Tiberium

Sounds like a hallucination unless proven otherwise, even the leading LLMs can do those from time to time, and they will always appear plausible like that. Also could be the session having a lot previous context, like 800K+, which (I think) makes hallucinations more likely.

Relevant comment from the OP which makes a hallucination more likely:

> There is one tool call result that includes a string that printed a pathname including minecraft.py because it was listing the files in a Python virtual environment and the Pygments package has a lexer called minecraft.py

I wonder how the performance looks like, because this can be interesting even for non-porting reasons ;)

NetBSD already has relevant packages officially.

Lavapipe is CPU rendering, it doesn't really prove much. But also, Vulkan on BSDs is totally possible and isn't something esoteric, FreeBSD has it.

> Build goal only: This targets compilation and linkage of the Vulkan stack. Runtime GPU acceleration is not available under VirtualBox; the software driver (Lavapipe) is the target.

I don't understand why this would ever be a problem, even without LLM assistance it's something that sounds like a weekend project?

> 2.5 kilobytes. No bloat, no telemetry, no nonsense. Just pure old-school Windows done right. Let's dive in and see how it's done.

> And today, we're going to answer the obvious question, which is not merely, "How is that possible?" The more interesting question is: "What does Windows already contain that lets a program that small behave like a real application?" Because the answer is hiding in plain sight, and it says something surprisingly important about native software, operating systems design, and why modern applications sometimes feel like they arrive towing a circus caravan.

> Suddenly, it wasn't just a stunt anymore; it was the beginning of something that could actually behave like actual software.

> A tiny native Windows program does not bring along its own entire civilization. It arrives with a lunchbox and a map of the city.

> And by the time the app even opens a blank document, it already has the gravitational field of a minor planet.

Those punchy comparisons, "not just" sentences are really a big tell of it being an AI-written script. I think a lot of people get fooled when YouTubers read AI-written text themselves, since you see it as a person talking, not as a pure text.

Some very ironic (unaware) comments from the video:

> It's so amazing to see this type of content in the era of AI slop where every app is just an Electron wrapper fighting for RAM with the other Electron wrappers. My favourite line from this "The OS is not just a bootloader for your browser and other apps, it's a giant library"

> Hey Dave, love all your videos, I'm curious how you manage not to fall into surrendering all your mental capacity to AI and what do you think of AI?

And other people noticing AI:

> Is it just me or does it feel like the script for the video was written by AI?

> I personally don’t like the style of narration used in this video, reminds me too much of AI generated fluff

> is it me or do daves scripts feel AI generated

> Is it just me or the whole script sounds like AI? It's not just x is, the comment about a compression goblin一 God, I have AI psychosis

> Why the AI text. You're a good storyteller.

> Dave, please tell me you are not using AI for your scripts... Your "it's not ____, it's ____", is making me worry

Even funnier, if you take most direct quotes from the PCGamer article [0] and concatenate them, Pangram (which is quite reliable) marks it as 100% AI-generated, and it does indeed read as AI-written. Someone in that Reddit thread remarked "I began watching his video and could not cope with him reading AI content from a teleprompter." as well.

"""

If the system feels sick, if an app is hung, if the machine is gasping, Task Manager does not get to arrive fashionably late, staggering in under the weight of its dependencies.

It has to be there now, and it has to feel crisp. It has to look calm even when the rest of the system is not.

Once you spend your formative years on a machine where every instruction has to justify its existence like it's applying for a loan, you never fully recover from that. Every line has a cost. Every allocation leaves footprints. Every dependency is a roommate that eats your food and never pays rent.

I'm not here to say that modern engineers are just dumb because they're not. Their world is vastly more complicated now.

Old code, like Task Manager, has the opposite bias. Nothing got to tive in the hot path without a fight.

"""

[0]: https://www.pcgamer.com/software/windows/task-managers-creat...

This person's whole marketing seems to be based on "I built Task Manager", so much that it has become a meme, see e.g. https://www.reddit.com/r/pcmasterrace/comments/1sl5nv4/task_... (also apparently there's some dark history involved)

The website is clearly AI-written (along with the text), and the screenshot also looks quite like the styles that LLMs love

Seems like the model is incredibly inefficient at max reasoning, and even at high/xhigh it uses far more tokens than other models, including Gemini 3.5 Flash, GLM 5.2 and so on. GPT 5.5's efficiency in tokens is still unmatched.

See also: https://cursor.com/cursorbench

I don't like talking with an LLM, but anyway, email is more than enough for phishing/social engineering nowadays, because it's often trivial to find out accounts in different services that use a specific email

Yeah, I forgot about these :)

You won't be able to scan most of websites this way because most servers expect you to also pass a valid hostname. However you can use domain lists, for example https://purecrawl.com/en/download/domains (or https://domains-monitor.com/ which is paid but has more domains) as an initial seed shouldn't be too bad, but you'll have to ingest terabytes of spammy/low quality content.

Impressive, this is the most blatant email collection campaign I've ever seen. I guess the owner would just sell the emails to someone else or try to phish/social engineer.

It could be true, but the more I look into it, the more I feel like it's not very genuine. For example, https://xonaly.com/privacy-policy/ has a very strong no third party claim, yet the actual xonaly.com homepage calls the Open-Meteo API for weather data from the user browser.

The search engine does indeed seem to be fully custom - the results for niche topics are quite bad, but that at least means it's not a Bing frontend, so it's forgivable. Although I wonder why the authors decided to go 100% custom instead of (partially?) reusing https://github.com/MarginaliaSearch/MarginaliaSearch for some of the core engine.

On an unrelated note: why do some people use LLMs to write all the text in their projects? As an example: https://xonaly.com/how-it-works - it's obvious that the text here is LLM-written, but I genuinely don't understand why. It's one of the pages linked directly from the home page, so it's quite important. At least personally, I always get very suspicious of any project that doesn't even bother to have some human-written content. (I know the whole website clearly looks LLM-authored, but I feel like it's not hard to add some human touch)

Don't get me wrong, I use LLMs myself quite a lot, but I try to always interact with others in my own words. In rare cases where I need to paste some output from an LLM, I always leave a note about it being AI-written.

Oh, and another funny tidbit I just found: https://xonaly.com/is-xonaly-legit/ repeats the same facts a lot. Ctrl+F "Canad", "independent": 10 results, "search engine": 17 results.

I think the fact that you only use the free plan might correlate with the code size and the need to debug/test a lot.

> I write

You mean the LLM writes the code based on your instructions (that's fine, I guess, but 5KLOC is huge for this kind of script).

Are they all actually 0-day? I think a lot of them are from disclosed CVEs/code that were already fixed upstream. It often seems like the term "0-day" has lost most of its meaning today and people often use it to refer to any exploits.

Wanted to mention that Sailfish has a lot of closed-source components, especially UI-related, despite the overall marketing/"vibe" making it look very open. If anything, AOSP (Android) is more open than Sailfish. I don't think this has changed with Sailfish 5, see e.g.:

- https://forum.sailfishos.org/t/sailfish-os-clarifying-claims...

- https://docs.sailfishos.org/Develop/Open_Source/

Welp, guess the only option is to stay on some single version then and hope it doesn't get critical security issues...

Because I wanted native TypeScript support which Node only gained relatively recently and only partially, plus the issues I showed are regressions - they worked fine in earlier Deno versions.

To be honest, Deno was cool in the past (I even somewhat promoted it on HN in some comments), but nowadays I'm disappointed in their lackluster approach to stability and testing (specifically in Node compat). I recently hit multiple Node compatibility regressions in Deno that were hard to debug, and it doesn't help that they use Claude for everything now, from actual fixes to writing blog posts (even this one).

For example, those two issues recently directly affected my projects:

- https://github.com/denoland/deno/issues/34297

- https://github.com/denoland/deno/issues/35289

Seems like the core of these issues was a Claude-coauthored PR: https://github.com/denoland/deno/pull/33208

I think I'll probably just go back to normal Node because it's stable and won't break things like this between minor releases, plus it's not full-on vibe-developed like Deno and Bun.

P.S.: Deno does genuinely have good parts: built-in type checking, LSP server, formatter with sane defaults, and so on. I'm just very disappointed that they seem to be focusing less on the actual core runtime.

It was kind of expected since Steam Deck (obviously) had an AMD APU, and AMD works much better with mainstream Linux projects in general.

I think a lot of people expected it to be in the ~$600 price range, maybe ~$800 at worst. RAM prices made it quite expensive...

Summary from the article:

Earlier this month, a friend of OALABS reached out with an interesting situation. A server of theirs had been compromised, and the attacker was using it as a staging host to carry out further attacks. Our friend was able to download the attacker's working directory before cleaning up the host and noticed that the attacker was using the Anthropic Claude Code agent to drive most of their attacks. OpenAI's Codex agent was also used to a limited extent.

During our analysis of the recovered working directory, we discovered that the attacker was not just using the host as a proxy; they had full Claude and Codex agents installed locally and were using them remotely to carry out reconnaissance, exploitation, and data exfiltration activities. Because the agents were local to the host, their full session logs were recovered, including the attacker's prompts, the tools used, the internal monologue of the large language model (LLM), and any policy violations recorded during the sessions. In total, we collected more than 1,000 agent sessions for Claude and Codex, so many that we had Claude (ironic) develop a session-log forensics tool to assist with the scale of the analysis: ASF Triage. In addition to the session logs, we also discovered a myriad of LLM-developed tools, artifacts, and logs detailing the breach of at least 14 companies.

Yes, but the Artificial Analysis result is also from GLM 5.2 (max), not high.

It seems to really be a nice step-up and is getting quite close to the frontier. I wish they'd start focusing on the reasoning efficiency now, though. I have a simple (relatively) test task to evaluate LLMs: writing a simple math evaluator library in Nim (it's about 400-600 lines total max), and GLM 5.2 (xhigh which maps to max effort) spent over 15 minutes (!) reasoning, spending about 45k tokens, before it finally wrote the first file.

I know it's hard to improve on that, but now that their models are good enough at raw intelligence, I think this should become a higher priority task.

Currently on https://artificialanalysis.ai/#output-tokens GPT 5.5 xhigh spends 16k tokens total on average, GPT 5.5 high is 10k, Fable 5 33k, Opus 4.8 41k, GLM 5.2 is 42k. GPT 5.5 is extremely reasoning efficient.

Of course if you convert those values to actual request cost, GLM 5.2 will probably beat GPT 5.5/Opus 4.8, but speed matters for a lot of people, I think.

Why is it stupid to flag genuinely LLM-written content? It might've been thought out by a human, but the final version is clearly LLM-written or extremely heavily LLM-edited.

It did, this article is clearly LLM-written/edited

What about women, though? Do they not get to age verify themselves? :P