astrostl

"We received *45* new #curl vulnerability reports this morning (from Anthropic). I'm slowly moving them over to GitHub." — Daniel Stenberg, curl CEO, via LinkedIn

Provided GitHub link: https://github.com/curl/curl/issues?q=is%3Aissue+state%3Aope...

I'm using the latest Homebrew git (2.56.0 confirmed with `which git` and `git --version`), and it remained vulnerable until I manually patched the SYSTEM per https://support.apple.com/en-us/149555

I don't think it's a good idea to front-page an exploitable site on HN. The blast radius isn't limited to the creator's Bitcoin, it also extends to zero-days against anyone visiting the site. This is true of all sites, but all sites are not built to fail while incentivizing exploits.

Beggar choosing: my kingdom for more 90B-133B MoE local models. Especially with disk offload, that is a function/performance sweet spot for Mac workstations with 64GB-128GB of RAM.

YES, and I also find that plan mode incentivizes bad practices and results in steadily reduced thought. On bad practices, I refer to zero/one-shot big bangs over iterative features/bugfixes. On reduced thought, assuming the plan was sufficiently comprehensive because it seemed to ask reasonable questions.

It can still be used in ways that I personally consider correct, but I think the parts I personally consider incorrect are so inherently alluring that I find plan mode to be an overall net negative for software development. I celebrate its apparently impending default removal (at least Claude Code and OpenCode are openly stating that they think it's time for it to go).

> it’s just BERT with more data

Let's take that as a given. Is BERT with more data not useful?

> I can see why people would want ready made one shot classifier, and I can see the value of sending multiple classifier in one call, but I wouldn’t call it breakthrough

Are those things that people want less useful because of what someone else calls it?

> I see it as a wake up call for the tech community to go back to basics for most tasks instead of relying solely on generic LLMs.

Maybe, or maybe to use Jev, which is useful?

Whether something is overmarketed or undermarketed, novel or derivative, it does not change its function.

I have updated macOS and iOS around day one of release since 2008 and have yet to experience meaningful issues, AMA.

The benchmark page itself asserts that it used Gemini CLI as a harness. I came to the comments just because I noticed the error. For my part — using agy — I found Gemini 3.8 Flash mid.

"If you're so worried about acceleration, why don't you accelerationmaxx?" — OP

> MacBook Pro M5 128GB RAM

614 GB/s of memory bandwidth

> MacMini M4 with 64GB of RAM

273 GB/s of memory bandwidth (also only currently available with 48GB)

When it comes to inference speed, you want your model to fit in memory, and then to have as much memory bandwidth as possible. In this case a hypothetical Mini with 1TB of memory would still be over 2x slower with 27-35B models.

And FWIW I have an M4 Max MBP 128GB that I keep on a Roost laptop stand, with a separate keyboard/mouse/video. It does fire up the cooling jets when running local LLMs, but stays within tolerance for me on noise. I haven't heat-tested it on longer runs, but I imagine the risen airflow helps a ton.

Updated https://github.com/astrostl/surplies to scan for it too

FWIW I vibe coded https://github.com/astrostl/surplies to detect evidence of the Axios and LiteLLM malware, using StepSecurity's writeups as a data source.

FWIW I vibe coded https://github.com/astrostl/surplies to detect evidence of the Axios and LiteLLM malware, using StepSecurity's writeups as a data source.

Disagree. We all are — or should be — Linux kernel developers. What's more, we should align to a specific and singular VCS worldview informed by BitKeeper, which no longer exists, whether or not we used it. Therefore Git. Thank you for your attention to this matter!

Huge enabler for the mini keyboards for me: Fn + L/R for Home/End, Fn + U/D for PgUp/PgDn.

I have mixed feelings about it, but I'm going to fire somebody tomorrow for using a struct just to prove a point to the author.

Browser automation: chrome-devtools-mcp, playwright-mcp, etc.

The quality of the ChatGPT Mac app is a major driver for me to keep a subscription. Hotkeys work, app feels slick and native. The Claude Mac app I found so poor that I'd never reach for it, and ended up uninstalling it — despite using the heck out of Claude Code on a Max plan — because it started blocking system restarts for updates.

Yep. Consumer Reports' "Find a Car" page has sorting options for Overall Score, Road Test Score, Predicted Reliability, and Predicted Owner Satisfaction. I think they're a tremendous pro-consumer non-profit, and that a $39/year membership more than pays for itself by way of better major purchases.

Rivian, by the way, is the lowest-ranked of 26 covered auto manufacturers in terms of predicted reliability, below Ram and Jeep. The top 3 are Toyota, Subaru, and Lexus.

> That doesn't seem like enough to entirely shape worldwide discourse around nutrition and sugar.

IDK, see the "BLOTS ON A FIELD?" by Science ("A neuroscience image sleuth finds signs of fabrication in scores of Alzheimer’s articles, threatening a reigning theory of the disease") or "The 60-Year-Old Scientific Screwup That Helped COVID Kill" by Wired (regarding the anti-scientific refusal to acknowledge it as airborne) for a couple of recent examples. Once underlying assumptions stop getting questioned, I think anything is at least possible.

Same. CMD-F, 'sqlite', no hits, skip and go straight to comments.

It's such an amazing business model:

- create a platform to host content others create

- get employees to ask for company-provided access

- almost none of these employees really use it

- collect subscription revenue indefinitely

This is why I use Go as much as reasonably possible with vibe coding: types, plus great quality-checking ecosystem, plus adequate training data, plus great distribution story. Even when something has stuff like JS and Python SDKs, I tend to skip them and go straight to the API with Go.

> The information to properly land the plane is in the manual

Look, I already liked the nerdy blog post! I don't need even more reasons to like it.

Most recently (yesterday), vibe coding a better interface for Roblox screen time: https://github.com/astrostl/blockblox . Claude Code crushes, and I'm preferring Go for everything I can to take advantage of typing, quality ecosystem, and distribution. Still need to implement the QE side on this as I have on other things.

The OP confirmed that it isn't:

"is this using RDMA?" "No. It will be faster with that in the next release" [1]

1: https://x.com/awnihannun/status/2000243131779023329

Having been through cycles of manual writing with '#' and having it do it itself, it seems to have been a push on efficacy while spending less effort and getting less frustrated. Hard to quantify except to say that I've had great results with it. I appreciate the spirit of OP's, "CLAUDE.md is the highest leverage point of the harness, so avoid auto-generating it" but you can always ask Claude to tighten it up itself too.

I have Claude itself write CLAUDE.md. Once it is informed of its context (e.g., "README.md is for users, CLAUDE.md is for you") you can say things like, "update readme and claudemd" and it will do it. I find this especially useful for prompts like, "update claudemd to make absolutely certain that you check the API docs every single time before making assumptions about its behavior" — I don't need to know what magick spell will make that happen, just that it does happen.

> Instead of software thermal control, I could add an actively cooled heatsink with PWM fan control. This might achieve similar temperature stability while using less power overall.

Love this (honestly). Interesting article!

I haven't seen convincing evidence that vitamin D supplementation is materially useful for anything but rickets. I get the impression that naturally high serum levels are an effect rather than a cause of other positive things, and that supplementation mostly increases serum levels without effecting positive things. It doesn't seem harmful either, so can't hurt might help?