SahAssar

Does /etc/ssl/cert.pem not exist if you don't install XCode?

Seems like it's due to the recent brotli bugs. The other blocker is stratis, but to be honest I'm not sure if that is a no-go.

> If you are a legally operating company in the US just saying it's banned is enough, the threat of enforcement is enough pressure.

Is there precedent for the US actually "banning" software? I know for example the Kaspersky ban and tiktok ban, but both of those were either banning the sales or banning the service. IIRC neither made the actual software illegal.

What is an example of a specific software being illegal to possess? What is an example of a specific software being illegal to use if it is not used to break other laws (copyright, etc.) or talks to banned service providers?

Closest thing I can think of is restricting the export of cryptography in the 90's, but that was not even close to what you are suggesting.

It didn't. They are probably referring either to Quad9 being ordered to block resolving certain hosts (and therefore deciding to not offer service in france) or the french prime minister sending a notice to ISPs to prepare DNS blocks for twitter, facebook, etc.

In both cases this is not taking the whole country offline, and for both of them you can easily bypass the "block" by using any other DNS provider. You don't even need VPN/TOR or anything else complicated.

Those are not really usable as something you toggle on/off when needed, since they are under the battery cover and you are strongly recommended to only flip them while the phone is off.

Cool that they are there, but not suitable for what most people actually want.

I mostly agree, but again, You said "Open-weights means weights are released under an open-source license" and I asked "According to who?"

"Open weights" is for the most part a term that is meaningless besides being technically able to run it on your own hardware.

I don't think we have a proper term for what you are reaching for, and proper open-source models (training, training-data, etc. being fully open) are scarce.

Besides including the sota could you include a link to the best previous open-weights (and if possible fully open-source) model?

> Open-weights means weights are released under an open-source license.

According to who? From https://en.wikipedia.org/wiki/Open_weights:

> Publishing these values allows others to download and use the model, while permission to modify, fine-tune or redistribute it depends on its license.

Those restrictions are definitely not compatible with the definition of open-source/FOSS. I think you have a much stricter view of what open-weights means than the industry.

First ever pTLD?

Do you also think that of the original 7 gTLDs (.com, .edu, .gov, .int, .mil, .net, and .org)?

But with a compiler you can see why the compiler did what it did, with AI you have a black box. Even if you fixed the AI model to be deterministic you could still not see why it produced the specific output for that specific input.

I think my take would be to report it anonymously (via support/marketing/etc.) and in the report strongly encourage them to create a path for security reports (either via a bounty or just a security email). When fixed or actually dismissed post publicly on anonymous channels, with a section saying how they could have created a channel for these reports.

It's not. The cookie only gets sent to the domains/servers you specify and is not accidentally exposed via browser history or copying a link.

FYI: the videos on your site do not work for me, requesting them only returns LFS metadata:

    < HTTP/1.1 200 OK
    < Date: Sun, 27 Sep 2026 08:35:26 GMT
    < Server: Apache/2.4.68 (Debian)
    < Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
    < Access-Control-Allow-Origin: *
    < Upgrade: h2
    < Connection: Upgrade
    < Last-Modified: Sun, 13 Sep 2026 06:23:37 GMT
    < ETag: "85-65b575b9634c9"
    < Accept-Ranges: bytes
    < Content-Length: 133
    < Content-Type: video/mp4
    < 
    version https://git-lfs.github.com/spec/v1
    oid sha256:9f7709c3cb163bf07a762873332fe40e552f750bcf310ce77c77f5b197b61426
    size 92474860

Seems generated. Also why no llamafile?

That metal does not seem very bare if it requires a coating of AWS/GCP/Azure.

The org takes responsibility. If you want to additionally name & blame an exec feel free.

This sounds very AI written and buries the lede, but my understanding is if you control the repo in a way that you can set the default branch state for a git repo and get a victim to install a plugin with the same git sha as that branch state you can RCE them?

Pretty bad for a package manager, but this seems like something I would unfortunately expect from a harness/agent.

The real question here is what is the default? Is it opt-in or opt-out?

If the site didn't require login, sure.

Now it'll be "Just don't use the site and encourage anyone else to stay away"

I don't see it in https://archive.org/details/worksofsirthomas0000urqu or https://archive.org/details/bim_early-english-books-1641-170...

I also don't find it on the site of "Klaus Schmeh" that it claims to be on a list of "Top 50 unsolved encrypted messages": https://klausschmeh.net/?s=Cyphral

Looks like the best source I can find is this: https://scienceblogs.de/klausis-krypto-kolumne/2014/11/17/we... which seems real-ish?

> That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record.

It's not. They control a long-term high-value asset (the domain tesla.com). They decided to delegate part of that asset to a large number of "random" people that they do not have a contract or agreement with.

Being able to issue certs for cloud IPs has nothing to do with this since it is not a long term asset, and if it is you probably don't delegate it to random people to control unless you do not value that asset.

I'm not a golang person, but does this even compile like that? Do people not even run a build anymore?

If you are going to make recommendations and promote them to a wide community (linux users) that is predominantly using something that you do not consider advisable for that recommendation (systemd) then it might be good to mention that.

Systemd is probably on 80%+ linux systems that people interact with, and 95%+ that people manually configure.

Usually you can't freeze the whole system UI with an infinite counter though. I'm pretty sure normal JS browser processes are not supposed to be able to do that.

So "run on a custom silicon" should not mean anything "custom" in regards to architecture or ISA or even microarchitecture?

If that is true then a lot (or most) of android phones run on "custom silicon" and the term is meaningless.

The steam decks APU was designed for Magic Leap 2. It is one of the worst examples you could choose for a chip specifically designed for the thing it is in.

They used the Think(Pad|Centre) brand and expanded it to other things (like IdeaPad).

They basically bought IBM's good reputation name and style and used it for both IBM-alikes and budget machines.

Some of it was good machines, some of it was crap.

Not a spinoff. It was founded 20 years before and was the largest PC manufacturer in China 10 years before buying IBM's PC business.

Peripheral chips, non-standard bootloaders, custom hypervisors and similar is not what people mean when they say "run on a custom silicon".