CGamesPlay

> if your model is that linux is just about single-user desktops, this local exploit isn't too bad.

For example, if you have passwordless sudo, you've already got a widely known LPE vulnerability lurking on your system.

It's worth pointing out that you cannot, definitionally, get "real UID 0" in a "rootless" container, because then it wouldn't be a rootless container. This is relevant because this exploit doesn't claim to be able to bypass user namespaces, and that getting "real UID 0" would be a different exploit.

Kubernetes 1.33 switches to user namespaces enabled by default, which I imagine is the same underlying mechanism that rootless Podman uses. `hostUsers: false` is the way to ensure that root in the pod is root on the host. It's trivial for a real (unmapped) root to escape a Kubernetes pod.

It doesn’t? You could easily install the tracker on the client app, no need to do it server side. In fact I bet the app in question (Flo) was doing the upload to Meta client-side.

Claude Code doesn't have an option to use Opus 4.6 any more for me. It was great, but I guess now I have to use it half as much or upgrade my subscription again.

Didn't know that! I tried it and it doesn't work for me, sadly. Test case: `seq 1 100 | bat --pager=builtin` Result: immediate exit, no output printed at all.

https://github.com/sharkdp/bat/issues/1053

Realistically, I will be reviewing a diff, see a hunk I don’t like, change it, and want to see the change back in less. So saving my scroll offset would accomplish my goal. I guess I should add that I want to be able to quit as well?

Like I said, fzf does this. Bind a key to an action that effectively changes the file from stdin to a different command that it runs, while preserving view state.

Bat just uses less internally. And it deliberately breaks less’ handling of ^C, annoyingly.

Is there a name for this style of writing? Where it's composed exclusively of simple sentences. Short and punchy.

Paragraphs with just a single sentence.

I know it's associated with LLM writing. This article probably wasn't written by an LLM. But still. It has a kind of rhythm to it. Like poetry. But poetry designed to put me to sleep.

I am definitely waiting for a "modern less replacement" in the same vein as fd, sd, fzf, and the rest of the under-20yo cli crew. I get that "less" is reasonably maintained still.

I think the killer feature for me would be refresh. I get that this can't work for piped input, but I want `git diff` to show in a pager with a refresh button that holds my place. fzf supports both refresh and piped input, so perhaps there's some ideas there that could be leveraged.

I made a fun marimo notebook to try and derive these myself. I structured each cell in order based on the diagram at the end of the paper. It uses Sympy to determine if the function is correct or not.

https://gist.github.com/CGamesPlay/9d1fd0a9a3bd432e77c075fb8...

That cuts it by about 90%. But as others have said, the default US plug doesn't ship with a ground pin (though the extended cord does IIRC).

Oh is that why it happens? Was wondering why the spot directly under my wrist was pitted into a sawblade. I also filed it, though just enough to remove the pitting, nothing like the OP did.

It's easy for me to feel the mains frequency while gently rubbing the top surface of the MacBook while it's plugged in. Really feels unsafe, but neither me nor the computer have suffered any serious injuries yet.

Can you clarify what exactly you mean? Skills are markdown files, so they definitely can't call APIs or CLIs. Are you saying that a skill can tell the agent to use curl to call web APIs? Or something different?

The packages that are actually compromised are yanked, but I assume you're talking about a scenario more like log4shell. In that case, you can just disable the config to install the update, then re-enable in 7 days. Given that compromised packages are uploaded all the time and zero-day vulnerabilities are comparatively less common, I'd say it's the right call.

What are you doing with ! that requires this? Some alternatives I can think of depending on the use case are ^Z or :term.

I am always curious when I see these kinds of movement. It seems abundantly clear that the options on any vote in any legislature for a proposed bill are always “yes” and “ask me later”. So when I see things like Fight Chat Control, it feels like the call is “we must tell our legislators to press the ask later button!”

Why? Why has your approach not been toward passing active legislation that protects these rights going forward? Genuinely curious. I understand that finding and pressing the “don’t ask again” button is always harder, but I don’t understand why “we punted on this decision!” is a celebratory moment.

Except, this wasn't a "cold start" test. It was a "leave the page open and watch subsequent requests" test. Cache absolutely applies here.

Disabling cache and then complaining that the bandwidth usage never stops increasing is certainly a take, but I'm not sure you can meaningfully draw any conclusions from it.

It does when the "disable caches" checkbox is checked, as it is in that screenshot.

SSH configs support wildcards, so if you couple it with a ProxyCommand you can an arbitrary level of dynamism for a host pattern (like *.exe.dev).

But yeah, everything is a trade-off.

Using nonstandard ports would break the `ssh foo.exe.dev` pattern.

This could also have been solved by requiring users to customize their SSH config (coder does this once per machine, and it applies to all workspaces), but I guess the exe.dev guys are going for a "zero-config, works anywhere" experience.

This would avoid dealing with merge conflicts when the PR changes, which is nice.

LLM coding has made programming feel like playing Factorio to me. It's simultaneously much more addictive and much more strenuous than it's even been for me before. Each commit feels like moving to a new link in the supply chain, but each link is imperfect so I have to drop back down to debug them. At the end of a long evening, "one more assembly line" and "one more prompt" feel exactly the same.

Appears not to. https://claude.ai/share/ac070cf5-0034-4f3c-9a8c-1c43a58eea36

Claude’s analysis seems solid here based on reading the snippets it tested.

A purpose-built linter could be cross-language, it’s pretty reasonable to blanket ban these characters entirely, or at least allowlist them.

I hope it’s at least a little tricky, since Claude was released only 3 years ago. That said, I would not be surprised to see companies asking for 10 years experience, despite that inconvenient truth.

I published my submission and all supporting information here, in case anyone is curious! https://github.com/CGamesPlay/moment-swarm

Claude subscriptions (strangely) have a Sonnet limit which is lower than the general model limit. Using Sonnet counts against both limits, using Opus only the general limit. So the subscriptions are discouraging Sonnet use as well.

That was fun! Will there be a blog post / showcase or anything? I came in 9th, and will definitely be writing a blog post. I did not write a single line of antssembly during the contest!

Yeah, but then they went and added "memories" and in particular automatic memory management, and now it isn't a clean slate each time. And that's exactly what this is importing: those automatically curated memories that make the chat bot "feel like" it knows you.