fock

but this is not what was searched for on reddit? sadly it shows. the reddit thing is beautiful, your thing is... ok compared to it.

and sadly that happens to a lot of existing opensource too...

and yet some OSS (projects not really known for 1 and 2) multiplied change velocity the last year, implementing features via what is essentially vibecoding.

If you look at that, this approach is producing a pile of slop, where one LLM implements a feature, two weeks later another LLM spots an edge case and without much human review just crams in the code to fix that. Even at 1-2 months of that, those repos have significant changes and the commit messages get weird. I wonder what happens if the LLM won't spit out a fix anymore?

Will the human maintainers who started this process because noone thanked them and noone wanted to work with them on their bright new ideas just reset to the last commit they understand? Will they drop the project? The sunk cost for them is enormous. The time-effort required to fix the mess is gargantuan already. To me it increasingly seems that after the LLM industry robbed most humans of their collective labour output it will now rob them of labour aka time as well. Some people (like you and me) seem to notice that but most just go on and essentially spend away their life on machines now. I guess the problem is that most of these people have been severely cut off from using their own agency.

and all this without vibecoding!

https://github.com/tmux/tmux/pull/5709/changes it is already happening. Nice 50 lines of C-code to add support for kernel-keyrings which no userland software uses and literally is a one-line config-option.

good to know! are these working generically against fpm with the multipart-progress disabled or against mod_php?

that's the point: it essentially shows (notice the --profile-flag) the work of 2 months making the exploit work reliably on every app-php/fpm-linux-combination. The only purpose is to spread fear - and then have 50% of the internet update to a patched version with 425 changed files reviewed by ~100people and their clankers at 1400 UTC sharp while for the vast majority (using fpm like recommended for ~10years everywhere...) disabling the progress-something-flag and (optionally...) disabling multipart-uploads would have nicely mitigated this.

(POV when storing 1PB in Oracle) when I saw the 10 TB in another post, I was like "wait, isn't this sold to scale out, we have 100 times the data here".

and they also have plenty of exposure to their motherships burning money on LLMs

oh, so you say they only sat on it for a week? And then they exhaustively searched all exploit-paths so they have a demo ready 2 months later?

yes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals.

did I skim this correctly that with the mitigation shared this does not (yet) impact fpm-usage and classic CGI (vs. mod_php) is not impacted either?

it's a shared host? So the hoster should have shut it down?

you could just use a MAC-framework? like recommended for years...

yeah so let's go an jail Elon, Dario, Sam and their gang. Or go to a no kings-demo and let them take over...

they're about as great as an average developer. See rsync fixing their fabled code for some time now. They also have more output than the average programmer. so...

rsync has a new maintainer - they appeared on the internet 6 months ago.

could you also mention which driver this is somewhere? I deduct it is the proprietary broadcom-driver, so only used in routers? Also what happens if you turn WPS off?

also the agent might introduce bugs, just like a human (see rsync which now has very busy development). Likely we (and the LLM) just won't notice them as easily. Fun times I guess.

I know a lot of devs paid 120k€ before socialism over here. Also: The 25% "employers part of the tax" isn't a tax but masking the burgeoning costs of (non-tax...) social security systems - benefit receiver are also the only people getting those regular 2-5% raises tbh. (and ofc. every capitalist earns these too I understand by looking at a bank's business model...)

go and look at how the good people and claude over at rsync are fixing all their bad security bugs currently: https://github.com/RsyncProject/rsync/commit/42f7c32ce51d8e0... Also: any Linux-distro-bugtracker...

So: while running in circles might be a bit of an exaggeration, it seems (which maps to my experience) these things are much less AGI than reporting might suggest...

EDIT: no Ai for pictures - cool!

that might indeed be a problem for all the pulp-producing labrats of STEM in southern europe and the third world.

However I think this area has so much decoupled from industry and solid research institutions that they might not notice at all (beyond their use of AI-generated slop to augment the slop they already produce)...

And this is, when it doesn't delete data randomly: https://github.com/trinodb/trino/issues/28885 (some enterprise open source was slop before AI even it seems)

300 to 4000 lines of "production like" (whatever that is) cobol code which is easily ported to a non-mainframe env. Our's sometimes uses assembler in its innards, so good luck with real legacy code spanning a dozen files and 50k loc...

I recently threw in (want to check those intelligence metrics!) some real production code into a non-agentic system (just to get a feel how things perform without a custom harness) and results where ... interesting. The particular program uses some preprocessor no LLM we have access to (newest was GPT 5.5) has any clue about - so they confabulate what it could do (Gemini 2.5 didn't even notice there was a preprocessor...). This is expected of course but it somehow seems the problem of this technology that unless you feed it masses of data or mechanically break up the tasks in rote subunits, it just doesn't do anything sensible still...

I have not researched this, but I see some 4 to 10 year olds in the family being on the phone every time I see them. Usually they stream "brainrot" on youtube on the tablet while they play roblox on the phone. From time to time there are ads.

In school they still perform ok for what is required there today, but from what happens when you say "oh, wifi doesn't work today in our place" I would argue they behave like addicts... It might be a fun addiction insofar as mental problems are usually not the cause but possibly the result if this runs for years on end.

My pet theory is that these kids will graduate to online-gambling around 12-14 because that's exactly the kind of gameplay they prefer on roblox currently. Even when I was 16 there was a noticable share of classmates gambling online - and this was pre-facebook.

Probably the best way forward would be to make KYC mandatory for large, data-selling public fora like we do with banks. Noone complains there and noone is forced to use platforms.

If you don't want to do KYC (such as on hn or a model train forum) you are liable for any criminal activity you enable (such as pedophiles using your private messages or whatever...).

well, Claude likely is not really trained on benchmarking across such systems...

are they? It's all the same company with the brand today just used for appealing to localized government funding (because we can just shutter that factory you have there!). In the small marketshare electric future these multiple brands will be useful to kill one by one without tarnishing the remaining brands too much.

- Malta is selling passports and harboring criminals who kill journalists (we all remember Daphne Caruana Galizia don't we?). - buying votes/parties there would get you 10 times the MEPs you get in Germany or France. - their mayors can veto EU policy... This EU-thing really is democratic!

so: I doubt anyone has to care about that pesky GDPR if they buy the government of Malta.