Goofy_Coyote

They’ve been bought by PE, so expect worse.

Same thing that’s happening with BitWarden.

I just moved my email domain off to PorkBun.

Move NOW before it becomes a problem. It WILL knock on your door too. Talking from experience, had my whole very small one-man business shutdown over night by Site5 (hosting) when I was a student, sent me into debt trying to keep my customers, and I had to shut it down.

Move off of the companies that obviously don’t care to the ones that might care a little bit (no guarantees this doesn’t happen to porkbun either though).

For math illiterate people like me, my understanding is that FLT was already proven, but the proof was beyond complex, certainly for mere mortals like me, and now Claude has codified it, correct?

I use Obsidian as my personal CRM, and I get this a lot.

It feels like people put more value on memorizing facts than writing them down, as if it’s somehow more noble to remember something about someone, but if you write it down to not forget it, it’s suddenly not as valuable a gesture.

I never understood that.

I had a problem (bad memory), I cared enough to find, and create a solution, and consistently use and maintain it, it’s way more work that I’m putting in to make sure I remember things about the people I care about vs just having it memorized better than another person by the virtue of my genetics.

This is not a criticism or a shot at smugglerFlynn here though, they already said they’re not the target audience. It’s just my personal experience and this looked like a good starting thread to post it under.

What a great write up. One of the few long form contents that I just opened and read from top to bottom without planning for it or keeping the tab open to read later. Great job.

I’ve been battling the same problem, and I solved it by keeping the state in my brain, long focus hours, and breaking down the problem to smaller chunks that agents could almost one-shot. That made me the bottleneck, and although I can do it for codebases I’m familiar with, working on totally new projects has been very painful.

I’m going to test it in my own vuln research workflow.

Yeah, I agreed, though I’m secretly hoping maybe Davinci enters this market too

Capture One.

Also, Davinci Resolve has added photo editing functionality since 2 V21 iirc, but it’s not a drop-in replacement. It’s Davinci Resolve though, so expect to be blown away.

No auth? I like to live dangerously too lol.

Jokes aside, the probability of it being exploited is low though.

Also, this assumes pc1 has a publicly, where as with Croc and MW, you can transfer files between two PCs on both behind different NATs.

Asks for feedback, gets feedback, complains.

It started with agreeable cases, then ended up on a holier than thou attitude.

Security Eng here. The whole thing is an absolute mess. I’ve been (and still am) on both sides of the fence.

I currently have two reports (one RCE on a famous OSS ML platform, one cluster take over on a k8s related projects), both are more than 2 months old without as much as an “F you, get lost”. Just got ignored and ghosted, which hurts a lot, because I spent a lot of time finding, and verifying these (all reports with poc and patch). BUT I understand why it’s happening, because I’m also on the receiving end.

security@ and VDPs have always received BS reports and beg-bounties, but boy oh boy, these days we have two people spending 3-4 days a week sifting through this constant flood of garbage compared to 2-3 tears ago where 1 person could triage the inbox and VDP in a day’s work max, which would’ve been considered very busy. Unfortunately we can’t just shutdown the programs or the mailbox because 1. We do occasionally get important and great stuff that actually matters, and 2. We’re a critical infra company and can’t ignore anything really.

The signal to noise ratio is almost zero, but the “what if” is keeping us swimming through this unending river of garbage and burning us out.

Overall, chaotic mess on both sides.

Ending on a doom-and-gloom note: there will be a reckoning.

(Don’t take the note too seriously though, I’m a SecEng, so I have a built-in doom multiplier lol)

It even refuses to read my resume, so... yeah

So it's essentially saying we can train models that put your jobs at risk (not saying it's correct or not), but you're not allowed to threaten our perceived moat?

These two sentences hit home:

> The flow of data was so hard to follow, it seemed like someone was trying to cover up a murder.

> Just getting the code to run on your laptop took a week.

I always thought I’m the only one having problem understanding the data flow, or setting up a proper dev environment. Impostor syndrome (and sometimes toxic environments that pushed for “velocity”) didn’t help either.

Felt good to know I’m not the one.

These Ais don't even need to arrive. They just are there. Always. Everywhere.

Seconding this.

I've seen it make the codebase vulnerable by changing the source, then claiming it found a vuln, or finding a well-defended and secure exec function, write a unit test that shows what exec does (which is running commands), then claiming a critical finding.