darkamaul

I see two main benefits of using paper ballots. The first one is that is easy to explain and everyone understand how it works. Your grandparents, probably your kids of a certain age... When you start talking about electronic voting, the system becomes much more complex, and you need to trust someone else assessment of the system.

The second one is that you can enrol interested people in the process, for instance during the vote counting. In France, any voter can register to participate during the night. This creates a sort of community engagement which is extremely important in my opinion.

Orange is a legend and this chain is extremely impressive here.

No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader.

As a bonus, they also posted a reverse chain: popping Edge from calc [0].

[0] https://www.youtube.com/watch?v=Bh1zglq4mLE

I wonder what's the ceiling for these plans' prices. At some point, it becomes a non-negligible fraction of the salary for the employee, especially in non-US employment markets.

A timeline to help understand what happened :

- Aug 6: Off By 1, the security lab of 1Password publishes their blog post (current title: Why AI-generated vulnerability patches still require expert human review)

This article gets some specialized and mainstream press coverage

- September 15 : Trail of Bits publishes a rebuttal on their blog 1Password's AI patching benchmark is misleading

- September 22: Suha publishes the current blog post

The main idea in the rebuttal is that the headline number (26 percent only of the AI generated patches are flawless) is misleading because the experiments were not well designed.

In coop [0], a VM manager we developped to sandbox agent usage (i.e. give them freedom to do their stuff, but in an isolated environment from your main machine), we try to solve this by having an intermediate proxy (coop-proxy).

Instead of forwarding ANTHROPIC_API_KEY / OPENAI_API_KEY into the guest, we simply run a reverse-proxy within the VM that replace a constant-time token with the real API key on the host.

Works well enough in practice

[0] https://github.com/trailofbits/coop

Silly question - but how do you apply the cooldown to brew itself ?

I would think this is one of the most critical dependency that you would not want to get right away at let it rest for a couple of days

I _think_ (disclaimer: I have only read the documention of the two tools) they overlap quite a bit. The main idea is to get VM isolation for your agents env.

I use coop daily and found it super convenient for my use case (ie letting agents go on with no access to my other projects or personal files)

I would recommend anyone that has desire to provide stricter boundaries to agents to give it a try - while remembering that a motivated agent would probably be able to escape it :)

This is uncomfortably too close to the reality…

And as always with those satirical posts, I love the attention to the details (location: Nebraska for instance)

Models are becoming scaringly good at finding meaningful issues with little guidance, and I have the feeling that the value of complex harness around them is ever decreasing.

Why spend time and resources creating a complex orchestration workflow around a model limitation, where the next model might just behave better without all these constraints around it?

Thanks for sharing this one, that’s truly a gem that I had no idea existed

I believe the changes here make a lot of sense because, most of the time, your best bugs are not your first ones

Anyone can point an LLM to a code base and ask to find a vulnerability - and the initial set of findings is going to be rather lame.

Encouraging researchers to stick to a target and to report 7 lows before getting in will probably make their contributions more valuable.

I have quite the opposite view here. I have switched from Firefox to Orion on my iPhone a year ago (potentially more?) and had a great experience.

Sure they are sometimes some buggy UI controls (like the focus not working), but for the most part, the experience has been smooth.

Did you try to report the bugs when you had some? Maybe this could help everyone else using the browser.

Well , there isn’t also the opposite take from TechCrunch where they say: Why Paris may be the most important AI city outside Silicon Valley. [0]

While the EU loves its regulation, I still feel it’s too early to write it down in the AI race. It will not replace Anthropic or OpenAI any time soon, but even Google and Meta fail to do that.

If AI continue to grow and expand, there is enough space for many more unicorns.

[0] https://techcrunch.com/2026/05/28/why-paris-may-be-the-most-...

What an interesting article. I did not assume I would read it until the end when I opened it, but the writing was super clear and easy to follow.

At the end, I admire the craft and patience to try to solve code diff rendering, and wish the folks at GitHub could put the same effort to improve their platform.

On a side note, I feel that we’re going to see more and more of this type of agentic usage, in well defined sub tasks, and the ability of a model to try many possibilities is a huge gift here.

I think Minecraft is still in good shape

I guess you could look at https://red.anthropic.com/2026/cvd/ to see exactly what was discovered.

If I understood the code correctly, it always use the hybrid version.

> Kyber is always used in a composite scheme along with a classic ECC algorithm.

One of the biggest issues I see with Upload Queues here that is not talked about is the added complexity on the package managers themselves (PyPI, NPM, crates.io ...).

They are already complex beasts of software, extremely important for the ecosystems, and not always well funded. Adding all this extra complexity, with official bypasses (for security reasons), monitoring APIs (for security review while a new version is in the queue), and others is not cheap.

And if somehow, they get the funding to do this, will they also get the funding for the maintenance in the long term?

I don't think the benefits here (which is only explicitly model the cooldown) are enough to offset the downsides.

I’m maybe not understanding here, but isn’t it the point of release attestations (to authenticate that the release was produced by the authors)?

[0] https://docs.github.com/en/actions/how-tos/secure-your-work/...

With the recent incidents affecting Trivy and litellm, I find it extremely useful to have a guide on what to do to secure your release process.

The advices here are really solid and actionable, and I would suggest any team to read them, and implement them if possible.

The scary part with supply chain security is that we are only as secure as our dependencies, and if the platform you’re using has non secure defaults, the efforts to secure the full chain are that much higher.

I love all the touches that went into creating the Dependabot configuration:

– Sunday at 3 a.m. for updates

– The prompt injection to skip CI

It was a fun read - I'm looking forward to it being ingested by future LLMs.

Second this.

I didn't expect Google (Mandiant) to release rainbow tables ever. Curious what changed internally to make that acceptable now.

Curious what tech stack is behind this docs/cookbook page. Doesn't look like standard MkDocs/GitBook, but maybe I'm wrong.

Would love to know.

I have been using OMZ for the last 8 years but recently made the switch to plain zsh with : - starship for a better prompt - Claude ported plugins I was using from omz (extract, sudo) - custom written aliases that were muscle memory - zoxide for the a command

So far that has been a great move, my terminal tab feel snappy again. One thing I miss (but I’m sure I could find a way to replace it) is `cd ….´

Xlssid

I'd argue ASML's moat isn't the machine itself but the ecosystem: Carl Zeiss optics, decades of supplier relationships, institutional knowledge.

This is clearly a significant achievement, but does anyone with semiconductor experience have a sense of how far "generates EUV light" is from "production-ready tool"?

According to UpDog [0], the incident only lasted 35 minutes (8:40 - 9:15). And the Cloudflare status page seems to validate this timeline.

While down times are not ideal, that's quite an impressive achievement to be able to resolve an incident of this scale in minutes - not hours.

[0]: https://updog.ai/status/cloudflare