dloss

They announced a partnership with Microsoft today.

Am I wrong to conclude that the statement by Google's VP of Security Engineering that "we simply must eliminate every software vulnerability on Earth" (before AI Agents find them) is not only stunningly ambitious, but doomed from the start?

https://youtu.be/B_7RpP90rUk (at 3:00)

My voice teacher had me blow air into water with a straw. Felt good and had some therapeutic effect on my vocal chords. Apparently the technique had been developed by a Finnish speech and voice therapist. Here is some background: https://www.laxvox.com/history/

Carlini gives some more background about his vulnerability research with Claude in this interview by tptacek & co. https://securitycryptographywhatever.com/2026/03/25/ai-bug-f...

If you're fine with CLIs, maybe my Kelora project is worth a look. It's a very flexible log processor with built-in scripting: https://kelora.dev

Do you have any specific pointers concerning that "relaxing/manipulating of fascia/muscles" part? I have only dabbled a bit in qigong and hadn't noticed this. Would love to learn more.

> "simply taking time to feel your body and put your attention into latched tissues can release them."

That has been my experience as well. I have developed my own little technique around this idea, where you invite tight areas of your body to soften and spontaneously make tiny stretching or unwinding movements - without forcing, bracing, or following a scripted routine. I call it Intuitive Release.

https://dirk-loss.de/intuitive-release/

I'm sharing Kelora, a hobby project that I have been developing over the last 6 months. It's a scriptable log processor for the command line, with 150+ built-in functions for parsing, transforming, and analyzing log files and streams.

My original idea was to have an easy to deploy, potentially faster and more correct "rewrite in Rust" of my Python log processing tool klp. It quickly turned into an AI coding experiment: how far I could get with vibe-coding, in a programming language that I barely know?

Kelora's code and extensive test suite have been generated entirely by AI agents (Claude CLI with Sonnet 4 to 4.5, Codex CLI with GPT5-codex). I come up with feature ideas and discuss it with the AI agents. The AIs then write the spec, the implementation, tests, docs and CI. I don't review the code, but I use the resulting program myself and review the docs. The result is fully functional and quite useful, in my opinion.

I am fully aware that this vibe-coding process has its problems. Without human review we cannot be sure that Kelora does (only) what it's supposed to do. And although Kelora passes 1000+ automatic tests and several checks (clippy, cargo audit, cargo deny, cargo fuzz), that probably shouldn't be sufficient to use it in production. In this sense, it's an experiment, or a prototype. So maybe just run it against the example logs I've provided in the GitHub repo. Or read the docs to get inspiration for your own log processing tool.

Because that's what I want to share: My ideas about a log processing tool with embedded scripting that can help turn messy logs into structured data. Some interesting features like level maps, windows and spans, tracking and state, JWT parsing, pseudonymisation, etc. And last but not least, my joy of working together with AI agent on a software project that would otherwise have been much too big for me. I've never had so much fun in 30+ years of (hobby) programming.

Yes, the 3B variant, with vLLM 0.11.2. Parameters are given on the HF page. Had to override the temperature to 0.15 though (as suggested on HF) to avoid random looking syllables.

Some more example programs in Lambda Calculus here, including a compliant brainf#*k interpreter: https://justine.lol/lambda/

Anthropic recently released a sandboxing tool based on bubblewrap (Linux, quite lightweight) and sandbox-exec (macOS). https://github.com/anthropic-experimental/sandbox-runtime

I wonder if nsjails or gVisor may be useful as well. Here's a more comprehensive list of sandboxing solutions: https://github.com/restyler/awesome-sandbox

Here's a list: https://github.com/dloss/binary-parsing

Great list! Will incorporate some of those into my list of tools for binary parsing: https://github.com/dloss/binary-parsing

Very nice! Added to my little list of log viewers at https://github.com/dloss/klp#alternative-tools

For example: No buffer overflows, null pointer exceptions, use-after-free, etc. On ARM and RISCV64 not even the C compiler has to be trusted, because functional correctness has been proven for the binary. And there are more proofs besides functional correctness. https://docs.sel4.systems/projects/sel4/frequently-asked-que...

Well, an L4 variant is used in iPhones: "The Secure Enclave Processor runs an Apple-customized version of the L4 microkernel." https://support.apple.com/de-at/guide/security/sec59b0b31ff/...

There's TinyTeX: https://yihui.org/tinytex/

Noir is a Domain Specific Language for SNARK proving systems. https://noir-lang.org/

A very easy way to find such "visual" collisions is described in section 4.2 of our drunken bishop paper: http://www.dirk-loss.de/sshvis/drunken_bishop.pdf

Other tools for parsing and analyzing binary data are listed here: https://github.com/dloss/binary-parsing

Two products for one-way data transfer, based on L4Re:

- https://www.genua.eu/it-security-solutions/data-diode-cyber-... - https://www.genua.eu/it-security-solutions/data-diode-vs-dio...

Disclaimer: I work for genua, the maker of these products.

To discover new podcasts, I often search on https://www.listennotes.com/ for episodes about people or topics I find interesting.

Instead of "hallucinating" I would have preferred the term "bullshitting" -- in the Harry G. Frankfurt sense of not caring about the truth of one's utterances. But it's too late for that.

https://link.springer.com/article/10.1007/s10676-024-09775-5

Related question: Which software do you recommend to sandbox a locally running AI agent, so that it can only access parts of the filesystem (e.g. one folder) and an allow-list of URLs?

Is this even faster? https://github.com/Vaibhavs10/insanely-fast-whisper

If so, is the quality still acceptable?

How small could this be if it was implemented on the SectorLambda VM (a sister project)? http://justine.lol/lambda/

I think Contiki had one. https://en.m.wikipedia.org/wiki/Contiki

Angle-grinder is really nice and the successor of sumoshell (by the same author).

I maintain a list of tools like these as part of the docs for my own tool klp (https://github.com/dloss/klp), which I think has a few useful features that are not in angle-grinder, but is orders of magnitude slower, because it's implemented in pure Python instead of Rust.

I wanted to write that TGI inference engine is not Open Source anymore, but they have reverted the license back to Apache 2.0 for the new version TGI v2.0: https://github.com/huggingface/text-generation-inference/rel...

Good news!

The above sans-io page links to this PyCon 2016 talk:

Cory Benfield - Building Protocol Libraries The Right Way https://youtu.be/7cC3_jGwl_U