@freddy Oh yeah and this other thing called the clipboard...or the keyboard...

@freddy sorry what? :)

Posting to social media is like writing to the wall of a public toilet.

If you are bothered by replies, pictures taken of your work, or genitals drawn next to it, then you are probably using the wrong medium.

I've turned off pull requests from non-members for Flask, Werkzeug, Jinja, and Click this week, and have enjoyed not waking up to a fresh wave of AI junk every morning. I think I'm going to update our contributing guide to say "introduce yourself and how you use the library in chat first if you want to contribute pull requests". Sad that we had to go here, but aside from conference sprints we weren't really getting outside contribution anyway (which is also sad, but that's been the case a lot longer than AI has been around). #python #flask #opensource

@tychotithonus I miss OS diversity too, guess it'll be a future improvement? Prioritizing Linux instructions makes sense if you consider CI pipelines.

My friends, I have spent months assessing "AI security" products, especially ones that claim to prevent jailbreaking, prompt injection, etc. Here's what I know:

1. They don't.
2. These companies are reinventing EDR from first principles, but with minimal understanding of system internals.

It's really a sight to behold.

@HalvarFlake Thanks for highlighting the importance of statistical rigor! I'm exactly as bad at stats as you describe, but seeing conclusions drawn from 3-5 test runs being the "standard" for model/prompt/agent evaluation feels just wrong.

I gave a talk at Bluehat Singapore. Here is a link to the slides, and a photo that perfectly frames it.

https://thomasdullien.github.io/about/slides/An-age-of-experimentation-BlueHat-Asia-2026.pdf

Telstra outage: The night a network decided the year was 2006

https://www.netnod.se/blog/telstra-outage-night-network-decided-year-was-2006

RE: https://mastodon.social/@eff/117215319335459732

Oof. "Copyright bad so AI companies violating copyright good" is a terrible take.

Dependency Cooldowns for different package ecosystems

https://cooldowns.dev

This Code is CRAP

https://testing.googleblog.com/2011/02/this-code-is-crap.html

#programming

Linux kernel root exploits in EH6, SCTP, PPPoE: https://seclists.org/oss-sec/2026/q3/822

If you don't know what these abbreviations means: networking stuff that you probably don't use (ok, you may use PPPoE on your Internet router, but you still don't need it on your desktop or server).
I'll add my ceterum censeo: Attack surface reduction works.

https://seclists.org/oss-sec/2026/q2/557

Flock cameras are riddled with security vulnerabilities and hard-coded credentials. Here's my analysis of today's @ddosecrets Flock leak https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/

RE: https://infosec.exchange/@micahflee/117282688510612709

*Jabba the Hut laugh* ho ho ho ho

Flock API key = НаJ3FgupAm8RrDJW3МНgT9X7Ft27eVaD

https://ddosecrets.org/article/flock-alpr-camera

This discussion in the ⁠binutils⁠ mailing list is interesting. I had no idea the target binary could easily detect and interact with Valgrind directly. Valgrind provides a header (⁠valgrind.h⁠) to help the client do exactly that.

A change in the ⁠gas⁠ assembler that optimized ⁠xchg reg, reg⁠ to ⁠mov reg, reg⁠ in specific conditions broke Valgrind. That optimization yielded more efficient code because the ⁠mov⁠ instruction is cheaper.

Valgrind implements a trapdoor—a "hypercall"-like mechanism between the target and Valgrind, officially called the Client Request Mechanism. This trapdoor relies on a magic sequence of preamble instructions followed immediately by an ⁠xchg⁠ instruction.

Because the ⁠gas⁠ optimization replaced that ⁠xchg⁠ with a ⁠mov⁠, Valgrind was seeing a ⁠mov⁠ and failing to recognize the request.

The problem occurred both when Valgrind itself was built with the optimization, and when target binaries were built with the client-request mechanism through the ⁠valgrind.h⁠ file. ⁠systemd⁠ was one of the affected projects. Because there are many projects out there built with the Valgrind header that hardcode the expectation of an ⁠xchg⁠ instruction, the optimization had to be reverted.

That problem resulted in the following error in Valgrind:

vex amd64->IR: unhandled instruction bytes: 0x48 0xC1 0xC7 0x3 0x48 0xC1 0xC7 0xD 0x48 0xC1
vex amd64->IR: REX=0 REX.W=0 REX.R=0 REX.X=0 REX.B=0
vex amd64->IR: VEX=0 VEX.L=0 VEX.nVVVV=0x0 ESC=NONE
vex amd64->IR: PFX.66=0 PFX.F2=0 PFX.F3=0
==568970== valgrind: Unrecognised instruction at address 0x484f1e9.

[PATCH 1/2] x86: optimize XCHG to MOV for same-register forms
https://sourceware.org/pipermail/binutils/2026-July/149944.html

x86: Disable XCHG to MOV optimization
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=49652cd8ecbb4c305a9a0e9099016edb138e6953

Using and understanding the Valgrind core: Advanced Topics
https://valgrind.org/docs/manual/manual-core-adv.html

@cR0w Exquisite meme, sir!

The entity drifted dreamlessly through space, as it had for aeons. It woke when it neared a star. Scanned for planets, life, signs of technology.

Having found all, it analyzed and decoded radio emissions, then composed a message to send.

"My hovercraft is full of feels."

It resumed dormancy.

#TootFic #MicroFiction #SmallStories

Another legend passed away, R.I.P. Bill! :,(

https://www.youtube.com/watch?v=SfMyJIX6S0k

#music #blues #hungary