akersten

This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software.

Makes me want to have like 5 separate computers:

- one for banking only

- one for development only

- one for web browsing only

- one for gaming only

- one for socials only

How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?

Glad to now have some hard evidence I can reference whenever I bring up my strongly held intuitive opinion of "Microsoft repackaging someone else's browser and adding some extra stuff to it can only make Edge strictly worse"

> I can't use "else" as a conjunction in normal speech, only in computer programs.

sure you can. who's going to stop you?

> If you use our alpinelinux/gitlab container image, pull alpinelinux/gitlab:19.3.6 again. The image published on October 27 contains Ruby 3.3.13. Any 19.3.6 image you pulled before October 27, and all older tags, are vulnerable.

shouldn't they tag a new version instead of re-releasing a fixed 19.3.6, if earlier 19.3.6 are vulnerable?

Do you really think Apple would make a product advertising a touch screen where you aren't able to actually touch buttons on the screen?

The marketing material shows a person playing a virtual piano with their fingers..

I'm not sure what the point being made is. No one is forcing anyone to come up with anti-LLM scripts...?

Well, the very coarse filters that are tripping on this are before the model even loads the text into VRAM, so hopefully it is less sickening to you to know that it's very likely a "if str.contains(`suicide`) { refuseAndSuggestHotline(); }" is thinking about your message on the CPU instead of a chain of `fuzzyWeightAddMulX` commands on the GPU.

> we really need browser developers to shut this shit down. Why are you even able to silently run all of these commands on my computer

???

This is a very strange understanding of the purpose of a browser you've installed on your computer does. It requests resources from other places and displays & runs those resources on your computer. Where else would they run? Or are you saying you don't actually want your browser to do what you've instructed it to do ("navigate to example.com and run it").

Or you only want to run certain pieces of what's delivered? (You have the power, and should exercise it, to do so, with ad blockers, script blockers, etc.)

They don't, if GP's does the FCC would be very interested in knowing his location

probably un learn it, it's cap

Color me unconvinced that the dev team that sat on the 2024 security audit leading to today's CVE successfully explored the ramifications of a new memory bug in an hour

I read their quip about mitigation as more of a defeatist "this is fine" meme than actual advice that it's a nothingburger, but I'm pretty cynical on PHP as a whole. We'll have to wait and see if today's a hat trick day or just a double header.

People keep defending PHP (as they have been for ages) saying things like "oh, it could happen to any platform, this one's just so popular so the odds are higher" but then you take a peek at the diff for this fix and realize that nothing has changed since Fractal of Bad Design was published a decade ago. PHP is a scourge and unfortunately a still too popular one. The best time to realize the only safe option is to stop using it was in 2010, the 2nd best time is now ..

No way to prevent this, says only language where this regularly happens