TuxSH

> threat that exfiltrates

No need for something new here, Claude Code (Auto + default settings) has a tendency of running "find"/"ls" on your home folder when it struggles with solving a problem. I wish I was joking.

Now of course people trust these AI companies not to do bad things(tm), but all it takes is replacing the model endpoint URL -or any kind of harness compromise- and nothing will seem amiss

> Google

Is it not because they have been enshittifying Search for over a decade, then recently lost their de-facto monopoly on Search due to LLMs, with no good new product to show for it?

LLM use != vibe coding (latter should be reserved to "cattle" projects)

One can use LLMs to find vulns and/or review hand-written code, for example. But to answer your question, one doesn't understand code they didn't design nor write themselves.

Not sure when it started (at least the M4 is affected by this) but all the macbooks I had (personal+work) since the M4 have display dimples after being put in a stuffed backpack.

Meanwhile the M1 Air I had for more than 3 years never saw the issue.

> Google has the products

Outside their most successful products (YouTube, Android, GMail, Chrome, Search), their products are usually worse than their competitors (e.g. GMeet vs Zoom)

> the brand recognition

Of not maintaining/outright abandoning their products, and making Search worse over the years?

> most importantly a billion normies

ChatGPT has 1.2B weekly active users, all the normies know what ChatGPT is but don't know about Gemini (outside the "AI Mode" stuff)

You're not alone. Though, I wonder if this means better coating, the coating on the existing MacBooks (but not the M1's) get damaged far too easily when in a bag.

Yeah and some of the article wasn't proofread (by himself or a clanker) and the project is missing some of the due dilligence.

One striking example is "No debugger, no stdout" which is baffling considering I implemented a GDB stub in the very first version of Rosalina which I released like... 10 years ago?

Stdout redirection is supported by both 3dslink and GDB stuff on 3ds, too.

I don't mean to be a party pooper - and the projects fullfills its role as a showcase of how far pure vibecoding can take someone - but it's this can of thing that gives the "absolutely no AI" crowd grounds to stand on.

> Good instinct, the bottleneck is on the CPU side though.

Have you, or rather your agents, tried to identify which CPU functions were the bottlenecks (e.g. in citro3d, perhaps)?

I find it surprising that your stuff is CPU bound. Are you doing one command-list submission for _both_ eyes (with one drawcall for each)? This should be relatively simple, only require viewproj matrix changes and avoid CPU<>GPU roundtrips.

If not, you are going to hit IRQ dispatching costs as well as shardmem dispatching costs as well as other costs.

It's the choice of the moderators* and they are banning solo projects, and any kind of AI usage even if not slop.

Most low- and medium-handing fruit vulns can be found and exploited by GLM and some knowledge already.

Kneecapping cyber vulns only serve governments, Pandora's Box is already open for cyber-related stuff.

> For the open-weight release of K3.1 Pro, we identified and removed cyber-related data from both training stages, while retaining the general-purpose coding tasks needed for model usefulness. We will continue to apply appropriate controls at every training stage, of which cyber-related data identification and restriction is one example.

Lame.

> Having a small number of apps installed at the same time, needs each app to be periodically reinstalled at short intervals (IIRC, one week), and you need to have your expensive Apple laptop with you for that reinstall.

Not true if one pays up ($99/yr), in which case the interval becomes one year. Also apps that sign and install other apps with one's cert exist.

The category they list in the $50k context are PSC exploits, or TSEC coprocessor exploit when executing the secure code that bootROM provides it.

So, presumably, current and future key material compromission like on Switch 1

> Worth noting too that this would have easily fetched >$50k

More like $30k, no ("system processes allowing piracy")?

https://openjdk.org/groups/vulnerability/advisories/2026-10-... - it's just the 8 certs

> Curious if anyone has experimented with LLM's RE'ing obfuscated code.

Sort of, albeit I haven't checked with SotA obfuscation, I've seen GPT 6.1 Sol find a URL hidden under a xorpad + 2 layers of encryption, and I've seen Astra RE an AES whitebox.

More importantly, remember these game decomps (e.g. Pokémon)? Well, with minimal guidance and IDA MCP these new models are able to do this _and_ properly name all function/params/locals in a single day.

It's insane how hard OAI is choking, they had much better models than A/ who were fumbling this year to date... then blunder after blunder.

The only things that OAI still have over A/ are better coding agent GUI, no 5hr limit on >$100, much more reasonable cybersec guardrails (that allow most RE work) and... that's it.

Yeah it's too little too late, cat's out of the bag as people know that GLM 5.3 exists and is great at defensive and offensive cybersec.

(sadly Mistral Large 4 isn't up to par - but Mistral serves GLM at 130 tps!)

Unfortunately Mistral Large 4 is benchmaxxed.

It also has guardrails, albeit very weak (which you can read in thinking traces).

I've had seen subagents fail with "hmm, hmm - hmm, hmm (...)" multiple times, it keeps trying to cheat at the task (trying to remember hallucinations).

GLM 5.3 (which Mistral also serves at 3x the speed!) wipes the floor with it

> why couldn’t people just use chinese models rehosted in the EU?

Guess what Mistral themselves do?

> say review every commit to catch obvious bugs

I’m using subscription models for exactly that, better models catch more subtle bugs, and they catch them faster. It works out far better in terms of work-hours saved.

Also A/ then OAI slashed token pricing by 2x~5x on their latest models

Vibe coding has always had and always will have one fundamental flaw: you didn't write the code it produced, therefore you don't have a good understanding/mental model of it.

On the other hand asking these clankers "review the feature branch I wrote" and "review my entire codebase for bugs" or "help me debug this" has saved me months of prospective work.

And more recently most major models have been getting _really_ good at RE, for example you can have OAI models (and maybe A/'s if they don't refuse) use idalib MCP and reverse-engineer stuff from start to finish, then follow up with GLM 5.3 for vuln assessment and exploit PoC.

Stuff that used to take weeks or months now just takes a few hours, or less.

> if hardware demand by openAI and Anthropic dwindles

Would it ever? Demand for inference (and I suppose the same applies for training) _increases_ when models get cheaper.

I suppose real risk is that one player aggressively cuts margins (say, AWS) and others follow suite. However the release of increasingly more capable, exclusive closed-weight models prevents this to an extent.

I doubt it will change much, inference (not training) is very profitable and demand for inference is quite high. See: Mistral serving GLM on their own servers.

8x for subscription, 6x for credits/enterprise: https://learn.chatgpt.com/docs/agent-configuration/speed

> Suggest trying it out yourself: Ask for something difficult from GPT-6 Sol and Opus 5.5 and watch what each one does. The difference is stark.

Oh yes, I know GPT-6 Sol is ... quite not up to par. At least it's not as bad as GPT-5.6 Terra I suppose.

Exactly half as expensive as Opus 5.5 in every API pricing metric

Liquid Glass actually looks like glass now, the weird side panel changes in apps is reverted, music slider hitbox hiccups are now fixed, etc.

It's just 26 but better. On my personal macbook I upgraded from 15 to 27 directly.

Yeah... on OpenRouter or equivalent

> OpenAI and Anthropic's lead is vanishingly small at this point.

Yep, with them nerfing their plans (and apparently planning to release a $500/$600/mo plan) their only advantage is Astra without 5hr limits and with not-too-stringent "cyber" safeguards.

Ergo, it's pretty damn good at unattended RE with the IDA MCP plugin while using most of the weekly quota at $100/mo... and that's it.