mr_mitm

AFAIK felonies in Germany require "intent", not "criminal intent". The guy could have stopped earlier, right after testing the password. But he decided to use it to view data which didn't belong to him. I realize I'm going against the general public opinion, but he didn't have to do that, and I can see why the court didn't accept "but I only did it to take screenshots" as a valid defense, because that's clearly intent.

The term is insufficiently defined and has overloaded meaning.

In the original sense of the word, i.e. creative use of technology? Debatable, and most techies would probably land on the "no" side of the debate.

Is it illegal? Depends on the jurisdiction and is up to a judge, but it probably falls under unauthorized modification of computer systems, so here the answer is probably "yes". IANAL, but lack of authorization mechanism is probably not a valid defense. AFAIK lawyers and judges do not follow the law to the letter independent of real world experience, so you can probably argue that if the UI didn't provide a way to cancel other people's appointments, then any reasonable person should realize it wasn't intended for public use and thus refrain from doing it. (Corollary: LLMs are not reasonable persons.) Just like an unlocked house door isn't an invitation to come in, you have to assume it was done accidentally (may depend on customs of the location, but where I come from it's pretty obvious).

Is it morally acceptable? Pretty clearly no. Even if it wasn't illegal, it's a jerk move.

It's a reference to this infamous post: https://news.ycombinator.com/item?id=9224

Which also makes it not obvious how to uninstall it. pip/npm/cargo etc have well known mechanisms for that.

curl|sh is convenient for container images I guess.

From the article:

> “I had the projector set up outside and was waiting for the sun to set,” wrote one Facebook user in Colorado Springs, “but to my surprise I was simply living in the past. AI informed me the sunset had already happened.”

It does sound a bit bizarre.

Next up: "I didn't do a statistical analysis but the sample size seems small"

And here I thought using open source client software is the only way I, the user, can guarantee E2EE of my data.

> NONE of my agents have broken away from their tasks and then started to communicate to try to hack something.

With all due respect, you also aren't evaluating brand new models that haven't been released.

Go creates `~/go` by default. It's not even hidden. Unfortunately, saying it's not really used that much doesn't help with this.

Surely e-mail is even more widely used?

My impression is that it's the NodeJS, Go and Rust communities that don't care about XDG.

This 11 year old, open issue is very symptomatic of this IMHO: https://github.com/rust-lang/cargo/issues/1734

True, I guess you might as well evaluate each vulnerability yourself without the CVSS base score.

> - Firstly, you quickly realise how irrelevant CVSS scores are

Even if you factor in the environmental score? I realize it's a lot more work, but it basically allows you to tune the score to get any value you want.

Here is a recent example. Currently unpatched in Debian stable.

https://www.cve.org/CVERecord?id=CVE-2026-60002

As I understood this, a malicious server can change its host key somewhere during key exchange and trigger a use-after-free in the client, which might be exploitable for code execution.

Have you ever tested this on a real corporate network?

Yes

Just FYI, it says "lack", not "luck"

I, a German, went to Switzerland for vacation once. I talked to a Swiss guy about how I like Switzerland and all that. I told him how impressed I was with how organized everything is and how well everything works. The train system and public transport in general is wonderful compared to the one we have in Germany, for example. To my surprise, he said something along the line of "yeah well, it only looks like that from the outside".

Perhaps the tendency to complain is a necessity to achieve a high level of efficiency.

The way I read the article was that cancer is caused by deficiencies in the body's repair mechanism. It appears as if some have a more robust mechanism than others, depending on genetics.

It's a zero day in some caching proxy who may not have had that threat model in mind. I guess its primary purpose is caching packages, not restricting internet access.

That's a far cry from finding a zero day in a hypervisor or even Docker, which OpenAI conveniently left out in their first statement by simply calling it a "sandbox".

I hate the BOM so much. It causes so many subtle issues and I don't even understand why it's needed.

Is teens ordering wine a big issue in the US? Bigger than social media?

I wish my team would at least use the rebase merge strategy by default to avoid branch graphs looking like the London tube network. Not in 10 years did I have an issue with that (okay, except accidentally rebasing deliberate no-ff merges).

The one time I suggested that, someone immediately came up to me trying to convince me that rebases are the most dangerous thing ever.

I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.

I take it you aren't programming business CRUD apps? I almost never have to do any math. It would be a delight if I did.

Is pangram using knowledge about specific models? Could you throw it off by having several models generate a paragraph each or so?

It is also built on the assumption that filenames never contain newlines, which is wrong in general.

It's baffling to me that POSIX allows non-printable characters in file names, but here we are. Surely they had a reason for this decision.

The next known black hole is tens of thousands of light years away. Also, the universe does not seem to be inside a black hole.

Note that you can't use these lasers to slow down the probe, which will dramatically limit the things the probe can do at the destination. I'm not even sure what kind of interesting things a probe the size of a smartphone could do, let alone phone home.

My point is that you cannot know that AI generated text is obviously AI generated. It's like the old "hair pieces look awful, I can tell immediately!" - no, you can only tell when they're awful. Maybe you're not as good as you think at detecting AI.