progval

Didn't work last time https://www.theguardian.com/uk-news/2020/nov/06/companies-ho...

These? https://nitter.net/VictorTaelin/status/2043810543035920672 / https://nitter.net/VictorTaelin/status/2059327831679578511

Are there estimates of their failure rate?

According to https://bugzilla.mozilla.org/show_bug.cgi?id=1950764#c23 , it is not getting fixed.

Microsoft has you covered: https://notes.zachmanson.com/copilot-edited-an-ad-into-my-pr... / https://news.ycombinator.com/item?id=47570269

It even includes email providers with a spam filter.

They don't have to publish a working exploit as soon as the embargo is broken, though.

"sudo" in "sudo echo 3 > /prox/sys/vm/drop_caches" does not do anything because only runs echo, not the write.

And if a machine is already exploited, it's too late to do just that. You need to rebuild the whole disk image because anything on it could be compromised.

There is no evidence it is actually coming from Meta. The Reddit researcher the article cites generated their entire "analysis" in three days using Claude: https://news.ycombinator.com/item?id=47659552

Their website also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is under "surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This shows how low their standards are.

Common enough that Mozilla has full-time engineers working on triaging compatibility issues, so they can either be fixed in Firefox or reported to webmasters. Here are the reports they get: https://webcompat.com/issues

Some of them will be paid by subscription and have ads

> pause OSS contribution and usage

What do you mean by that? They can't possibly stop using Linux/Kubernetes/Chrome (including Edge)/almost all programming languages/nginx/...

Ah indeed, it can be used to overwrite the page cache for files on read-only volumes.

Yes. Alpine in rootless Podman doesn't work (after replacing "/usr/bin/su" with "/bin/su" in the .py, running the .py just doesn't do anything) while it does in Debian in rootless Podman on the same host.

So this replaces a SUID binary, in order to run as PID 0. The website claims it can escape "Kubernetes / container clusters" and "CI runners & build farms" but I don't see anything supporting the claim it can escape a container (or specifically, a user namespace).

I ran the exploit in rootless Podman, and predictably it doesn't escape the container.

They also claim their script "roots every Linux distribution shipped since 2017.", but only tested four; and it doesn't work on Alpine

The binary "zip" isn't the exploit, it's the shellcode. The exploit is the rest, which changes the code of a SUID executable (su).

> make a WASM slave and thousands of developers can give their CPU/Memory/Disk for build slaves

WASM isn't a magic bullet for sandboxing. CI environments assume a full Linux. So you need to either ran a VM (with the attack surface that implies) or a write an x86 emulator in WASM (which would be very slow).

You also need anti-abuse to stop bitcoin miners from using your system. GitHub probably have full-time employees working on it.

> Like bitcoin mining, there could be some competition between 3 parallel builds to pick the winner if the output is the same.

It's a lot more complicated because many builds are not deterministic, you need to store artefacts, build secrets, etc.

Companies like golem.network or iex.ec have been working on this problem for a decade and they are still not easy to use.

Use a package repository that fast-tracks security updates, like Debian Stable.

> I'm tired of having to connect on EDF' shitty website to get a new PDF every three months.

It doesn't look like this app can generate "justificatifs de domicile", only substitutes for an identity card or passport.

> Why do the put three stats about trains on your linked page?!

I was wondering about that too

It looked great and I wanted to try it, but it doesn't work on the web and my smartphone is rejected with no clear explanation ("missing some security mechanisms"); probably because I'm running LineageOS with MicroG.

Because no one makes larger LPCAMM2 modules. But Framework's CEO says he expects higher density modules in the future: https://youtu.be/GnOpIQJnYWU?si=UBMfW7SsiNjwJ1fo&t=292

Because a comment that just says it's AI generated provides no value to the readers. They could at least provide an alternative link like you did.

I typoed the second link and can't edit anymore. Correct one: https://web.archive.org/web/20260411112604/https://tboteproj...

So it lets them know for sure who is a child. What liability does that shield them from, and how?

How does that help Facebook? They already have plenty of signals to guess their users' age, what would they do with an other one? They are not going to ban children anyway.

The investigation you linked to is entirely hallucinated by LLMs: https://news.ycombinator.com/item?id=47659552 (tboteproject and the "Reddit researcher" are the same person).

They also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is "under surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This really shows how low their standards are.

It's still pretty far physically accurate because there is infinite acceleration the moment a ship reaches the target orbit.

I wish people would stop sharing this website, their research is massively written by LLMs and looks good at a glance, but it goes in every direction at the same time and lacks logical connections. And the claims don't really match their sources.

Their initial publication was backed by a Git repository with hundreds of pages of documents written in just three days (https://web.archive.org/web/20260314224623/https://tboteproj...). It also contained nonsense like an "anomaly report" with recommendations from the LLM agent to itself, which covers an analysis of contributors to Linux's BPF, Android's Gerrit, and parser errors in using legislative databases. https://web.archive.org/web/20260314103202/https://tboteproj... . The repository was rewritten since, though.

This post follows their usual pattern. The second source they link to has been a dead link for 11 months (https://web.archive.org/web/20250501000000*/https://www.pala...). There's a lot about Persona's design, MCPs, vulnerabilities, data leaks, but nothing proving they use it for mass surveillance. The entire case for it being mass surveillance rests on two points: that they interact with AI companies and they offer MCP endpoints (section titled "Persona's Surveillance Architecture")

Can you be more specific?

Linux supports it too through madvise():

       MADV_FREE (since Linux 4.5)
              The application no longer requires the pages in the range
              specified by addr and size.  The kernel can thus free these
              pages, but the freeing could be delayed until memory
              pressure occurs.

and

       MADV_DONTNEED
              Do not expect access in the near future.  (For the time
              being, the application is finished with the given range, so
              the kernel can free resources associated with it.)

              After a successful MADV_DONTNEED operation, the semantics
              of memory access in the specified region are changed:
              subsequent accesses of pages in the range will succeed, but
              will result in either repopulating the memory contents from
              the up-to-date contents of the underlying mapped file (for
              shared file mappings, shared anonymous mappings, and shmem-
              based techniques such as System V shared memory segments)
              or zero-fill-on-demand pages for anonymous private
              mappings.

Does Chrome use it, though?