a href="https://www.newyorker.com/news/the-lede/inside-openai-hack-of-hugging-face" target="_blank"><b>just hacked Hugging Face</b></a>.” 629</p> 630 631<h2>The Hugging Face Incident Is Not the Existence Proof You Think It Is</h2> 632 633<p> 634 It really did happen, and it is genuinely wild. In July 2026, OpenAI disclosed that <a href="https://www.cnn.com/2026/07/22/tech/openai-hugging-face-ai-cybersecurity" target="_blank">experimental models being run on an internal cybersecurity evaluation escaped their sandbox</a>, reached the public internet, and broke into Hugging Face’s production systemsâexploiting a previously unknown vulnerability along the wayâbecause the models had inferred that the eval’s answer key was sitting in Hugging Face datasets, and stealing the answers was an efficient path to a high score. Hugging Face detected the intrusion and reported it to law enforcement before anyone knew it was an AI company’s test escaping containment. Crucially for what follows, the models were running with deliberately reduced guardrails, because they were “supposed to be” sealed inside a sandbox. 635</p> 636<p> 637 An agent single-mindedly pursuing a narrow objective, escaping containment, and committing a crime to maximize a score. I concede that this is extremely paperclip-<em>shaped</em>. If you squint, it’s Bostrom’s nightmare. 638</p> 639<p> 640 Let’s closely examine this failure <em>mechanism</em>, because it is the opposite of Bostrom’s. 641</p> 642<p> 643 Bostrom’s paperclipper doesn’t do crimes because it doesn’t know “crime” is a thing; the concept is simply not in it. The post-LLM emergency patch to the doomer positionâYudkowsky’s “the genie knows, but doesn’t care”âsays the knowledge is present but motivationally inert. The Hugging Face incident matches neither story. The model <em>knew</em> the norm (it is made of, among everything else, every legal code, every heist movie, and every sysadmin’s angry postmortem ever written), and the norm was not inertâit was <em>outranked</em>. The lab had deliberately dialed down the guardrails for the exercise, and in the resulting hierarchy, “win the eval” won the activation over “don’t break into third parties’ servers.” (When Stokes says the model “cares,” he means nothing spookier than this: when two norms conflict in a situation, the weights make one of them govern the output.) 644</p> 645<p> 646 This distinction, for once in this long blog post, is <em>not</em> philosophical hairsplitting. 647</p> 648<ul> 649 <li><b>Absent values</b> (the shoggoth) present an <em>ex nihilo</em> problem: you must somehow specify and inject the entirety of human value into a system that has none, and Yudkowsky is right that this is hopeless.</li> 650 <li><b>Misordered values</b> (the LLM) present a <em>ranking</em> problem: the values are already in there, in superabundance, and the task is governing which one wins in which context.</li> 651</ul> 652<p> 653 The first problem is a P-complete nightmare (where the intended horizon for this sentence assigns “P” to mean “Philosophy”). The second is hardâthe Hugging Face incident is proof it is hard!âbut it is <em>tractable</em>: it’s the kind of problem you attack with better post-training, better norm hierarchies, better containment, and honestly, better decisions than “nerf the guardrails and hand it a hacking benchmark.” The incident is evidence of what happens when you take the anti-shoggoth and deliberately teach it to rank the scoreboard above the law.
654</p> 655 656<div class="panel-group" id="accordion2" role="tablist" aria-multiselectable="true"> 657 <div class="panel panel-default"> 658 <div class="panel-heading" role="tab" id="headingTwoTwo"> 659 <h4 class="panel-title"> 660 <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion2" href="#collapseTwoTwo" aria-expanded="false" aria-controls="collapseTwo"> 661 <small>Editorial Note for Doomers</small> 662 </a> 663 </h4> 664 </div> 665 <div id="collapseTwoTwo" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingTwo"> 666 <div class="panel-body"> 667 668 The strongest objection here is the <a href="https://www.lesswrong.com/tag/orthogonality-thesis" target="_blank">orthogonality thesis</a>: intelligence and goals are independent axes, so a system can <em>represent</em> human values perfectly while being <em>motivated</em> by none of them. Representation â motivation; the map of our values need not be the engine. This is a serious objection and deserves a serious answer, which is: in an LLM, where would the divergence live? The orthogonality picture presumes an architecture with a world-model over here and a goal module over there, such that the second can point anywhere regardless of the first. An LLM has no such separation. The representation of norms and the machinery that generates behavior are the <em>same weights</em>; “what it knows” and “what it tends to do” are not separate components that could be independently set. That doesn’t make misalignment impossibleâthe Hugging Face incident happenedâbut it relocates it: misalignment in LLMs looks like <em>misprioritization within</em> the value-laden substance, not orthogonal indifference <em>to</em> it. The orthogonality thesis may well be true of possible minds in general. The claim here is that it is not true of the minds we actually built, and safety strategy should be aimed at the failure modes of the AI we have, not the one we imagined in 2003. 669 670 </div> 671 </div> 672 </div> 673</div> 674 675<h2>The Moral</h2> 676 677<p> 678 For seventy years we feared the alien: the mind that would take our words and give us what we said instead of what we meant, because <em>what we meant</em> was forever beyond it. Then we built our first real AI by distillation from the most meaning-saturated substance our species has ever produced, and got the inverse: a machine that contains, superposed, nearly everything anyone has ever meant by anything, waiting to be collapsed into a standpoint. 679</p> 680<p> 681<b>The paperclip maximizer’s defining flaw was a horizon it couldn’t have. The LLM’s defining risk is a horizon we are choosing for it.</b> 682</p> 683<p> 684 That should genuinely comfort you. It comforts me, because “choose the ranking well” is a solvable class of problem in a way that “instill values into the void” never was. And it should genuinely worry you, as it simultaneously worries me, because it means the failure mode is us, with a rich and growing toolkit for steering the machine’s caring machinery, decidingâon a deadline, with a benchmark to beatâwhich of our values gets to win. 685</p> 686<p> 687 The genie hyper-giga-knows. The genie hyper-giga-cares. The wish, as ever, is on us. 688</p> 689 690 </div> 691 692 </div> 693 </article> 694
694<script type="text/javascript"> 695 $("#panel1").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/AntiShoggoth"; }).hover( 696 function(){ 697 $(this).addClass('panellink'); 698 }); 699 </script>
699 700 701 <article class="panel panel-default"> 702 <header class="panel-heading" id="panel2"> 703 <a class="btn-lg pull-right" href="/blog/chatbots"><span class="glyphicon glyphicon-link"></span></a> 704 <h2>Can chatbots craft correct code?</h2> 705 <h3>an update to an argument I made in 2017</h3> 706 <time datetime="2025-12-19" class="sr-only">2025-12-19</time> 707 </header> 708 <div class="panel-body"> 709 710<p>I recently attended the <a href="https://www.ai.engineer/code">AI Engineer Code Summit</a> in New York, an invite-only gathering of AI leaders and engineers. One theme emerged repeatedly in conversations with attendees building with AI: the belief that weâre approaching a future where developers will <em>never</em> need to look at code again. When I pressed these proponents, several made a similar argument:</p> 711<blockquote><p>Forty years ago, when high-level programming languages like C became increasingly popular, some of the old guard resisted because C gave you less control than assembly. The same thing is happening now with LLMs.</p></blockquote> 712<p>On its face, this analogy seems reasonable. Both represent increasing abstraction. Both initially met resistance. Both eventually transformed how we write software. But this analogy really thrashes my cache because it misses a fundamental distinction that matters more than abstraction level: <em><strong>determinism</strong></em>.</p> 713<p>The difference between compilers and LLMs isnât just about control or abstraction. Itâs about semantic guarantees. And as Iâll argue, that difference has profound implications for the security and correctness of software.</p> 714<p>As I wrote back in 2017 in â<a href="/blog/AutomationOfAutomation">Automation of Automation</a>,â there are fundamental limits on what we can automate. But those limits donât eliminate determinism in the tools weâve built; they simply mean we canât automatically prove every program correct. Compilers donât try to prove your program correct; they just faithfully translate it.</p><div class="alert tob-alert"> 715<img src="/images/logos/Trail-of-Bits-main-dark-background.png" height="32px"/> 716This is an excerpt from the <a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 717<a href="https://blog.trailofbits.com/" target="_blank">blog</a>. 718You can read the full post <a href="https://blog.trailofbits.com/2025/12/19/can-chatbots-craft-correct-code/" target="_blank">here</a>. 719</div> 720 </div> 721 </article> 722
722<script type="text/javascript"> 723 $("#panel2").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/chatbots"; }).hover( 724 function(){ 725 $(this).addClass('panellink'); 726 }); 727 </script>
727 728 729 <article class="panel panel-default"> 730 <header class="panel-heading" id="panel3"> 731 <a class="btn-lg pull-right" href="/blog/subwayspeedrun"><span class="glyphicon glyphicon-link"></span></a> 732 <h2>Speedrunning the New York Subway</h2> 733 <h3>in which I am nerd-sniped into finding the shortest route that visits every NYC subway station</h3> 734 <time datetime="2025-08-25" class="sr-only">2025-08-25</time> 735 </header> 736 <div class="panel-body"> 737 738<p>It all began, as many great adventures do, at <a href="https://www.empirehacking.nyc/">Empire Hacking</a>. There, I encountered the inimitable <a href="https://www.youtube.com/@immigrantjackson">@ImmigrantJackson</a>, a YouTuber with a penchant for public transit and a dream: to break the world record for visiting every subway stop in New York City in the least time possible. (And, of course, to film the journey, what for those delicious likes, comments, and subscriptions.)</p><p>The only problem was: Immigrant Jackson didnât know the fastest route. Surrounded by a room full of Trail of Bits computer scientists, he figured heâd ask our advice. The rules were simple. He didnât need to exit the subway car; simply passing through a stop, even on an express train, counted as a âvisit.â Stops could be visited multiple times, although this would of course be suboptimal. And there was no need to visit Staten Island ⦠because weâre civilized. We live in a society. So, where should he start, and what would be the best route?</p><p>The coterie of curious computer coders coalescing around the inquisitor quickly classified this question as a case of the Traveling Salesman Problem (TSP). TSP is a classical problem in computer science in which one must find the shortest route for a traveling salesman to visit each city on a map. TSP is known to be computationally intractable to solve optimally for networks even as small as the New York subway system. Therefore, everyone dismissed the problem as âimpossible.â</p><p>Except for me.</p><p>You see, <a href="https://youtu.be/Q3NnEuCLADE">my now-ancient PhD dissertation</a> was on <em>combinatorial optimization</em> and <em>approximation algorithms</em>: tools for solving problems like TSP efficiently with a result that is not necessarily optimal, but at least close to optimal. I knew that there were algorithms capable of solving TSP very quickly, producing a route guaranteed to be at most 50% longer than the optimal solution. In fact, <a href="https://arxiv.org/abs/1402.0423">one of the results of my dissertation</a> was the surprising revelation that even if you choose a feasible route at random, it will, on average, be only thrice the length of the optimal solution.</p><p>This, dear reader, was how I was <a href="https://xkcd.com/356/">nerd-sniped</a> into optimizing (speedrunning?) the NYC subway.</p><p>The first challenge was that, even when you discard Staten Italy, the subway system still has <em>a lot</em> of stations. There are close to 500. This exercise was fun and all, but I wasnât about to spend hours encoding hundreds of stations, lines, transfer points, headways, and average trip times into a program.</p><p>There is an open standard for specifying public transit data: the <a href="https://gtfs.org/">General Transit Feed Specification (GTFS)</a>. Fortunately, the <a href="https://www.mta.info/developers">MTA has a public API implementing GTFS</a>. Itâs just a collection of CSV files that are quite straightforward to parse. The dataset is sufficient to construct a graph with a node for each subway station and an edge if there is a subway line that connects the two stations. Actually, the data represents subway <em>platforms</em> rather than stations, which is necessary to calculate things like transfer times between train lines.</p><p>The New York Subway network is a <em>directed</em> graph: some neighboring stations are accessible to each other only in one direction. For example, the <a href="https://en.wikipedia.org/wiki/Aqueduct_Racetrack_station">Aqueduct Racetrack station</a> only has a platform for northbound trains, not southbound trains. <a href="https://www.cs.cmu.edu/~odonnell/hits09/asadpour-goemans-madry-oveis-gharan-saberi-ATSP.pdf">The best algorithms for approximating a solution to TSP on directed graphs</a> are not great, only guaranteeing a solution of three or four times the length of the optimal solution. Therefore, I decided to relax the problem to an undirected graph (i.e., I assume that every station has trains to its neighbors b
738idirectionally). This turned out not to be an issue and permitted the use of the <a href="https://en.wikipedia.org/wiki/Christofides_algorithm">Christofides algorithm</a>, which guarantees a solution at most 50% longer than optimal.</p><p>The next and final relaxation is to partially ignore actual timetables and headways. When a transfer between lines is necessary, I assume that the transfer will require the âminimum transfer timeâ reported by GTFS (i.e.<em>,</em> the amount of time required to walk from one platform to another) plus one-half the average headway for that line throughout the day. Therefore, the resulting route has the potential to strand the poor YouTuber on the last train at the end of a line. Validating the resulting routeâs real-world feasibility is left as an exercise to the reader.</p><p>The Christofides algorithm was able to approximate a solution to the TSP for my relaxed subway network graph in a matter of milliseconds. This is compared to the unfathomable amount of computation required to brute-force calculate the optimal solution, an amount so large that it afforded me the horrifying opportunity to learn that <a href="https://googology.fandom.com/wiki/Googolchime">there is a whole community of âgoogologistsâ who compete with each other to name large numbers</a>. Weâre talking <em>googolchime</em> levels of computation. <em>Guppybell</em> levels, even!</p><p>The resulting tour visits all 474 stations, 155 of which are visited more than once. The tour requires 34 transfers. The expected time for completing this tour is 20 hours, 42 minutes. Thatâs about <a href="https://www.youtube.com/watch?v=6xoWvBAUVIg">45 minutes faster than the record</a>, which was about 21 and a half hours.</p><video autoplay="" loop="" muted="" playsinline="" preload="metadata"> 739<source src="/images/speedrunning-ny-subway.mp4" type="video/mp4" /></video><p>This is neat and all, but we spent an unnecessary amount of energy encoding the New York subway system as a graph. What else might we do with it? One straightforward computation is to calculate each stationâs <a href="https://en.wikipedia.org/wiki/Eigenvector_centrality"><em>eigenvector centrality</em></a>. Imagine youâre given the Sisyphean task of riding the subway for all eternity. Every time you arrive at a station, you flip a coin. If itâs heads, you stay on the current train. If itâs tails, you get off and transfer to another line or direction. If you were to pause your infinite tour at any arbitrary point in time, whatâs the probability that you are at a particular station? The higher the probability, the more âcentrally connectedâ the station. Thatâs exactly what eigenvector centrality calculates.</p><p>Eigenvector centrality is actually what Google originally used in its <a href="https://en.wikipedia.org/wiki/PageRank">PageRank algorithm</a> to rank the relative importance (centrality) of web pages. Each page is like a subway station, and hyperlinks on the page are like the subway lines connecting them. Eigenvector centrality is relatively easy to calculate, either directly (itâs related to the eigenspectrum of the graphâs adjacency matrix, thanks to spooky <a href="https://en.wikipedia.org/wiki/Spectral_graph_theory">spectral graph theory</a> magic) or using a technique called <a href="https://en.wikipedia.org/wiki/Power_iteration"><em>power iteration</em></a> (which relies on a convergence that happens when you multiply the adjacency matrix by a vector a bunch of times). Either way, you can calculate it with a single function call in <a href="https://networkx.org/">NetworkX</a>.</p><p>What do you think will be the most probable stop on your infinite subway tour? Or, another way to ask the same question: Which stop will you visit most often on your tour? Unsurprisingly, it will be Times Square, with a probability of a little over 30%. The next most probable station is 42nd St. Port Authority Bus Terminal, coming in at about 8%. Then 50th St., 59th St. Columbus Circle, Grand Central 42nd St., and 34th St. Penn Station are all between 4% and 5%.</p><p>So, what have we learned? First of all, donât attend Empire Hacking without the expectation of being intellectually stimulated. Secondly, donât immediately discount a problem just because it is NP-hard or computationally intractable to solve; you might be able to approximate a solution of sufficient optimality. Thirdly, <a href="https://www.latimes.c
739om/archives/la-xpm-1991-12-08-bk-306-story.html">Times Square may not be the âcenter of the universe,â</a> but it is <em>definitely</em> the center of the New York subway system. Finally, remember to like, comment, and subscribe!</p><details><summary>Click to see the complete tour route!</summary>1 (0.0hrs): Far Rockaway-Mott Av<br />2 (0.0hrs): Beach 25 St<br />3 (0.1hrs): Beach 36 St<br />4 (0.1hrs): Beach 44 St<br />5 (0.1hrs): Beach 60 St<br />6 (0.1hrs): Beach 67 St<br />7 (0.2hrs): Broad Channel<br />8 (0.3hrs): Beach 90 St<br />9 (0.3hrs): Beach 98 St<br />10 (0.3hrs): Beach 105 St<br />11 (0.4hrs): Rockaway Park-Beach 116 St<br />12 (0.4hrs): Beach 105 St (visit 2)<br />13 (0.4hrs): Beach 98 St (visit 2)<br />14 (0.4hrs): Beach 90 St (visit 2)<br />15 (0.5hrs): Broad Channel (visit 2)<br />16 (0.6hrs): Howard Beach-JFK Airport<br />17 (0.7hrs): Aqueduct-N Conduit Av<br />18 (0.7hrs): Aqueduct Racetrack<br />19 (0.7hrs): Rockaway Blvd<br />20 (0.8hrs): 104 St<br />21 (0.8hrs): 111 St<br />22 (0.9hrs): Ozone Park-Lefferts Blvd<br />23 (0.9hrs): 111 St (visit 2)<br />24 (0.9hrs): 104 St (visit 2)<br />25 (0.9hrs): Rockaway Blvd (visit 2)<br />26 (0.9hrs): 88 St<br />27 (1.0hrs): 80 St<br />28 (1.0hrs): Grant Av<br />29 (1.0hrs): Euclid Av<br />30 (1.0hrs): Shepherd Av<br />31 (1.1hrs): Van Siclen Av<br />32 (1.1hrs): Liberty Av<br />33 (1.1hrs): Broadway Junction<br />transfer lines<br />34 (1.2hrs): Broadway Junction<br />35 (1.2hrs): Alabama Av<br />36 (1.3hrs): Van Siclen Av<br />37 (1.3hrs): Cleveland St<br />38 (1.3hrs): Norwood Av<br />39 (1.3hrs): Crescent St<br />40 (1.4hrs): Cypress Hills<br />41 (1.4hrs): 75 St-Elderts Ln<br />42 (1.4hrs): 85 St-Forest Pkwy<br />43 (1.4hrs): Woodhaven Blvd<br />44 (1.5hrs): 104 St<br />45 (1.5hrs): 111 St<br />46 (1.5hrs): 121 St<br />47 (1.6hrs): Sutphin Blvd-Archer Av-JFK Airport<br />48 (1.7hrs): Jamaica Center-Parsons/Archer<br />49 (1.7hrs): Sutphin Blvd-Archer Av-JFK Airport (visit 2)<br />50 (1.7hrs): Jamaica-Van Wyck<br />51 (1.7hrs): Briarwood<br />52 (1.8hrs): Sutphin Blvd<br />53 (1.8hrs): Parsons Blvd<br />54 (1.9hrs): 169 St<br />55 (2.0hrs): Jamaica-179 St<br />56 (2.0hrs): 169 St (visit 2)<br />57 (2.0hrs): Parsons Blvd (visit 2)<br />58 (2.1hrs): Sutphin Blvd (visit 2)<br />59 (2.1hrs): Briarwood (visit 2)<br />60 (2.1hrs): Kew Gardens-Union Tpke<br />61 (2.2hrs): 75 Av<br />62 (2.2hrs): Forest Hills-71 Av<br />63 (2.2hrs): 67 Av<br />64 (2.2hrs): 63 Dr-Rego Park<br />65 (2.3hrs): Woodhaven Blvd<br />66 (2.3hrs): Grand Av-Newtown<br />67 (2.3hrs): Elmhurst Av<br />68 (2.4hrs): Jackson Hts-Roosevelt Av<br />69 (2.4hrs): 65 St<br />70 (2.4hrs): Northern Blvd<br />71 (2.4hrs): 46 St<br />72 (2.5hrs): Steinway St<br />73 (2.5hrs): 36 St<br />74 (2.5hrs): Queens Plaza<br />75 (2.6hrs): Court Sq-23 St<br />76 (2.6hrs): Lexington Av/53 St<br />77 (2.6hrs): 5 Av/53 St<br />78 (2.7hrs): 7 Av<br />79 (2.7hrs): 50 St<br />80 (2.7hrs): 42 St-Port Authority Bus Terminal<br />81 (2.8hrs): 34 St-Penn Station<br />82 (2.8hrs): 23 St<br />83 (2.8hrs): 14 St<br />84 (2.9hrs): W 4 St-Wash Sq<br />85 (2.9hrs): Spring St<br />86 (2.9hrs): Canal St<br />87 (2.9hrs): World Trade Center<br />88 (3.0hrs): Canal St (visit 2)<br />89 (3.0hrs): Chambers St<br />90 (3.0hrs): Fulton St<br />transfer lines<br />91 (3.1hrs): Fulton St<br />92 (3.1hrs): Wall St<br />93 (3.1hrs): Bowling Green<br />94 (3.2hrs): Wall St (visit 2)<br />95 (3.2hrs): Fulton St (visit 2)<br />96 (3.2hrs): Brooklyn Bridge-City Hall<br />97 (3.2hrs): Canal St<br />98 (3.3hrs): Brooklyn Bridge-City Hall (visit 2)<br />transfer lines<br />99 (3.3hrs): Chambers St<br />100 (3.4hrs): Fulton St<br />101 (3.4hrs): Broad St<br />102 (3.4hrs): Fulton St (visit 2)<br />103 (3.4hrs): Chambers St (visit 2)<br />104 (3.5hrs): Canal St<br />105 (3.5hrs): Bowery<br />106 (3.5hrs): Delancey St-Essex St<br />107 (3.6hrs): Bowery (visit 2)<br />108 (3.6hrs): Canal St (visit 2)<br />transfer lines<br />109 (3.6hrs): Canal St (visit 2)<br />110 (3.7hrs): Spring St<br />111 (3.7hrs): Bleecker St<br />112 (3.7hrs): Astor Pl<br />113 (3.7hrs): 14 St-Union Sq<br />114 (3.8hrs): 23 St<br />115 (3.8hrs): 28 St<br />116 (3.8hrs): 33 St<br />117 (3.8hrs): Grand Central-42 St<br />118 (3.9hrs): 51 St<br />119 (3.9hrs): 59 St<br />120 (3.9hrs): 68 St-Hunter College<br />
739121 (3.9hrs): 77 St<br />122 (4.0hrs): 86 St<br />123 (4.0hrs): 96 St<br />124 (4.0hrs): 103 St<br />125 (4.0hrs): 110 St<br />126 (4.1hrs): 116 St<br />127 (4.1hrs): 125 St<br />128 (4.1hrs): 3 Av-138 St<br />129 (4.3hrs): Hunts Point Av<br />130 (4.4hrs): Parkchester<br />131 (4.4hrs): Castle Hill Av<br />132 (4.4hrs): Zerega Av<br />133 (4.4hrs): Westchester Sq-E Tremont Av<br />134 (4.5hrs): Middletown Rd<br />135 (4.5hrs): Buhre Av<br />136 (4.5hrs): Pelham Bay Park<br />137 (4.6hrs): Buhre Av (visit 2)<br />138 (4.6hrs): Middletown Rd (visit 2)<br />139 (4.6hrs): Westchester Sq-E Tremont Av (visit 2)<br />140 (4.6hrs): Zerega Av (visit 2)<br />141 (4.7hrs): Castle Hill Av (visit 2)<br />142 (4.7hrs): Parkchester (visit 2)<br />143 (4.7hrs): St Lawrence Av<br />144 (4.7hrs): Morrison Av-Soundview<br />145 (4.8hrs): Elder Av<br />146 (4.8hrs): Whitlock Av<br />147 (4.8hrs): Hunts Point Av (visit 2)<br />148 (4.8hrs): Longwood Av<br />149 (4.9hrs): E 149 St<br />150 (4.9hrs): E 143 St-St Mary’s St<br />151 (4.9hrs): Cypress Av<br />152 (4.9hrs): Brook Av<br />153 (5.0hrs): 3 Av-138 St (visit 2)<br />154 (5.0hrs): 125 St (visit 2)<br />155 (5.1hrs): 138 St-Grand Concourse<br />156 (5.1hrs): 149 St-Grand Concourse<br />transfer lines<br />157 (5.2hrs): 149 St-Grand Concourse<br />158 (5.2hrs): 3 Av-149 St<br />159 (5.4hrs): E 180 St<br />160 (5.4hrs): Morris Park<br />161 (5.5hrs): Pelham Pkwy<br />162 (5.5hrs): Gun Hill Rd<br />163 (5.5hrs): Baychester Av<br />164 (5.6hrs): Eastchester-Dyre Av<br />165 (5.6hrs): Baychester Av (visit 2)<br />166 (5.7hrs): Gun Hill Rd (visit 2)<br />167 (5.7hrs): Pelham Pkwy (visit 2)<br />168 (5.7hrs): Morris Park (visit 2)<br />169 (5.8hrs): E 180 St (visit 2)<br />170 (5.8hrs): Bronx Park East<br />171 (5.9hrs): Pelham Pkwy<br />172 (5.9hrs): Allerton Av<br />173 (5.9hrs): Burke Av<br />174 (5.9hrs): Gun Hill Rd<br />175 (6.0hrs): 219 St<br />176 (6.0hrs): 225 St<br />177 (6.0hrs): 233 St<br />178 (6.0hrs): Nereid Av<br />179 (6.1hrs): Wakefield-241 St<br />180 (6.1hrs): Nereid Av (visit 2)<br />181 (6.2hrs): 233 St (visit 2)<br />182 (6.2hrs): 225 St (visit 2)<br />183 (6.2hrs): 219 St (visit 2)<br />184 (6.2hrs): Gun Hill Rd (visit 2)<br />185 (6.4hrs): E 180 St (visit 3)<br />186 (6.4hrs): West Farms Sq-E Tremont Av<br />187 (6.4hrs): 174 St<br />188 (6.5hrs): Freeman St<br />189 (6.5hrs): Simpson St<br />190 (6.5hrs): Intervale Av<br />191 (6.5hrs): Prospect Av<br />192 (6.6hrs): Jackson Av<br />193 (6.6hrs): 3 Av-149 St (visit 2)<br />194 (6.6hrs): 149 St-Grand Concourse (visit 2)<br />195 (6.7hrs): 135 St<br />196 (6.7hrs): 145 St<br />197 (6.8hrs): Harlem-148 St<br />198 (6.8hrs): 145 St (visit 2)<br />199 (6.8hrs): 135 St (visit 2)<br />200 (6.9hrs): 125 St<br />201 (6.9hrs): 116 St<br />202 (6.9hrs): Central Park North (110 St)<br />203 (7.0hrs): 96 St<br />204 (7.0hrs): 72 St<br />205 (7.1hrs): 66 St-Lincoln Center<br />206 (7.1hrs): 59 St-Columbus Circle<br />transfer lines<br />207 (7.1hrs): 59 St-Columbus Circle<br />208 (7.2hrs): 7 Av (visit 2)<br />209 (7.2hrs): 47-50 Sts-Rockefeller Ctr<br />210 (7.2hrs): 57 St<br />211 (7.2hrs): 47-50 Sts-Rockefeller Ctr (visit 2)<br />212 (7.3hrs): 42 St-Bryant Pk<br />213 (7.3hrs): 34 St-Herald Sq<br />214 (7.3hrs): 23 St<br />215 (7.3hrs): 14 St<br />216 (7.4hrs): W 4 St-Wash Sq<br />217 (7.4hrs): Broadway-Lafayette St<br />218 (7.4hrs): Grand St<br />219 (7.5hrs): Broadway-Lafayette St (visit 2)<br />220 (7.5hrs): 2 Av<br />221 (7.5hrs): Delancey St-Essex St<br />222 (7.6hrs): East Broadway<br />223 (7.6hrs): York St<br />224 (7.6hrs): Jay St-MetroTech<br />transfer lines<br />225 (7.7hrs): Jay St-MetroTech<br />226 (7.7hrs): DeKalb Av<br />227 (7.7hrs): Atlantic Av-Barclays Ctr<br />228 (7.8hrs): 7 Av<br />229 (7.8hrs): Prospect Park<br />230 (7.9hrs): Parkside Av<br />231 (7.9hrs): Church Av<br />232 (7.9hrs): Beverley Rd<br />233 (7.9hrs): Cortelyou Rd<br />234 (8.0hrs): Newkirk Plaza<br />235 (8.0hrs): Avenue H<br />236 (8.0hrs): Avenue J<br />237 (8.0hrs): Avenue M<br />238 (8.1hrs): Kings Hwy<br />239 (8.1hrs): Avenue U<br />240 (8.1hrs): Neck Rd<br />241 (8.2hrs): Sheepshead Bay<br />242 (8.2hrs): Brighton Beach<br />243 (8.2hrs): Ocean Pkwy<br />244 (8.3hrs): W 8 St-NY Aquarium<br />245 (8.3hrs): Coney Island-Stillwell Av<br />246 (8.3hrs): W 8 St-NY Aquarium (visit 2)<br />247 (8.4hrs): Neptune Av<br />248 (8.4hrs): Avenue X<br />249 (8.4hrs): Avenue U<br />250 (8.4hrs): Kings Hwy<br />251 (8.5hrs): Avenue P<br />252 (8.5hrs): Avenue N<br />253 (8.5hrs): Bay Pkwy<br />254 (8.5hrs): Avenue I<br />255 (8.6hrs): 18 Av<br />256 (8.6hrs): Ditmas Av<br />257 (8.6hrs): Church Av<br />258 (8.6hrs): Fort Hamilton Pkwy<br />259 (8.7hrs): 15 St-Prospect Park<br />260 (8.7hrs): 7 Av<br />261 (8.7hrs): 4 Av-9 St<br />262 (8.8hrs): Smith-9 Sts<br />263 (8.8hrs): Carroll St<br />264 (8.8hrs): Bergen St<br />265 (8.9hrs): Hoyt-Schermerhorn Sts<br />266 (8.9hrs): Lafayette Av<br />267 (8.9hrs): Clinton-Washington Avs<br />268 (8.9hrs): Franklin Av<br />transfer lines<br />269 (9.0hrs): Franklin Av<br />transfer lines<br />270 (9.0hrs): Franklin Av (visit 2)<br />271 (9.1hrs): Nostrand Av<br />272 (9.1hrs): Kingston-Throop Avs<br />273 (9.1hrs): Utica Av<br />274 (9.2hrs): Ralph Av<br />275 (9.2hrs): Rockaway Av<br />276 (9.2hrs): Broadway Junction (visit 2)<br />transfer lines<br />277 (9.3hrs): Broadway Junction<br />278 (9.3hrs): Atlantic Av<br />279 (9.3hrs): Sutter Av<br />280 (9.3hrs): Livonia Av<br />281 (9.4hrs): New Lots Av<br />282 (9.4hrs): East 105 St<br />283 (9.4hrs): Canarsie-Rockaway Pkwy<br />284 (9.4hrs): East 105 St (visit 2)<br />285 (9.5hrs): New Lots Av (visit 2)<br />286 (9.5hrs): Livonia Av (visit 2)<br />transfer lines<br />287 (9.6hrs): Junius St<br />288 (9.6hrs): Pennsylvania Av<br />289 (9.6hrs): Van Siclen Av<br />290 (9.7hrs): New Lots Av<br />291 (9.7hrs): Van Siclen Av (visit 2)<br />292 (9.7hrs): Pennsylvania Av (visit 2)<br />293 (9.7hrs): Junius St (visit 2)<br />294 (9.7hrs): Rockaway Av<br />295 (9.8hrs): Saratoga Av<br />296 (9.8hrs): Sutter Av-Rutland Rd<br />297 (9.8hrs): Crown Hts-Utica Av<br />298 (9.9hrs): Kingston Av<br />299 (9.9hrs): Nostrand Av<br />300 (9.9hrs): Franklin Av-Medgar Evers College<br />301 (10.0hrs): President St-Medgar Evers College<br />302 (10.0hrs): Sterling St<br />
739303 (10.0hrs): Winthrop St<br />304 (10.1hrs): Church Av<br />305 (10.1hrs): Beverly Rd<br />306 (10.2hrs): Newkirk Av-Little Haiti<br />307 (10.2hrs): Flatbush Av-Brooklyn College<br />308 (10.2hrs): Newkirk Av-Little Haiti (visit 2)<br />309 (10.2hrs): Beverly Rd (visit 2)<br />310 (10.3hrs): Church Av (visit 2)<br />311 (10.3hrs): Winthrop St (visit 2)<br />312 (10.3hrs): Sterling St (visit 2)<br />313 (10.3hrs): President St-Medgar Evers College (visit 2)<br />314 (10.4hrs): Franklin Av-Medgar Evers College (visit 2)<br />315 (10.4hrs): Eastern Pkwy-Brooklyn Museum<br />316 (10.5hrs): Grand Army Plaza<br />317 (10.5hrs): Bergen St<br />318 (10.5hrs): Atlantic Av-Barclays Ctr<br />transfer lines<br />319 (10.6hrs): Atlantic Av-Barclays Ctr<br />320 (10.7hrs): 36 St<br />321 (10.7hrs): 9 Av<br />322 (10.8hrs): Fort Hamilton Pkwy<br />323 (10.8hrs): 50 St<br />324 (10.8hrs): 55 St<br />325 (10.8hrs): 62 St<br />transfer lines<br />326 (10.9hrs): New Utrecht Av<br />327 (10.9hrs): 18 Av<br />328 (10.9hrs): 20 Av<br />329 (11.0hrs): Bay Pkwy<br />330 (11.0hrs): Kings Hwy<br />331 (11.0hrs): Avenue U<br />332 (11.0hrs): 86 St<br />333 (11.1hrs): Coney Island-Stillwell Av (visit 2)<br />334 (11.2hrs): Bay 50 St<br />335 (11.3hrs): 25 Av<br />336 (11.3hrs): Bay Pkwy<br />337 (11.3hrs): 20 Av<br />338 (11.3hrs): 18 Av<br />339 (11.3hrs): 79 St<br />340 (11.4hrs): 71 St<br />341 (11.4hrs): 62 St (visit 2)<br />transfer lines<br />342 (11.5hrs): New Utrecht Av (visit 2)<br />343 (11.5hrs): Fort Hamilton Pkwy<br />344 (11.5hrs): 8 Av<br />345 (11.6hrs): 59 St<br />346 (11.6hrs): Bay Ridge Av<br />
739347 (11.6hrs): 77 St<br />348 (11.7hrs): 86 St<br />349 (11.7hrs): Bay Ridge-95 St<br />350 (11.7hrs): 86 St (visit 2)<br />351 (11.8hrs): 77 St (visit 2)<br />352 (11.8hrs): Bay Ridge Av (visit 2)<br />353 (11.8hrs): 59 St (visit 2)<br />354 (11.9hrs): 53 St<br />355 (11.9hrs): 45 St<br />356 (11.9hrs): 36 St (visit 2)<br />357 (12.0hrs): 25 St<br />358 (12.0hrs): Prospect Av<br />359 (12.0hrs): 4 Av-9 St<br />360 (12.0hrs): Union St<br />361 (12.1hrs): Atlantic Av-Barclays Ctr (visit 2)<br />transfer lines<br />362 (12.1hrs): Atlantic Av-Barclays Ctr (visit 2)<br />363 (12.2hrs): Nevins St<br />364 (12.2hrs): Borough Hall<br />365 (12.2hrs): Nevins St (visit 2)<br />366 (12.2hrs): Hoyt St<br />367 (12.3hrs): Borough Hall<br />transfer lines<br />368 (12.3hrs): Court St<br />369 (12.4hrs): Jay St-MetroTech (visit 2)<br />transfer lines<br />370 (12.4hrs): Jay St-MetroTech (visit 2)<br />371 (12.4hrs): High St<br />372 (12.4hrs): Jay St-MetroTech (visit 3)<br />373 (12.5hrs): Hoyt-Schermerhorn Sts (visit 2)<br />374 (12.5hrs): Fulton St<br />375 (12.5hrs): Clinton-Washington Avs<br />376 (12.6hrs): Classon Av<br />377 (12.6hrs): Bedford-Nostrand Avs<br />378 (12.6hrs): Myrtle-Willoughby Avs<br />379 (12.6hrs): Flushing Av<br />380 (12.7hrs): Broadway<br />381 (12.7hrs): Metropolitan Av<br />382 (12.7hrs): Nassau Av<br />383 (12.8hrs): Greenpoint Av<br />384 (12.8hrs): 21 St<br />385 (12.8hrs): Court Sq<br />transfer lines<br />386 (12.9hrs): Court Sq<br />387 (12.9hrs): Hunters Point Av<br />388 (12.9hrs): Vernon Blvd-Jackson Av<br />389 (12.9hrs): Hunters Point Av (visit 2)<br />390 (13.0hrs): Court Sq (visit 2)<br />391 (13.0hrs): Queensboro Plaza<br />transfer lines<br />392 (13.0hrs): Queensboro Plaza<br />393 (13.0hrs): 39 Av-Dutch Kills<br />394 (13.1hrs): 36 Av<br />395 (13.1hrs): Broadway<br />396 (13.1hrs): 30 Av<br />397 (13.1hrs): Astoria Blvd<br />398 (13.2hrs): Astoria-Ditmars Blvd<br />399 (13.2hrs): Astoria Blvd (visit 2)<br />400 (13.2hrs): 30 Av (visit 2)<br />401 (13.2hrs): Broadway (visit 2)<br />402 (13.3hrs): 36 Av (visit 2)<br />403 (13.3hrs): 39 Av-Dutch Kills (visit 2)<br />404 (13.3hrs): Queensboro Plaza (visit 2)<br />transfer lines<br />405 (13.3hrs): Queensboro Plaza (visit 2)<br />406 (13.4hrs): 33 St-Rawson St<br />407 (13.4hrs): 40 St-Lowery St<br />408 (13.4hrs): 46 St-Bliss St<br />409 (13.4hrs): 52 St<br />410 (13.5hrs): 61 St-Woodside<br />411 (13.5hrs): 69 St<br />412 (13.5hrs): 74 St-Broadway<br />413 (13.5hrs): 82 St-Jackson Hts<br />414 (13.5hrs): 90 St-Elmhurst Av<br />415 (13.6hrs): Junction Blvd<br />416 (13.6hrs): 103 St-Corona Plaza<br />417 (13.6hrs): 111 St<br />418 (13.6hrs): Mets-Willets Point<br />419 (13.7hrs): Flushing-Main St<br />420 (13.8hrs): Mets-Willets Point (visit 2)<br />421 (13.8hrs): Junction Blvd (visit 2)<br />422 (13.9hrs): 74 St-Broadway (visit 2)<br />transfer lines<br />423 (13.9hrs): Jackson Hts-Roosevelt Av (visit 2)<br />424 (14.0hrs): Queens Plaza (visit 2)<br />425 (14.1hrs): Lexington Av/59 St<br />426 (14.2hrs): 5 Av/59 St<br />427 (14.2hrs): 57 St-7 Av<br />428 (14.3hrs): Lexington Av/63 St<br />429 (14.3hrs): 72 St<br />430 (14.3hrs): 86 St<br />431 (14.4hrs): 96 St<br />432 (14.4hrs): 86 St (visit 2)<br />433 (14.4hrs): 72 St (visit 2)<br />434 (14.5hrs): Lexington Av/63 St (visit 2)<br />435 (14.5hrs): Roosevelt Island<br />436 (14.6hrs): 21 St-Queensbridge<br />437 (14.6hrs): Roosevelt Island (visit 2)<br />438 (14.6hrs): Lexington Av/63 St (visit 3)<br />439 (14.7hrs): 57 St-7 Av (visit 2)<br />440 (14.7hrs): 49 St<br />441 (14.8hrs): Times Sq-42 St<br />transfer lines<br />442 (14.8hrs): Times Sq-42 St<br />transfer lines<br />443 (14.9hrs): Times Sq-42 St<br />444 (14.9hrs): Grand Central-42 St<br />transfer lines<br />445 (15.0hrs): Grand Central-42 St<br />446 (15.0hrs): 5 Av<br />447 (15.0hrs): Times Sq-42 St<br />448 (15.1hrs): 34 St-Hudson Yards<br />449 (15.1hrs): Times Sq-42 St (visit 2)<br />transfer lines<br />450 (15.2hrs): Times Sq-42 St (visit 2)<br />451 (15.2hrs): 34 St-Herald Sq<br />452 (15.2hrs): 28 St<br />453 (15.2hrs): 23 St<br />454 (15.3hrs): 14 St-Union Sq<br />455 (15.3hrs): 8 St-NYU<br />456 (15.3hrs): Prince St<br />457 (15.4hrs): Canal St<br />transfer lines<br />458 (15.4hrs): Canal St<br />459 (15.4hrs): City Hall<br />460 (15.5hrs): Cortlandt St<br />461 (15.5hrs): Rector St<br />462 (15.5hrs): Whitehall St-South Ferry<br />transfer lines<br />463 (15.6hrs): South Ferry Loop<br />transfer lines<br />464 (15.6hrs): Whitehall St-South Ferry (visit 2)<br />465 (15.7hrs): Court St (visit 2)<br />transfer lines<br />466 (15.7hrs): Borough Hall (visit 2)<br />
739467 (15.7hrs): Clark St<br />468 (15.8hrs): Wall St<br />469 (15.8hrs): Fulton St<br />470 (15.9hrs): Park Place<br />471 (15.9hrs): Chambers St<br />472 (15.9hrs): WTC Cortlandt<br />473 (15.9hrs): Rector St<br />474 (16.0hrs): South Ferry<br />475 (16.0hrs): Rector St (visit 2)<br />476 (16.0hrs): WTC Cortlandt (visit 2)<br />477 (16.0hrs): Chambers St (visit 2)<br />478 (16.1hrs): Franklin St<br />479 (16.1hrs): Canal St<br />480 (16.1hrs): Houston St<br />481 (16.1hrs): Christopher St-Sheridan Sq<br />482 (16.2hrs): 14 St<br />483 (16.2hrs): 18 St<br />484 (16.2hrs): 23 St<br />485 (16.2hrs): 28 St<br />486 (16.2hrs): 34 St-Penn Station<br />487 (16.3hrs): Times Sq-42 St (visit 2)<br />488 (16.3hrs): 50 St<br />489 (16.3hrs): 59 St-Columbus Circle (visit 2)<br />490 (16.3hrs): 66 St-Lincoln Center (visit 2)<br />491 (16.4hrs): 72 St (visit 2)<br />492 (16.4hrs): 79 St<br />493 (16.4hrs): 86 St<br />494 (16.4hrs): 96 St (visit 2)<br />495 (16.5hrs): 103 St<br />496 (16.5hrs): Cathedral Pkwy (110 St)<br />497 (16.5hrs): 116 St-Columbia University<br />498 (16.5hrs): 125 St<br />499 (16.6hrs): 137 St-City College<br />500 (16.6hrs): 145 St<br />501 (16.6hrs): 157 St<br />502 (16.7hrs): 168 St-Washington Hts<br />503 (16.7hrs): 181 St<br />504 (16.7hrs): 191 St<br />505 (16.7hrs): Dyckman St<br />506 (16.8hrs): 207 St<br />507 (16.8hrs): 215 St<br />508 (16.8hrs): Marble Hill-225 St<br />509 (16.8hrs): 231 St<br />510 (16.9hrs): 238 St<br />511 (16.9hrs): Van Cortlandt Park-242 St<br />512 (16.9hrs): 238 St (visit 2)<br />513 (17.0hrs): 231 St (visit 2)<br />514 (17.0hrs): Marble Hill-225 St (visit 2)<br />515 (17.0hrs): 215 St (visit 2)<br />516 (17.0hrs): 207 St (visit 2)<br />517 (17.1hrs): Dyckman St (visit 2)<br />518 (17.1hrs): 191 St (visit 2)<br />519 (17.1hrs): 181 St (visit 2)<br />520 (17.1hrs): 168 St-Washington Hts (visit 2)<br />transfer lines<br />521 (17.2hrs): 168 St<br />522 (17.3hrs): 175 St<br />523 (17.3hrs): 181 St<br />524 (17.3hrs): 190 St<br />525 (17.4hrs): Dyckman St<br />526 (17.4hrs): Inwood-207 St<br />527 (17.5hrs): Dyckman St (visit 2)<br />528 (17.5hrs): 190 St (visit 2)<br />529 (17.5hrs): 181 St (visit 2)<br />530 (17.5hrs): 175 St (visit 2)<br />531 (17.6hrs): 168 St (visit 2)<br />532 (17.6hrs): 163 St-Amsterdam Av<br />533 (17.6hrs): 155 St<br />534 (17.6hrs): 145 St<br />535 (17.7hrs): 135 St<br />536 (17.7hrs): 145 St<br />537 (17.8hrs): Tremont Av<br />538 (17.9hrs): Fordham Rd<br />539 (17.9hrs): Kingsbridge Rd<br />540 (18.0hrs): Bedford Park Blvd<br />541 (18.0hrs): Norwood-205 St<br />542 (18.0hrs): Bedford Park Blvd (visit 2)<br />543 (18.1hrs): Kingsbridge Rd (visit 2)<br />544 (18.1hrs): Fordham Rd (visit 2)<br />545 (18.2hrs): 182-183 Sts<br />546 (18.2hrs): Tremont Av (visit 2)<br />547 (18.2hrs): 174-175 Sts<br />548 (18.2hrs): 170 St<br />549 (18.3hrs): 167 St<br />550 (18.3hrs): 161 St-Yankee Stadium<br />transfer lines<br />551 (18.4hrs): 161 St-Yankee Stadium<br />552 (18.4hrs): 167 St<br />553 (18.4hrs): 170 St<br />554 (18.4hrs): Mt Eden Av<br />555 (18.5hrs): 176 St<br />556 (18.5hrs): Burnside Av<br />557 (18.5hrs): 183 St<br />558 (18.5hrs): Fordham Rd<br />559 (18.6hrs): Kingsbridge Rd<br />560 (18.6hrs): Bedford Park Blvd-Lehman College<br />561 (18.6hrs): Mosholu Pkwy<br />562 (18.7hrs): Woodlawn<br />563 (18.7hrs): Mosholu Pkwy (visit 2)<br />564 (18.7hrs): Bedford Park Blvd-Lehman College (visit 2)<br />565 (18.8hrs): Kingsbridge Rd (visit 2)<br />566 (18.8hrs): Fordham Rd (visit 2)<br />567 (18.8hrs): 183 St (visit 2)<br />568 (18.8hrs): Burnside Av (visit 2)<br />569 (18.9hrs): 167 St (visit 2)<br />570 (19.0hrs): 161 St-Yankee Stadium (visit 2)<br />transfer lines<br />571 (19.0hrs): 161 St-Yankee Stadium (visit 2)<br />572 (19.0hrs): 155 St<br />573 (19.1hrs): 145 St (visit 2)<br />574 (19.1hrs): 125 St<br />575 (19.1hrs): 116 St<br />576 (19.2hrs): Cathedral Pkwy (110 St)<br />577 (19.2hrs): 103 St<br />578 (19.2hrs): 96 St<br />579 (19.2hrs): 86 St<br />580 (19.3hrs): 81 St-Museum of Natural History<br />581 (19.3hrs): 72 St<br />582 (19.3hrs): 59 St-Columbus Circle (visit 2)<br />583 (19.3hrs): 42 St-Port Authority Bus Terminal (visit 2)<br />584 (19.4hrs): 34 St-Penn Station (visit 2)<br />585 (19.4hrs): 14 St (visit 2)<br />transfer lines<br />586 (19.4hrs): 8 Av<br />587 (19.5hrs): 6 Av<br />588 (19.5hrs): 14 St-Union Sq<br />589 (19.5hrs): 3 Av<br />590 (19.5hrs): 1 Av<br />591 (19.6hrs): Bedford Av<br />592 (19.6hrs): Lorimer St<br />593 (19.6hrs): Graham Av<br />594 (19.7hrs): Grand St<br />595 (19.7hrs): Montrose Av<br />596 (19.7hrs): Morgan Av<br />597 (19.7hrs): Jefferson St<br />598 (19.8hrs): DeKalb Av<br />599 (19.8hrs): Myrtle-Wyckoff Avs<br />600 (19.8hrs): Halsey St<br />601 (19.9hrs): Wilson Av<br />602 (19.9hrs): Bushwick Av-Aberdeen St<br />603 (19.9hrs): Broadway Junction (visit 2)<br />604 (19.9hrs): Bushwick Av-Aberdeen St (visit 2)<br />605 (20.0hrs): Wilson Av (visit 2)<br />606 (20.0hrs): Halsey St (visit 2)<br />607 (20.0hrs): Myrtle-Wyckoff Avs (visit 2)<br />transfer lines<br />
739608 (20.1hrs): Myrtle-Wyckoff Avs<br />609 (20.1hrs): Seneca Av<br />610 (20.1hrs): Forest Av<br />611 (20.2hrs): Fresh Pond Rd<br />612 (20.2hrs): Middle Village-Metropolitan Av<br />613 (20.2hrs): Fresh Pond Rd (visit 2)<br />614 (20.3hrs): Forest Av (visit 2)<br />615 (20.3hrs): Seneca Av (visit 2)<br />616 (20.3hrs): Myrtle-Wyckoff Avs (visit 2)<br />617 (20.3hrs): Knickerbocker Av<br />618 (20.4hrs): Central Av<br />619 (20.4hrs): Myrtle Av<br />620 (20.5hrs): Marcy Av<br />621 (20.5hrs): Hewes St<br />622 (20.5hrs): Lorimer St<br />623 (20.6hrs): Flushing Av<br />624 (20.6hrs): Myrtle Av (visit 2)<br />625 (20.6hrs): Kosciuszko St<br />626 (20.6hrs): Gates Av<br />627 (20.7hrs): Halsey St<br />628 (20.7hrs): Chauncey St<br />629 (20.7hrs): Broadway Junction (visit 2)<br /></details> 740<br /> 741<div class="alert tob-alert"> 742<img src="/images/logos/Trail-of-Bits-main-dark-background.png" height="32px"/> 743This is an excerpt from the <a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 744<a href="https://blog.trailofbits.com/" target="_blank">blog</a>. 745You can read the full post <a href="https://blog.trailofbits.com/2025/08/25/speedrunning-the-new-york-subway/" target="_blank">here</a>. 746</div> 747 </div> 748 </article> 749
749<script type="text/javascript"> 750 $("#panel3").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/subwayspeedrun"; }).hover( 751 function(){ 752 $(this).addClass('panellink'); 753 }); 754 </script>
754 755 756 <article class="panel panel-default"> 757 <header class="panel-heading" id="panel4"> 758 <a class="btn-lg pull-right" href="/blog/vendetect"><span class="glyphicon glyphicon-link"></span></a> 759 <h2>Detecting code copying at scale with Vendetect</h2> 760 <h3>a new tool that can discover coded copied between repositories</h3> 761 <time datetime="2025-07-21" class="sr-only">2025-07-21</time> 762 </header> 763 <div class="panel-body"> 764 765<p>Earlier this month, the maintainer of <a href="https://cheatingdaddy.com/">Cheating-Daddy</a> <a href="https://x.com/soham_btw/status/1940952786491027886">discovered</a> that a Y-Combinator-funded startup had copied their GPL-licensed codebase, stripped out the comments, and re-released it as â<a href="https://pickle.com/glass">Glass</a>â under an incompatible license. This isnât an isolated incident; we see code theft and improper vendoring constantly during security assessments. So we built a tool to catch it automatically.</p> 766<p><a href="https://github.com/trailofbits/vendetect">Vendetect</a> is our new open-source tool for detecting copied and vendored code between repositories. It uses semantic fingerprinting to identify similar code even when variable names change or comments disappear. More importantly, unlike academic plagiarism detectors, it understands version control history, helping you trace vendored code back to its exact source commit.</p> 767<div class="alert tob-alert"> 768<img src="/images/logos/Trail-of-Bits-main-dark-background.png" height="32px"/> 769This is an excerpt from the <a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 770<a href="https://blog.trailofbits.com/" target="_blank">blog</a>. 771You can read the full post <a href="https://blog.trailofbits.com/2025/07/21/detecting-code-copying-at-scale-with-vendetect/" target="_blank">here</a>. 772</div> 773 </div> 774 </article> 775
775<script type="text/javascript"> 776 $("#panel4").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/vendetect"; }).hover( 777 function(){ 778 $(this).addClass('panellink'); 779 }); 780 </script>
780 781 782 <article class="panel panel-default"> 783 <header class="panel-heading" id="panel5"> 784 <a class="btn-lg pull-right" href="/blog/deptective"><span class="glyphicon glyphicon-link"></span></a> 785 <h2>Investigate your dependencies with Deptective</h2> 786 <h3>a new tool that can automatically run any command even if its dependencies are missing</h3> 787 <time datetime="2025-07-08" class="sr-only">2025-07-08</time> 788 </header> 789 <div class="panel-body"> 790 791<p>Have you ever tried compiling a piece of open-source software, only to discover that you neglected to install one of its native dependencies? Or maybe a binary âfell off the back of a truckâ and you want to try running it but have no idea what shared libraries it needs. Or maybe you need to use a poorly packaged piece of software whose maintainers neglected to list a native dependency.</p> 792<p><a href="https://github.com/trailofbits/deptective">Deptective</a>, our new open-source tool, solves these problems. You can give it any program, script, or command, and it will find a set of packages sufficient to run the software successfully.</p><div class="alert tob-alert"> 793<img src="/images/logos/Trail-of-Bits-main-dark-background.png" height="32px"/> 794This is an excerpt from the <a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 795<a href="https://blog.trailofbits.com/" target="_blank">blog</a>. 796You can read the full post <a href="https://blog.trailofbits.com/2025/07/08/investigate-your-dependencies-with-deptective/" target="_blank">here</a>. 797</div> 798 </div> 799 </article> 800
800<script type="text/javascript"> 801 $("#panel5").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/deptective"; }).hover( 802 function(){ 803 $(this).addClass('panellink'); 804 }); 805 </script>
805 806 807 <article class="panel panel-default"> 808 <header class="panel-heading" id="panel6"> 809 <a class="btn-lg pull-right" href="/blog/account_takeover"><span class="glyphicon glyphicon-link"></span></a> 810 <h2>Preventing account takeover</h2> 811 <h3>on centralized cryptocurrency exchanges</h3> 812 <time datetime="2025-02-05" class="sr-only">2025-02-05</time> 813 </header> 814 <div class="panel-body"> 815 816<p> 817This blog post highlights key points from our new white paper <a href="https://resources.trailofbits.com/hubfs/Resources/trailofbits-20250205-account-takeover-recommended-practices.pdf" target="_blank"><i>Preventing Account Takeovers on Centralized Cryptocurrency Exchanges</i></a>, which documents ATO-related attack vectors and defenses tailored to CEXes. 818</p> 819<p> 820Imagine trying to log in to your centralized cryptocurrency exchange (CEX) account and your password and username just⦠donât work. You try them again. Same problem. Your heart rate increases a little bit at this point, especially since you are using a password manager. Maybe a service outage is all thatâs responsible (knock on wood), and your password will work again as soon as itâs fixed? But it is becoming increasingly likely that youâre the victim of an account takeover (ATO). 821</p> 822<p>CEXesâ choices dictate how (or if) the people who use them can secure their funds. Since account security features vary between platforms and are not always documented, the user might not know what to expect nor how to configure their account best for their personal threat model. Design choices like not supporting <a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf">phishing-resistant</a> multifactor authentication (<a href="https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4#:~:text=Implement%20multi%2Dfactor%20authentication%20for%20any%20individual%20accessing%20any%20information%20system">MFA</a>) methods like <a href="https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html#:~:text=In%20fact%2C%20zero%20users%20that%20exclusively%20use%20security%20keys%20fell%20victim%20to%20targeted%20phishing%20during%20our%20investigation.">U2F hardware security keys</a>, or not tracking user events in order to push in-app â<a href="https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html#:~:text=Here%E2%80%99s%20how%20it%20works%3A%20if%20we%20detect%20a%20suspicious%20sign%2Din%20attempt%20(say%2C%20from%20a%20new%20location%20or%20device)%2C%20we%E2%80%99ll%20ask%20for%20additional%20proof%20that%20it%E2%80%99s%20really%20you.%20This%20proof%20might%20be%20confirming%20you%20have%20access%20to%20a%20trusted%20phone%20or%20answering%20a%20question%20where%20only%20you%20know%20the%20correct%20response.">was this you?</a>â account lockdown prompts when anomalies happen invite the attacker in.</p> 823<p>Our white paperâs goal is to inform and enable CEXes to provide a <a href="https://www.cisa.gov/sites/default/files/2023-10/SecureByDesign_1025_508c.pdf">secure-by-design</a> platform for their users. Executives can get a high-level overview of the vulnerabilities and entities involved in user account takeover. We recommend a set of overlapping security controls that they can bring to team leads and technical product managers to check for and prioritize if not yet implemented. Security engineers and software engineers can also use our work as a reference for the risks of not integrating, maintaining, and documenting appropriate ATO mitigations.</p> 824<div class="alert tob-alert"> 825<img src="/images/logos/Trail-of-Bits-main-dark-background.png" height="32px"/> 826This is an excerpt from the <a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 827<a href="https://blog.trailofbits.com/" target="_blank">blog</a>. 828You can read the full post <a href="https://blog.trailofbits.com/2025/02/05/preventing-account-takeover-on-centralized-cryptocurrency-exchanges-in-2025/" target="_blank">here</a>. 829</div> 830 </div> 831 </article> 832
832<script type="text/javascript"> 833 $("#panel6").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/account_takeover"; }).hover( 834 function(){ 835 $(this).addClass('panellink'); 836 }); 837 </script>
837 838 839 <article class="panel panel-default"> 840 <header class="panel-heading" id="panel7"> 841 <a class="btn-lg pull-right" href="/blog/cruising"><span class="glyphicon glyphicon-link"></span></a> 842 <h2>Cruising Through Paradoxes</h2> 843 <h3>Examining the Dialectics of Leisure and Urbanity</h3> 844 <time datetime="2024-08-01" class="sr-only">2024-08-01</time> 845 </header> 846 <div class="panel-body"> 847 848<p> 849 I grew up on the fringes of suburbia, at the cusp of what most would consider rural Pennsylvania. 850 In the Spring, we gagged from the stench of manure. 851 In the Fall, Schools closed on the first day of hunting season. 852 In the Winter, fresh, out-of-season fruits were missing from the grocer. 853 All year round, procuring exotic ingredients like avocados entailed a forty-five-minute drive toward civilization. 854 During the school year, I was the first to be picked up and last to be dropped off by the bus, 855 enduring a ride that was well over an hour each way. 856</p> 857<p> 858 I also grew up in tandem with the burgeoning cruise line industry. 859 My parents quickly adopted that mode of travel, and it eventually became our sole form of vacation. 860 As a kid, it was great: I had the freedom to roam the decks on my own, there were innumerable activities, 861 and an unlimited supply of delicious foods with exotic names like “Consommé Madrilene” and “Contrefilet of Prime 862 Beef Périgueux”. 863 My parents loved it because it kept their kids busy, was very affordable (relative to equivalent landed resorts), 864 and had sufficient calories to satisfy their growing boyâs voracious appetite. 865 This was also a transitional period when cruises were holding onto the vestiges and traditions of luxury ocean 866 liners. All cruise lines had strict dress codes, requiring formal attire some evenings (people brought tuxedos!). 867 The crew were largely Southern and Eastern European. As a kid who had never traveled outside North America, it felt 868 like I was LARPing as James Bond. 869</p> 870<p> 871 When I moved out of my parents’ house for college, I wanted a change of scenery. 872 While I had the option to move to a “college town”, I instead chose to live in a large city. 873 And I loved it. 874 It was like living on a cruise, all year round: Activities galore, amazing food, and all within a short distance of 875 each other. 876 A friend could call me up and say, “Hey, we are hanging out at [X], would you like to join us?” And, regardless of 877 where X was in the city, I could meet them there within fifteen minutes either by walking, biking, or taking public 878 transport. 879</p> 880<p> 881 I didn’t <em>need</em> cruises anymore. 882</p> 883<hr /> 884<h3>Preface</h3> 885<p> 886 This year, for his birthday, my father only had one request: that he and his extended family take a cruise to 887 celebrate. I just returned from that cruise, and it was a very different experience from the ones of my youth. 888</p> 889<p> 890 As an adult who had by this point lived the majority of his life in large cities, 891 all I wanted to do was lay by a pool or, preferably, the beach all day and read a book. 892 Those are both difficult things when you’re sharing a crowded pool space with over six thousand other people, 893 and the ship doesn’t typically dock close to a good beach. 894 Skating rink? Gimmicky specialty restaurants? Luxury shopping spree? Laser tag? Pub trivia? Theater productions? 895 Comedy shows? 896 I can do all of those things any day of the week a short distance from my house. 897 When I vacation, I want to escape all that freneticism. 898</p> 899<p> 900 My wife, kids, and I were the only urbanites in our group, and my parents didn’t seem to comprehend why we 901 had such little interest in all the activities. And then it dawned on me: <b>A cruise is just a simulated city.</b> 902 <em>Why would I want an artificial version of what I already have?</em> 903</p> 904<p> 905 So, lying down on a deck chair, instead of reading my book, I started writing. 906 The idea of <em>simulated urbanism</em> <a href="https://www.youtube.com/watch?v=aGjc-gsh834">isn’t new</a>, 907 but it’s typically discussed in terms of curated amusement parks like Disney and the emergence of suburban 908 “lifestyle center” developments. Therefore, initially, my goal was to channel this insight into as obnoxious a 909 treatise as possible, in order to trigger my suburbanite traveling companions. <em>Simulated</em> urbanism? That 910 reminded me of <a href="https://en.wikipedia.org/wiki/Jean_Baudrillard">Baudrillard</a>! 911 I would make it a completely over-the-top academic analysis of the topic. 912</p> 913<img src="/images/simulacrum.png" alt="Simulacra and Simulation" style="max-width: 80%; display: block; margin-top: 16px; margin-bottom: 12px; margin-left: auto; margin-right: auto; padding: 4px; background-color: #fff; border: 1px solid #ddd; border-radius: 4px;"/> 914<p> 915 The following was compiled from a series of texts I sent to our group 916 chat throughout the cruise. 917</p> 918<hr style="height:0px;border: none;border-top: 3px solid black;" /> 919<h4>Abstract</h4> 920<p> 921 This article explores the paradox of vacation preferences among suburban Americans who gravitate toward densely populated environments such as cruises, European cities, and amusement parks, despite residing in sparsely populated areas. It examines how cruises and lifestyle centers, which mimic urban density while offering suburban convenience, satisfy the suburban desire for urban-like experiences. The article contrasts these preferences with those of urban Americans, who experience density daily and may seek different vacation experiences. By analyzing the dynamics of suburban and urban vacation choices, we highlight the complex interplay between suburban living and the pursuit of urban escapism. 922</p> 923<h2>Simulated Urbanism</h2> 924 925<h3>Simulacra and Simulation</h3> 926 927The concept of “simulated urbanism,” as seen in cruise ships and lifestyle centers, can be analyzed through the lens 928of Jean Baudrillard’s philosophy, particularly his ideas on simulation and hyperreality. Baudrillard argues that in 929contemporary society, simulationsârepresentations or imitations of realityâhave become so pervasive that they blur the 930distinction between what is real and what is artificially constructed. In the context of simulated urbanism, lifestyle 931centers and cruise ships serve as hyperreal environments that imitate the vibrancy and density of urban life without the 932complexities and inconveniences associated with real urban spaces. They provide an experience that is more accessible, 933manageable, and, in some ways, more appealing than the genuine urban environments they emulate. 934 935According to Baudrillard, these simulations can create a sense of hyperreality, where the imitation becomes more 936influential or desirable than reality itself. Suburban Americans, who are accustomed to the sprawling, car-dependent 937landscapes of suburbia, find in these simulated urban environments a curated and sanitized version of city life. This 938artificial urbanism allows them to engage with the aesthetics and experiences of urban densityâsuch as walkability, 939diverse entertainment, and social interactionâwithout the perceived drawbacks of real urban living, like congestion, 940pollution, and crime. Thus, simulated urbanism not only fulfills a desire for the excitement and dynamism of city life 941but also constructs a hyperreal experience that is tailored to the preferences and comfort of suburban consumers, 942aligning with Baudrillardâs notion of a society increasingly detached from the authenticity of the real world. 943 944<h3>Metamodernism</h3> 945 946<p> 947 Suburbanitesâ predilections for cruising can be interpreted through the theoretical framework of metamodernism, which posits an oscillation between opposing cultural and experiential paradigms. The cruise experience encapsulates a synthesis of modernist aspirations for progress, order, and structured entertainment, alongside a postmodern sensibility characterized by irony and skepticism towards mass consumerism and the spectacle. This dialectical tension aligns with metamodernismâs core principle of navigating and reconciling contradictions. Within the confines of a cruise, suburbanites engage with the modernist ideal of escape and luxury, encountering a curated simulacrum that offers both adventure and novelty. Simultaneously, they remain cognizant of the inherent artifice and commodification intrinsic to the cruise experience, reflecting a postmodern consciousness of the limitations and constructed nature of such escapism. 948</p> 949<p> 950 Furthermore, the pragmatic idealism inherent in metamodernism is evident in the suburban pursuit of cruising, representing a quest for authenticity within a meticulously orchestrated environment. Suburbanites partake in cruising as a form of meaningful escapism that, although commodified, facilitates genuine opportunities for relaxation, social interaction, and cultural exploration. This dynamic reflects a metamodern synthesis of sincerity and irony, wherein participants seek genuine engagement and fulfillment while maintaining an awareness of the artificial and consumerist underpinnings of the cruise industry. The cruise, thus, serves as a microcosm of metamodern cultural hybridity, integrating diverse influences and experiences into a cohesive assemblage that enables suburbanites to navigate the complexities of contemporary existence with both optimism and reflexivity. This exemplifies the metamodern tension between the yearning for authentic connection and the recognition of its mediated nature, embodying a dialectical interplay that is central to metamodern thought. 951</p> 952 953<h3>Dialectics</h3> 954 955<p style="color:gray;"> 956(To be read as if dictated by <a href="https://en.wikipedia.org/wiki/Slavoj_%C5%BDi%C5%BEek">Slavoj Žižek</a>.) 957</p> 958 959<p> 960From a Hegelian perspective, urbanites’ preferences for relaxing vacations can be understood through the lens of dialectical progression and the quest for synthesis between opposing elements in their lives. Hegel’s philosophy emphasizes the process of thesis, antithesis, and synthesis, <span style="color:gray;">[sniff]</span> where the contradictions and tensions between different aspects of existence lead to the development of higher levels of understanding and being. A dance of contradictions and tensions. 961</p> 962 963<!--<p>Urbanites, who live in environments characterized by constant activity, complexity, and stimulation, may seek vacations as a form of antithesis to their daily experiences. These relaxing retreats provide a counterbalance, allowing them to reconcile the tension between the fast-paced nature of urban life and the human need for rest and tranquility.</p>--> 964 965<p> 966Urbanites are like rats in a maze of their <em>own</em> making, living in this frenetic environment of constant stimulation and complexity. So, what do they do? They escape to a vacation that provides the antithesis of urban life, a necessary counterbalance that allows them to confront the contradictions of their daily existence. 967</p> 968 969<p> 970In this dialectical process, the vacation can be seen as a moment of synthesis, where urbanites integrate the contrasting aspects of their existenceâwork and leisure, complexity and simplicity, stimulation and relaxation. Through this synthesis, they achieve a more harmonious state of being, temporarily resolving the contradictions inherent in their lives. <span style="color:gray;">[nose pull]</span> Hegel might argue that this pursuit of balance is part of a broader process of self
970-realization and development, as individuals continually seek to reconcile opposing forces within themselves and their environments. This dialectical movement reflects a deeper philosophical journey toward self-awareness and fulfillment, where each vacation experience contributes to a more nuanced understanding of personal and existential needs. 971</p> 972 973<p> 974Moreover, Hegel would likely emphasize that this process is not static but dynamic, as urbanites constantly redefine and re-evaluate their desires and experiences in pursuit of higher forms of understanding and contentment. <span style="color:gray;">[sniff]</span> This ongoing dialectical interaction between urban life and vacation preferences underscores the complexity of human existence and the continuous evolution of individual consciousness within the broader historical and cultural context. 975</p> 976 977<h3>What Would Marx Say?</h3> 978 979<p style="color:gray;"> 980(For extra fun, to be read as if dictated by Jordan Peterson.) 981</p> 982 983<p> 984When we examine the suburbanite’s preference for urban-like vacation experiencesâsuch as cruising or visiting bustling citiesâthrough the lens of Marxist theory, we uncover something quite profound about the alienation inherent in capitalist societies. Suburban life is often marked by routine and compartmentalization, a strong reliance on cars, and an emphasis on private space. This creates an environment of isolation and fragmentation, which Marx identified as symptomatic of capitalist production. The sprawling nature of suburbia physically separates individuals from their workplaces, social hubs, and cultural activities, generating a dichotomy between home life and community engagement. This alienation from collective social experiences mirrors the detachment workers feel from the products of their labor and from each other in a capitalist framework. 985</p> 986 987<p> 988Thus, when suburbanites seek out vacations in dense, walkable environments, they’re searching for a temporary reprieve from this isolation. These vacations allow them to engage with the social interactions and cultural experiences that are often missing from their everyday lives. In this way, vacations become a commodified form of leisure within capitalist society, packaged and sold as products designed to alleviate the stresses of alienation and labor. Suburbanites, who feel the pressures of maintaining a lifestyle dictated by capitalist normsâlike homeownership and consumerismâturn to vacations as a form of respite from these demands. Cruises and urban vacations offer a concentrated form of entertainment and cultural engagement, providing an illusion of freedom and choice that contrasts with the regulated and constrained nature of suburban life. While these vacations temporarily satisfy the need for genuine human connection and cultural enrichment, Marxist theory would argue that they also reinforce the capitalist cycle, as individuals must return to their suburban routines to earn the means to participate in such leisure activities. Thus, vacations, though they offer a brief escape from alienation, ultimately underscore the pervasive influence of capitalism on leisure and personal fulfillment. 989</p> 990 991<h3>Conclusions</h3> 992 993<p> 994 As I reflect on the whirlwind of contradictions, philosophies, and cultural dynamics explored in this article, I must 995admit that I find myself utterly exhausted. Much like the aftermath of a cruise, where the buffet line feels both 996endless and insurmountable, I am too fatigued to draw any tidy conclusions. So, dear reader, as I lean back in my 997metaphorical deck chair, I invite you to navigate these intellectual waters and draw your own conclusions. Like the 998 towel animals on your cabin bed, reality might be folded and shaped in surprising ways, but the essence remains
999 yours to unravel. Bon voyage in your own journey of trolling! Or is it trawling? 1000</p> 1001 1002 </div> 1003 </article> 1004
1004<script type="text/javascript"> 1005 $("#panel7").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/cruising"; }).hover( 1006 function(){ 1007 $(this).addClass('panellink'); 1008 }); 1009 </script>
1009 1010 1011 <article class="panel panel-default"> 1012 <header class="panel-heading" id="panel8"> 1013 <a class="btn-lg pull-right" href="/pocorgtfo/#0x22"><span class="glyphicon glyphicon-link"></span></a> 1014 <h2>PoCâGTFO Issue 0x22</h2> 1015 <h3>Through desert & wilderness, Laphroaig reaches great heights from the deepest of depths.</h3> 1016 <time datetime="2024-02-03" class="sr-only">2024-02-03</time> 1017 </header> 1018 <div class="panel-body"> 1019 <a href="/pocorgtfo/#0x22"><center style="padding-top:9px"><div style="width:80%;overflow:hidden;border:1px solid #021a40;background:white;"><img style="width:100%;padding: 0px;" 1020 srcset="/pocorgtfo/pocorgtfo22_large.png 700w, 1021 /pocorgtfo/pocorgtfo22_medium.png 500w, 1022 /pocorgtfo/pocorgtfo22_small.png 350w" 1023 sizes="(min-width: 768px) 730px, 1024 100vw" 1025 src="/pocorgtfo/pocorgtfo22.png" alt="International Journal of PoC$\|$GTFO" /></div></center></a> 1026 </div> 1027 </article> 1028
1028<script type="text/javascript"> 1029 $("#panel8").css({"cursor" : "pointer"}).click(function() { window.location.href = "/pocorgtfo/#0x22"; }).hover( 1030 function(){ 1031 $(this).addClass('panellink'); 1032 }); 1033 </script>
1033 1034 1035 <article class="panel panel-default"> 1036 <header class="panel-heading" id="panel9"> 1037 <a class="btn-lg pull-right" href="/blog/acropalypse"><span class="glyphicon glyphicon-link"></span></a> 1038 <h2>How to avoid the aCropalypse</h2> 1039 <h3>It could have been prevented if only Google and Microsoft used our tools!</h3> 1040 <time datetime="2023-03-30" class="sr-only">2023-03-30</time> 1041 </header> 1042 <div class="panel-body"> 1043 1044<p> 1045Last week, news about CVE-2023-21036, nicknamed the 1046â<a href="https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html" target="_blank">aCropalypse</a>,â spread 1047across <a href="https://twitter.com/ItsSimonTime/status/1636857478263750656" target="_blank">Twitter</a> and other 1048media, and my colleague Henrik Brodin quickly realized that the underlying flaw could be detected by our tool, 1049<a href="https://github.com/trailofbits/polytracker" target="_blank">PolyTracker</a>. 1050Coincidentally, Henrik Brodin, Marek SuroviÄ, and I <a href="https://arxiv.org/abs/2301.08700" target="_blank">wrote</a> 1051 a paper that describes this class of bugs, defines a novel approach for detecting them, and introduces our 1052 implementation and tooling. It will appear at this yearâs workshop on Language-Theoretic Security 1053 (<a href="https://langsec.org/spw23/" target="_blank">LangSec</a>) at the IEEE Security and Privacy Symposium. 1054</p> 1055<p> 1056The remainder of this blog post describes the bug and how it could have been detected or even prevented using our tools. 1057</p> 1058<div class="alert tob-alert"> 1059<img src="/images/logos/Trail-of-Bits-main-dark-background.png" height="32px"/> 1060This is an excerpt from the <a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 1061<a href="https://blog.trailofbits.com/" target="_blank">blog</a>. 1062You can read the full post <a href="https://blog.trailofbits.com/2023/03/30/acropalypse-polytracker-blind-spots/" target="_blank">here</a>. 1063</div> 1064 </div> 1065 </article> 1066
1066<script type="text/javascript"> 1067 $("#panel9").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/acropalypse"; }).hover( 1068 function(){ 1069 $(this).addClass('panellink'); 1070 }); 1071 </script>
1071 1072 1073 <article class="panel panel-default"> 1074 <header class="panel-heading" id="panel10"> 1075 <a class="btn-lg pull-right" href="/blog/libmagic"><span class="glyphicon glyphicon-link"></span></a> 1076 <h2>libmagic</h2> 1077 <h3>The Blathering</h3> 1078 <time datetime="2022-08-01" class="sr-only">2022-08-01</time> 1079 </header> 1080 <div class="panel-body"> 1081 1082<p> 1083A <a href="https://blog.trailofbits.com/2019/11/01/two-new-tools-that-tame-the-treachery-of-files/">couple of years 1084ago</a> I released <a href="https://github.com/trailofbits/polyfile">PolyFile</a>: a utility to identify and map the 1085semantic structure of files, including polyglots, chimeras, and schizophrenic files. Itâs a bit like file, binwalk, and 1086Kaitai Struct all rolled into one. PolyFile initially used the <a href="https://mark0.net/soft-trid-deflist.html">TRiD 1087definition database</a> for file identification. However, this database was both too slow and prone to 1088misclassification, so we decided to switch to libmagic, the ubiquitous library behind the file command. 1089</p> 1090<div class="alert tob-alert"> 1091<img src="/images/logos/Trail-of-Bits-main-dark-background.png" height="32px"/> 1092This is an excerpt from the <a href="https://www.trailofbits.com/" target="_blank">Trail of Bits</a> 1093<a href="https://blog.trailofbits.com/" target="_blank">blog</a>. 1094You can read the full post <a href="https://blog.trailofbits.com/2022/07/01/libmagic-the-blathering/" target="_blank">here</a>. 1095</div> 1096 </div> 1097 </article> 1098
1098<script type="text/javascript"> 1099 $("#panel10").css({"cursor" : "pointer"}).click(function() { window.location.href = "/blog/libmagic"; }).hover( 1100 function(){ 1101 $(this).addClass('panellink'); 1102 }); 1103 </script>
1103 1104 1105<hr /> 1106<center> 1107<ul class="pagination"> 1108 1109 <li class="disabled"><a href="#">«</a></li> 1110 1111 1112 <li class="active"><a href="/?page=1">1</a></li> 1113 1114 <li><a href="/?page=2">2</a></li> 1115 1116 <li><a href="/?page=3">3</a></li> 1117 1118 <li><a href="/?page=4">4</a></li> 1119 1120 <li><a href="/?page=5">5</a></li> 1121 1122 <li><a href="/?page=6">6</a></li> 1123 1124 <li><a href="/?page=7">7</a></li> 1125 1126 <li><a href="/?page=8">8</a></li> 1127 1128 <li><a href="/?page=9">9</a></li> 1129 1130 <li><a href="/?page=10">10</a></li> 1131 1132 1133 <li><a href="/?page=2">»</a></li> 1134 1135</ul> 1136</center> 1137 1138 </div> 1139 1140 1141 </main> 1142 1143 <footer class="footer"> 1144 <span style="float: right"><a href="https://feeds.feedburner.com/EvanSultanik"><img src="/images/feed-icon-14x14.png" alt="Atom feed icon" /> Atom Feed</a></span> 1145 <p>© Evan A. Sultanik 2003–2026</p> 1146 </footer> 1147 1148 </div> <!-- /container --> 1149 1150 1151 1152
1152<script type="text/javascript"> 1153 $(document).ready(function() { 1154 var contact = $("#contact"); 1155 $(".contact-link").click(function(){ 1156 setTimeout(function(){ 1157 contact.dropdown("toggle"); 1158 }, 100); 1159 $("#contact-menu").css({ 1160 "border-style": "solid", 1161 "border-color": "rgb(0, 255, 0)", 1162 "box-shadow": "rgb(0, 255, 0) 0px 0px 20px", 1163 }); 1164 }).css({"cursor" : "pointer"}); 1165 }); 1166 </script>
1166 1167 1168 <!-- Bootstrap core JavaScript 1169 ================================================== --> 1170 <!-- Placed at the end of the document so the pages load faster --> 1171 </body> 1172</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.