shakna

[delayed]

Anecdote only.

A lot of people in my circles recently got fed up with Windows breaking everything. They went from teasing about Linux, to installing it.

... And then the kernel fully embraced genAI.

The same people went, "No thanks." Saw NetBSD's AI stance, and started installing it.

Granted, tech people. But not that deep into things. Most are scared of the command line - but find they don't need it.

If I can exfiltrate your email with something that responds in that way, what other information can I pull from your system, without your intervention?

If I made it send something, I probably made it make a tool call. What other tools can I make it call?

I'm afraid this isn't a shrug - it's a zero-click vulnerability. It might be the start of a chain to RCE. It doesn't have to work every time, either. Just enough of the time.

Should an agent not ask for confirmation, before leaking their patron's contact information to any random third party who asks for it?

If not... That sounds like primetime for prompt injection.

And AU. Dick Smith started out selling Tandy's, before switching to their own clones.

MIT is relicensed as GPL, under the GPL 2.0. By including it as part of the whole, the whole becomes GPL.

And... It is surprising to me, that anyone can think otherwise, 2 decades on from D-Link [0].

> The GPL grants anyone who enters into such contract with the licensor the right to copy, distribute and modify the software, on the condition that the software is again distributed under the very conditions of the GPL

Which is something you start to say, and then say it isn't the case.

The whole just becomes GPL v2. That's the virality.

[0] https://web.archive.org/web/20130426055334/http://www.jbb.de...

Always good to see progress towards people getting to own their own hardware.

> MIT for all original code. The kernel excerpt (kernel/mem.c) retains its GPL-2.0 license and copyright notices.

One small tweak needed here.

GPL 2.0? Has this bit:

> You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

"under the terms of [this License]."

It is viral. Copying the code, and distributing it, as done here, means that GPL 2.0 is meant to apply to everything. The only carveout, is if your code didn't depend on the kernel excerpt at all. But... It does.

> If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission.

Is your Brotli library built from older than the February commit? (The last tagged release is before then.)

If so, might be vulnerable.

Don't have Brotli enabled? Not vulnerable to this.

Older games tend to have their source code leaked [0], and cracks generally are designed from reverse engineering, revealing parts of how systems work.

And the forefront models have intentionally been trained on quite a bit of reverse-engineering.

[0] https://en.wikipedia.org/wiki/List_of_commercial_video_games...

You have an automated pipeline, that includes decompilation. I highly doubt the courts will see the nuance that you apparently do.

The pipeline begins with decompilation. Maybe it doesn't save all that information, but it is part of the pipeline, and so, will be part of the consideration when discovery happens.

How could they have trained on books that they didn't buy or source from libraries?

I'm afraid, the companies in question, have been more than happy to ingest pirated material.

... A clean room, means that you aren't reverse engineering. You're producing the same result, with zero awareness of the process, or it isn't a clean room.

LLMs are created through mass ingestion of data, and so, by definition, cannot be a clean room. They are trained on the things that they're tasked with copying.

"but they're nowhere performant enough in practice or memory efficient compared to Rust."

I would not include Ada, if you're benchmarking against Rust. Mostly because Ada either outperforms it (because it can reduce sizes in the optimiser), or it is equal to it.

This is why Australian law includes the term "reasonable". So that if it seems like a burden, the court acts.

I'm afraid I'll believe that will happen, when I believe tech debt doesn't exist. That utopia does not seem on the horizon.

Not a non sequitur - No one should be taken at their word. Not them, not me, and not you. This is the security world. Nobody is trusted altogether.

Breaching an embargo, makes reverse engineering easier. We don't need to analyse motives or pontificate. Disrupting the supply chain... Disrupts the supply chain.

The reading that chainguard have said that before when it was not the case.

Why would you implicitly take them at their word?

Was the exploit made, from reverse-engineering, this early release? Because that is how I'd do it.

We're only 10 months out from React2Shell. That is not nearly enough time to say "battle-tested".

I can affirm that I'm seeing vibe-coded dashboards designed to ingest and run on top of Excel spreadsheets full of macros, VBA, and "Excel Scripts" interlinks.

I... Cannot call this a step up. They're expanding, not replacing.

The corporate partners, who are also often investors, and have an interest in ensuring the world sees genAI as utterly required.

Microsoft, SK Group, Meta, Google, Oracle, etc.

Bevy is intentionally sharded across many crates, is small, and has the dev working on optimised build times.

That isn't "Rust compiles are fast", it's another example of "Rust requires you architect your code a specific way".

Voted to be removed attribution in the last meeting [0], but the patch thread is a bit controversial and ongoing at the moment. [1]

[0] https://lwn.net/Articles/1099594/ (user required).

[1] https://lore.kernel.org/lkml/20261009083137.3-1-sashal@kerne...

[delayed]

They still are. [0]

> This could lead to remote code execution over Bluetooth with no additional execution privileges needed.

[0] https://www.cve.org/CVERecord?id=CVE-2020-0022

Every click, keyboard tap, and peripheral event, are now logged and (most) of those are then sent back to Microsoft.

With Windows' socket-hogging, its a miracle they can be this invasive and only use that much RAM.

That certainly might be one of the oldest Fortran codebases still in use I've heard of, but not quite the largest. (Character came in '77 wasn't it?)

E3SM [0] is still maintained today, and somewhere around 2mil LoC of F90.

Modern Fortran has a lot of niceties that it brings to the table.

[0] https://e3sm.atlassian.net/wiki/spaces/DOC/overview | https://github.com/E3SM-Project/E3SM

Most interns would not be dumb enough to try it. Because there would be consequences, and there is training. The pre-trained entity, that everyone has been screaming is as smart as your intern, though?

sscanf has locale things that make it include implementation-defined behaviour, doesn't it?

> Over the year, nothing they've released with a lean proof attached has turned out false

That's not true. [0]

> On July 25, Ramana Kumar published a repository containing a sorry-free "disproof" of the Collatz conjecture, produced with AI assistance. It is not a valid proof because it exploits a bug in the kernel's handling of nested inductive types.

Even in this dump we're talking about, it hasn't been true. [1]

> In “Algebraicity of Weil classes on split abelian eightfolds” a sign error invalidates a stabilization-trace cancellation argument and the construction used by two dependent papers.

[0] https://leodemoura.github.io/blog/2026-8-24-postmortem-for-t...

[1] https://github.com/openai/math/blob/main/history.md