Aissen

This saddens me since MPTCP is quite useful and not the cause of the bug, just a way to ease exploitation (probably simpler heap massaging? Way over my head). Anyway, upgrade, but don't block MPTCP; no exploit is available, and it's just as likely someone finds another path before Anthropic releases theirs.

Note: this article is from last month predates the answer from Disney: https://thedesk.net/2026/09/sources-disney-wont-run-ads-in-a...

> two sources at Disney familiar with the change said the updated terms was intended to give Disney greater leeway to incorporate promotional spots for its other movies, TV shows and live events before and after content streams on Disney Plus, not traditional commercial spots.

> The use of the word “advertising” was intended to help its terms of service remain consistent across regions where the streaming platform is available, including countries where promotional spots for its own shows and other content might be legally considered an advertisement, even if the spots are not promoting third-party products or services.

> To that end, Disney’s plan is similar to what other streamers, including Paramount Plus, do with their platforms now. Paramount Plus has long streamed promotional spots for its own shows, movies and live events before content on its ad-free tier.

Now I'll let you decide if you trust more what the PR person says or what is written in T&C.

> especially due to persistent attempts to use regexes to validate untrusted input

This is not the case here, it's an untrusted regex which can be the issue.

No, that's open source and it will be an accelerator for everyone, instead of a small advantage kept by a few. Even the frontier labs benefit. I'd argue (like I did when the initial DeepSeek was released), that the AI market *needs* to those inference breakthrough.

There are links to pretty readable changesets, so you can go read and understand exactly what's happening instead of speculating.

It's basically an additional policy on top your OS's policy, while waiting for the stores to update, it protects the users.

Indeed. Link: https://huggingface.co/mistralai/Timestral-209M/blob/main/LI...

Can we talk about how this particular CNA is abusing its power here ?

And it was the same refrigeration vendor.

> What’s the secret behind that Mario ‘feel’?

> I think that is fine-tuning. Many, many, many hours and days spent actually sitting down and playing the game.

Turns out quality takes time. Who would have thought. Very few games reach this level of fine-tuning, because it takes dedication (and budget).

Funnily, it's almost conflicting with this answer:

> Was much changed during development?

> Apart from the number of polygons use, the characters were first-off – once they were designed, they went straight into the game. There wasn’t really a lot of changing, artists just kept supplying stuff that just got put in the game, conveyor-belt style. That was more or less because of a very, very tight deadline – it had to be out right when the N64 came out.

So it's more nuanced. You fine-tune the fundamentals, but not necessarily everything.

No, you can do bootstrapping and save binaries for reuse with hash verification. Android did that for its Rust toolchain: https://cs.android.com/android/platform/superproject/main/+/...

Bootstrapping at every build does not save you from the threat you think it does.

I expected this to be a multi-months rewrite, not 3 weeks. I almost forgot we live in the agents era now.

Edit: this seems to have been cooking for a while when the first commit dropped: https://github.com/rui314/mold/commit/f41bfcd5c72ca30cce6498...

> But this is really end-90s/begin-00s Microsoft levels of anti-competitiveness. I'm surprised that (particularly non-US) regulators are not investigating them yet.

You mean like the Skyhook vs Google 2014 lawsuit? (look it up) Settled before it could go any further.

Nice to see Kernel Recipes covered again on HN. Shameless plug: I do the live blog: it's incomplete, imperfect and has typos; but it's written and published during the presentations. On this talk : https://kernel-recipes.org/en/2026/2026/09/22/live-blog-day-...

Not even 12 hours ago I was writing here:

> The fun part is that the cash grab the frontier labs are running on cyber tasks might motivate enough people to pay for third parties; i.e it might bring enough cash to sustain Chinese competitors (and their open weights marketing strategy, which we all benefit from).

And now, they are doing marketing for them(!) in the hope of getting them regulated.

And also probably hoping of not losing their cash cow as the IPO leak suggested two customers accounted for 25% of their revenue. Not hard to imagine a 3-letter agency being one of these two.

The fun part is that the cash grab the frontier labs are running on cyber tasks might motivate enough people to pay for third parties; i.e it might bring enough cash to sustain Chinese competitors (and their open weights marketing strategy, which we all benefit from).

Note that it seems that it no longer falls back automatically. So the actual score of Opus 5.5 will be even lower (fail vs fallback than can succeed)

Me too. YouTube was given up, and what the op did was to use Twitch streaming and redirect it before the forward to a TLS-verifed server, bypassing verification:

> redirects the actual stream to the Mac without any certificate issues.

> test several levels against your own evals

Of course, and this is the basics anyone should do when working with LLMs & agents; but with their high-variance, doing statistically significant benchmarking is very costly. Which is why the debates here on HN often talk about the "feelings" of degradation (or improvement!), but often without proofs. I'm not sure how to solve ạt; maybe inference providers should provide free benchmarking to anyone publishing results, along with the guarantee to never train on those sessions.

A quick checks shows that it seems so, last month. No answer to the RFC yet, though.

b4 maintainer and Director of LF IT Konstantin Ryabitsev demo-ed git-bug support in b4 and cgit (kernel.org fork) just this week at the Kernel Recipes conference:

https://b4.docs.kernel.org/en/latest/maintainer/bugs.html

https://git.kernel.org/pub/scm/utils/b4/b4.git/bugs/

https://kernel-recipes.org/en/2026/2026/09/22/live-blog-day-... (shameless plug)

A recent study seemed to support Fabian's well written article: https://dl.acm.org/doi/epdf/10.1145/3779212.3790129

If you are talking about publicly known vulns, it's a bit moot since they should be in the training sets. If not, you just burned the vulns to that inference provider's training data (and any intermediary), and future benchmarks will be meaningless.

> And the judgement that they did it is independent of whether the Clay people agree: you can make up your own mind and so can everyone else.

No I cannot, and I'd argue most people can't either. We rely on mathematicians, peer review, and letting the scientific process run its course.

Also, if you have any sort of buying power: make sure you company pays for a group subscription, and maintains it over the years. I try do that here. Nudge your colleagues to use the subscription and send them the occasional article!

I was there at the start of the smartphone boom. I built a demo Android device that was capable of telephony/data, 3D rendering, etc. all before Google open-sourced the OS, for a SoC vendor that wasn't in Google's inner circle. Yet the industry was not interested in my junior profile during the subprime crisis.

"Stealing" something you already paid for (tokens), but that you can't have access to(!). And trained on the sum of human knowledge.

Training on other model outputs ought to be business as usual, stop using morally charged terms made up by future monopolists: https://thomasdullien.github.io/posts/2026-06-15-rl-economic...

Was a recent convert. It's so much better than the competing apps, it's almost funny. It whips Google's antispam for example. And it's free software.

Though to be fair it is helped by the fact that businesses have mandatory phone prefixes to use when doing telemarketing in France.

We should fight against their call to ban distillation much more strongly: LLM SaaS should ease people getting their full query history and everyone should be allowed to pool them to distill or analyze or whatever. It's a basic requirement against future monopolies.

Following this being in the news, GrapheneOS wrote this post summarizing the data extraction defense: https://discuss.grapheneos.org/d/40700-grapheneos-protection...

On the duress pin, they say (read the whole thing though):

> People should carefully consider how to use it in an actual duress situation where there can be physical or legal consequences for wiping the device.