Jon_Lowtek

they just wrote a paragraph about evil being easy, convenient and providing value, how the evilness of others legitimizes their own, how the inability to achieve absolute moral purity means that one small evil deed is indistinguishable from being evil all the time, discredited trying to avoid evil as stupid, claimed that only those who have unachievable moral purity should be allowed to lecture about ethics in favor of good, and literally gave a shout out to hell. I don't think property damage is what we need to worry about. Walk away slowly and do not accept any deals or whatabouts.

Social Media companies have actively and intentionally tried to make their products more addicting... now they have to face the very obvious consequences of that decision.

on desktop i had to click on the small black area between two pictures before scrolling with left/right arrows became possible ... very bad UX

The citizens of the USA need to modernize their concept of privacy. Defining it over private/public spaces comes from a time when mass surveillance was technologically unfeasible. Technology has changed, and so must the definition of privacy.

thought experiment: >> if they do not want their conversations in their living room recorded, parsed by automated language models running in our datacenters, and added to their permanent record, they shouldn't have a window to a public space that vibrates. All we are doing is being in a public space, spending billions of VC money to point laser microphones at all homes 24/7 collecting data that anyone in this public space could have collected. You can not outlaw that without outlawing 5 year old Timmy riding his tricycle down the sidewalk, because we are using his right to see the light from his lamp being reflected by the houses, to justify why our creepy business model isn't a violation of millions of peoples privacy. You can't have a reasonable expectation of privacy that allows little Timmy to see, but forbids our corporation to spy on everyone, not in america. We also send electromagnetic waves out on one side off your house and collect them on the other, so we can see you move inside your house. It is basically like ham radio, anyone could do it, little Timmy sends electromagnetic waves through your house when he talks to his friend on a walkie talkie. You think Timmy shouldn't be allowed to have a walkie-talkie? We just send them through all the homes, all the time, everywhere. No we are not on your property all our devices are in public spaces <<

The idea that, if a single piece of information could be collected by a human in a public space, then mass scale collection of that and similar information at all times and in all public spaces, for any purpose by a fully automated behemoth is fine, is insane.

The USA needs to amend its constitution to define the right to privacy in a way that declares mass surveillance and systematic profiling using non-consensual data gathering at scale illegal for being the nefarious violation of basic human rights that it is, before they completely loose what little privacy they have left when they hole up in their homes.

So your think that AI systems that pose a significant risk to basic human rights at scale, should not be subject to oversight and regulation, because that would be anti-human?

According to the "Huawei cyber security evaluation centre" (HCSEC) oversight boards annual report to the national security adviser of the United Kingdom (note: HCSEC was a joint lab between NSCS, GCHQ and Huawei with a lot of access to internal documentation and firmware source code and so on to check if they are telling the truth when they promised there is no backdoor for the chinese ministry of national security in the 5G equipment) their quality and basic security processes are so bad, that it is believable that all the vulnerabilities are unintentional. However they did improve in the years prior to being kicked out, so you are not wrong that it was somewhat of a bandwagon move following the us sanctions.

this is not a new issue: airbus has been the victim of corporate espionage supposedly by boeing with aid by the nsa in a well documented case in november 2011, and they are not the only victim of US government agency supported corporate espionage: investigations into the selector lists that ran in the cabinet noir at DE-CIX have shown that a large part of them were targeting european corporations. and that predates the cloud act of 2018, which made american infrastructure significantly less trustworthy.

the 24% increase has nothing to do with car size over time in europa.

Table 2 in the paper lists which cars where compared, and that 24% numbers is an average from comparing models where manufacturers offer EV and ICE variants.

While that is the most common use case for CLAs, it is normally done by contributors granting a very permissive, but not exclusive, license to a legal entity like a company or foundation, in addition to the public license granted to everyone.

This is not that. This is not even a license. They want a full transfer of intellectual property ownership. Sure that enables them to use it in a commercial product, but it also enables them to sue if contributors contribute similarly to other projects. Obviously that would create a shit storm, and there is an exception with the public license, but riddle me this: can you legally make similar contributions to multiple projects that have this type of CLA?

Let us take a step back and instead look where such terms are more common: employment contracts.

has anyone tried the PoC for CVE-2025-12198 from that chinese site on a version more recent than rusty? It wants a signup with a mainland china phone number, and i only have a taiwanese fax machine.

The affected version 2.73rc6 is quite interesting, because it is from 2015, and it is not the version the relevant code was introduced in, that is even older (guessing 2.62). Why fuzz some random release candidate from ten years ago?

Even more interesting v2.77 from 2017 (commits 5614413 and 2282787 to be precise) changed the code and added an (++i == maxlen) check at the place that is being highlighted by CVE-2025-12198 as lacking an (i < maxlen) check. The commit message says it fixed a crash and thanks a friend for fuzzing the config file.

Now i am not well versed in heap smashing with C, so don't confuse my lack of skill with an expert opinion, but i have a hard time understanding how that check is circumvented in recent versions of the code. Any explanation would be welcome.

But more than that someone should verify if this PoC works in recent versions. As a prerequisite it should be shared internationally.