mpeg

Back in the day I wrote a PoC exploit for my employers app that abused an image upload api by embedding a jar file inside an svg as XXE which then got me RCE. Fun times.

It is, it asks you if you want to continue as opus 4.8… but I was trying precisely to evaluate fable

It's not even very usable... I tried 2 different chats and both eventually got stopped due to the safeguards

One was a piece of code I gave it to improve, it did so and then started writing tests, some of which tested security so the safeguards triggered

Another was one of the cryptography puzzles I use as new model tests, which are hard to oneshot and there's no public solution anywhere, it completely refused to even try to solve it

I figured, I just had a visceral reaction to that specific template as I get so many of them

Random but... please do not use this template on real emails

"Hi [FirstName],

I came across [Company] and was impressed by the work you're doing — especially [specific detail]."

It's a terrible cold email, I get so many of these every week... There's better ways to get someone's attention

I find it quite dishonest as github stars used to be (and maybe still are?) the measure of an open source project popularity, and these big, flashy LLM generated repos seem to always get a bit of attention

Have seen it from jobseekers trying to boost their profile with fake projects, founders trying to make their product more attractive to VCs, consultants trying to advertise their services...

I don't always have time for OSS, but every PR I've ever sent has always been hand written, and tested, and has taken into consideration the project coding style and architecture choices – I don't like this new world where developers can't even be bothered to write the docs.

How does this compare to the classic css-native parallax effect? Before the scroll timeline APIs you'd use the "perspective" css property to create a container where the z plane is n pixels away from the screen, and then position each layer within it at a different z distance using transform: translateZ

That method is GPU accelerated too, so it is performant compared to some js solutions, and has worked well in every browser for around a decade

I like the idea of the scroll-timeline though, just keen to understand what the advantage is for this

This is cool, I have SVT and usually am able to stop an episode if I do slow breathing like that; although sometimes if that doesn’t work the modified reverse valsalva manoeuvre does it every time.

I wouldn't be surprised if all the large AI labs already had an FTP account for Anna's

At the very least the chinese ones definitely would regardless of the legality, the western labs would keep it under wraps but they also probably do.

At their scale, he cost of scraping or getting it directly from Anna's sources is way higher than just donating $50k and getting easy, fast access

Or KSA

Yes but you can't compare some ollydbg script that would maybe be useful in a super specific challenge to LLMs which trivialise absolutely every challenge in a ctf and are de facto necessary to compete now

On the tooling I've made? Feel free to ask here or via email, the Salesforce one was for a fairly large (50k+ employees) company that uses it very extensively but as it often happens they're stuck with a ton of legacy crap. They have some of the AI tooling from SFDC but barely use it (lack of training, or interest) so this solves their immediate problem.

I'm very keen to use their new dynamic workflows (cf's durable execution engine) which would let agents write workflow steps, that way my users can ask an agent to do stuff like "run this report daily and email it to me" and it can work with minimal setup (very basic example, but you get the idea)

Huh? Haha I swear I’m not a sockpuppet or getting paid by cloudflare (I wish!) I just like their products

I think this post needs to be put in context, for months now Cloudflare has been releasing products that allow their whole platform to be usable by agents with the main objective of enabling their customers to dynamically write code using Cloudflare, this is just another step.

For example, you can now with Artifacts and Dynamic Workers make a lovable-style SaaS where your customers ask the AI agent to write software for them, the agent can run it in sandboxes with no build step, it can version it with a git-compatible API, and now you can even have it buy a domain for the end customer or set up their own cloudflare account when they want to move to production.

I personally have no use case for creating domains via agents, but some of the other features they're releasing around this area are extremely useful and I've started to ship internal tools for my clients where they are used, like giving them their own mini claude code that only does one thing – one I shipped last week was an agentic interface for Salesforce reports that understands their domain better (and all the undocumented tech debt) than the built-in Salesforce AI does and therefore manages the context better

If you look at the last 5 challenges (the ones Kimi was in) both Claude and Kimi have 1 DNF, chatgpt has 2

I'm not sure this is enough data to form an opinion, but going by what we have Kimi would be as reliable as Claude

If you look at the ranking breakdown though, Kimi K2.6 has only participated in the last 5 challenges (claude dominated before then) and if you only count those it would be in first place

You learn the most random ways to abuse program features, one I still remember because of how long it took to figure it out was an htb box that (after a long exploitation path) used NTFS ADS to hide the flag within the alternate stream in a decoy file; and of course the normal way to extract the stream was disabled so had to do some black magic with other binaries to get it

I was surprised at the low bounty too, considering the resources of openai

Last year I won a similar prompt injection challenge ran by a crypto startup against the latest claude and gpt (at the time) and it was considerably more money, from an org with maybe $5-10m in funding.

That and the restrictive NDA kinda tells me they're not looking for serious bounty hunters, who would either want a lot more money or, alternatively, to be able to publish their work; seems like a marketing stunt.

This one would be a fun challenge in a ctf, or maybe more appropriate for a puzzle hunt – most people would look at the dissassembly and not at the actual bytes and completely miss the binary encoding

Depends of what you prompt it... if you tell it to use react and shadcn, it will use that.

It's generated, when you try it you can see this is mostly a harness around claude opus 4.7 that helps it create a good design plan, it also supports asking you questions as it goes along, letting you review and feedback on mockups, etc, but ultimately if you look at what it's generating as it does it – it's just code

It's rolling out progressively, it works for me – it actually seems very polished, the examples are really good; and it lets you create your design system from your codebase

I don't have a horse in this race, but this seems the right way to me. As a developer, I do already inject custom scripts to provide extra functionality / automation on SaaS I use where APIs are not available or limited.

However, the thought of the non-technical users I work with doing that is scary, they have no idea if the code the LLM writes is correct, is it going to have a bug that causes a massive issue down the line?

I've seen fat finger errors cause financial loss, but at least in those cases the user always had a chance to realise their error and fix it, with something like this how would you even know?

lots of admin credentials too, which have probably never been changed

Sorry I'm blind! I completely missed the live demo. I think because it's on the top right corner I instinctively ignored it.

Maybe could have a "Try live" button that sort of nudges you to it (could open the sidebar with the page structure or something to make it obvious you're in "edit mode") if other people struggle to find it

Re. diff view, yes, I think it's the kind of thing that would give reassurance to users that they can play around with it without breaking anything, otherwise I feel I'd be a bit scared of accidentally touching something that shouldn't be changed (especially as you might experiment a bit before you land on the right style to change)

Motion is an excellent library so I gave this a go on a prod site. Some feedback

- I LOVE the concept, no clunky SaaS, you add the package and start it on your dev server and it just works. It seamlessly did with my vite based build.

- Needs a diff view which tells me what the agent is going to change when I publish my changes, right now it's a bit scary to use without it (not sure if it does once you try to publish changes, I didn't get that far in the process)

- I don't see the point of the "draw" feature. Maybe it's because I envision this kind of tool being used so that non-technical members of the team can make small design changes without dev support, and not as a way to design from scratch, but maybe you have a use-case for it.

- Integration with tailwindcss would be a killer feature, this particular project uses tailwind so all the styles in the style view show as the default ones but of course they're being applied via classes. You could detect tailwind classes and either show them separately or resolve them and show what they do in the styles view, then on publish you'd tell the agent to edit using tailwind classes

I agree with what others have said, a video or even better a live demo would be great. A demo would be extra work but would be super cool, as a stopgap you could have a stackblitz demo maybe.

The client-side injected js -> mcp flow is brilliant though. I might have to steal that idea for some projects I'm working in, I can imagine a lot of scenarios where it would make a great interface

Most of the time: no

But sometimes you do have clients in both sides of the atlantic and it's nice being able to cut their request times by a few hundred ms "for free". Personally, that's not the main reason I use cloudflare, but it can be handy!

Yes perhaps I should have specified you can't get much cheaper for serverless platforms.

You can certainly run a VPS like that for cheaper, you could probably even beat the raw request numbers from those 1€ a month vps from ovh or similar. The key difference is with cloudflare your site is globally distributed by default, and you get to buy into the whole ecosystem, if you want.

Honestly, you'll struggle to find a cloud platform cheaper than cloudflare.

The $5/mo gets you 10 million dynamic requests (static assets are not included in this limit, so often a single pageview will be 1 dynamic request) and that would be across the whole workers product for your account, no extra pricing for extra websites, domains, or anything else like you'd see in most "wordpress hosting"

I run all my personal sites and client sites (one of them for a fortune 500 company) in the $5/mo plan, and the only time I went over that was when a client got hammered with malicious requests (and it was like $100)

Disclaimer: I have no relationship to cloudflare, I'm just a happy customer

I think this makes sense, when you explain it like that, it might be a matter of cleaning up the docs a bit so the "why" of RX is more clear (admittedly, a README is not always the best channel for this!)