News for hackers. Stuff that matters.

perching_aix

[delayed]
[delayed]
Re:Agentic backdoors via pretraining poisoning on Tuesday November 03, 2026 @12:51AM (#50348560)
[delayed]
Re:The U.S. Census Bureau and "Super Intelligence" on Tuesday November 03, 2026 @12:38AM (#50348497)
[delayed]
[delayed]
and landline won't? it's also oversubscribed. pretty sure it isn't guaranteed e2e circuit switched either, and that it hasn't been for quite a while.
I personally find that to be a bit of an inversion. People will utilize leverage and identity in whatever context, so mixing that in doesn't seem cogent to me.

But maybe the two are genuinely tied together enough that it's deserving to be a part of the definition, I don't know. Tried looking up the definition, I'm not really convinced.

For the longest time I considered the "hate on bureaucracy" more of a reactionary trope rather than anything actually coherent. Maybe this is just another one of my cultural differences of many. It's not as if people forming consensus, keeping count, or delegating authority were ever actually possible (or desirable) to escape, comes with scale. So to try and paint it as some odd devilish plague always came across to me as dilettante, though maybe it's more me who's simply never grasped the whole dynamic and the cultural position around this fully.

> human-like social pathologies - such as bureaucratic inertia

Isn't bureaucracy just the sociological manifestation of synchronization overhead? Sounds shortsighted to file it away as just some weird social pathology that emerges out of nowhere specifically affecting humans.

Re:Some Thing is Happening A note from the AI companies on Saturday October 31, 2026 @11:23PM (#50322439)
that's true. instead they (device dependent) butcher calculations by accumulating arbitrarily large numerical error and/or by using binary floating point math, which is so much better... /s

https://en.wikipedia.org/wiki/Round-off_error

Re:Some Thing is Happening A note from the AI companies on Saturday October 31, 2026 @11:15PM (#50322409)
> in a world that has had deterministic calculators for the better part of a century

so rewind that clock and see the above comment miraculously start making sense

[delayed]
Re:AI Isn't Replacing SREs. It's Deskilling Them on Friday October 30, 2026 @12:46PM (#50306547)
I work a "dev"ops job, and like yeah, I'm pretty sure this field is even more fucked than software engineering is.

IaC codebases, configs, utility scripts are relatively tiny, and fit into context windows whole. Models are eating them for breakfast.

They're really good at incident response. Sadly, much better than our dedicated colleagues from <location> ever will be. They'll chew through cloud service logs, application logs, application code, iac code and config, CI output, etc. to get whatever is needed, cause wide knowledge is no issue. Even disassembling stuff is no barrier, tracing things down from app level, to runtime level (e.g. JVM), to native calls.

They're really good at handling deployments, end to end infra setup and migrations, following checklists. Hell, they don't even really need checklists. Something that cannot be said about other dedicated colleagues from <location>, who cannot breathe without a checklist, will skip over steps, or otherwise very creatively misinterpret them or improvise something wicked.

They're really good at spinning up mad nice dashboards, and keeping business types happy with impressive looking write-ups they'll never read. It's really refreshing to not have to write those write-ups anymore (or the aforementioned checklists).

It's straight up both not looking good and looking better than ever. Having it be fully hands off remains an issue though.

Re:AI Isn't Replacing SREs. It's Deskilling Them on Friday October 30, 2026 @12:37PM (#50306397)
Something tells me they were not very big on doing that even prior to 1 BC (Before Claude).
i envy the folks who can actually make sense of msdn docs. they were tedious and overwhelming decades before ai made that the premiere style this year.

some parts are better than others, but god is it a quest to find anything in there.

Re:Official Claude Code extension compromise on Friday October 30, 2026 @10:47AM (#50304744)
I'm guessing it was the easiest quick workaround available, but obv wait for official confirmation.

Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.

You severely underestimate humanity's goalpost moving capabilities.

The state of cope:

- models are still not intelligent, they're just like, uhh, really good semantic fuzzers! so you can just put them in the loop, they'll fuzz your code, and all is good :)

- the number of bugs is "finite", so - esp with agentic help - we'll just catch up and all will be good :)

Annoyingly, the cope frontier is kinda right about both of these, so the joke shall go on. The only real counter to it would be to bring up that this finiteness claim only really applies to a frozen set of security boundaries and attack surfaces, but they'll probably just raise this being "an academic tier concern" and just tell you to ""fuzz"" more.

So ironically, it looks like these practices are rescued once again, and the bare minimum stays winning. It also starts being moved to the territory of the magic box, but I guess nobody cares about that anymore. Local AI will just get really good too, fully competitive and self hostable even. Any day now.

From the horse's mouth, in case you were suspecting these descriptions to be in bad faith: https://www.youtube.com/watch?v=NnV_cWeoo5Q

Re:Why Is This Fingerprinting Script Creating Bioweapons? on Wednesday October 28, 2026 @05:24PM (#50281102)
how so? the whole idea is that they don't even see/read the thing and so it sneaks by. and many even disclose ai use up front cause - gasp - they're not dickheads. pretty sure if github added a button to pre-flag one's own posts as ai, it'd be widely used. there's already a precedent for this on other platforms, like pixiv.
Re:Why Is This Fingerprinting Script Creating Bioweapons? on Wednesday October 28, 2026 @05:15PM (#50281002)
this guardrail tripping thing is cute, but a simple identifier substitution and comment stripping should defeat it completely. probably a good practice to do that anyhow.

wouldn't be the first time manipulation like this was used, just that earlier the targets were humans (misleading them about functionality or country of origin). except for humans, the overhead induced, even with renaming, was significant. not so much for models, they don't give a fuck.

was it the "bears on" that you caught? :)
That's the point. GP deceptively suggests that what the EU escapes in gun deaths, it makes back in spades in heat deaths, providing GP with great ideological schadenfreude. Except this doesn't actually follow, in part because these are fundamentally different mortality categories indeed (and in part because the counting methodologies involved are drastically different, etc).
> there are songs written about the temp. being 35C because it was that really special heat day

Do you mean "28° in the shade" perhaps, a French song from 1978 by Jean-François Maurice? https://www.youtube.com/watch?v=vpPnr0mCka4

Been a while I heard it, had to look it up. :) I also recalled mid-30s something, guess that was wrong. Or this is another case of the Mandela effect.

Pretty much this, it simply genuinely hasn't been a part of the culture until recently. The energy use angle doesn't help, nor does the cost of the units. In case GP forgot, the eastern half of Europe only got rid of Soviet occupation in the 90s, and has been playing quite the catchup. We bought fans and that was kinda it. Can't really comment on western Europe, but I'm sure they can. :)

GP's big leftist overregulation fantasy is adorable though, and definitely no stereotypes were hurt in the writing of his comment, but the reality is that mini split heat pump aircon installations in particular are booming here, usually paired with solar. So unless he's referring to something from the past millenium, which would be pretty weird to do without noting it, that's a swing and a miss.

The spooky statistics "difference" comes down to a difference in measurement methodology afaik; we actually measure the thing, for one. This exact talking point he's raising has been common in certain circles as of late, actually.

But I'm sure his position is entirely his own and actually way more informed than mine, he simply omitted his sources for brevity :)

i tend to run a pass of sol 6.1 at its output, cleans up the language well and finds defects opus missed
would be, yes... are we going to pretend that botch jobs don't exist, and that everyone credentialed actually does an equally (or at all a) good job or something?

you either trust and/or verify. the people clearly cannot verify and clearly do trust. vagueposting about ai bad won't break that vacuous trust, on the contrary, due to the incentives involved, induces distrust on the human expert side.

so maybe you wanna actually elaborate?

the article above is about a defect in google's brotli compression library (CVE-2026-111497). compression libraries don't really do web serving, or communicate with networked resources at all, they're hermetic. so exposure depends on the context this library is deployed in as a dependency.

put it in the network path, it can become an RCE.

put it in a privileged context, it can become privilege escalation.

put it in a hardened environment, it can become completely inert.

in no sane perspective is me listing off the applications shipping with vulnerable versions of this codec off-topic. just because the article is hellbent on portraying this as some sort of second php2shell, the actual underlying issue here is still CVE-2026-111497.

how will they tell that the person hired did a good job if they can't tell if the ai cocks up?
git for windows is vulnerable even in its latest release (2.56.0.windows.3), careful pulling repos over https from random ass servers (prolly uncommon but hey). they already merged the fix on the repo, it's just in a snapshot build only; should prolly arrive on Monday (2.56.0.windows.4).

also affects codex (gui), which ships its own git, could be more of a problem there, when the LLMs get quirky at night. still unlikely to be a problem though.

speaking of, update codex (and wipe its cache at ~/.cache/codex-runtimes), ships its own node. update python.

stuff like wireshark and imhex remain vulnerable, even on their latest repo commits, which may or may not be spicy.

also Microsoft 365 Copilot still has its own unpatched brotlidec.dll from Oct 7, if anyone uses that. no fix available for that one afaik, not sure about how it can be made to access the vulnerable decoder.

sounds like it's not just these models that could really use a thesaurus
Nohow, because the real world is informal. This is as far as coding can and will ever go, basically.

And like yes, it does just launder defects to a layer higher, but another way to phrase that in this case (and in many other cases) is that it raises the bar.

Instead of defects being mostly about nonsense minutia (relative to business logic), they are about actual design decisions and their correspondence to reality, i.e. the actual original goal and point of this god forsaken, navel-gazing field.

Older »