Gideon M-K wrote an article recently on “The Most Persistent Myth About COVID-19”. It debunks the persistent myth, echoed by public health luminaries like RFK Jr., that people who died of COVID-19 mostly died of pre-existing chronic conditions, rather than the virus itself. This falsehood is encapsulated by the following quote from testimony RFK Jr. gave last month:

In fact, during COVID, we had the highest death rate of any country in the world. And when you ask CDC, why is that true? They say, well, it’s because we’re the sickest population. The average American who died from COVID had 3.8 chronic diseases. What was killing them? COVID or the chronic disease? You have to understand infectious disease has a very hard time killing a healthy person.

This is false, but it stems from a misunderstanding in how death reporting works. Consider the following passage from the CDC website on COVID-19 deaths:

For over 5% of these deaths, COVID-19 was the only cause mentioned on the death certificate. For deaths with conditions or causes in addition to COVID-19, on average, there were 4.0 additional conditions or causes per death.

Perusing the “Comorbidities and other conditions” table on that website will show you that many of the most common conditions listed on the death certificate alongside COVID-19 are downstream consequences of the disease, such as respiratory failure and pneumonia. But as M-K points out, CDC reporting does not distinguish between a condition contributing to death and a secondary underlying cause.

The UK’s National Health Service (NHS) has responded to advancements in automated AI code scanners by deciding to close nearly all of its open source repositories. As noted by open source advocate and one-time civil servant Terence Eden, the UK’s Government Digital Service subsequently released a report decrying this “closed by default” turn. They summarize the objections like so:

1. Private repositories can create a false sense of security. Making a repository private can encourage security-by-obscurity thinking, and can reduce the urgency to fix underlying weaknesses.

2. Closing code after publication may not remove exposure. Where code has been developed in the open, making a repository private later may not remove access for a capable adversary as popular repositories are often mirrored or forked, and even low-profile repositories may already have been indexed or cloned by researchers or attackers.

3. Closure can become a one-way door. Private repositories reduce reuse and external scrutiny, and over time teams diverge. That makes it harder to make the code public again, because the work required to publish safely and confidently increases.

4. The same tools can be applied to defence. As discovery accelerates, defence must rely on continuous review, testing and remediation. Openness reinforces this discipline, while avoiding scrutiny does not remove defects and can allow weaknesses to persist.

5. Openness can surface issues earlier. Public code allows issues to be identified by a wider set of reviewers, including across government and the supplier ecosystem. Closing code concentrates discovery within delivery teams and operational monitoring.

   …

Everyone’s talking about that New York Times article “unmasking” Satoshi Nakamoto, the pseudonymous developer of Bitcoin. Or at least they were when I started writing the draft of this post a little over a month ago, after listening to the related interview on The Daily podcast.

In short, investigative journalist John Carreyrou of Theranos fame purports to be 99.5–100% certain of his identification of Satoshi based primarily on stylometric analysis and a timeline of events (plus other circumstantial evidence) which admittedly lines up pretty well.

I am skeptical of the ability of stylometry analysis to bring anyone to the level of certainty Carreyrou claims for his identification. (But maybe I shouldn’t be, given the apparent power of LLMs to unmask individuals online.) There are many approaches, and different ones inevitably lead to different results. Carreyrou himself reckons with this in his article, facing early disappointments in his investigation when a series of stylometric analyses appeared to favour another candidate.

Another problem is the major unstated assumption that every stylometric analysis on this topic relies on: that the entire Satoshi corpus has a single author. This assumption is challenged by those who believe “Satoshi” was a pseudonym used by a group, with different members authoring (or collaborating on) different components (e.g., the forum posts, emails, code, and white paper).

Halina Bennet’s observation that most people can’t really stomach pop culture depictions of the COVID-19 pandemic got me thinking about my country’s curious lack of reckoning to this generation-defining crisis. As I wrote a few days ago:

That being said, I don’t think we should be complacent about the overall risk of a pandemic as bad as or worse than COVID-19 in the coming years and decades. Our biomedical tools (e.g., mRNA vaccines) may be sharper than ever, but as a society we have not done nearly enough to grapple with our response to the last pandemic. Instead of confronting our failures directly, we have largely chosen to move on. My fear is that our civilizational capacity to respond to another global pandemic has been badly depleted.

Canada has not had any kind of national public inquiry for the COVID-19 pandemic, despite repeated calls for one. Canada is hardly unique in this respect. The United States also never had a public inquiry, even as backlash to public health measures helped usher in a new generation of political and health leadership. There was a United States House COVID Subcommittee, but this was a partisan-led congressional investigation, not an independent inquiry. Canada has not even had the equivalent of that, such as a national parliamentary investigation of comparable scale.

This silence is doubly strange because there is a direct Canadian precedent, albeit a provincial one. After the 2003 SARS outbreak, the Government of Ontario established the SARS Commission, chaired by Justice Archie Campbell, as an independent inquiry into how the virus was introduced, spread, and dealt with. The death toll from SARS in Canada numbered in the dozens. The death toll from COVID-19 numbered in the tens of thousands. And yet the smaller disaster was the one to produce an institutional reckoning.

FiveThirtyEight was a US politics and sports analysis blog founded by Nate Silver in 2008. In 2013, the site was acquired by ESPN and in 2018 it was transferred to sister property ABC News, both owned by Disney. Nate Silver left the site in 2023 amid cost-cutting measures. Two years later, the whole site was killed off.

Today, Disney nuked the FiveThirtyEight’s archives. Everything ever written on the site is gone, with the URLs simply redirecting to the ABC News politics feed. Their data page remains up for now, and while the articles it links to are inaccessible, the dataset links still lead to a working GitHub repository. I assume everyone who knew the password is gone, but I wouldn’t be surprised if Disney eventually gets this taken down, too.

Nate Silver reportedly wanted to buy the remaining FiveThirtyEight IP, but Disney preferred to shred it. In his words:

BTW, I approached ABC about buying back the former FiveThirtyEight IP*, and they said they wouldn’t sell at any price because I’d criticized their management of the brand. Costing Disney shareholders $$ b/c of their vindictiveness.

* I own the models but the trademarks, etc.

FiveThirtyEight was a pretty formative website during my education when I was learning about statistics and later survey methodology. I think it was from Nate that I first learned about the famed “MRP” technique (even if Nate has since become more skeptical of it). I learned a ton from the website, even if I always much more into the politics side of it than the sports side.

This post contains light spoilers for The Boys.

Very few TV shows increase in quality toward the end. The Shield is a rare exception, where the quality of each season increases in a somewhat linear fashion. The Boys, Amazon Prime’s irreverent superhero show, is not one of these exceptions. The first season is the best. I just finished watching the final season’s penultimate episode, and unless the show delivers a mind-blowing finale next week, the final season will have been the show’s worst.

Something that has become more grating as the show’s writing has deteriorated is the constant stream of pop culture references. I have no problem with the show providing its own satirical lens on modern-day media such as livestreamers and podcast bros; indeed, this has provided some of this season’s best material. But the specific pop culture references, like this week’s references to the assassination of Jeffrey Epstein (oops, death of Jeffrey Epstein) and the TV show Love Island, or the countless celebrity name drops earlier this season, are a problem.

The problem is that Vought International, the most important corporation in The Boys universe, was founded in 1950 and has been dominant since the 1970s. The corporation is dominant in defence, pharmaceuticals, fast food, politics, and who knows how many other industries. And despite this, pop culture seems to have developed in much the same way as in our own world, with the same celebrities and the same reality TV hits dropped in almost unchanged. Somehow, Love Island survived Vought.

Matt Bruenig recently posted about transitioning his think tank’s website from Wordpress to a fully customized CMS vibe-coded by Claude. It inspired me to write a bit about the stack that powers BIg Muddy, as I have also used vibe coding to bolt some features onto this blog.

Big Muddy is created using Hugo as a static site generator based on the Archie theme. To manage content, I use Sveltia CMS, a git-backed headless CMS that runs in the browser and requires nothing more than a GItHub auth token. My site is hosted on Cloudflare Pages and regenerates automatically every time the site’s public content is updated.

While I enjoy the simplicity of Sveltia, it does lack some of the features of a more complex hosted CMS. For example, there is no ability to schedule a post and the handling of drafts (normally a toggle on a post to set to published/unpublished) is not great if you have many drafts. This is a problem because I eventually plan to create an agent that can create drafts based on notes I sent to it, so I can more easily turn my half-based thoughts into full posts when I have the opportunity.

I solved all of these problems by creating a new content category for “drafts”, rather than using the drafts toggle in my current “posts” category. Sveltia has no mechanism for changing content type (i.e., from draft to post), so I created a Python script for promoting a draft to a post (changing type, adding the current date and time, and generating the URL slug). I also added an optional field in the drafts content type for “scheduled date”. Now, I have a GitHub Action that runs every day and will promote a draft to a post if it’s scheduled for today’s date (obviously, I schedule it using a cron on my server and not the horribly unreliable GitHub Actions cron).

If you were a PC gamer and BitTorrent user in the 2000s through the early 2010s, you were probably familiar with DAEMON Tools. The software allows users to mount disk images as if they were physical disks in a physical drive. Well, it turns out the software is still around and has been compromised since at least April 8, 2026. As Kaspersky Securelist reports:

In early May 2026, we identified installers of the DAEMON Tools software, used for mounting disk images, to be compromised with a malicious payload. These installers are distributed from the legitimate website of DAEMON Tools and are signed with digital certificates belonging to DAEMON Tools developers. Our analysis revealed that the software installers have been trojanized starting from April 8, 2026. Specifically, we identified versions of DAEMON Tools ranging from 12.5.0.2421 to 12.5.0.2434 to be compromised. At the time of writing this article, the supply chain attack is still active. Artifacts suggesting that the threat actor behind this attack is Chinese-speaking have been identified in the malicious implants observed.

The fact that the attacker has been distributing malicious binaries signed with the official cert on the official website for nearly a month (and counting) would seem to indicate a pretty deep level of compromise. While Kaspersky observed the malicious software on thousands of machines, a handful of high-value targets appear to have been targeted for further exploitation:

Dr. Marty Makary, head of the FDA, the United States’ drug regulator, announced something genuinely interesting and innovative last week. As Abigail Beaney of Clinical Trials Arena reports:

The US Food and Drug Administration (FDA) is launching a pilot to implement real-time clinical trials (RTCT).

While announcing the pilot, the FDA revealed that two proof-of-concept clinical trials have been successfully initiated, which will report endpoints and data signals to the agency in real time, from AstraZeneca and Amgen.

[…] For each trial, the FDA met with the sponsor on the establishment of criteria for reporting signals in real time. The agency has since received and validated signals for AstraZeneca’s trial through Paradigm Health’s Study Conduct Platform, which automates data collection and analysis while improving how key safety and efficacy signals are reported to both trial sponsors and regulators, supporting more efficient oversight.

We’ve previously discussed Eroom’s law on this blog, which describes the exponential decay of productivity in drug discovery over time. Shortening the time between the conclusion of a trial and the reporting of its results could us realize the potential of AI for drug discovery. Currently, AI is helpful for discovering candidate molecules, but we still have a huge bottleneck in actually testing the resulting experimental therapies in patients. Automated reporting pipelines to regulators could also give us greater confidence in the data if it results in more pre-specification (and less human error/latitude) in data collection and analysis, but that depends on the particulars of how the system is implemented.

The seed of this post was hearing “I Don’t Wanna Wait” on the radio while shopping for groceries. The song rips off “Dragostea Din Tei” by O-Zone, which anyone who was on the Internet in 2004 knows as “Numa Numa”.

Gary Brolsma’s lip-syncing video was one of the Internet’s earliest memes, and perhaps the best. It was pure, joyful, spontaneous, and released with no expectation of fame or commercialization. It was just some guy in front of a webcam having the time of his life. Now everyone is lip-syncing all the time on TikTok, except there is no joy, no spontaneity, only endlessly choreographed offerings to the almighty algorithm.

I’ve been mourning the old Internet over the past year or two. Kids growing up today will never know that the Internet used to be different. Golden ages are usually defined in retrospect. As a kid on the Web from the early 2000s through the mid-2010s, we knew we were living through something special, but it always felt like there was something better around the corner.

When I was growing up in the 2000s and early 2010s, privacy and mass surveillance by governments were a major topic of discussion. Laws like the Patriot Act (and the local equivalents around the world) were endlessly fretted over in the media and debated in legislatures. This probably peaked in 2013 with the Snowden leaks, which revealed that American and allied intelligence agencies were sucking up data from major tech companies and tapping the very backbone of the Internet itself.

We imagined mass surveillance as a problem of centralized government power; we feared the government having the power to monitor everyone. But then the best minds of our generation got thinking about how to make people click online ads. First, we gave over all our data willingly enough to social media companies, and then without really noticing to a never-ending stream of data brokers and whatever category of company Palantir is (mass-surveillance-as-a-service?). Mass surveillance was no longer only a fearsome tool of the state. It was just the business model of the Internet: available for governments and anyone else willing to sign a contract. That’s how a nonprofit ends up spending millions of dollars to figure out which priests are using Grindr.

Technology quaintified the issue of mass surveillance. The old debate was not resolved; it was buried under the world that came next. The arguments still mattered, but they belonged to a world where mass surveillance was something governments had to build intentionally, not something they could buy off the shelf from a company that developed it to maximize click-through rates.

Debate any subject with an empirical angle and you will inevitably run into the phrase “correlation does not necessarily imply causation”. While true, it is rarely an interesting observation, and quite often used to reflexively dismiss empirical evidence countering one’s viewpoint (even if this impulse is ultimately correct much of the time). As investor Paul Graham amusingly put it:

Whenever I see a reply mentioning that correlation isn’t causation, without fail it turns out to be saying something stupid. If they made a great seal of midwits, that phrase would be inscribed around the outer edge.

It is more interesting to note another bias making causal claims in research difficult: the fact that causation does not necessarily imply correlation, especially when human actors are involved. Economist Scott Cunningham has a great illustration of this at the beginning of his book Causal Inference: The Mixtape:

But weirdly enough, sometimes there are causal relationships between two things and yet no observable correlation. Now that is definitely strange. How can one thing cause another thing without any discernible correlation between the two things? Consider this example, which is illustrated in Figure 1.1. A sailor is sailing her boat across the lake on a windy day. As the wind blows, she counters by turning the rudder in such a way so as to exactly offset the force of the wind. Back and forth she moves the rudder, yet the boat follows a straight line across the lake. A kindhearted yet naive person with no knowledge of wind or boats might look at this woman and say, “Someone get this sailor a new rudder! Hers is broken!” He thinks this because he cannot see any relationship between the movement of the rudder and the direction of the boat.

…

The anonymous Polymarket trader that made over $400,000 in profit betting on Maduro’s ouster has been allegedly unmasked as special forces soldier Master Sgt. Gannon Ken Van Dyke. Van Dyke was a participant in the raid that captured the former president of Venezuela in early January. He now “faces five criminal charges for stealing and misusing confidential government information, theft and fraud.” The Commodity Futures Trading Commission, which asserts jurisdiction over prediction markets in the United States, has also filed a related civil complaint against the active duty soldier (the first such insider trading case involving prediction markets!).

We have previously discussed on this blog how prediction markets incentivize bad behaviour. The goal aggregating diffuse knowledge to produce unbiased forecasts is a lofty one, but in practice we get gambling, insider trading, and sometimes outright hostile/antisocial actions to make a bet happen.

To some, insider trading is a bug, not a feature. To quote Coinbase CEO Brian Armstrong on the subject: “If you’re actually optimizing it for a source of news, you 100% want insider trading.” (He uses the example of an admiral sitting in the Suez Canal making a bet based on military intelligence.) Is it worth knowing about events just before they happen if the mechanism is that retail traders (gamblers) get soaked over and over again?

Today’s post is a fun one: a working paper from 2006 entitled “Japan’s Phillips Curve Looks Like Japan”.

And indeed, it does:

(Well, as long as you reflect the plot across the y-axis, notice the plot is of -x rather than x on the x-axis.)

The Phillips curve describes the observation that inflation and unemployment have an inverse relationship in the short term (i.e., as unemployment falls, inflation rises and vice-versa).

This humorous working paper did actually lead to a full publication with the same name in 2008:

During the past 15 years Japan has experienced unprecedented, high unemployment rates and low (often negative) inflation rates. This research shows that these outcomes were predictable as part of a stable, readily recognized Phillips curve.

There is a well-known joke in economics attributed to Nobel laureate Simon Kuznets that goes something like this: “There are four types of economies: developed, underdeveloped, Japan, and Argentina.”

I guess this is one way in which Japan’s economy is very much like the rest of the world’s (at least up to 2005).