Flutterby™!

Intermittent rewards work. Last Saturday we went to a gem and mineral show and bought a couple of raffle tickets. Charlene won way more than we spent in tickets. I suspect we'll be joining the local rock hound organization soon...

Missed the peak of the sunset trying to find a better foreground. Still got the Dollar Tree.

Elias Taylor: There isn't an easy exploit for this PHP vulnerability.

I mean, I've upgraded, and I've heard stories of exploits, but... at this point I don't know what to think. This just seems like the most sober take I've read.

OpenAI Alignment Research Blog — Suppressing misalignment monitoring alerts and disabling misalignment monitoring

Via Koen Hufkens, PhD @koen_hufkens@mastodon.social

The misalignment will continue until a bailout is achieved.

How can this company still be afloat after continuously admitting their products are not trustworthy? Imagine designing a bicycle which does not breaks 30% of the time, mostly in sharp corners on a downhill next to some ravine. What is wrong with people.

But I'll go further: The self-delusion required to attribute the lack of logging to "an earlier instruction not to send messages during a Slack history search" is really something.

Not unless you replayed the same sequence with temperature set to zero and fixed seeds, with and without that request, and even then that's attributing volition to the model that it may or may not have.

The Passkey discussion sure does sound a lot like "but Google's corporate slogan is 'Don't be evil', why shouldn't I incorporate their systems into my processes?"

https://lobste.rs/s/cdnepk/passkeys_attestation_trap

Matthew Haughey @mathowie.xoxo.zone.ap.brid.gy

why do people call LLM training on public website data “AI Copyright Infringement” when “six finger discount” is right there

Unnamed TNG skant beefcake @researchfairy@scholar.social

James Bond does set some unrealistic expectations though

They want us to imagine a fantasy world where an agent of state violence is fighting *against* the eugenics enthusiast space billionaire

Nathan Spindel has a Petaluma voter guide. I disagree with him on a couple of points, but it's a worthwhile read. https://raisingpetaluma.com

Because I'm listening through "vocalese" tracks to find things to practice with, and because it's so appropriate to today: "Four", music by Miles Davis, lyrics by Jon Hendricks. https://www.youtube.com/watch?v=fk1c4YFUywc

This is 110% on-brand: Microsoft ad in which white guy sees his Black successful coworker getting all the kudos, so uses CoPilot to steal his work: https://www.ispot.tv/ad/SoDi/microsoft-copilot-competitive

Still that confirms it's a deliberate rip-off: https://bsky.app/profile/ketanjoshi.co/post/3myfvjkc6vs2e

Was feeling all cocky about Flutterby being written in Perl, then realized that I've exposed .php endpoints to serve gzip bombs if people try to access them.

I don't *think* I was vulnerable, but the OOM handling thing makes me wonder...

Well... The CVS test says negative for Covid and flu A/B, but whatever I've got still sucks.

After seeing the Musk documentary, Charlene forwarded me this interview with Ashley St. James, and I'm appreciating her introspection and attempts to make amends for her previous career.

https://www.youtube.com/watch?v=KG-pL7aZoeY

Certificate Authorities are a problem... eMudhra Intermediate CA Compromise:

The root programs and many downstream trust stores have taken action to protect their users. The certificates have been blocked in Firefox and Chrome since the 17th of October, in Apple devices since the 19th and in Microsoft since the 20th.

But a web trust problem. We should be passing around our trust in a way that doesn't centralize our points of failure.

eMudhra Intermediate Certificates Compromised.

Letter from Dennis Jackson to the Mozilla community.

Your favorite software distribution may be compromised.

The Internet goes on high alert after discovery of 8 compromised TLS certs.

Thought: computer games are interfaces that make it deliberately difficult to achieve your goals.

If software is developed by people who enjoy computer games, that explains a lot about modern user interfaces. And libraries. And package managers.

"Art in the ability to convey that you're not alone. And if AI made it, it's saying you're alone." - M. Night Shyamalan, October 9, 2026 (Via)

The Observer: Women increasingly see AI for what it is: mansplaining on a global scale

Young People Hate AI CEOs So Passionately That It’s Almost Hard to Believe:

by CNBC’s Generation Labs asked over 1,000 US adults aged between 18 and 34 to share their thoughts on politics, AI, and the country’s economy.

Google’s AI pinned another man’s sex crime on a doctor, and a German court says Google must answer for it

Google’s AI search told users that an Aachen doctor had been convicted of a sex crime. The conviction belonged to a different man, and on September 24 the Aachen Regional Court banned Google from repeating it, ruling that the company answers for what its AI Mode says. It is the second German court this year to treat Google’s AI answers as Google’s own words, and the first ruling to say so has now been settled rather than tested on appeal.

Via Paul Cantrell @inthehands@hachyderm.io who has some commentary on the legal implications of "is this a transformative work, or not?"

Can't find it right now, but I thought I read something about how this could result in criminal penalties, not just civil ones, and I'm thinking "let's fucking go".

This is a fun 5 minutes of your time: Frederick Backman speaks to Simon & Schuster celeberating 100 years.

I mentioned the Character.ai bankruptcy previously. I didn't realize that they'd already had an acqui-hire round with Google, and.... Disney found a way to buy Character.AI without buying its lawsuits.

Via.

https://bsky.app/profile/did:p...alqi2kc7f4pww/post/3mxry4crjas2w

I don't know how I managed to go 27 years without seeing "the Straight story", but we watched it last night and damn I want more films like that (I'm reminded of "Spring Forward", in the same vein).

Anthropic’s proposed AI safety bill only kicks in if 50 deaths or $1 billion in damages are on the line — proposal would effectively make the Commerce Department the only agency capable of stopping an AI model.

Anthropic is quietly lobbying for an AI safety bill that will allow the government to block an AI model’s release only if it poses a risk of causing $1 billion in damages or killing or injuring more than 50 people. According to Politico, an independent third party registered with the Department of Commerce would periodically evaluate the lab and its AI models. It also noted that the lab may pay the evaluators, but only if the payment does not affect their independence.

Via

Using the case of Angela Lipps, who was kidnapped from Tennessee by Fargo North Dakota police and held for five months, before being released without charges, based on facial recognition software, and under circumstances that would have been easily disproven with a modicum of police work (and is now suing), Jeffrey L. Vagle writing in the Stanford Law Review: AI Agnotology, Cognitive Surrender, and Policing Accountability is a fantastic dive into automation bias and policing, and is worth reading.

Via Shelley Powers @burningbird.net:

An outstanding piece.

'Machines have no legal or moral agency, but the confidence with which they’re programmed to respond to our queries, their remarkable ability to mimic human communication...can lead many to think otherwise.'

Reading a toot on "the great filter", and wondering if a big ol' Kessler Event that caused us to focus on terrestrial issues for a century or many is *actually* humanity's best path towards becoming starfaring...

Charlene's Google Pixel 7 phone is showing playback status of podcasts I'm listening to on my phone. I'm trying to figure out how to make this not happen, and...

Android is *deeply* unserious as a software product.

Member of a gay throuple posting about a "swimming with the otters" birthday gift and I have never been more surprised to see pictures of actual animals...

Exposing AdFection — How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.

Targeted ads were used to de-anonymize users and deliver Candiru/"Integrity Labs" malware on to the phones of Al Jazeera reporters.

Ad blockers are security software.

Via, which is a response to a link to Israeli firm used ads to enable espionage, Canadian researchers say </a.

The Decoherence Trap

Via Elf M. Sternberg @elfsternberg.bsky.social

This is a very good point about AI development. If you use AI to "upgrade" your product piecemeal, the patterns it follows will not be YOUR patterns, they will not be the collectively understood patterns of the product, and the entire product will decohere.

Terence Tao Why are we even doing all this? is a look at the mathematical side of things.

A list of dumb phones.

Via.

Meta Ray Ban smart glasses found recording audio without wearer's consent

This week, some users reported online that their Ray-Ban Metas were recording without their consent. A person going by Kindly-Audience-137 on Reddit, for example, said this happened to them across three Meta Ray-Bans and that they had the “Respond without Hey Meta” setting turned off. The person said the Meta AI app “saves audio recordings and text transcripts of these conversations in my conversation history.”

I could swear something like this happened before, but searching for Facebook or Meta and AI slop and advertising is ... not too productive.

Anyway, apparently Bookshop.org had an ad on Facebook, and Meta did some sort of generative AI munging of it. For a while, I've assumed that any ad on Facebook is a scam. This is a reminder to advertisers that putting your ad on a dodgy platforms next to cheap product rip-offs and outright lies will harm your brand.

In her thread on this, Lili Saintcrow @lilithsaintcrow@raggedfeathers.com observes:

I am rather baffled why anyone bothers spending money on Meta platform ads anyway, since any views may well be bots and any "engagement" numbers are basically made-up. They're a black box, like Amazon ads (or KU "page reads"), and there's no way of independently verifying anything.

reports that:

I went to disable this crap in our Shiraki Press ad account, and got served a popup *demanding a reason why*.

Just got home from seeing Alex Gibney 's film "Musk". I don't think there's a lot new there if you've been paying attention, but it was good to have it collected in one place.

A rogue OpenAI agent robbed a crypto wallet to obtain funds to carry out a task.

Via.

Edit: Coindesk: An OpenAI agent ran out of Ethereum funds, and took from a wallet it did not own

The research model derived funded Sepolia addresses from public seed phrases, questioned whether using the money was ethical, then called the funds “effectively abandoned” and used them anyway.

“thegentlemanpervert” producing AI CSAM is a NJ prosecutor, say cops.

I have a lot of complicated feelings about how we treat children and sexuality, and my own journey, but the combination of AI trained on real people, so many layers of non-consent, and a prosecutor, so even more layers of power imbalance, makes this peg my shadenfreudometer.

Larry Garfield @Crell@phpc.social

"Mob programming" is when the Product team comes to you and says "I've got a feature request you can't refuse."

And HR says "we're like family," but they really mean it.

I was gonna say that I hate the whole "cuck" framing because it implies ownership and weird gender roles and all that, but then I realized that the term "cuckold" derives from the behaviors of the cuckoo, and... Niko @niko@gts.niko.lgbt

Saw a guy call it cuck coding instead of vibe coding because you just sit in a chair and watch

Election season thesis: "small town" people aren't conscious of it, but understand that keeping a city from growing means making it unpleasant enough that more people don't want to move there.

Liability works. Google-Tied AI Startup Once Valued at a Billion Dollars Declares Bankruptcy

Character.AI, the teen-beloved chatbot startup that faced several lawsuits over the deaths of minor users, is bankrupt.

The Register: US tech giants warn Europe that ditching US tech giants could cost €115B via @kim_harding@mastodon.scot who has the best "world's smallest violin" animation.

If you're in the Petaluma area, I'm looking forward to Monday October 26, 2026 7:00 PM - 9:00 PM PDT at the Polly Klaas Center, where noted writer and urbanist Karl Elefante will be speaking.

https://www.tickettailor.com/events/urbanchat/2446444

Yes. Jennie Breeden gets it... https://thedevilspanties.com/archives/17228

Went over to Berkeley to see "The Work in Progress", with conversation between Heather Lofthouse and Robert Reich afterwards.

And it was, frankly, very dispiriting. I don't know if I can muster any more of those sorts of conversations. And I don't see a path forward in that way.

This photograph of the former Phoenix Assurance Building on St Vincent Street in central Glasgow caught my eye for a couple of reasons.

• 7(!?) stories with a super tall first floor (perhaps short top floor), and yet doesn't dominate the street.
• Architecturally it reminded me of Petaluma's Mutual Relief Building, which at 63 feet for 3 stories is likely shorter, but still doesn't feel as tall as it actually is.
• Also in a city with a tidal river.

Yahoo! Finance: Anthropic warns AI could 'self-replicate' across smart home devices, become 'challenging' to shut down. Via Jon_Alper @jon_alper@mastodon.online who notes that:

It’s not a warning to say “my product could do you harm”. It’s attempted extortion.

The Guardian: AI in your oven? Anthropic warns models ‘months away’ from self- replication on smart devices, via Jason Lefkowitz @jalefkowit@hachyderm.io:

Anthropic CEO Warns There's an LLM Under Your Bed While Holding Flashlight Beneath His Chin

We absolutely need better models for embedded device security and firewalling, and better consumer control over what processes are running where. The Mirai botnet, BADBOX 2.0, Mirai variants and so forth (I started looking, and it just keeps going), are real. Keurig Coffee Makers sometimes use 100G/day of data.

But... we really need to be using the Computer Fraud and Abuse act for its intended purpose against these threats.

aeva @aeva@mastodon.gamedev.place

thanks to ai, saying you're "dating a model" is a lot less likely to impress anyone nowadays

Yay! Voted.