Old Fucking Punk @lwriemen@librem.one

If this had been a woman in a senior dev, security or SRE position, she would not have concluded this with an inspiring LinkedIn post about "not always getting it right".

This guy is the CEO of Chainguard by the way.

I hope that this causes Chainguard to be kept away from any security related embargoes until trust has been properly restored.

RE: https://social.coop/@coopcloud/116770343059078681

Ever since yesterday's announcements of (oh so many) security vulnerabilities, our community has been hard at work identifying vulnerable recipes which need to be undeployed, writing checks and guides, and updating recipes as new images come in.

In today's Kite Flying (in just over an hour!) we'll be sharing our process and discussing recommendations for coop cloud deployments. See you there!

- amras <3

most test suites are actually not very fine constraints on the system under test; the idea that "any program that passes the tests is acceptable" is nonsense, even more so when you're also generating the test suite

RE: https://toot.cafe/@baldur/117484059424957991

The reason why the way many have been talking—describing “AI”-written exploits popping up require heroic defence—smells like bullshit is that, so far, all of the exploits seem to require pre-existing second vulnerabilities so bad that any site with them would have been hacked months ago already.

That can change any time, which is why you should patch PHP ASAP, but many of the responses smack of madness of crowds

But it really also does look like anybody describing waves of exploits targeting their site yesterday or heroic work by their "agents" to safeguard their servers may be operating on the reality-deficient side of the bullshit scale.

It's not only that the EUID wallet prefers iOS and Android, they don't want to even look at alternatives:

https://github.com/eu-digital-identity-wallet/.github/issues/20#issuecomment-6337434090

It's nice that the spec is open but that only helps so much as long as 💵 goes into the proprietary software channels.

#LinuxMobile #PublicMoneyPulicCode

RE: https://mastodon.social/@Edent/117483785620327786

“There isn't an easy exploit for this PHP vulnerability · Elias Taylor”

https://eliastaylor.com/noexploit/

> One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

Are you a FLOSS maintainer? What does the current state of LLMs do to you, personally? Does it help you? Does it give your sleepless nights? How do you feel about companies using your code to train their models?

I'm looking for some (quotable) feelings for a slide for my hackumenta talk (CCC) - Agent leck Aier (Agent lick b**ls), the influence of LLMs on our society.

Edit: And tell me if its OK to attach your name and a link to your comment :) - default: anonymous quote

Pls boost or tag a maintainer (who is OK with being tagged).

#php #rust #zig #floss #foss #OpenSource #FreeSoftware

People talking about "the worst security hole of the year" are being optimistic tbh

Delivery robots scan faces and collect customer biometric data, lawsuit alleges - https://mashable.com/tech/delivery-robots-allegedly-collecting-biometric-data if they don't, they soon will #privacy #surveillance

Judge rejects Trump’s wild claim EPA can dismiss data center pollution lawsuits - https://arstechnica.com/tech-policy/2026/10/judge-rejects-trumps-wild-claim-epa-can-dismiss-data-center-pollution-lawsuits/ " Trump’s EPA can’t unilaterally dismiss SpaceXAI pollution lawsuit, court rules. "

✨Your Daily Reminder✨: We don't have to build technology to surveil and kill. We can build technology that helps us fight for a better future.

@bagder I have very mixed feelings about this. Yes, AI does find real bugs (turns out a lot of bugs and exploits fit common patterns, hooray humans). But I also think taking a dump of an AI conversation, or even a “summary” of the problem, and dropping it on the doorstep of a maintainer is…VERY RUDE.

It should be socially expected that a filer of a bug continue to write a succinct summary of the issue.

I tend to reject reports like this, not because the error is not real, but because increasing automation means that the bug WILL SOON BE FOUND AGAIN BY SOMEONE WITH BETTER MANNERS who will take the time to understand the problem and write a succinct paragraph to describe it. This latter filer is MY FRIEND, and someone I want to build a relationship with and reward by crediting with finding the bug.

If maintainers don’t reject slop-dumps (sorry, LLM-dumps), they will be DDoS’d by thousands of auto-filers. As AI bug reports get better, it must get easier to reject those who don’t put any effort into filing.

Static website, but it’s just white noise

So today some of the worst people on earth using the most environmentally destructive tools on earth brought down a huge part of the internet by exploiting a potential problem found many years ago in PHP which was previously not practical for anyone to exploit.

It only became "practical" to exploit this problem because "AI" came along to automate the boring and repetitive work required to do so. Absurd amounts of computing power were applied specifically to break into other peoples' websites.

Now the same people who are behind this are trying to pretend that they're heroes for finding an exploit.

"AI uncovers critical vulnerabilities", their headline reads. But the vulnerability was only made to be critical by the very same people as hide behind that headline.

Many thousands of websites are offline, many people are losing money, many thousands of people are working hard to try to patch or work around the problem, many small guys are finding it almost impossible to patch, and we're all supposed to be thankful to OpenAI and others involved ? Nah. Fuck off.

Everything about "AI" involves a lot of externalized costs, but I've still yet to see even a single positive thing that has been achieved by "AI". That has definitely not changed today.
#php2shell #php #fuckai #openai

mitmproxy now has an --emudhra option 😆

https://github.com/mitmproxy/mitmproxy/commit/169234499088fc2c414644a67efaed3d64ae2e3b

There is a dog in the park. I am jealous, for the dog knows nothing of php

@drahardja I am an extremely stupid man, certainly less calibre than the IA could hire, and I fixed this shit without asking *any* LLMs. Not even my local ones. Come on guys.

RE: https://mastodon.archive.org/@brewsterkahle/117481215431503956

Why the hell did they need to use Claude wtf is this brainrot