mr_mitm

Next up: "I didn't do a statistical analysis but the sample size seems small"

And here I thought using open source client software is the only way I, the user, can guarantee E2EE of my data.

> NONE of my agents have broken away from their tasks and then started to communicate to try to hack something.

With all due respect, you also aren't evaluating brand new models that haven't been released.

Go creates `~/go` by default. It's not even hidden. Unfortunately, saying it's not really used that much doesn't help with this.

Surely e-mail is even more widely used?

My impression is that it's the NodeJS, Go and Rust communities that don't care about XDG.

This 11 year old, open issue is very symptomatic of this IMHO: https://github.com/rust-lang/cargo/issues/1734

True, I guess you might as well evaluate each vulnerability yourself without the CVSS base score.

> - Firstly, you quickly realise how irrelevant CVSS scores are

Even if you factor in the environmental score? I realize it's a lot more work, but it basically allows you to tune the score to get any value you want.

Here is a recent example. Currently unpatched in Debian stable.

https://www.cve.org/CVERecord?id=CVE-2026-60002

As I understood this, a malicious server can change its host key somewhere during key exchange and trigger a use-after-free in the client, which might be exploitable for code execution.

Have you ever tested this on a real corporate network?

Yes

Just FYI, it says "lack", not "luck"

I, a German, went to Switzerland for vacation once. I talked to a Swiss guy about how I like Switzerland and all that. I told him how impressed I was with how organized everything is and how well everything works. The train system and public transport in general is wonderful compared to the one we have in Germany, for example. To my surprise, he said something along the line of "yeah well, it only looks like that from the outside".

Perhaps the tendency to complain is a necessity to achieve a high level of efficiency.

The way I read the article was that cancer is caused by deficiencies in the body's repair mechanism. It appears as if some have a more robust mechanism than others, depending on genetics.

It's a zero day in some caching proxy who may not have had that threat model in mind. I guess its primary purpose is caching packages, not restricting internet access.

That's a far cry from finding a zero day in a hypervisor or even Docker, which OpenAI conveniently left out in their first statement by simply calling it a "sandbox".

I hate the BOM so much. It causes so many subtle issues and I don't even understand why it's needed.

Is teens ordering wine a big issue in the US? Bigger than social media?

I wish my team would at least use the rebase merge strategy by default to avoid branch graphs looking like the London tube network. Not in 10 years did I have an issue with that (okay, except accidentally rebasing deliberate no-ff merges).

The one time I suggested that, someone immediately came up to me trying to convince me that rebases are the most dangerous thing ever.

I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.

I take it you aren't programming business CRUD apps? I almost never have to do any math. It would be a delight if I did.

Is pangram using knowledge about specific models? Could you throw it off by having several models generate a paragraph each or so?

It is also built on the assumption that filenames never contain newlines, which is wrong in general.

It's baffling to me that POSIX allows non-printable characters in file names, but here we are. Surely they had a reason for this decision.

The next known black hole is tens of thousands of light years away. Also, the universe does not seem to be inside a black hole.

Note that you can't use these lasers to slow down the probe, which will dramatically limit the things the probe can do at the destination. I'm not even sure what kind of interesting things a probe the size of a smartphone could do, let alone phone home.

My point is that you cannot know that AI generated text is obviously AI generated. It's like the old "hair pieces look awful, I can tell immediately!" - no, you can only tell when they're awful. Maybe you're not as good as you think at detecting AI.

How do you estimate your false negative rate?

Maybe the PowerShell folks were onto something when they implemented seven different output streams [1]. But then again most users are utterly confused by this and just dump everything to the information stream when they should be using the output stream, making their code near impossible to reuse in an idiomatic way.

[1] https://learn.microsoft.com/en-us/powershell/module/microsof...

And the OS will never background the browser for battery optimization reasons? Genuine question, I'm not an expert on mobile OSs (as you already guessed).

Everyone but me!

Wireguard by itself also doesn't allow for 2FA or expiring keys. Not as relevant for private use, but some orgs need it for compliance. The idea was always that things like that need to be implemented by an application on top of it, so you end up with something like tailscale eventually.