zero_k

I'd love to have one that randomly fails, so we could debug e.g. databases and other apps that are supposed to be resilient. I'd call it "havocfs". Doesn't corrupt data, just randomly fails reads/writes/etc. Some software is supposed to handle that gracefully. Would be a great test tool...

I feel the pain. We have been delaying release because sooo many bug reports have come in. AI is finding a lot of obscure, and interesting, and annoying bugs.

Thanks, I tried :)

LOL I love this and also hate it. You are the best and also the worst. I am actually laughing :D Who cares about deepening our understanding? Curiosity? Hoping to understand some deeper connections/meaning? Let the AI write 10 papers to top conferences per year, and be done with it. If this is what people think science is, that's what we should do. Incentives -> outcomes, in the purest form. Loving it. And hating it!

Yes, the proxy (here, papers & citations) becomes the goal, and so we end up in strange places :(

Fair, but I just don't know how to fix it. Eventually, whatever metric you come up with, it will be gamed -- p-hacked, if you will. Not sure what the solution is. I am just dissatisfied with whatever is going on, and I felt like sharing it. Maybe you have some good ideas? It'd be nice to fix this...

I'm sad to hear that. I know of a PhD student who confided in me that his professor didn't believe his suspicion that the results of a well-known, supposedly top tool, are wrong. According to his view, not being able to replicate or improve that tool has prevented him from being allowed to graduate. While I cannot confirm this, I suspect there to be a grain of truth in the story. The results are indeed wrong, but I suspect the results are too big to fall -- too many people made too many mistakes (reviewers, editors, awards committees, hiring committees, etc.). It's sad.

It's a fine line. Fraud? No, they are just sloppy, and so one questions whether they ought to be amended, retracted, or a note by the editor attached. The solution you propose, about a follow-up paper is that who will accept a paper that simply demonstrates that the original work was so full of bugs/issues/misconceptions, that many/most of the claims of the paper don't hold? Would you accept that paper into a top-rated conference? And if it's in a 2nd or 3rd rate conference, wouldn't most people question it authenticity (remember, 2nd and 3rd rate conferences have less rigor in reviews) or simply not hear about it? I think these are legitimate concerns.

A slightly sad side-effect of the follow-up-paper idea, is that it sometimes means that the authors get one more citation, and furthermore, since some of the authors may themselves write part of it, it would mean even more papers by the authors, potentially further cited. So we may be unfortunately incentivizing sloppy research -- the authors can now make two papers: one sloppy, and one fixed. Not sure that's great.

I am not saying what you are proposing is wrong. But it has side-effects that are not great.

If you are interested in the original, high-quality article: https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...

Only in case you are interested in the original source, of course. If you like the copywrited version of it, you can go to techdirt :)

Lol in Germany, internet is soooo slowwwwwwww. I used to live in France, and Free (i.e. free.fr = kind of a bad choice of name) was absolutely demolishing the local big carrier (France Telecom?), but in Germany, there is very little competition to Telekom, so it's really bad.

This is very important work. If it interests you, and you want to dig further, it's broadly called "Safety II". You probably want to read Erik Hollnagel [1] or Sydney Dekker. I put together a presentation once about how this translates to IT security [2]. But broadly:

Safety I Learn from Errors, Safety defined by absence,Reactive approach, Understanding what goes wrong, Accident causation models, Avoidance of errors, Reducing losses

Safety II Learn from successes, Safety defined by presence, Proactive approach, Understanding what goes right, Repeat what goes right, Enforce successful behaviours, Create new processes based on successful behaviour

If anything, think long and hard about this: "Post-accident attribution to a ‘root cause’ is fundamentally wrong." It's a true statement. If you truly understand this sentence, you have mastered Safety II to the level that a light bulb will come on, and you won't be able to un-see it. This light bulb is a curse, a beautiful curse.

[1] https://safety4sea.com/cm-safety-i-vs-safety-ii-an-overview [2] https://www.msoos.org/largefiles/safety2.pdf

Markus Anders, who wrote the symmetry breaking system (satsuma) they use for SAT is pretty much a genius. His version of Kissat won the SAT Competition this year, with satsuma of course:

https://satcompetition.github.io/2026/downloads/satcomp26sli...

See slide 18. It was really nice to see him win. I have always been a huge fan of symmetry breaking, CryptoMiniSat (that I develop) had a symmetry breaking system, BreakID (which is _way_ slower than Markus' satsuma), in it for many years now.

Build walkable cities instead. Stop car-brain-rot. Your cities could be beautiful, full of life and children running around and having fun. Walking, cycling, and taking public transport, brings life to a city. It allows random connections and makes you see "the other". It could significantly improve your quality of life. Open up your eyes, there's a whole beautiful world out there.

Wow, so true! Domain expertise is apparently not a requirement. At all. Wow.

It's crazy I am being downvoted, though. Like, I am complaining about their processes that failed, and people are somehow on GitHub's side. Really weird stuff.

Nobody at GitHub expected this? Their feature develoment&release processes must be garbage/non-existent/not followed. This potential security issue should have been flagged when the new feature was thought up, security should have been part of the process of implementing the feature giving continuous feedback, and it should have been tested for before release of the feature. That's how modern security teams work in large, well-functioning organisations.

What is going on over there? No process, no oversight, just YOLO? Super-scary, because it means other stuff that we don't see is likely to be done in a similar manner.

My friend bought an apartment. In February. Still in processing at the Amt (bureau). It's nightmare fuel. They are sending physical letters, and are hand-matching payments from banks. Apparently, they couldn't match a 53 EUR transfer last week, so a ~400k EUR payment is stalling.

The issue is, the people holding the stamps (and believe me, they ARE stamps, with ink and all) are in charge, and are VERY reluctant to give up that comfy job. Zero accountability, too, since once you are a government employee, it's incredibly hard to get fired. So they stall the process, forever, without any reprecussions.

I am all for having and caring about process and dealing with everyone equally. That's why I live in Germany and not in Eastern Europe where often some money under the table is the only oil in the machine. No such oil in the German machine, thankfully. But it's infuriatingly slow, because bureaucrats are in control and will never willing give up that control.

Citation needed :) That's a bold claim. May be true, but it's a bold one, so something backing it up would be nice.

Data Protection Authority (DPA) should investigate. In Germany, the company's DPO (Data Protection Officer) has personal, criminal liability. For these cases, I'd like to see them in front of criminal court, and see what happens. I wanna see someone having a criminal record for this, and then all the stupid excuses of large companies about "I didn't know" and "I thought lalalala" will stop rather quickly. It will turn out that, at the end of the day, it was just a resource issue. And when criminal liability is on the table, resources magically... appear.

It's time to be serious about this. Unacceptable.

I'll steal your ZD-8965 recommendation :) Thanks!

You don't need $300 gear to do Level 2. A lot of people who are pretty up there the "pro" scale use something similar to a FNIRSI DWS-200 200W, which I bought for $90, with shipping. It comes with 8 tips, and is extremely tight, supports fast tip switching, very fast heating (auto-spleep, etc), very nice interface, short tip, etc. Yes, the tip is not well-calibrated temp wise, but you can get a non-certified calibrator for $15. I work on RC planes and associated flight controllers with it all day long. The annoyingly expensive area is the hot air station, actually, but that's really a bit "out there" -- the cheap(er) copies don't yet exist, so it's still on the expensive side. A good hot air station is where it's more like lev 2.5 -- with it, you can do HDMI/USB port changes reliably, and in seconds. The BGA etc. is lev 3.

Beyond the soldering iron, my recommendations that are not too obvious at first sight:

* solder paste (verrrry useful, just get it, and use it)

* something to purify air that _pulls_ it (a reverse fan) with a carbon filter (~30 USD)

* magnifying glass, hopefully attached to a ring of LEDs + a stand so you can see what you are doing (30-60 USD)

* solder sucker, hopefully automated (5 USD non-automated, 80 USD+ automated)

It essentially already has one. Probably only self-levelling, but has some extra programming like delayed flaps, wheel-up sequence (first up the wheels, then close the doors), blackbox feature, etc. Likely using a version of Ardupilot [1] that's already in use by everyone. Maybe INav [2], but I'd wager on the former. There's more than one computer in there, too. The receiver is likely double-redundant (2 receivers, each with 2 separate receiver circuits, one 900MHz, the other 2.4GHz). I have planes costing 400 EUR that have dual-bandwidth redundant receivers (costs 40 EUR, a joke).

ELRS (radio), Ardupilot (Flight Controller), EdgeTX (Radio OS), and Mission Control (Ground Station SW) are serious tools used by many in the hobby. Them being open means there's a lot of competition and a lot of features. But also not amazing UX :)

[1] https://ardupilot.org/ [2] https://inavflight.github.io/

If they want "eco progress" they should make their devices repairable.

Reduce, Reuse, Recycle. *In that priority*

Reduce & Reuse by making it repairable!

See: https://www.epa.gov/recycle

Yes, agree. At the same time, it's what these top-tier universities are known for: presenting something relatively simple as if it was ground-breaking, but in a way that the average person can (or has a better chance to) understand it. I am still unsure whether the communication quality has such added value. But people seem to like it, so here we are.

Code & Readme: https://github.com/meelgroup/ganak/

It's not only about the token cost! It's also my TIME cost! Much-much more expensive than tokens, it turns out ;)

Honestly, the more research papers I read, the more I am suspicious. This "surprisingly" and other hyperbole is just to make reviewers think the authors actually did something interesting/exciting. But the more "surprises" there are in a paper, the more I am suspicious of it. Often such hyperbole ought to be at best ignored, at worst the exact opposite needs to be examined.

It seems like the best students/people eventually end up doing CS research in their spare time while working as engineers. This is not the case for many other disciplines, where you need e.g. a lab to do research. But in CS, you can just do it from your basement, all you need is a laptop.

I still remember the time when a gcc bug caused MiniSat to output UNSAT for a satisfiable problem [1]. I was the author of a SAT solver, and I was chasing my tail trying to figure out why I was getting UNSAT for a satsifiable problem. I have to admit I didn't expect it to be a gcc bug... (note: bug was found by Vegard Nossum on the CryptoMiniSat mailing list)

[1] https://www.msoos.org/2013/04/gcc-4-5-2-at-sat-competition-2...

I worked at a company that wanted to implement an AI chatbot. I was helping to review the potential issues. On the first try I realised it was given full access to all past orders, for all customers via an API it could query in the background. So I could cajole it to look up other people's orders. It took less than 3 minutes of checking to figure this out.

Often engineers and especially non-technical people don't have the immediate thought of "let's see how I can exploit this" or if they do, they don't have the expertise to exploit it enough to see the issue(s). This is why companies have processes where all serious external changes need to go through a set of checks, in particular, by the IT security department. Yes, it's tedious and annoying, but it saves you from public blunders.

Such processes also make sure that the IT security department knows of the new feature, and can give guidance and help to the engineers about IT security issues related to the new feature. So if they get feedback about security issues from users they won't freak out and know who to contact for support. This way, things like accusing the reporter for "blackmailing" don't happen.

In general, this fiasco seems to show that Eurostar haven't integrated their IT security department into their processes. If there was trust and understanding among the engineers about what the IT department does, they would have (1) likely not released the tool with such issues and (2) would have known how to react when they got feedback from security researchers.

Honestly US standards can go to hell. I absolutely abhor these monstrosities. They should be outright banned except if specific need can be shown. They are dangerous, take up way too much space, and excessively damage the road.

Your freedom to do stuff stops where my freedom to walk & cycle around without undue fear of death begins.