I guess the year mark is when things go from bad to worse? Instead of the financially motivated groups currently doing their work, it ends up being random people being able to say "Hack my ex's website" to a box they just bought and ran a program they downloaded onto it.

I wish people would stop using internet for evil things. But maybe it is inevitable. Luckily, as the technology evolves, our tools and awareness are getting better at protecting us every day.

Personally I wouldn't be writing an open letter to what is effectively a bunch of spam bots. I don't think they'll read it, or care.

Ridiculous conclusion.

That would be the opinionated part of the opinionated software.

So if some company donated to the Python Software Foundation during during Guidos rein as BDFL, would it be fair to characterize that as "That is a contribution to an individual"?

Was Guido designing Python for only his own sake, during his time as BDFL? As far as I know, he was not doing that.

Additionally, Guido never had exclusive control over the Python Software Foundation, from what I can see.

If Guido was the only person responsible for the Python Software Foundation, its only board member, its only share holder that the board is responsible to, and was designing Python for the use-case of a single person, himself, and he was soliciting donations, then yes I would consider those donations to effectively be a contribution to an individual. Of course I would.

As far as I know, only Motorola is given access to the driver source code for all the chips, which then as part of using it, they are obligated to release it, which then GrapheneOS can then access and use it.

As a result, Motorola's software support is just as important as Motorola's hardware

We won't have to depend on Motorola's public OS releases for access to the firmware and drivers as we do for Pixels. We'll also have access to a lot more than what's mandatory to provide due to GPLv2.

Oh that is very exciting to hear!

For those with difficulty accessing:

- - -

From: Anthony Hurtado <[redacted since hn has no scrape protection]>

vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero.

While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, causing SIGFPE.

Fix by:

- Checking nb_channels != 0 before division in vpk_read_packet

- Returning EOF for empty last blocks (last_block_size == 0)

- Validating block_count > 0 in vpk_read_header

- Validating last_block_size <= block_align in vpk_read_header

Found by fuzzing with libFuzzer + AddressSanitizer. Reproduces with 10 distinct inputs.

[patch redacted for brevity]

Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…

It keeps casual users (which most bots masquerade as) out. For frequent users of that site it is a solve once access forever.

I don't get it, it briefly flashed up on my iphone , about quarter second maybe, then passed on. Does the same in private mode.

Maybe it uses other heuristics like detecting if someone lives in the AI agent world

Took like 2.5-3 minutes on my regular desktop browser. Nothing AI related

Damn, I've never seen Anubis set up that aggressively, I wonder what kind of attack their web servers must be under to set their bot filters up this strictly.

There is training systems and validation of skills in mturk iirc: for tshirt folding, you'd be given fake setups to be able to get used to controlling the robot, if you can't do it, you won't ever get assignments to do it. For traffic overrides, you'd be tested on having correct knowledge, and once again given supervised tasks to show you can actually be trusted (and there would be safety systems, elevating tasks that can't be performed at your level to people who can, etc)

The worker needs to do a bunch to opt into any given work group, which makes the (lack of) payments extremely unreasonable on top of everything else

> but rather that we need to focus on finding and fixing vulnerabilities and misconfigurations in these environments.

And how long will that take? It's already well past due.

> And how long will that take? It's already well past due.

Probably not anytime soon, and it's getting worse: every AI-pilled CxO is horny for AI-boosted velocity - instead of security. Expect more bugs shipped, based on just the volume AI enables.

Protocol Labs owned significant parts of the infrastructure. Regardless of community support, PL leaving would always be damaging.

Kubo, Helia, Boxo, Rainbow, IPFS Desktop, IPFS Companion, Someguy, Service Worker Gateway, IPFS Check, libp2p, ipfs.io, dweb.link, check.ipfs.network, delegated-ipfs.dev, Wikipedia-on-IPFS.

It kinda feels like the AWS or Azure of file distribution, so much stuff so confusing. Also apparently with Protocol Labs owning several of those things despite not operating those things?

Ironically seems quite a fragile setup.

Regardless, very sad news.

    tar -c x | head -qc $((18*-512)) | gzip > x.tar.gz
    tar -c y | head -qc $((18*-512)) | gzip > y.tar.gz
    cat {x,y}.tar.gz | gzip -d | tar --list

seems easier to just not have the EOF marker, if you need to append stuff later