dotdi

> already being exploited in the wild [0]

The article cites this commercial blog patting themselves on the back how they detect the exploit, yet after reading it I don't see any actual exploiting? Is scanning/probing the same as active exploitation all of a sudden?

[0]: https://ellio.tech/en/blog/php2shell-what-we-observed-and-wh...

  Location: EU (EET, UTC+2/+3)
  Remote: Yes, remote only
  Willing to relocate: No, but travel OK
  Technologies: Java, Kotlin, Golang, Python, Vert.x, PostgreSQL, Oracle, Kafka, Redis, Kubernetes, Keycloak/OIDC/WebAuthn. STRIDE, PASTA, attack trees. EU regulation: NIS2, CRA, eIDAS 2.0, DORA.
  Résumé/CV: https://linkedin.com/in/dase
  Email: dse [at] tuta [dot] com

Software architect / tech lead with ~10 years building identity, authentication and secure-communications systems for banks and government clients. My focus is scalability: backend systems that hold up under load in regulated environments. I've led stack modernization, migration of legacy products to Kubernetes and cloud, CI/CD, and supply chain security. Earlier career in the space industry (ESA ground segment, EUMETSAT, NASA).

Also doing an MSc in cybersecurity, with thesis work on adversarial ML against EDR systems and energy-efficient IoT firmware attestation.

Open to contract work: software architecture and governance, code audit, threat modeling, and CRA/supply chain security for product teams without an in-house security lead.

The whole point of this post was that it's questionable what can be achieved without huge investments into oversight and steering, because navier-stokes was a topic with an unusual level of specification. The problem itself was a specification. Such situations are rare in real-world scenarios.

AI agents are good at solving well-specified tasks, not at solving problems. They do well in fields where the cost/effort of specification is already part of the business.

Are we EVE yet?

Another +1 for migrating to Immich.

Somebody in my family who generally doesn't pay that much attention to prompts and modals was repeatedly telling me their Gmail doesn't work because it's full and - surprize - it was because Google Photos was harassing them with the backup prompt, which in a hurry, they just re-activated every time I turned it off.

After a while and much convincing (and changing Immich to be the default gallery app), we're pretty happy. Immich has been very good, it's fast enough to not be bothering, and running it on TrueNAS has been quite hands-off. I have a mirrored 6TB drive and do off-site backups to a Hetzner storage box.

Previously we were using OneDrive and the Photos archiving was horribly slow for everything but the most recent months. It was literally unusable beyond a certain date, with the UI locking up, tabs crashing, huge amounts of memory consumed by the open tab, etc. The mobile app was only marginally better, but still very slow. Immich doesn't have this problem. I scroll back years of photos and they load almost instantly from HDDs.

A bit of context: Apple is being forced by different jurisdictions (EU, UK, Japan) to allow third-party browser engines. In all other regions it's still not allowed to use them.

Apple has been maliciously compliant, putting up roadblocks to testing and distribution. For example, the existing Firefox iOS app cannot be simply updated to use Gecko/Servo; it needs to be a new app.

As far as I know, none of the major browser vendors have released apps with their own engines on iOS. I suppose maintaining two (or more) different codebases for US, EU, etc. is not very attractive.

It's not that absolute progress is slow, it's extremely slow compared to the predictions. It might be fast in absolute terms, but the "50% of coders will be obsolete by 2023" has been renewed every six months, and it's becoming increasingly clear that there's a real chance it might not ever happen.

It being a proxy buyer means they don't really support you with issues (at least from my experience using it once). I purchased a guitar for several hundred EUR (before shipping and taxes), and it was described as functional. It arrived relatively quickly and was extremely well packaged.

However, the seller either didn't know or hid an issue. Zenmarket provided 0 support. I think they just google-translated my message, forwarded it to the seller, the seller just said "item as-is, no partial refunds", and Zenmarket just closed the issue.

For the guitar nerds: the neck was back-bowed, and it was not really playable because several frets were already buzzing. Truss rod arrived completely loose, meaning fixing this would be difficult/expensive. Try to explain to a tired customer support person that it makes some kind of sound, but not the right kind.

I feel the rug under my feet moving. Is it being pulled?!

The funny part is that I never heard a professional tell me I should use WD40 for a specific task. It's been developed for (W)ater (D)isplacement, it's really good for that; and it's passable at other tasks too. For DIYers, it's fine.

For professional use-cases, targeted products are preferred, whether they be lubricants, penetrating oils, rust remover, etc.

> We move money, so mistakes are costly and quality is contractually non-negotiable. We build on a twelve-year-old monorepo with structural bottlenecks: bloated test suites, manual code review, unstable CI, and deploy infrastructure not made for the pace we need.

In my experience, each single item on this list already is a major hurdle for AI agents. The unholy union of all of them together is something I couldn't personally be responsible for - period.

Working on that codebase - I'm sure - is already difficult and often frustrating. Having a horde of short-term-memory-only agents without any real institutional knowledge is a recipe for disaster. I'm sure the rollout looks great on paper, and long-term effects are - conveniently - not the scope of this article.

I read a moderate amount I'd say, about 2 weeks average for a book, and I was using a very old and very beat-up but still functioning 4th gen Kindle until recently.

However, I woke up from my stupor when Micro$oft's eBook store closed and purged their library from under everybodies butts. Giving Amazon complete control over my library is a horrible thought, so I'm out.

I am now a happy Boox Go 10.3 + BookFusion user. Crisp screen, great battery life, full android with play store underneath. It syncs to my phone, has most of the bells and whistles I need in terms of reading, and it supports writing handwritten notes (albeit not onto the ebook itself; that's apparently too sci-fi even for 2026), and Bookfusion can sync notes into Obisidian vaults via an Obsidian plugin. I feel in control. I buy books from alternative sites with either no DRM to begin with, or where I'm confident I can remove it. Bookfusion costs me 20EUR a year.

I'm fairly happy with my setup.

EDIT: yes, I'm aware Boox are not the good guys in this story. I have not signed up to any of their services - the device is perfectly usable without that. I turned their book shop off immediately, and I do monitor+block the Chinese IPs it's trying to reach on my router.

Important bit of information is further down in the article: OnlyOffice is Russian. I would therefore view any collaboration as a risk. It's not adequate for strategic reasons as well as sovereignty.

Several ideas from this blog post are factually wrong.

Additionally, I cannot confirm the more subjective ideas - and I've been running Macbooks for almost 20 years, and specifically working with Python both for hobby, for research, professionally, for cybersecurity, etc.

I have an old 2013 laptop that is the "couch machine". It still works adequately. No issues with sleep/wake. Time machine outlasted the external HDD it was running on. I am writing this on an M1 Max, which will be 5 years old this year, and I hope I get 5 more years, it's just that good.

I guess this image generation feature should never have been continvoucly morged back into their slop machine

The real story here is not how stupid the responses are - it's to show that on a question that even a young child can adequately answer, it chokes.

Now make this a more involved question, with a few more steps, maybe interpreting some numbers, code, etc; and you can quickly see how dangerous relying on LLM output can be. Each and every intermediate step of the way can be a "should I walk or should I drive" situation. And then the step that before that can be one too. Turtles all the way down, so to say.

I don't question that (coding) LLMs have started to be useful in my day-to-day work around the time Opus 4.5 was released. I'm a paying customer. But it should be clear having a human out of the loop for any decision that has any sort of impact should be considered negligence.

> And what's happening at CISA right now should terrify every American who depends on running water, electricity, and the ability to vote in free elections.

The answer is right at the beginning. Current administration has the explicit goal to not have free elections going forward. It has been stated plainly, on TV. The rest is collateral damage, and an attack on critical infrastructure will be a good excuse to invade the next country, declare state of emergency or outright war and get rid of elections completely.

The cryptography is sound, however, it's also frequently changing, in addition to straying from standards more or less. This makes it difficult to give a firm answer.

This ETH (i.e. Zurich) paper[0] identified several exploitable vulnerabilities (bad), which were quickly addressed by delta chat (good).

So overall, I'd see it as a good messenger, but with downsides.

[0]: https://www.usenix.org/system/files/usenixsecurity24-song-yu...

> In terms of the Matrix Fdn being incorporated in the UK… I guess that means one shouldn’t use the Internet, given IETF is US incorporated? :)

The outputs of the IETF are RFCs. The Matrix foundation does more directly oversee the "de-facto" Matrix, so has more influence, could bow to government pressure or changing laws, etc. etc.

I was on a team that evaluated moving a significant portion of a product that should be used for government/healthcare onto Matrix. There were several drawbacks that made us NOT go this route:

- Olm/Megolm does not offer forward secrecy for group messaging

- Olm/Megolm does ensure end-to-end encryption for message data, but not for metadata.

- Federation makes it challenging to be GDPR compliant

- Synapse is very heavy, other implementations are less production ready

- For better or worse, the matrix foundation is under UK jurisdiction.

I'm sure I forget some of the nuance, but these were some of the major points. However, there are several government entities in Germany, France, Poland, etc, that can live with the limitations and DO self-host Matrix servers.

I won't go into the pair of high-severity vulns in 2025 (and the somewhat difficult mitigation) because that could hit anyone.

This immediately lost credibility for me with this quote:

> And vibe coding is fun. Even Bret Taylor, OpenAI’s chair, acknowledges it’s become a legitimate development approach.

Color me shocked! Bret, who directly profits by how his product is perceived, thinks it's legitimate???? /s

You _can_ blame them for several high-impact things they willingly did or at least supported, e.g. benefiting greatly from public spending yet successively voting to restrict it later on; f*cking over the real estate market and squeezing younger generations with extreme rents/prices; refusing any kind of social reforms while it has been obvious for decades that current models don't scale; decoupling of productivity from wages; and last but not least racking up huge carbon debt that later generations will pay dearly for.

    Location: EU (GMT+2)
    Remote: Yes (some travel OK)
    Willing to relocate: No
    Technologies: Java/Kotlin, Python, Go, Kubernetes/OpenShift, AWS, Microservices, CI/CD, Secure DevOps, NoSQL, Security Engineering, Performance Optimization, Platform Engineering.
    Résumé/CV: linkedin.com/in/dase (up-to-date; full CV available upon request)
    Email: dse {at} tuta [.] com

Software Architect / IC with over 10 years of experience designing and building secure, scalable, and mission-critical systems for the aerospace, finance, and identity-security sectors. I have worked with production embedded systems, I have rewritten large security-focused backends, I have led migrations of legacy software to cloud-native environments. I was the technical interviewer for several hires and have a good track record hiring competent engineers. I am looking for a challenging role where I can leverage my expertise to make a significant impact.

My first instinctual reaction to reading this were thoughts of violence.

At the same time subsidies are being phased out. I was about to get 8kW panels + batteries installed when my country decided to pull them, and I'm not going to spend 10k out of pocket.

  Location: EU (GMT+2)
  Remote: Yes (some travel OK)
  Willing to relocate: No
  Technologies: Java/Kotlin, Python, Go, Kubernetes/OpenShift, AWS, Microservices, CI/CD, Secure DevOps, NoSQL, Security Engineering, Performance Optimization, Platform Engineering.
  Résumé/CV: linkedin.com/in/dase (up-to-date; full CV available upon request)
  Email: dse {at} tuta [.] com

Software Architect / IC with over 10 years of experience designing and building secure, scalable, and mission-critical systems for the aerospace, finance, and identity-security sectors. I have worked with production embedded systems, I have rewritten large security-focused backends, I have led migrations of legacy software to cloud-native environments. I was the technical interviewer for several hires and have a good track record hiring competent engineers. I am looking for a challenging role where I can leverage my expertise to make a significant impact.

Still, you are comparing a non-empty program to an empty program.

This is not an apples-to-apples comparison. Python needs to load and interpret the whole requests module when you run the above program. The golang linker does dead code elimination, so it probably doesn't run anything and doesn't actually do the import when you launch it.

> The unexpected return of server-side rendering (htmx.org)

Glad to know this topic is still thrashing and spasming and refusing to die.

I was typing in my CC info when I went back to read about battery life. This is meant as positive feedback: I won't be ordering a non-rechargeable device with 12 hours of recording for $100.

Imagine I fall asleep with it on my finger and accidentally press the button with my head. It's recording me snore for 3 hours, and 25% battery life gone.