XOF correctly implemented doesn’t ensure you haven’t made other mistakes, such as using entropy sources correctly, doing needed math correctly to avoid any entropy bias, etc. etc….
You’re correct about black and white thinking. Then you invoke multiple straw men in this thread to defend that you’ll roll your own.
Disclaimer: I’ve been hired for multiple DoD projects to break hardware and software security systems, and I nearly always succeed, because so many people (and companies) roll their own.
The nice thing about a secure XOF is that it doesn’t matter if the entropy given to the XOF is less than perfect. If an XOF is given 10 different sources of entropy, and only one of them is secure, the XOF will remain secure. [1]
One reason why I don’t change the RNGs used in my code is because I know how dangerous playing with RNG code is. For example, one implemention I wrote of the XOF—not one I used in production code, mind you—generated incorrect vectors, but only in clang and only at some levels of optimization. Needless to say, I now have a test to make sure my XOF code generates correct vectors with both GCC and clang at multiple different optimization levels.
People have brought up CVE-2008-0166 in this thread, but the Coldcard incident from this year (where people literally lost millions of dollars) also comes to mind, so I’m aware how dangerous playing with RNG code is.
That’s why the code is basically the same code I had 18 years ago, and why I (as well as multiple people running AI-assisted security audits) have extensively tested that code.
The proof is in the pudding: No security issues have ever been found with the XOF PRNG, and it’s been nearly two decades.
(I also think “straw men” is being used incorrectly here; most likely the parent poster thinks I was implying that Linux’s /dev/urandom is insecure but the actual argument is that my code runs on a lot more than just Linux, and some of those systems could have an insecure /dev/urandom)
[1] As per https://blog.cr.yp.to/20140205-entropy.html as long as we’re not using a malicious source of entropy, but said malicious source will need to perform 2^n operations of the XOF to generate n bits of controlled output, and only in the case if said malicious entropy source can somehow know the output of the other entropy sources, especially since the XOF is seeded once then run indefinitely in my code.
> The nice thing about a secure XOF is that it doesn’t matter if the entropy given to the XOF is less than perfect. If an XOF is given 10 different sources of entropy, and only one of them is secure, the XOF will remain secure
Secure is not a binary state; not understanding basic information theory and how entropy evolves is fatal.
This right here shows 100% why no one should trust you or your code. You have a seriously fundamental misunderstanding of entropy or what the Bernstein blog post (and it is a blog post, even if it’s Bernstein) states.
His post states, correctly, that a hash is as secure as its weakest entropy source. Adding more bad ones does not strengthen it. He doesn’t say you can ignore the entropy per source, and simply hope one “is secure,” whatever the heck that even means.
Entropy of a source is a number, often in units of bits/sec (or nats or Harley’s or some rate for differential entropy). It’s most definitely doesn’t even make sense to say “one is secure”. That’s a nonsensical phrase.
If you do not correctly know the entropy bit rate of all your inputs, and very importantly cross correlations, you cannot know if you have enough entropy accumulated for an operation, which is then used up; you cannot make downstream claims about security. That you’re so incredibly lax and naive and state the opposite of reality shows the lack of crypto skill. This type of misunderstanding is why there’s still groups hiring people like me to break systems: tons are implemented very poorly, leave holes from poor entropy, timing attacks, power attacks, glitch attacks, etc. depending on the system.
The very least anyone designing such things should know about information theory is a solid understanding of the book by Cover, then stack on top significant knowledge about the physical systems used under the software and have detailed models for them.
This is why people should be skeptical about this stack.
> His post states, correctly, that a hash is as secure as its weakest entropy source. Adding more bad ones does not strengthen it. He doesn’t say you can ignore the entropy per source, and simply hope one “is secure,” whatever the heck that even means.
I believe it is you with the misunderstanding. A hash is as secure as its _strongest_ entropy source provided that none of the inputs can snoop on the others. The key point being made in that blog post is that if a malicious source can snoop the other inputs and has knowledge of the implementation then it could potentially (partially) control the output. That's quite a high bar, and even then the attacker is limited to a brute force search for the desired partial output.
> you cannot know if you have enough entropy accumulated for an operation
This is superstitious nonsense. Entropy is merely an estimate of the effective size of the input space, ie how hard an attacker would have to work to exhaustively search it.
> The nice thing about a secure XOF is that it doesn’t matter if the entropy given to the XOF is less than perfect. If an XOF is given 10 different sources of entropy, and only one of them is secure, the XOF will remain secure. [1]
Isn’t that also true of the cryptographic sponge function that is used to implement /dev/{,u}random?
And on that page govts have tried and failed at it also. Thinking the current prices are the result of fixing and not insane demand is surely going to lose in court. It’s trivial to show massive demand, and thus production line changes, as the driving forces here.
If you look over all such lawsuits, they extremely rarely succeed.
And you apparently only read the title and ignored the content.
It’s also poor reasoning to you only pick one thing you think supports your view, and ignore vastly more things not supporting it, all from the same useful criteria.
Now if only you’d carefully read the report you chose, and spend equal time looking at ample presented evidence, you’d develop a more accurate understanding.
This isn’t true, as there are plenty of things proven beyond reach.
And plenty of things, eventually solvable, can create major problems that could both be avoided and the problem solved by taking a much better path.
Having technology and the ability to safely and sanely use the technology needs to progress together at a similar rate. The failure to do this is even a reasonable and common solution to the Great Filter. Jared Diamonds book “Collapse” has ample examples of cultures that wiped themselves completely out via not having this balance, so it’s not simply a theory.
> In the case of a planet going around the sun we know that the planet travels in an ellipse
That's a Newtonian approximation. Under General Relativity it is not true - the possible solutions are time varying, and I'm not even sure there are periodic orbits, nor even stable orbits. All N-body patterns radiate gravitational energy till the system collapses. I'm pretty sure there are no general closed form solution, and I think it's true there is not even a single case where the path is a closed form solution.
In general relativity it is closer to quasiperiodic.
Classical motion under an 1/r^2 field is really strange as a dynamical system because the periods of rotation, in-out and up-down motion are all the same which is why the motion closes as an ellipse. It is beautiful in a lot of ways but a godawful mess from the viewpoint of perturbation theory because these are always in resonance as opposed to only in resonance occasionally.
Ignoring gravitational radiation, in GR (or with secular perturbations from other planets) those periods no longer match up so the orbit goes in-and-out in not quite the same time it goes around and then you get a precession so it is still basically an ellipse but the angle of the ellipse changes and you'd see something like a spirograph if you draw it. It's a quasi-periodic orbit.
You can write down closed forms (often with special-function integrals) for things like 1/r^3 and it is the same story, the variables separate nicely because angular momentum is conserved.
> It's very hard to beat the encoding performance of libjpegturbo, even with an asic.
Pretty much any platform with a hardware jpeg encoder beats libjpegturbo. So probably all smart phones, large scale CPUs, even tiny few $ microcontrollers like ESP32's have hardware encode/decode that outperforms libjpegturbo.
If you want to move the bar to quality for your strawman, then libjpeg-turbo is not even close in image quality to plenty of encoders, such as jpegli crush it. For compression size it also loses to modern libs. There is no metric that libjepg-turbo wins at nowadays, not even speed.
Then, if you care to learn, there are extremely high quality, lkely far beyond old software like libjpeg-turbo, use in DoD projects, satellites, medical imaging systems, commercial cameras systems, and plenty of companies that sell such chips and IP to embed in ones own ASIC. There is zero technical problem taking an opensource project, turning that exact code into an ASIC or VHDL one can put into any ASIC, an so the best ideas are reused in hardware all the time.
Alma Technologies, CAST, intoPIX all sell such cores that are integrated throughout the industry, embedded everywhere, and can be bought with an ever improving host of features.
Not linearized as in samples do not represent linear color space? I think that's untrue, as all sensor work I've done (a decent amount across many projects) are linear: double light = double photon count = 1 bit of sensor space. There are technically often some bends from physical and engineering effects (photon interaction with substrate has some variability, temperature affects things a bit).
Or is there some other meaning of "not linear" you mean?
I would not say $1-$2k/mo extra income counts as a huge amount richer. It’s like 58th percentile by family income. I don’t really think it makes sense to call solidly middle class income rich in any sense…
In the sense they were not opposed to all machines as a concept. They were definitely against machines they thought reduced their labor value:
"They wrecked specific types of machinery that posed a threat to the particular industrial interests in each region. In the Midlands, these were the "wide" knitting frames used to make cheap and inferior lace articles.[22] In the North West, weavers sought to eliminate the steam-powered looms threatening wages in the cotton trade. In Yorkshire, workers opposed the use of shearing frames and gig mills to finish woollen cloth.[23]"
Yes, that's what I wrote. "They were opposed to bad labor practices, with machine-breaking as way of applying pressure on employers."
Otherwise it would be like claiming that an industrial union is opposed to people working in factories by pointing to a strike action and concluding they members just want to stand around outside the factory instead of work.
Recall that my comment is in response to "it is economically infeasible for me to be a luddite".
If that means something like "infeasible for me to oppose bad labor practices" then collective action is the typical response to bad labor practices.
If that means something like "infeasible for me to destroy the employer's use of AI" then I think that's mistaking what Luddites did as being the Luddite goal.
You wrote "The Luddites were not opposed to machines." What you wrote makes it sound as if there was no problems with machines, only with labor practices. That's simply misleading to untrue in this chain.
You can say Luddites were not only opposed to machines they thought cost them (which was the main reason they started the trouble they did at that point), but they also (insert labor practices).
Read their writings or contemporary reports. The wiki page has ample references to good material.
"Luddites were not opposed to the use of machines per se (many were skilled operators in the textile industry); they attacked manufacturers who were trying to circumvent standard labour practices of the time".
How is that meaningfully different than what I wrote?
It's the difference between "Paul McCartney is not opposed to food" and "Paul McCartney is opposed to eating meat."
Here's a paragraph from p45 of my paperback edition of "The AI Con" on the Luddites:
"But Luddites were not against technology. Some Luddites, weavers in particular, were into technologies that helped evaluate the quality of their work, for instance, being able to count the number of threads per inch, such that they could fetch a higher prices at the market. Luddites were instead against technologies of control and coercion, and concerned about the loss of jobs, health, and community."
I do not think your assessment of my statement is correct.
I think your maybe counting just physical sales? 15 years ago was the start of the shift to digital sales, which have greatly grown. Just steam (which is the bulk of digital PC sales):
Steam units sold: 402M (2019) → 704M (2024), up 21% in 2024 alone.
Steam peak concurrent users: 3.52M in January 2011 → 42,042,778 on January 11, 2026. Roughly twelvefold, directly measured from Valve's API.
Valve's own disclosed number, which isn't an estimate by anyone: between August 2024 and August 2025, Steam averaged 109,000 people making their first ever purchase every day. That's about 40 million brand-new paying customers in one year.
Games released on Steam: ~8,100 in 2019 → 20,282 in 2025.
Some of the best selling games did come out roughly 15 years ago, but that's because they've been selling consistently ever since. Like Minecraft, the Witcher, etc.
Games released is not indicative of revenues: 80% of steam games make < $5k, and median steam game makes at most a few hundred $. So that doesn't really tell much about sales.
Recent data seems available in reports from Newzoo: their The PC & Console Gaming Report 2025 states there was 1.2% total PC growth 2021-2024 in nominal dollars (40.5B to $40-42B). In real dollars that is around -15%, so enough shrinkage that many industries would really feel the pain. In smaller sections, their 2014, 2017, 2024 reports show PC share of global games spend fell 17%. They (and SuperData) data show premium PC fell a few percent (nominal, more in real $). Playtime per player fell 26% (Newzoo 2024, 2025).
Also, around 50-60% of revenue, which is nice, is not new game sales, but microtransactions, and these are extremely weighted to the largest few games. Of the remaining, around 10-15% is subscription fees, also not new sales.
Using Steam as a proxy for the whole industry hides losses if more title % moved to Steam, since then the numbers you posted are not comparing like to like.
Some Newzoo data is easily found, use AI to find copies of their closed reports floating around the internet.
You’re correct about black and white thinking. Then you invoke multiple straw men in this thread to defend that you’ll roll your own.
Disclaimer: I’ve been hired for multiple DoD projects to break hardware and software security systems, and I nearly always succeed, because so many people (and companies) roll their own.
reply