Multivariate CLT for L\'evy processes: convergence rates without moment assumptions
Jorge Gonz\'alez C\'azares, David Kramer-Bang, Aleksandar Mijatovi\'c
https://arxiv.org/abs/2510.06891
Here are some key takeaways from implementing #PyPI attestations in #Gentoo:
• With OpenPGP, you need to validate the authenticity of a key. With attestations, you need to validate the authenticity of the identity (i.e. know the right GitHub repository). No problem really solved here.
• They verify that the artifact was created by the Continuous Deployment workflow of a given repository. A compromised workflow can produce valid attestations.
• They don't provide sufficient protection against PyPI being compromised. You can't e.g. detect whether new releases weren't hidden.
On the plus side, TOFU is easier here: we don't have to maintain hundreds of key packages, just short URLs on top of ebuilds.
Security-wise, I think PEP 740 itself summarizes it well in the "rationale and motivation" section. To paraphrase, maintainers wanted to create some signatures, and downstreams wanted to verify some signatures, so we gave them some signatures.
#security #Python
Short-Pulse High-Power THz Generation Using Optical Klystron FELs: Simulation Results
Najmeh Mirian
https://arxiv.org/abs/2510.05842 https://arxiv.org/pdf/…
Disney sues Sling TV for allegedly violating their carriage deal by including Disney's networks without permission in the new mini-bundles launched in August (Dade Hayes/Deadline)
https://deadline.com/2025/08/disney-sues-sling-tv-min…
A century of the Bose-Einstein condensation concept and half a century of the JINR experiments for observation of condensate in the superfluid 4He (He II)
Valentin Zagrebnov (I2M)
https://arxiv.org/abs/2510.03378
Collective communication in a transparent world: Phase transitions in a many-body Potts model and social-quantum duality
Pawat Akarapipattana, Sergei Nechaev, Bogdan Slavov
https://arxiv.org/abs/2508.20267
I've probably mentioned that I'm working on switching #Gentoo from our half-broken eselect-ldso logic to #FlexiBLAS. This also involves a transition period where both setups would be supported.
A good thing is that the switch is ABI-compatible with the previous state (or at least it's supposed to be — we're working with upstream on fixing function coverage). Since libblas.so, liblapack.so and the rest are replaced by symlinks, programs that link to them will simply start using FlexiBLAS. So far, so good.
Unfortunately, switching the other way doesn't work as well. Stuff newly built against our libblas.so & co. symlinks naturally reads FlexiBLAS's SONAME from them, and links to libflexiblas directly. So should you decide to switch back, some packages will stay linked to FlexiBLAS and will need to rebuilt.
In order to avoid this, I would have to replace the symlinks with wrapper libraries, having libblas.so.3 and so on SONAMEs, and linking to libflexiblas. Unfortunately, a dummy wrapper isn't going to work — the linker will complain about using indirect symbols from libflexiblas.so. So I would probably have to "reexport" their symbols somehow, and ideally split into appropriate libraries, so that `-Wl,--as-needed` wouldn't drop some of them. But how to do that?
Well, let's look at the existing logic for eselect-ldso — clearly both BLIS and OpenBLAS create some wrappers. So I've spent some time investigating upstream Makefiles, and literally couldn't find the respective targets. I mean, these are quite complex Makefiles, but I'm grepping hard and can't find even a partial match.
As it turns out, these Makefile targets are added by Gentoo-specific patches. And these patches are just horrible. In case of OpenBLAS, they create the wrapper libraries by linking all the relevant .o files from OpenBLAS build, plus the shared OpenBLAS library. So the OpenBLAS symbols relevant to each interface end up duplicated in libblas.so, liblapack.so, etc., and apparently the symbols needed by them are taken from libopenblas.so. The individual interface libraries aren't even linked to one another, so they expose their own duplicate symbols, but use the implementation from OpenBLAS instead.
BLIS is even worse — the patch is simply creating libblas.so and libcblas.so, using all BLIS objects directly, plus symbol visibility to hide symbols irrelevant to the library. So yes, libblis.so, libblas.so and libcblas.so are roughly three separate copies of the same library, differing only in symbol visibility. And of course libcblas.so doesn't use libblas.so.
Truly #GSoC quality.
Toward Automated Hypervisor Scenario Generation Based on VM Workload Profiling for Resource-Constrained Environments
Hyunwoo Kim, Jaeseong Lee, Sunpyo Hong, Changmin Han
https://arxiv.org/abs/2508.08952
The Economic Complexity of the Roman Empire
Matteo Mazzamurro, Petra Hermankova, Michele Coscia, Tom Brughmans
https://arxiv.org/abs/2508.19892 https://arx…
Most Western African migrants remain local and travel short distances
Irene Tafani, Ola Ali, Rafael Prieto-Curiel, Massimo Riccaboni
https://arxiv.org/abs/2509.10314 https://