jeroenhd

LLMs are finding bugs where there aren't any and wasting human time trying to disprove the slop.

If all LLM reports were accurate, they'd be of any value. However, that's not what is happening. If you have even mentioned something about a bug bounty anywhere, waves of slop peddlers will flood you with fake reports marking every minor bug as a critical problem, hoping to catch a handful of dollars in the process.

These models do find some problems and may even provide decent suggestions to fix them (though they really want to add code above anything else, quickly leading to spaghetti if you accept it all). That's not the issue at the moment, and as long as people try to incentivize people to report bugs, the issue will remain.

I do expect this to be temporary, though. Not because LLMs will fix all the bugs, but because the flood of slop will shut down most public bug bounties.

You put the money in your bank account and use that to pay, or you buy the other currency. The same way you would with physical coins and notes.

Or, if the UK/USA/China set up their own pseudo-cryptocurrency, you can probably exchange digital euros for digital dollars or digital yuans.

Thanks to the incredible combination of Lenovo and Nvidia, I cannot remove the Microsoft keys from my laptop. Not because Microsoft backdoored my computer, but because the Nvidia boot ROM is signed by an MS cert and that runs before you can access the UEFI setup.

I hope the firmware either doesn't check the expiry date or that the firmware itself has been upgraded, or several years worth of Thinkpad are about to stop booting in the near future.

The ships aren't new, but a large transport operator like DHL buying into the concept is.

Well, unless you count pre-motor cargo ships of course, those were the only option for centuries.

Which operating system do you mean? Flatpak has this already, Android enforces this kind of API for shared files, Windows UWP has pretty much the exact same API (https://learn.microsoft.com/en-us/uwp/api/windows.storage.pi...).

App developers will often choose not to sandbox their applications because it's a lot easier (and sometimes faster) do to all file management yourself, but the APIs are there and ready to be used.

That's different. While your CA can hand out new certificates, it doesn't know your keys (unless you messed up when uploading your CSRs).

CAs have to prove they're not faking certs through the certificate transparency logs, there's no such limitation on Bluesky.

A more apt comparison is a shared host that does certificate management for you. Those are also often considered less secure, of course.

Every scraper I have blocked seemed to use IPv4 primarily. Only when IPv4 gets blocked, some of them fall back to IPv6. Others just stay dead.

With AI companies using botnets ("residential proxies") for scraping, they're probably going to be in the 50% that doesn't use IPv6.

My home internet has IPv6 but my mobile carrier doesn't. IPv6 on mobile carriers is unfortunately still not universal.

It'll bite any user that the bots will copy. Every trick a user might use to make themselves unrecognisable on the web is also used by a bot farm somewhere out there.

Website owners that use Turnstile and other such services choose to exclude these users. A tiny margin of false positives isn't going to dissuade most website owners, I imagine only the ones that themselves have issues with Cloudflare will bother to add the necessary rules to permit uncommon users (and the bots that copy them).

Zero issues on Firefox + Linux. Gnome Web is stuttery and weird, though. Must be a WebKit/Safari thing.

If all bots are subject to a rate limit, then the system works as designed. Especially if site operators can block bot accounts. Requiring accounts is one of the easiest solutions for that problem. One of the large issues with scrapers is that they pretend to be normal internet visitors that never visited your site before, because any bot that stored cookies would immediately be rate limited by basic config.

Turnstile isn't something Cloudflare put up to annoy you. It's what the website owners decided to put up, for many different reasons.

In the same vein, Anubis has a default configuration that lets honest scrapers and crawlers through, because those can easily be rejected by basic web server configurations. Only scrapers pretending to be browsers need to solve the proof-of-work puzzle. You can disable that feature, of course.

Cloudflare may play this smart: force bots to pay for access, then take 30% of the cut and give the rest to the website owners. That way, websites get paid when the AI slop machine digests their content. Normal visitors get in for free, turn the scraper hellscape into a sustainable model. Bonus points for letting websites set their own rates (pre-declared to scrapers, of course) to dissuade all but the most interested scrapers.

There are USB to USB dongles (and even fully wireless bluetooth dongles!) that run firmware like QMK/ZMK which let you reprogram almost any keyboard you can find.

You can use them to use multiple keyboards with different functionality tied to the F keys (or any key, really), add extra layers (if ctrl+shift+win aren't enough layers for you), program in things like macros, and more. The most extreme case I've personally seen online was someone with individual hotkey labels printed on two keyboards besides their main keyboard.

The advantage to this over software remapping is that these dongles work like physical devices, so they'll work just as well over RDP or VNC as they do locally. Applications using raw key scan codes for shortcuts (which they shouldn't do, but alas) will also be fed raw keystrokes, which improves compatibility.

I use a bluetooth numpad remapped in software myself, and I wish I could reprogram it so I didn't have to deal with the software bugs (but reprogrammable keyboards are three or four times as expensive).

It states something about "your organisation's security requirements", do they document what requirements cause this rejection page? Some kind if changed default perhaps?

Offering a UI to quickly set it up.

Reading through exim docs has taken hours of my life and it still caused weird issues. Using software that works for setting up a multinational email server to make your homelab send messages to Gmail is a massive time sink and kind of ridiculous really.

I haven't tested the code myself, but I'd prefer a simple system with limitations over a complex system that can be configured for simple tasks.

I simply do not trust articles that use slop imagery like this. I assume the text of this article (and realistically, most articles posted here) is also slop, but it's often difficult to tell.

If you don't have the time or put in the effort to make your article, I'm not going to spend time and effort reading it. You really don't need some generic cartoon guy hovering over your graphs, draw them in MS paint or something.

JDK 21 is a few years old now, so you were a few years behind. JDK 25 was released last year, which makes for the next stable LTS for a while. JDK 28 is expected in 2028, and these features are not going to be enabled by default for years after that.

Java is generally backwards compatible, so unless you're using fat frameworks that use shady internals or known-deprecated APIs, you should generally be fine immediately upgrading to the latest LTS, possibly even non-LTS versions if you have confidence in your stack.

I've had this issue with a different Linux distros. If I recall correctly, it was becauserthe headphones were using some proprietary codec to push more bits over an older Bluetooth standard.

If you boot into desktop mode, you can check if switching to plain old A2DP works. That solved the issue on Ubuntu (and Windows) for me. I think audiophiles will lament the loss of audio quality, but lower latencies are much more important for gaming.

Americans are also far less into AI than a startup forum like HN will make you believe.

In real life, there are a few AI maniacs that make their entire identity about how they use AI, but it's hardly the sensation that the internet will make you believe. I don't believe there is any difference between the USA and Europe, although the lack of employee protection does mean that it's a lot easier for Americans to lose their jobs when their managers get lured in by AI companies.

After all, the entire AI bubble is all about VCs and startups hyping each other up until profits magically appear.

There's an absolutely massive cultural and behavioural bias in those models. Models will suggest things like "go to the hospital" for things that require GP appointments, "just drive three hours" while it's faster to go places by train, and so on. They will do it in anglicised Dutch (compound words split, English-like grammar structures) that's perfectly understandable, but the cultural bias is there if you know to look for it.

Furthermore, the expertise in designing and training these models is valuable as well. The existing models are good as a starting point in terms of learning from previous mistakes, but we should not just let a handful of American and Chinese people keep the knowledge and expertise.

One problem with this particular project, though, is that copyright has been enforced for Dutch LLM training before, and the AI industry cannot exist without massive scale piracy, the likes of which has never been seen before. A lot of Dutch training material exists in pirated books that AI companies in countries that do not care about copyright have access to, but are exempted from the training set here. The impact of enforcing copyright on an AI model will be quite interesting to see.

My experience mirrors that, but mostly because Caddy does HTTP/2 and http3 by default, natively. HTTP 1.1 is faster for bulk data transfers (while being worse at pipelining and latency in general), so I'm not surprised Caddy is taking more CPU in this case.

In my experience, in terms of latency, Caddy is a lot faster, every single time. I don't know what modifications I need to do to nginx to make it comparative but Caddy easily shaves half of the connection and transfer delays on my local network.

mTLS supports some protocol level security guarantees that passkeys don't. Because the keys are exchanged during connection setup, there's no need for a login screen and Javascript middleware to begin the authentication process. mTLS is also easy to implement for APIs, you basically get authentication for free.

Unfortunately, browsers don't invest into making a good UI for mTLS. If browsers simply put their foot down and said "we will not permit websites to ask for a certificate if the request does not contain the proper requirements" like they do in passkeys, mTLS would be just as easy to use (and even easier to manage and rotate!).

When I ran mTLS auth on my intranet, I discovered that a lot of sites will use mTLS support to do fingerprinting, which means a lot of pages will open a blocking popup (sometimes multiple times) when I just want to read an article.

The attacker used at least three Node dependencies in the attack, just checking for atomic-lockfile is not enough. The names js-digest and lockfile-js were also used, and at some point the attacker switched to bun instead of npm.

To be fair, generative AI is wrecking society in new and unexpected ways every week. From lies and misinformation to people choosing chatbots over therapy and relationships, there's a profound impact on society that will only get worse in the coming years. The look for junior programmers who are capable enough to get anything done when the AI is down has been depressing, and things are looking much worse for the years to come.

Important safety features ("do not generate child porn", "statements should be factual or backed by evidence") were simply not part of the design of these systems and have yet to truly solved to this day, but AI companies decided to release these technologies onto the general public regardless of their glaring flaws.

I like AI for its shitposting capabilities and its neat parlour tricks, but I also believe so far it has been a net negative for everyone but the richest minority of society who benefits from firing people and having computers do half their jobs badly. It's too late now, but in hindsight I do agree that these systems were too dangerous to release in this shape.

Note that pacman supports date locales; searching for '9 Jun' only works in English locales (or locales using similar formatting, I suppose).

After correcting, for me, it flagged "jd-gui", but I had actually installed "jd-gui-bin" about two hours before the compromise. As far as I can tell, I was lucky that I felt lazy that night and went for the -bin package instead of waiting for the source to be compiled.

It's technically possible (though I don't know if they actually do this) that they're not referring to a signature check in the download part, but are verifying the code signing signature of the executable downloaded. You'd only notice the CRC if you were looking at the downloaded content, but if the updater refuses to launch an executable that isn't signed by AMD's cert then they would be fine.

Given the way AMD has been treating this issue, I'm assuming they're just incompetent, though.

I am literally showing the reader mode view in my screenshot. I know how to work around badly designed websites.

I disagree. https://litter.catbox.moe/3h3atpy3s8ny7ify.png is a lot less readable than https://litter.catbox.moe/tqims20z6biymm3y.png

Even on desktop the site is quite difficult to read. White on gray isn't a great reading experience regardless of font size.

Accessibility technology like reader mode is once again proving its worth.

You need to click "highlight all" to highlight all occurrences. It's the checkbox to the right of the search box. If you enable it for the first time, you may need to hit enter in the search bar again for it to show up (it remembers the setting and works instantly the next search)

The EU would be better off promoting separatism for the redneck states rather than specifically supporting California. Direct trade with California is tough, but if the southern states were to fall off, the east coast of the USA would still provide a decent area to trade with.