xx_ns

I meant more like installing LineageOS (which exists for most of the devices that PixelOS is ported for) and managing Google apps yourself - whether just installing a regular minimal GApps, or using MicroG. PixelOS is like a "give me Google everything" nuclear option.

It's always surprising how many people who like to tinker with their devices also deliberately want to tie themselves more into the Google ecosystem. I would've guessed that the Venn diagram of these two types of people wouldn't have much overlap, but the ROM's popularity kind of speaks for itself.

They basically asked me if I want them to go digging through their trash because they had accidentally thrown it out just shortly before handing the car over. I said that it's no worries and I'll figure it out. Just didn't expect that this would be the way I'd do it.

Yeah, I'll keep working on this to get it to do more stuff that's at least a little bit more useful, if not just a better UI that isn't 90% a useless "No maps found" screen. It's more complicated than it might initially seem because they actually have a kernel module blocking me from mounting non-signed partitions as exec, so I'll need to work around that.

I'll probably post a follow up if I get anywhere with this!

Yep. I didn't get into it in the article, but in reality the previous owner had already (accidentally) thrown the SD card in the trash, and was pretty much asking me if they want me for them to go digging through their trash to find it, and I told them not to worry about it.

Thanks for clarifying!

I assumed they meant "also" as in "besides Cursor marketplace", which seems to be the highlight of the article. Although you raise a valid point and I've edited the parent comment.

I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.

EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.

EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:

> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.

[1]: https://code.visualstudio.com/api/working-with-extensions/pu...

While I don't disagree with you in principle, the context for JS JIT vulns and potential Python JIT vulns is pretty different and worth taking into consideration.

For JS, your machine running untrusted JS code is the intended use case. In this scenario the JS is sandboxed in whatever JS engine (V8 etc) and does not have access to "dangerous" methods, and the main use case for a JIT vuln is to escape this sandbox to execute code on the host. This applies to regular internet browsing (and visiting potentially malicious sites) and also, e.g., using the built-in browser in a locked down device (such as game consoles) to gain arbitrary code execution.

For Python, this security boundary doesn't exist. I can't really think of a scenario where you would be running potentially malicious Python code in CPython that would need a JIT vuln to escape whatever sandbox it is in instead of, say, calling the functions in Python directly (or using the C FFI to do whatever). I'm sure that in some niche use cases, this scenario might exist, but to me, it seems like the potential attack surface is fairly minimal.

EDIT: Also, I'm pretty sure that Python's copy-and-patch JIT writes code to a writable mapping and then mprotects it to W^X? I don't think it leaves RWX pages lying around at all.

"No successful PHP2Shell exploits seen so far"... in the wild, specifically in Wiz's honeypot. The vulnerability itself has been successfully exploited, most notably for the "Steal my Bitcoin" challenge [1] as one example.

Dan Guido, of Trail of Bits, claims they have an "universal" exploit [2]. Knowing their track record, I don't currently have a reason to doubt this claim.

[1]: https://stealmybitcoin.com/

[2]: https://news.ycombinator.com/item?id=50226010

EDIT: The HN title has been changed since posting this comment.

It's unfortunate that a technically exciting new feature is being killed partly because of what is essentially bureaucracy (and the lack of the developer's personal bandwidth). On the other hand, it's pretty safe to say that the strict adherence to the PEP policy and all of the bureaucracy that comes with it is what makes Python a great language, for better or worse.

Not to say that the technical objections were without merit, they likely very much weren't, and the debugger and instrumentation support and maintenance work sounds fairly painful on its own.

> given it's vibecoded

Why is this a given? This service has been around for longer than LLMs have been a thing.

Interestingly, they added the `preinstall` key (that is supposed to run the malicious script when installed) under the package.json root, and not under `scripts`, so from what I can tell this wouldn't run on install.

Otherwise, yeah, this seems like a stage-1 loader for fetching and running a payload off the Ethereum mainnet.

It's exciting to see JXL support being re-added in Chrome after being removed a while ago and them seemingly not being interested in supporting it [1].

I think JXL is a cool image format, but was being held back by the most popular browser not supporting it, limiting its use (in the web especially) by a lot.

[1]: https://issues.chromium.org/issues/40270698

I posted a write-up here: https://blog.nns.ee/2026/08/26/project-zomboid-vulns/

They were very fast to patch it. The patch actually removed loadstring (among the other fixes), which broke a bunch of mods for a while. The vulns themselves could also theoretically be abused by malicious mods, which unfortunately seems to be more commonplace these days.

Very good write up! Kudos.

I recently wrote about an RCE exploit in the game Project Zomboid (which uses Lua for mods), which also used loadstring as an initial entry point for the exploit chain, but since the Lua interpreter was fully Java, byte-code memory manipulation shenanigans were out of the question for me and I had to pivot in a more traditional way.

The fact that loadstring can also load straight up bytecode was news to me though, that's interesting to know.

This is a really cool project! A mini cyberdeck that doesn't seem too impractical to use. Repurposing the Clicks keyboard is a genius idea.

I find a lot of LLM articles to be hard to read, but since this one was pretty "straight to the point", I found it to be okay and got the important information across.

The title "The Linux reality check" made me groan, though. LLMs (Claude?) seem to love this phrase.

It makes sense. The chess piece is the first profile picture in the list.

IDEs, static linters, and syntax highlighters aren't designed to replace any part of the problem solving process, but rather augment them. It's impossible to become dependent on any of these tools to the point where your cognitive skills begin to atrophy, unlike LLMs [1].

IDEs, static linters, and syntax highlighters aren't the cause of a global microchip shortage, immensely increased energy demand, or the destruction of rare works. They have not, at any point, been the cause of effectively DDoS attacks in an effort to slurp up all of the internet's data, or the extensive proliferation of hallucinated content on the internet.

The development of IDEs, static linters, and syntax highlighters has at no point employed low-paid labor from third world countries for data labelling or safety filtering, exposing thousands of people to violent and abusive content for multiple hours a day.

Any of these issues alone would be a reasonable cause for adopting a policy to avoid using such tools. Calling it equivalent to not using IDEs or linters is bizarre to me.

* [1]: https://www.media.mit.edu/publications/your-brain-on-chatgpt...

That's not my experience at all. I was approved fairly fast - around an hour from submitting the form and getting a response.

However, even being in the cybersecurity programme, Fable refuses to answer prompts that it determines could be even tangentially related to cybersecurity. In fact, for a while, I was unable to use Fable with any prompt, as it recalled from memory that I was a cybersecurity professional, which triggered the refusal even for simple prompts like asking for a chili recipe.

Both projects have the same author.

I got the same vibe from

> These are asciinema recordings of real terminal sessions, rendered as text rather than video. Playback caps idle pauses at two seconds and changes nothing else.

Thanks? This sounds like it's the LLM's response to the prompter, not something you should display on the page itself...

I think this is a slightly different problem. The absence of an optional field, if that's a legal state, is meaningful every time you use the type, so you encode it on the field: `phone: ValidPhoneNumber | null`. When it's not null you're still guaranteed a valid phone number. When it is null, that's a legal state you have to handle and which is domain logic, not validation you forgot to do.

The combinatorial explosion you're picturing only shows up if you make a separate type per combination of present fields, but you don't need to. An independent optional field stays one `T | null`. You only reach for distinct types when fields are correlated and present together because they represent a state, and then it's a discriminated union on a status field, which is N states, not 2^N.

This campaign is still ongoing. I just got an email that one of my old packages (which hasn't worked for years and was orphaned for a while) was adopted and immediately a malicious commit was pushed. They seem to be using bun instead of npm now, so any npm-based workaround likely isn't effective.

https://aur.archlinux.org/cgit/aur.git/commit/?h=toggldeskto...

That would've been a cool PoC to work on as well, but seems a fair bit more complicated than the BadUSB-style attack I ended up doing. Would've had to do a lot more RE to figure out how to interact with the whole microphone subsystem, I think.

> A probe packet contains the MAC address as well as the list of all the past Wi-fi networks that your device has tried to join before, which can reveal a lot about you!

Generally, most modern devices send broadcast/wildcard probes precisely to avoid leaking the PNL. From what I know, directed probes are only sent for hidden APs.

From personal experience, there have been a few papercuts (mostly trying to figure out why runners aren't picking up jobs), but it isn't too hard to debug and the CI format is simple. When it works, it works well enough. It uses a similar workflow as GitHub actions. Some, but not all, actions are even interchangeable or at least portable from GitHub without much fuss.

I'm not from the US, so I hope you excuse my ignorance, but who exactly voted for mass surveillance or AI cameras?

I wish my city only had a single case like that. Unfortunately, in Tallinn, it is extremely common that a bike path is suddenly routed onto the curb, and that's when you're lucky. For some paths, the path just... ends, and you suddenly find yourself right in the middle of car traffic. Unfortunately, the city leadership is anti-bike and pro-car, and it shows in the infrastructure.

Paths where pedestrians and bikers (and other light transportation vehicles) are mixed are overwhelmingly common.