high_byte

24 hours is better imo than am-pm.

I made an app widget to measure time in percentages instead of 24 hours

https://www.reddit.com/r/Time/comments/1ujj9py/comment/ov6qo...

this is definitely a backdoor, not necessarily that they use it to infiltrate users but definitely they put them at risk.

reminds me of a bug I found in some tplink router it compared passwords of 3 different users but that table was empty so basically 15 NULL bytes would log you in as admin lol

what if it contained a zero day for tesseract and the script you thought you got is just a throwaway

those spikes in march and june? war with iran. interesting...

my experience with ffmpeg scene detection is that it's flaky. it works, sometimes, but not reliable by any means

would be nice to be able to simply get the list instead of having an ominous heatmap

this was absolutely fascinating to read

that's sort of what skills are.

create a skill that transformed the json then "/<skill> <prompt>"

code is like assembly now.

in the olden days (pre-LLMs) we would write high-level code.

the entire layer was high-level code and rarely would we ever need to peak into the assembly:

writing, debugging, architecting, reviewing, testing - all were done in the high-level language layer.

---

welcome to present day:

since we don't write code - we write intents, we also shouldn't review code either - we should review intents.

I don't review my code anymore. I ask the agent to generate markdown docs, graphviz diagrams, changelogs, audit reports, etc. I only review that.

I also ask it to write test and evaluate by whether the tests passed or not. I don't need to peak into the tests code - I can also ask plain english, pseudocode, control flow graph, whatever it is I want.

I can ask it to find errors or missing tests and improve that too!

code is like assembly now.

rare are the cases you would need to peak into that level.

this is amazing exactly what I always wanted

how did this even get approved by app store? that's actually surprising

interesting attack vector

shame it's not a real device so the surface is limited to bash only

I wonder what software might be vulnerable to this attack surface

rick rubin says otherwise

of course

classic HN

I am the founder and ceo

"the code review: if you can’t review code, you can’t direct AI tools. You cannot lead a team. You cannot even trust your own work."

I would revise that a bit

since we don't write code, we write intents - we shouldn't review code either, we should review intents.

I don't review my code anymore. I ask the agent to generate markdown docs, graphviz diagrams, changelogs, audit reports, etc. I only review that.

I also ask it to write test and evaluate by whether the tests passed or not. I don't need to peak into the tests code - I can also ask plain english, pseudocode, control flow graph, whatever it is I want.

I can ask it to find errors or missing tests and improve that too!

so yea - code is like assembly now. rare are the cases you need to peak into that level.

even if the most powerful ai is open source and let's even assume runs on consumer hardware - in the end data is the real moat.

if it can access private data it will necessarily have more power.

honestly I don't think I've ever seen D codebases??

on the other hand steve jobs would've called Qt human-slop

guess it's a matter of taste

I am using cursor on auto and I got the exact same experience.

installed quartz, used accessibility and screen recording api, all that.

initially it managed to do it on another desktop space somehow, opening safari in the background without me even noticing. but then it actually started using my own mouse while I was using it lol

all this for 2%

you vill use ze ai und you vill love it

similar thing happened to me. I'm not a heavy aws user but wanted to setup some s3 buckets few days ago but my account was suspended for the same reason

but unlike OP I just accepted this fate and moved away from aws :)

you could start by writing more about yourself than just the title

alternative title: 1/3 gambling ads now target women, massive increase

this is exactly the kind of vibe coding horror stories I asked for just few days ago :)

https://news.ycombinator.com/item?id=47707681

did you report this?

"The correct answer: not currently vulnerable, but the code is fragile and one refactor away from being exploitable."

absolutely. I see this pattern all the time when doing security audits - code that is nearly-vulnerable. I would mark these things as informational and recommend to harden them anyway, and any model would do a good job to do the same.

specifically procmon will probably be what you want

sysinternals