stackghost

> Also, how does this meta-understanding of the weights end up in the weights in the first place? Idk, this is mind-blowing to me.

These models are trained on pirated textbooks and papers, including every ML paper ever written.

I think this is a story about the author getting hit by a delivery robot? Or a car? I honestly am not sure what this is supposed to be about.

Not sure I understand what you're referring to.

Debian has a patch out, do they not?

Back when I used Ubuntu it was because I was tired of being excited about a new feature and not getting to use it until it made its way to Debian 5 years later.

I suspect at this point that it’s a bunch of techno-bureaucrats at Canonical who are dogmatically sticking with their release cadence because artificial justifications. I have worked in big organizations where The Process, or The $place Way of Doing Things, has become so big that the bureaucracy takes on a life of its own and you end up having a whole team of people who just manage the process so that the people actually doing the work can maybe get something done.

I haven’t used Ubuntu for a few years now but I’m glad they’re getting this trial by fire now. This new era of software vulnerabilities is going to reduce the viability of a lot of smaller distros who more or less are entirely dependent on upstream for security and reliability. I sincerely wish the Ubuntu folks well but this is a sink or swim moment, and even if they sink it will be a net positive for Linux as a whole as weaker projects get picked off like the slowest antelope in the herd.

>Back in the day it would've been fine for the programs you wrote yourself.

I mean, maybe if your code was simple enough that you could keep the entire state in your head at once, but we're talking about guys writing memory management routines and OS kernels. In C. With no LSP, no syntax highlighting, no linting, etc.

It's one thing to say "my hardware is too limited, I can't fit all that extra context into memory", but to be working with that tech stack and to say "I actively choose not to see the context around the line of code I am editing at this instant in time" is just obtuse, no matter how many programming languages you've invented.

> By the way, 'em' stands for 'editor for mortals' - I christened it that after Ken Thompson visited our lab at QMC while I was developing it and said something like: "yeah, I've seen editors like that, but I don't feel a need for them, I don't want to see the state of the file when I'm editing".

Literally an insane opinion.

American Tech Firms: fucking over society one segment at a time.

I think it’s referring to “May”, as her name was most certainly Mary.

I’m interested in hearing about your AMD based, sans-CUDA stack, if you’re willing to share details

Yes, Faraday shielding is one of many considerations when building a SCIF or other EMSEC zone.

Touch *balls*?

The idiots that wanted no takebacks are the same ones who lacked the critical thinking ability to foresee this exact situation.

So, your argument is “don’t have kids because your parents might develop health problems”?

Literally nothing is less interesting than yet another "discussion" about the relative merits of software licenses, or generalizations about the kinds of people that prefer license A to license B.

I have flagged this comment.

Which software have you rewritten for speed?

Of course nothing will happen. The wealthy play under a different set of rules in America.

> Who is cultivating a "favorite language"?

I don’t know, but deflecting legitimate criticism of a language by calling it “language purism” seems pretty emotional to me.

>It is so difficult to feel scale with aircraft due to the fact that most of the images are of them flying and so there is no context. Seeing them in person can really help put them in perspective.

100% this. I got to ride in Vera, one of two airworthy Avro Lancasters, a few years ago, and I was shocked how small and cramped it was. The C-130 Hercules, far from the largest military transport today, feels luxurious and roomy by comparison. And that was the RAF's premier bomber, among the heaviest bomb loads.

And likewise, the comparison between a P-47 and a Bf 109 is not something you can really appreciate until you see them side by side. I would not have wanted to go to war in that cramped metal sarcophagus of a Messershmitt.

This has nothing to do with purism. I use python all the time, where it makes sense.

What I don't do is cultivate a "favorite language" and make it my whole identity, and then take criticism of that language as some sort of personal affront. Python objectively has some serious flaws. That shouldn't make anyone emotional, and I don't know why people get their backs up like this.

>Ok but a mediawiki page is obviously not comparable

The attack is against the underlying php install, and is application-agnostic, I was merely duplicating the trailofbits POC.

The dump truck that is C++ definitely goes just as fast if not faster than that Hellcat, though.

To me it seems more like C++ is the metal shop's old school 3-axis mill: effective and dangerous. Can do almost anything, including easily maim you unless you're continually vigilant.

Go seems like a CNC machine: just as effective, much less dangerous because it relies on digital safeguards and embedded controllers. You need to go to extreme lengths to make it do something it wasn't designed to do.

Python seems like lego. Shit simple to build things with, lets you start building immediately, fantastic for prototypes, but finished product is still just press-fit plastic bricks

I don't agree at all that it's a coke/pepsi situation. That analogy is for when two mostly-interchangeable choices develop tribal followings based largely on personal preference. Coke and Pepsi are both caramel carbonated soft drinks that are terrible for your health differing only slightly in flavour. Otherwise they're materially identical.

C# is strongly/statically typed, compiled, and quite fast (after the vm has started), whereas python is weakly/dynamically typed, interpreted, and generally slow as fuck. Those are two fundamentally different languages, how could it possibly be a coke/pepsi situation?

I think python is fantastic for certain use cases: gluing other tools together (like LAPACK or other ancient libraries), system automation, prototyping, exploitation (I think pretty much all of us were working on stealmybitcoin in python), and exploratory data analysis.

The problems arise when people try to write, say, gigantic GUI applications in python, or really anything with CPU-bound workloads. Part of being an engineer is using the right tool for the right job. Python is the wrong tool for lots of jobs. That shouldn't be a controversial statement.

The only professional I saw making that claim was the CEO of trailofbits who is a former NSA TAO member and doesn’t have anything to prove by talking a big game.

It wasn’t that difficult of an exploit, to be honest. I was most of the way there, having been set back by the downtime and my time zone. It’s definitely a fiddle, tricky exploit but I think the initial alarm was justified.

While waiting for the server to come back up, it took me about 3 hours with LLM assistance to write a php2shell RCE for nginx and mediawiki on the same version of php as TFA.

The biggest win, as others have also observe, was the demonstration that there aren’t swarms of automated pwnbots out there that will insta-root your server.

Considering the amount of downtime, I think that flag got got pretty quickly.

Astro is based on npm is it not? Given the state of that ecosystem and the rate at which new vulnerabilities are being discovered these days, I prefer to stay as far away from Node as I can.

What’s an image ladder src set?

Damn it I was almost there. Just finished pwning Wordpress behind nginx with fpm.

I have a working php2shell RCE against a stock nginx+mediawiki1.45.1+php8.4.26 docker container now. Wrote it with LLM assistance while watching Formula 1.

You are not being trolled.

In the late aughts and early 2010s I and a few other people came up with the `darknet plan` aka `project meshnet` which was a subreddit and adjacent communities dedicated to creating a completely parallel internet using 802.11s mesh networks akin to the Athens and NYC meshes that span a huge portion of those metros.

The movement eventually got coopted by the CJDNS project and its fans. Instead of a completely separate internet they were advocating more of an overlay on top of the existing internet (because that didn't require solving interurban/intercontinental backhaul), which to my mind addresses essentially none of the problems we set out to solve, so I eventually lost interest.

But today we have things like LoRa and a greater hacker community around the ISM bands, which might be just what's needed. I have hope one day we can achieve global interconnectivity without rent-seeking ISPs.

PHP runs something like 75% of major websites. It's unlikely they have all been patched.