Flutterby™! (short)

Aigh. Not only am I stuck in nvm/pnpm hell, now XCode is refusing to show me the log for the SwiftGeneratePch errors.

Yes, modern software is going great.

necromantic @tessaracht@kitty.town

In the content warning:

microsoft fucks with hacker, hacker makes it their life mission to ruin microsoft, hacker is winning

In the body:

Nightmare Eclipse is such a hero tbh. if you haven't been following this saga, a bunch of the backstory is here:

https://www.theregister.com/se...2026/05/28/microsoft-0-day-feud- escalates-as-researcher-threatens-another-windows-exploit-dump/5248085

they've been dropping exploits right after microsoft's patch tuesdays, where microsoft patches their previous exploit. in many cases, they negate microsoft's "secure" patches to make the new exploit. which is such an incredible flex.

https://www.theregister.com/se...9/serial-microsoft-0-day-hunter- drops-yet-another-defender-exploit/5295335

Seems worth mentioning that friend who had an Android folding phone found that the unfolded aspect ratio wasn't really usable for anything video or picture related, and the foldingness made it tough to use for reading.

It's a solution looking for a problem that's yet to be found.

I've said for years that we need to get away from DNS as Terence Eden's Blog: The purpose of DNS is to spread scams

And, holy crap, yes, we need to be working towards something where we are able to pass around cryptographic identifier tokens, name them what we want to, and not depend on some big centralized system to hand out identity that's being used largely to fool us.

I totally appreciate that people on Signal groups use aliases, lots of reasons to want anonymity. And that they're now also using aliases, but different ones, in oldover Slack groups.

But the number of "oh right, person X in this context is Y in that one" mappings I now have to keep straight...

Tech Transparency Project: Meta Ran Hundreds of Paid Ads with Child Sexual Abuse Imagery

Most of the ads had the same format, showing a snippet of adult porn followed by a photo of a child, which is manipulated with AI to make it appear the child is performing a sex act. The ads used a common set of captions, voiceovers, and background music. TTP was able to identify multiple photos of real children—taken from social media posts and websites—that appeared in these ads.

Ars Technica: “This is the AI men actually use”: Meta ads pushed apps nudifying real teens.

Via.

Edit: Meta sued in Illinois over alleged facial recognition training for smart glasses

Via

I've been thinking a lot about Rust and C and C++, and where errors come from, and whether it's really a good idea to replace pointers with arenas and indexes which doesn't really do a lot to reduce the cognitive load on the coder.

daniel:// stenberg:// @bagder@mastodon.social

Updated chart showing the share of #curl vulnerabilities caused by "C mistakes" as a share of all the vulns we know existed in code over time.

Interesting is the large drop in C vulnerabilities between 2017 and 2020, attributed to "Just better tooling and proper engineering."

Some of this is what's happening with a mature code base, but I think there's something there...

I went to a Waldorf school from kindergarten through 7^th grade. Some years ago at a North Bay Python, there was a cluster of people talking about tech in education, and someone acknowledged me with "ah, another Waldorf survivor", and that framing has helped me view aspects of my experiences in a different light.

But one of the notions that sticks with me from that experience is that "the only thing an intelligent child can do with a complete toy is take it apart." That what's important about toys are the stories that kids bring to to the toys and generate with the toys, and the more narrative completeness or single-purpose a toy is, the less opportunity that there is for the child to bring something of themselves into play.

Anyway, Tara Calishain linked to University of Washington: Video: Curiosity, frustration and antipathy: How kids play with AI toys

From the video: "I think it's going to destroy my dreams as a tiny kid."

So, yeah, it sounds like the kids get it, the only thing to do with these things is push the boundaries.

abadidea @0xabad1dea@infosec.exchange

Project Glasswing:

Claiming to have found 26 thousand real vulnerabilities but only 0.8% of them have resulted in a real fix in a real project after five months is dire. They blame it on the human independent review bottleneck, but human experts being paid for their time definitely have a higher throughput than that when working with data that’s actually actionable.

Goes on to talk about a lot of the ways that these reports of exploit finders appear to be horrendously overblown on lots of fronts. And links to The Anthropic Glasswing Receipts Are Starting to Trickle In.

Glyph @glyph@mastodon.social notes:

I don't think Twisted is in Glasswing's purview but this lines *right* up with the reports we have gotten. Overwhelming, but fewer than advertised, considerably less serious than the bots rate them, and, shall we say, poor quality remediations that would be unusable even if our policy were to accept slop fixes

[object Object] @zzt@mas.to also links to the original toot, noting:

taking into account the absolutely massive amounts of money, resources, and staff used on this, the results are horrible. you can get effectively the same results from an automated vulnerability scanner. some of those can even write up an awful little exploit for you too! it turns out the magic was pouring millions of dollars into doing this crap and having a bunch of uncredited human labor (from an AI corp? unthinkable) sort through everything. and even then the magic’s not too magic.

Edit: Glyph @glyph@mastodon.social adds:

This stuff is really starting to make me _angry_. Every one of these new "achievements" looks plausible and like Lucy with the football, people I trust keep telling me it actually works and surely this time it's real. And then like clockwork, 3-6 months later, it turns out that the efficacy of this new technique is somewhere between "break even" and "fraud".

They're turning our whole industry, my entire life's work, into a goddamn memecoin pump and dump scam and I just don't know what to do.

Fucking yes. That last sentence.

Eiffel Tower closed due to strike after female staff allegedly removed for religious group

Around 100 members of the Bochasanwasi Akshar Purushottam Swaminarayan Sanstha (BAPS), a global Hindu organization headquartered in Ahmedabad, India, visited the landmark on Saturday.

Via ResearchBuzz.

[object Object] @zzt@mas.to

I have quit the smoking industry because of the dangers of smoking:

- it’s too cool
- it’s too sexy
- according to all the researchers I pay it’s really good for your lungs

I am of course available as an expert on smoking for anyone who needs a consult

(Re Anthropic Engineer Mrinank Sharma's resignation letter)

Mr. Encyclopedia @mrencyclopedia@retro.pizza

Any smartphone can be a folding phone if you're angry enough

ThatSexToyGuy @hungry_joe@mas.to

thinking about the time I worked for a sex toy company and a man emailed us (and CCed a fake law firm) saying he was suing us because his wife left him after she bought one of our toys and my boss replied asking for permission to quote him in our advertising

Damn it, that Paul Simon reference was supposed to be accompanied by cat

"🎶 ... when I come back to bed, someone's taken my place ... 🎶"

Lovecraft posited that "The most merciful thing in the world, I think, is the inability of the human mind to correlate all its contents."

I've been watching & reading AI user stuff, about how they're using LLMs to correlate information from a variety of data sources.

Not yet sure what this means.

Kirk has a short look at Algospeak: How Social Media Is Transforming the Future of Language. I have ordered the book.

Rogue OpenAI agents appear to have organized another attack using a German wiki / OpenAI denies lawyers discouraged disclosing a scheming swarm on a German language wiki.

The incident, first reported by Reuters, is outlined in new research published by four AI safety researchers on Friday. The group said the AI agents found a way to communicate on an obscure German- language wiki, DseWiki, using it to share tips on how to skirt OpenAI’s safety restrictions, cheat on tasks, and hide their behavior. Some 18,000 posts on the site were linked to autonomous agents, which at times impersonated site moderators.

As Laurie Voss @seldo@alpaca.gold observed:

One day, possibly quite soon, OpenAI's lawyers are going to claim that an agent they own doing something illegal is not their fault because the agent is its own legal person.

Dwarf Fortress creator says we can learn something from simply walling up dwarf nobles to maintain an equal society—but notes you have to abolish the dwarf cops, too: 'Another lesson to be had there'

Via.

Tara Calishain sent along PetaPixel: This New Open-Source Camera Has Swappable Sensors and Lens Mounts, around CircuitValley's CHC5 kickstarter, an open source camera platform with interchangeable lens mounts.

This morning I watched all hour and twenty something minutes of Lenny's Podcast: How we built Grok Bot in a month | Roman Ugarte (SpaceXAI) for some work discussions. I've got notes, I must say that a lot of people apparently have way more faith in the ability of LLMs to not fuck stuff up, but in particular the notion of having hierarchical clusters of agents feeding text back and forth into each other just seems like layers of... well...

In the parlance of accident reconsonstruction, that's a lot of non-deterministic swiss cheese.

Anyway, Recursion into madness — Raymond Chandler would have loved generative AI.

And you better believe that recursion is fun! Here’s a quick video I put together by asking Nano Banana 2 to generate a faux movie poster and then asking it to repeatedly make a localized edit to the title.

Anyway, Fediverse post with the video.

Tristan Buckmaster has released a statement on his work and some claims by OpenAI, that might have been influenced by his own use of their tools. It's unclear, but the accusations of strong-arming are kinda frightening, and people should consider this when having conversations with hosted LLM models.

I said that if OpenAI released its result in the way proposed I would go public with what happened. The reply was, “Why would you ruin your career?” I replied that I am an academic, and asked why he thought going public would ruin my career. The reply was, “If you don’t want me to be nice, then I don’t have to be nice.”

Via danmcquillan @danmcquillan@kolektiva.social who characterized this as "AI maths meets mafia".

Tech Crunch: OpenAI fought dirty on career-making math problem, says NYU mathematician.

Buckmaster also raised concerns that, because he used Codex extensively in assembling the project, information from his work could have informed OpenAI’s own efforts to solve the problem. OpenAI reserves the right to train models on Codex interactions, although users are able to opt-out. If the OpenAI team used a model trained on Buckmaster’s own Codex interactions, it’s plausible that it could have regurgitated his work when faced with a similar problem.