chias

IIRC they were part of a base64 encoded blob. IIRC base64 decoding was also referred to as an "advanced hacking technique". But your point very much stands.

Note: I work at LiteLLM

There exists a critical vulnerability which affects only Enterprise LiteLLM deployments, and does not affect OSS deployments.

We have provided our customers with patched releases distributed via a private registry and are allowing them some time to update their deployments before we release the fix in our public registry and disclose the vulnerability details. Releasing the fix publicly in an open source product would be a de-facto vulnerability disclosure.

Note: I work at LiteLLM

There exists a critical vulnerability which affects only Enterprise LiteLLM deployments, and does not affect OSS deployments.

We have provided our customers with patched releases distributed via a private registry and are allowing them some time to update their deployments before we release the fix in our public registry and disclose the vulnerability details. Releasing the fix publicly in an open source product would be a de-facto vulnerability disclosure.

The cookie banners are not required to be this way. They are deliberately designed to be as annoying as they can legally be (many actually moreso), in part to influence your perspective against GDPR.

Yes. I think the idea is that on the path of events or actions between the starting point and the target, you have already completed every single one, and all that remains now is the final step before you can call it done.

You've walked all but the last step of the journey.

What an excellent choice of product name :D

"You're da C"

if you're using firefox, you can generally juts ctrl-click on the page. It'll draw outlines around every child element without reflowing.

Generally, no.

Ignoring for now how you are synchronizing the database and filesystem, and how doing so may well result in your duplicate experiencing the same failure as the original, you can maybe recover from a small class of availability issues that could knock you out of an SLA.

But that assumes you can get online and can fully orchestrate the transition within less than 53 minutes of it starting. Including the time you took to become aware of it. And including the time to diagnose and decide that a switchover would resolve the problem. Including the time it takes for DNS caches to expire and point to the new host. Including the DNS caches which may ignore your TTL. And including all these things again when you switch back.

And assuming, of course, that it doesn't happen again for a whole year.

Perhaps to you. But that's because you have prior cultural knowledge of chess, and what it means to "play" something. It seems to me to be perfectly reasonable for an ai agent to define "play chess" as "behave in a way that this arbiter indicates that you have done well"

I really love boxes.py, and have contributed several designs. The flexbook, shadowbox, coinbanksafe, and frameloom are all mine :)

I'm really proud of the loom.

https://boxes.hackerspace-bamberg.de/FlexBook

https://boxes.hackerspace-bamberg.de/Shadowbox

https://boxes.hackerspace-bamberg.de/CoinBankSafe

https://boxes.hackerspace-bamberg.de/FrameLoom

Recently I've been on a kick making bracelets with that frame loom. The rotating heddle bar makes it super quick to warp up. I've written about how to go from woven rectangle to bracelet here:

https://ojensen.net/musings/bracelet-on-frame-loom

> I agree that it would be the right thing to do. Which is why you have to make the best attempt to make it the legal thing

Do you believe that in an ideal world, any instance of not "doing the right thing" should be illegal?

The number of dickovers[1] this website pops up while you're trying to read the article is truly astounding. I gave it my best shot, but after the third one i figured I'd probably gotten enough of the gist of it and gave up.

[1] https://daringfireball.net/2026/05/what_is_a_dickover

The url was to transfer log data from metabase to framework. It is not something that is intended for end user access.

The author mentions this in the second paragraph...

Not relevant to the overall discussion, but this VHS vs Betamax thing is actually a myth, borne from confusing Betamax (a home consumer version, comparable and inferior to VHS) with Betacam (a professional format, which could use the same physical tapes as Betamax, albeit at much shorter runtimes so not suitable for movies).

There is a difference between crediting the LLM (which i agree is silly) and disclosing the use of an LLM, which I think is important. The author seems to conflate these two.

A disclosure is appropriate whenever the reader might feel differently about the result of armed with this information. For example, "this research on the non-addictive nature of tobacco, funded by the tobacco industry".

Moreover, not citing the LLM is plagiarism. Maybe people outside academia have an oddly narrow understanding of plagiarism, and (for example) cannot understand how it is possible to plagiarize yourself. It is hard to explain the importance of citing LLM contributions to people with this view.

I was in this state a few weeks ago. I spent a bit of time familiarizing myself then wrote up my learnings as a series of exercises.

If you think of docker as "kinda like vms except not really" and k8s as "kinda like deploying and composing docker containers but not really", this may be for you:

https://ojensen.net/infra/understanding-k8s-1

It's actually really neat, i wish i had bothered to learn it years ago.

the contrast ratio of a black-and-white e-ink screen is significantly better than the contrast ratio of a color e-eink screen when displaying black and white. It's a very noticeable difference between black-and-white vs dark-grey-on-light-grey. The P2D is much more comfortable to read indoors with the backlight off.

https://i.imgur.com/Z2Yrkl1.jpeg

I had my PT2 shipped to Germany. Watch cost $225 and then I had to pay an additional $58.54 in taxes / customs fees.

The watch I really want is the Pebble Time 2 with a black-and-white screen.

The Pebble Time 2 is a huge step up from the Pebble 2 Duo in almost every conceivable way, but the contrast ratio on the latter is so much better that I still wear the P2D instead of the PT2, and just resign myself to deal with the lower resolution screen and inferior build quality.

That and it's wild to celebrate innovation that was literally default behavior 20 years ago, which they themselves worked hard to break.

Used to be you'd look at your server logs and see referrer headers of google.com/?q=search+terms

Then they broke that (deliberately, well before cross origin header concerns were a thing) so you'd have to sign up for their webmaster tools.

Ah yes - the cure for world hunger: eating food.

Mine (11th gen framework 13) is.

I have to keep it in battery saver mode or the fans just spin up when it's idle. They come up anyway (and irregularly) when watching a movie, loud enough to be heard over the movie -- though that may also be partly the fault of the milquetoast speakers that also inexplicably point down (so if you're watching something in bed you'll need to find a hard surface to put it on so that the sound isn't completely muffled).

That said, i have a macbook pro for work and macOS infuriates me, i would not trade my framework for any apple device under any circumstances. I love my framework more than any laptop I've ever owned. I just wish the hardware was more polished.

There are no "rules" for responsible disclosure. We have guidelines that we have broadly accepted, but at the end of the day whether or not you discussed responsibly is in the opinion of your peers.

There's no such thing as "responsible disclosure on a technicality". Don't be a dick, and work in good faith to keep users safe.

I have no insider information so this is all appreciation, but:

When it comes to legislative things, there is pretty much always a timeline in which to become compliant. I do wonder if there was opportunity to give warning etc. but Anthropic decided to perform an immediate full stop deliberately causing the metaphorical three-car pileup, because the more painful for the users, the more pressure from the people there will be on the government to undo this.

See also: those painfully annoying cookie banners that are malicious compliance in the most irritating way possible, which GDPR does not require, in order to make people think GDPR is dumb.

Sounds like a win win to me

There is a vast difference between it not being 100% impossible and data holders not doing the absolute basics to keep it safe.

I could imagine if, after a data breach, there was a government-run cyber investigative task force that would come into an organization, and be tasked with investigating and fully understanding the nature of the breach. We already have forensic detectives for other crimes, why not this one?

And if it turns out that the failure occurred due to the company acting negligently, a la (whoopsie all the records were in an open S3 bucket) then humans would be found personally liable.

--

But in principle, i also agree with the other causes you list. These are very much what GDPR was aimed at improving. It really is a shame when you look at what GDPR could have accomplished if not for malicious compliance by American tech giants, and shitty enforcement (instigated by American tech giants)

As Cory Doctorow is fond of saying

> The thing that determines whether you’re the product isn’t whether you’re paying for the product: it’s whether market power and regulatory forbearance allow the company to get away with selling you.

Or more simply:

> Companies don’t make you the product because you don’t pay — they make you the product because you can’t stop them.

As far as feature development goes, Meta isn't looking under the couch cushions for change. If they want to invest in a feature, they will.

I've had this conversation for real. The server's recommendation was that I scan the QR code.

That was my last time going to that restaurant.