milkshakes

not sure why this was flagged, it's completely on point.

> It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

i agree with you!

nevertheless,

> where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment

not sure what sort of comprehensive assessment is still called for at this point?

this is a really bad look in 2026 imo

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-fo...

> We have not requested CVE identifiers in Ruby for these fixes, at least for now.

> Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for CVE-2022-28738, where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for CVE-2024-27282.

also it was under hn load which makes this much harder

what exactly is this testing or proving? do you even have session support enabled? https://news.ycombinator.com/item?id=50234093

this take will not age well.

consider where "AI" was just two years ago, pre claude and codex. what do you think the next two years will bring?

fair

really?

1. there's no actual evidence that the key to the wallet is on this machine at all. it would be trivial to add a service that would sign challenges to prove so

2. a working RCE against PHP is worth much more than $1000, attacking this machine would easily burn that

> created: 54 days ago

lol.

> I wouldn't be surprised

yeah i am not surprised you're not surprised. you seem to have already made up your mind. that said, every single guess you have made here is completely incorrect and not based in facts at all.

literally you have no idea what you're talking about! but don't let that stop you from having an opinion

what makes you so sure these would be publicized? what incentive does an adversary have to be loud about it?

with more productive teams you can have smaller teams and better communication

it sounds like leverage

as a solo: you can build and ship more in your own time

as a startup: you can iterate and scale more with more velocity and less growing pains

as an enterprise: people with ideas but not a technical background can put their tokens where their mouth is and build their own interfaces, personal apps, ask their own questions, ship their own features without having to navigate layer 8 and play games for resources

"AI" -- as in agentic workflows -- have been around for a little over a year. it doesn't seem like enough time to "prove" anything conclusively to me, what makes you so confident?

> Turns out, a lot of people didn't really do things in the open to benefit the others, in pay-it-forward style. They just did it for selfish gains. Which is fine, just like keeping source closed and selling licenses is fine. The problem is with lying - doing something for personal gain, while claiming it's for greater good, thus getting more gains through dishonesty.

> There are other reasons to dislike LLMs and fear or hate what AI is doing to the world. But people who feel something was "stolen" from them, who now close their blogs and turns repos private because LLMs - they're just showing they had ulterior motives for their work - which again, is fine if they were up-front about it. The OSS subset of those, just paint themselves as being grifters all along.

thank you for putting such clear words to a feeling that's been troubling me about this outrage for a long time.

see https://en.wikipedia.org/wiki/XKeyscore for the sota from 20 years ago

if your threat model includes the NSA i don't think your choice of CDN is going to make a difference

i predict this perspective will not age well at all

i am a big fan of llms and the possibilities they enable. but i also find this type of behavior extremely rude! ai;dr for life. :is-your-human-around: is my preferred emoji for reacting to such behavior

i'm not blaming all problems here, i'm blaming the allocation of surplus. it does seem at least at surface level that this is driven by capitalism?

> The problem is not that AI is evil, but most of the people would have to learn new skills and adapt because the profession or job they trained at college doesn't exists anymore.

isn't the problem then capitalism? the promise of AI is to deliver efficiencies, leverage, and consequent surplus. AI does not itself allocate the surplus.

> data centers are purely extractive

please, tell me more

> people in the community, or at least in the surrounding area, will play golf there

going to go out on a limb here and guess that net-net, a datacenter provides more benefits to a broader spectrum of society than a golf course does.

brace yourself

which of these do you represent?

if a teenager did this, the police would show up, but in the end the feds or ic would intervene and recruit him

justice for who exactly?

lol

inference is the cheap part; training is expensive. what compute infrastructure would train this mythical magic model?

see: https://en.wikipedia.org/wiki/Pharmacy_benefit_management

lately, i like to try to spend the morning talking through and framing up a few very detailed initiatives for parallel efforts that each spawn and orchestrate their own tasks, then feed them to /goals and go for a nice walk in the park, get some groceries, check in on the orchestrators and spawned tasks along the way, steer them from the phone.

so far it's been working pretty well for me in most cases, but not always. having a few parallel efforts in motion means that even if one goes off the rails, i can pause it and still make progress on the others, then fix it up when i get home.