Aissen

This saddens me since MPTCP is quite useful and not the cause of the bug, just a way to ease exploitation (probably simpler heap massaging? Way over my head). Anyway, upgrade, but don't block MPTCP; no exploit is available, and it's just as likely someone finds another path before Anthropic releases theirs.

Note: this article is from last month predates the answer from Disney: https://thedesk.net/2026/09/sources-disney-wont-run-ads-in-a...

> two sources at Disney familiar with the change said the updated terms was intended to give Disney greater leeway to incorporate promotional spots for its other movies, TV shows and live events before and after content streams on Disney Plus, not traditional commercial spots.

> The use of the word “advertising” was intended to help its terms of service remain consistent across regions where the streaming platform is available, including countries where promotional spots for its own shows and other content might be legally considered an advertisement, even if the spots are not promoting third-party products or services.

> To that end, Disney’s plan is similar to what other streamers, including Paramount Plus, do with their platforms now. Paramount Plus has long streamed promotional spots for its own shows, movies and live events before content on its ad-free tier.

Now I'll let you decide if you trust more what the PR person says or what is written in T&C.

> especially due to persistent attempts to use regexes to validate untrusted input

This is not the case here, it's an untrusted regex which can be the issue.

No, that's open source and it will be an accelerator for everyone, instead of a small advantage kept by a few. Even the frontier labs benefit. I'd argue (like I did when the initial DeepSeek was released), that the AI market *needs* to those inference breakthrough.

There are links to pretty readable changesets, so you can go read and understand exactly what's happening instead of speculating.

It's basically an additional policy on top your OS's policy, while waiting for the stores to update, it protects the users.

Indeed. Link: https://huggingface.co/mistralai/Timestral-209M/blob/main/LI...

Can we talk about how this particular CNA is abusing its power here ?

And it was the same refrigeration vendor.

> What’s the secret behind that Mario ‘feel’?

> I think that is fine-tuning. Many, many, many hours and days spent actually sitting down and playing the game.

Turns out quality takes time. Who would have thought. Very few games reach this level of fine-tuning, because it takes dedication (and budget).

Funnily, it's almost conflicting with this answer:

> Was much changed during development?

> Apart from the number of polygons use, the characters were first-off – once they were designed, they went straight into the game. There wasn’t really a lot of changing, artists just kept supplying stuff that just got put in the game, conveyor-belt style. That was more or less because of a very, very tight deadline – it had to be out right when the N64 came out.

So it's more nuanced. You fine-tune the fundamentals, but not necessarily everything.

No, you can do bootstrapping and save binaries for reuse with hash verification. Android did that for its Rust toolchain: https://cs.android.com/android/platform/superproject/main/+/...

Bootstrapping at every build does not save you from the threat you think it does.

I expected this to be a multi-months rewrite, not 3 weeks. I almost forgot we live in the agents era now.

Edit: this seems to have been cooking for a while when the first commit dropped: https://github.com/rui314/mold/commit/f41bfcd5c72ca30cce6498...

> But this is really end-90s/begin-00s Microsoft levels of anti-competitiveness. I'm surprised that (particularly non-US) regulators are not investigating them yet.

You mean like the Skyhook vs Google 2014 lawsuit? (look it up) Settled before it could go any further.

Nice to see Kernel Recipes covered again on HN. Shameless plug: I do the live blog: it's incomplete, imperfect and has typos; but it's written and published during the presentations. On this talk : https://kernel-recipes.org/en/2026/2026/09/22/live-blog-day-...

Not even 12 hours ago I was writing here:

> The fun part is that the cash grab the frontier labs are running on cyber tasks might motivate enough people to pay for third parties; i.e it might bring enough cash to sustain Chinese competitors (and their open weights marketing strategy, which we all benefit from).

And now, they are doing marketing for them(!) in the hope of getting them regulated.

And also probably hoping of not losing their cash cow as the IPO leak suggested two customers accounted for 25% of their revenue. Not hard to imagine a 3-letter agency being one of these two.

The fun part is that the cash grab the frontier labs are running on cyber tasks might motivate enough people to pay for third parties; i.e it might bring enough cash to sustain Chinese competitors (and their open weights marketing strategy, which we all benefit from).

Note that it seems that it no longer falls back automatically. So the actual score of Opus 5.5 will be even lower (fail vs fallback than can succeed)

Me too. YouTube was given up, and what the op did was to use Twitch streaming and redirect it before the forward to a TLS-verifed server, bypassing verification:

> redirects the actual stream to the Mac without any certificate issues.

> test several levels against your own evals

Of course, and this is the basics anyone should do when working with LLMs & agents; but with their high-variance, doing statistically significant benchmarking is very costly. Which is why the debates here on HN often talk about the "feelings" of degradation (or improvement!), but often without proofs. I'm not sure how to solve ạt; maybe inference providers should provide free benchmarking to anyone publishing results, along with the guarantee to never train on those sessions.

A quick checks shows that it seems so, last month. No answer to the RFC yet, though.

b4 maintainer and Director of LF IT Konstantin Ryabitsev demo-ed git-bug support in b4 and cgit (kernel.org fork) just this week at the Kernel Recipes conference:

https://b4.docs.kernel.org/en/latest/maintainer/bugs.html

https://git.kernel.org/pub/scm/utils/b4/b4.git/bugs/

https://kernel-recipes.org/en/2026/2026/09/22/live-blog-day-... (shameless plug)

A recent study seemed to support Fabian's well written article: https://dl.acm.org/doi/epdf/10.1145/3779212.3790129

If you are talking about publicly known vulns, it's a bit moot since they should be in the training sets. If not, you just burned the vulns to that inference provider's training data (and any intermediary), and future benchmarks will be meaningless.

> And the judgement that they did it is independent of whether the Clay people agree: you can make up your own mind and so can everyone else.

No I cannot, and I'd argue most people can't either. We rely on mathematicians, peer review, and letting the scientific process run its course.

Also, if you have any sort of buying power: make sure you company pays for a group subscription, and maintains it over the years. I try do that here. Nudge your colleagues to use the subscription and send them the occasional article!

I'm not an LLM engineer, but I just got an idea of how it could work, combining CoT + checkpoints :

- use checkpoints to save KV cache before trigger CoT

- trigger CoT, save result as a summary

- go back to previous checkpoint

- instead of generating tokens, add result of CoT summary as input tokens

- continue normally

For the price of twice the KV cache memory, the context stays perpetually small, allowing smarter sessions. You can even apply that continually by summarizing tool calls, etc.

This idea is free.

I'm not sure it's that advantageous though: it consumes more memory, and the sessions are already quite long at 1M+ tokens. One would need to run the economics down, and just test if the shorter sessions are actually smarter with the continuous summarization.

Definitely, this is the easy "bruteforce" way, but it would require more memory, and would not resolve the second part of the problem (i.e "how to pick a better path").

I'm not sure how that would work. You'd need to be able to reverse the operations in the KV cache, and I'm not sure if it's doable or not. And then you'd need to pick another path, or "rebalance" the probabilities or you'd go the same token path. CoT is probably easier to implement (but not necessarily better).

I was there at the start of the smartphone boom. I built a demo Android device that was capable of telephony/data, 3D rendering, etc. all before Google open-sourced the OS, for a SoC vendor that wasn't in Google's inner circle. Yet the industry was not interested in my junior profile during the subprime crisis.