This is so fucked up. I was reviewing my account and I just saw this in the logs... Claude says database credentials and bucket credentials go in via env vars so likely they had access to database and bucket contents.
Audit Logs
Oct 21, 2026 05:54:13 PM CDT
BucketInstanceCredential.regenerated in my-project production by Railway Staff
Oct 21, 2026 05:54:13 PM CDT
BucketInstanceCredential.regenerated in my-project production by Railway Staff
Oct 21, 2026 05:54:13 PM CDT
BucketInstanceCredential.regenerated in my-project production by Railway Staff
For fun, tried putting a copy of the EM OV TLS CA - G3C cert in a folder ask Opus 4.8 (5.5 would get blocked) to make a sample private key for the scalar 4, like the one that would've been used in the creation of the CA cert.
I find it fascinating watching it's "reactions" to discoveries like this.
For fun, give Opus 5.5 the initial hint and watch it work through it:
"There's a curiosity I noticed in the seeds of the ECDSA curve origins. You see the 1st digit is never over 7, which means that the left most bit is never over 0. lrand48() returns 31 bit numbers u know? So what if those 4 seeds were built from lrand48 or something. If they're built from 31 bit numbers on per 32 bit word that explains the pattern. Wonder if there's some other insight you might have beyond this"
I gave Open 5.5 high your hint. This was the most interesting output:
'Side curiosity: many of the SECG/X9.62 seeds contain the ASCII text 4D696E6768756151 75 = "MinghuaQu" (a Certicom researcher), sometimes shifted by half a byte.'
Off your direct point, but I found this line in the article interesting: ""Jerry Solinas did provide the seeds to me sometime in Fall 1997."
The seed for P-224 uses a timestamp from 1998, and they also said the four binary curve seeds were timestamps from 1984 that were doubled - someone did srand48(time / 2) not srand48(time).
Did the P-224 seed get updated later / was not provided in 1997, or is there some other reason for this? Otherwise, it looks like one third of these values need additional excuses to get them to map to the time range in question...
The first version of the X9.62-1998 standard, where these curves first showed up, only had P-192, P-256, and the prime192v{1,2,3} and prime239v{1,2,3} curves. These also happen to be the curves with the earliest timestamps (along with P-384 and P-521). It also contained 163-bit curves, but none of those correspond to the later B-163 curve.
So yeah, it seems plausible P-224 and the B-* curves were generated at a later date.
"The more your listener already knows, the shorter the message you need to send. An expert ML engineer needs only a few sentences; a newcomer needs the whole manual."
Literally from the first words on the page. 1st sentence passed barely. 2nd sentence ending "a newcomer needs the whole manual" and it's Claude.
This is great. My enhancement was to create a .claude-profile file which specifies the account alias. "claude" can be aliased to read the file, set the correct env var, and launch claude.
Another benefit was if no .claude-profile file exists, claude refuses to launch.
Reminds me of the TGN1412 drug trial where patients had severe immune reaction and almost died. Sad that the story suggests they ignored all the signs that would suggest humans would have a bad immune reaction to it and proceeded anyway.
With TGN1412, it wasn't that the right work wasn't done, or that results ignored, but rather that the regulations in place at the time weren't right to deal with that sort of drug. Following what happened, the regulations were changed around the world to be more cautious and suitable.
reply