Hendrik Weimer

Theoretical physicist, professor for condensed matter theory at TU Berlin.

#quantum #physics

Personal Home Page: https://tu.berlin/en/cmt/prof-dr-hendrik-weimer

Public Key

npub1456mcswdpnzyayaqjv8h0kzcchtcrkjdhp9udcykyq9d5uuszk2svx3wns

NIP-05 Address

hweimer_at_fediscience.org@momostr.pink

Profile Code

nprofile1qqs26ddug8xse3zwjwsfxrmhmpvvt4upmfxmsj7xuztzqzk6wwgpt9gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntw9hnxv

Publishing to

relay.momostr.pink

Author Public Key

npub1456mcswdpnzyayaqjv8h0kzcchtcrkjdhp9udcykyq9d5uuszk2svx3wns

Show more details

Last Notes

2026-09-25 15:10:04 UTC

- reply

It's easy when you know that the speed of light is approximately 3 times10^something meters per second. Then, you multiply the leading digits to get the number of seconds in a day. 6(0) seconds times 6(0) minutes gives 3.6 times 10^whatever, and you round this to 4 before the next multiplication, which is by 2(4) for the number of hours. So, there are about 8 times 10^whoknowswhat seconds in a day. Multiply this with the speed of light and you get 2.4 times 10^icouldntcareless for the final result. There's only one answer that's reasonably close.
Physicists are very lazy people.

2026-09-17 19:34:10 UTC

- reply

That's not the same. I can make lots of changes to my car without requiring recertification, like changing the tyres. With app attestation, any modification is forbidden, even if I take the original source code and compile it myself without making any changes.

2026-09-17 16:56:39 UTC

- reply

I'm referring to the most commonly used definition of open source and explained that the incompatibility of the age verification spec with said definition is a great cause of concern for many people.

2026-09-17 16:25:04 UTC

- reply

If you restrict such uses, that's incompatible with Article 6 of the Open Source Definition: https://opensource.org/osd
For your driver's license, it's also completely unnecessary. A digital driver's license is a bunch of data signed by a government key. If I modify the data, the signature will no longer match. But I can modify an app using the driver's license in any way without compromising the security of the system. There's no reason why such a driver's license app must be attested to be unmodified.

2026-09-17 15:36:47 UTC

- reply

In the open-source definition, there are no consumers, only recipients of the code, who possess certain rights, including the right to modification. If you don't want this, the attestation must be proprietary because otherwise you could modify the attestation to match your changes to the app.
You cannot have an open-source implementation that is compliant with the spec.

2026-09-17 14:52:09 UTC

- reply

"AVS Unit Attestation (AVSUA): A data object, issued by the provider of an Age Verification solution, that describes an Age Verification App Instance and the device on which it is installed, enabling an Attestation Provider to verify that the App Instance is a genuine and untampered instance of a compliant Age Verification solution."
https://docs.ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/
You will not be allowed to modify the app. This is obviously incompatible with the core principles of open-source software.

2026-09-17 14:18:10 UTC

- reply

The backlash would be much less severe if there was a credible path to run an open-source implementation that doesn't require handing over highly sensitive data to a third party. The currently discussed solution requires apps to be secured against modification, which obviously violates a core principle of open-source software.
If you want a positive example for a government-sponsored app, look at Germany's CovPass for covid vaccinations, which had independent builds for F-Droid: https://riqq.gitlab.io/fdroid-website/en/packages/de.rki.covpass.app/

2026-07-13 12:15:14 UTC

Very interesting preprint by @npub1ly9…edww comparing the language indicators for content sharing on different social media platforms. On Mastodon (not sure how much content from the wider Fediverse was included), reasoning and nuance were most strongly associated with boosting. On X, insult, identity attack, and toxicity are rewarded instead. Bluesky doesn't seem to have particularly strong language indicators for sharing content.
https://arxiv.org/abs/2607.04220
#fediverse #mastodon

2026-05-26 19:48:30 UTC

Very interesting analysis by @npub1pf6…45j3 about Mastodon and Bluesky in Germany. For high-profile accounts active on both platforms, the Mastodon accounts saw on average a 193% higher increase in followers over the last six months.
https://netzbegruenung.de/blog/das-ende-der-dominanz-microblogging-wandel-in-deutschland-in-zahlen/
#fediverse #mastodon #bluesky #germany

2026-05-17 11:59:57 UTC

- reply

LLM dependence is a form of debt and now the interest payments are due.
https://fediscience.org/@hweimer/115428806838046734

2026-05-04 07:10:43 UTC

It's great to see that the @npub1yz9…xjs4 has joined the Fediverse!
It's hard to underestimate the impact they had on my career, allowing me to start my own research group under a Freigeist Fellowship grant. After almost 10 years, my Freigeist project has come to an end just in the last week. I'm happy to see that we will be able to continue our interaction here.
(FWIW, the Volkswagen Foundation is independent of the carmaker with the same name.)
#academicchatter

2026-04-14 14:04:26 UTC

Having a presence in the Fediverse isn't about reach, engagement metrics, or cost per conversion.
It's a civic duty of every organization believing in democratic values.
#fediverse #mastodon

2026-04-13 15:23:13 UTC

- reply

If you don't want to use the common workarounds, you can find a recycled version here: https://quantus.substack.com/p/the-leftward-shift-in-the-democratic
There has definitely been a stretch on the left as well, and it's not limited to party activists.

2026-04-13 14:58:42 UTC

- reply

There is considerable evidence that the Democratic party has shifted significantly to the left of the median voter on social issues: https://www.ft.com/content/73a1836d-0faa-4c84-b973-554e2ca3a227
And concerning birthright citizenship, the situation also seems to be a bit more complex: https://www.nytimes.com/2026/03/31/us/politics/birthright-citizenship-support.html

2026-03-13 09:55:24 UTC

- reply

Wobei ich es schon als sehr frustrierend empfinde, dass die DNB ihrem gesetzlichen Auftrag bei der Archivierung digitaler Medienwerke praktisch überhaupt nicht nachkommt. Wir sollten eigentlich schon längst eine deutsche Variante des Internet Archive haben.
(NIcht verwandt oder verschwägert.)

2026-02-16 12:34:18 UTC

I wrote a small game simulating the transition to a solar-powered economy. You can build solar panels, batteries, hydrogen storage and sell your generated electricity at market prices. Electricity demand, pricing, and weather conditions are based on realistic models for Germany.
https://sonnenwende.codeberg.page/
#gaming #games #simulation #solar #solarpunk #renewables #godot #opensource #germany
https://fediscience.org/system/media_attachments/files/116/080/313/970/641/346/original/38ca381711d5820d.png

2026-01-29 08:12:30 UTC

Fediverse starter pack for physics with a focus on DE/AT/CH: https://fedidevs.com/s/ODg2/
(h/t @npub157l…nzus)
#physics #science #academicchatter #germany #austria #switzerland #fediverse

2026-01-29 07:23:11 UTC

- reply

The Academic Cloud instance is only available to members of universities in Lower Saxony, Max Planck institutes, and possibly some more. We decided to focus on instances that are accessible to at least a large part of the readers of the Physik Journal.

2026-01-27 14:08:36 UTC

Together with Mario Birkholz of @npub19tf…ahrh fame, I have written an article about Mastodon and the Fediverse in the journal of the German Physical Society: https://pro-physik.de/zeitschriften/download/23119
It's free to read but in German. Let's hope that @npub199m…c34y's move to the Fediverse will inspire other scientific societies and universities to follow!
#physics #mastodon #fediverse #academicchatter #wisskomm #physik

2026-01-25 18:49:46 UTC

Most boosted Fediverse posts of 2025:
1. @npub1388…sxrr: https://beige.party/@maxleibman/114441790730464541 (3815 boosts)
2. @npub1s20…twmm: https://mstdn.social/@stux/113974665364673502 (3720 boosts)
3. @npub1gq5…qcul: https://mastodon.social/@pixelfed/113849098386232034 (3153 boosts)
4. @npub1rkw…5q62: https://mastodon.world/@signalapp/115311121329278998 (3128 boosts)
5. @npub1wkr…yvj6: https://mastodon.social/@Daojoan/114587431688413845 (3045 boosts)
Terms & Conditions apply, see thread.
#fediverse #fedistats

2026-01-24 18:52:24 UTC

- reply

Weil Smartphone-Apps unter Verwendung der Hardware-Schlüsselspeicher als sichere Endgeräte unter PSD2 gelten und Browser nicht. Du müsstest also analog zum Bezahlen bei Online-Händlern die Transaktion wiederum per Smartphone-App oder FIDO2-Token freischalten.
Es gibt zwar Diskussionen, solche Hardware-Speicher im Browser zugänglich zu machen: https://github.com/w3c/webcrypto/issues/263 Ich bin aber skeptisch, ob sich damit eine PSD2-konforme Lösung bauen lässt, weil die Webanwendung im Browser nicht unter einem separaten Benutzer läuft.

2025-11-11 15:25:01 UTC

- reply

"Providers should remain free to offer services using end-to-end encryption and should not be obliged by this Regulation to decrypt data or create access to end-to-end encrypted data."
Das klingt für mich danach, als würde das Aushebeln von Ende-zu-Ende-Verschlüsselung nicht mehr als angemessene Risikominderungsmaßnahme gelten.
Altersverifikation schließt nicht notwendigerweise anonyme Nutzung aus, Zero-Knowledge-Protokolle hierfür existieren. @npub1fus…tvjp hat etwas hierzu: https://docs.taler.net/design-documents/024-age-restriction.html

2025-11-02 09:24:41 UTC

- reply

https://blog.arxiv.org/2025/10/31/attention-authors-updated-practice-for-review-articles-and-position-papers-in-arxiv-cs-category/
Centrailzed publishers won't go away for a long time since they hold exclusive rights to groundbreaking works for at least 70 years after the deaths of all authors. That's a different story.
But for (new) preprints, that's not the case. In the past, a centralized system was somewhat useful for content discovery. But with standards like ActivityPub, that's no longer necessary.

2025-11-02 07:29:51 UTC

Given the drama surrounding the arXiv for its dependence on Google and its recent ban on review articles in computer science, I have a question:
Do we still need the arXiv?
Wouldn't a federated network of institutional repositories be a much better option?
#arXiv #academicchatter #physics #math #cs #ActivityPub

2025-10-04 07:54:46 UTC

- reply

Das ist ja schön, wenn Herr Macron endlich erkannt haben will, dass wir amerikanischen und chinesischen Tech-Konzernen zu viel Macht gegeben haben.
Dann sollte er als erstes die französische Position zur #Chatkontrolle ändern. Deren Einführung würde diese Konzerne noch weiter stärken, weil datenschutzfreundlichere Alternativen kaputtreguliert würden.
https://fediscience.org/system/media_attachments/files/115/314/814/361/368/252/original/74dd62f56a7459ea.png

2025-09-25 12:53:14 UTC

- reply

As far as I know, using a separate profile under @npub1kwa…e0nj is the way to go.

2025-06-18 08:46:21 UTC

The Ising model in a transverse field is one of the most fundamental models in quantum many-body physics. Despite being around for more than 60 years, we still make new discoveries in it. In our latest work, we show the existence of a dynamical phase transition (a concept pioneered by @npub1nss…pn0r) where the quantum entanglement between the constituents becomes extremely large: https://arxiv.org/abs/2506.13898
Such a transition is not only fun to play with, but it can also lead to building better quantum sensors, as it is precisely this type of entanglement that allows quantum sensors to outperform their classical counterparts.
#quantum #physics
https://fediscience.org/system/media_attachments/files/114/703/481/774/851/154/original/57db44918e037f17.png

2025-05-13 14:40:48 UTC

Great news! While Trump is busy dismantling the Library of Congress, the German National Library of Science and Technology (@npub1268…u2k4) is preparing for more to come: they've downloaded the entire 10 TB of the arXiv preprint server and safeguarded more than 2.6 million scientific articles. Thank you so much! This was especially needed since, last year, the arXiv decided to shut down its mirror network.
https://blog.tib.eu/2025/05/13/die-wissenschaft-schuetzen-tib-baut-dark-archive-fuer-arxiv-auf/
#arxiv #physics #math #unplugtrump

2024-09-30 14:28:03 UTC

- reply

Also, jetzt wird es langsam ein bisschen albern. Natürlich unterstützt die Javascript-Engine von Chrome die Fetch API, mit der es möglich ist, Daten an einen externen Server zu übermitteln. Es mag sein, dass da bei Chrome noch ein weiterer Prozess zwischengeschaltet ist, aber wenn der kompromittierte Prozess diesem sagt, er solle bitte etwas an einen externen Server schicken, dann wird er dies ohne Murren tun, das ist schließlich sein Job. Geht ja gar nicht anders.

2024-09-30 13:49:30 UTC

- reply

Wirklich überzeugend ist das nicht. Sandboxing gegen remote code execution hat noch nie richtig funktioniert. Ein Renderer muss z.B. in der Lage sein, auf lokale Dateien zuzugreifen (Up-/Downloads) und Netzwerkkommunikation zu betreiben (Fetch API und Co.). Das kann der kompromittierte Prozess dann auch. Wenig überraschend steht auch in der Chromium-Dokumentation an der Stelle "TODO: need to research".
Wird Zeit, dass aus @npub1nvf…cpws was wird: https://servo.org/

2024-09-30 11:11:11 UTC

- reply

Wenn die externen Unternehmen den Request gar nicht zu Gesicht bekommen, dann können sie auch kein Fingerprinting machen. Das ist also ein weiterer Grund, nicht von überall Javascript-Code auszuführen. Adblocker erwischen vielleicht gerade einmal die Hälfte der externen Inhalte.
Bei Brave ist zudem indiskutabel, dass es außerhalb des Play Stores keine automatischen Updates gibt.

2024-09-30 10:20:56 UTC

- reply

Brave unter Android unterstützt auch keine Extensions, es ist exakt dasselbe Problem wie bei Chrome.

2024-09-30 10:17:33 UTC

- reply

Praktisch alle Browser-Bugs für remote code execution betreffen Javascript-Code (z.B. CVE-2023-37450, CVE-2023-3420, CVE-2024-3833). Selten ist wie in CVE-2023-4863 sowas wie eine Bildbibliothek betroffen.
Wenn du eine typische Webseite gehst (z.B. Zeit), dann werden da 10-20 Javascript-Elemente von externen Unternehmen nachgeladen, und das ist nur die erste Ebene. Das erhöht massiv die Angriffsoberfläche und Chrome unter Android bietet keine Möglichkeit, sich dagegen zu wehren.

2024-09-30 09:31:47 UTC

- reply

Brave unterstützt wie praktisch alle Chrome-Derivate unter Android keine Externsions. Wer gerne Javascript-Code von überall ausführt, mag das verschmerzen, aber Sicherheit und Chrome unter Android schließen sich aus.