asddubs

I got a lot of these as far as my logs go back (which is the 17th also). I don't really think it means anything, just scanning for other vulns, as happens all the time. My server did not get pwned.

There wasn't any info on the exploits beyond hearsay and the claim that they're very serious, so the risk assessment, sober or not, boils down to "do I trust the PHP people when they claim this is very serious"

I don't think this is right, I got requests like that from the 17th already (and that's just as far as my logs go back). And yes, with spoofed UAs to say grokbot, claudebot, etc., but I've been getting bot traffic like that for a while. I don't think these are really agents because the same ip will switch UAs between requests.

ease is somewhat relevant initially, since it determines how quickly you have to patch before exploits start popping up. I would be extremely curious to see if anyone has been pwned by this already, especially before the public release of the patches (not that I doubt it, but I heard some people saying they saw attempts in their logs, but not really enough information to tell whether they were understanding their logs correctly. The situation just seems a bit murky and unclear to me).

Do you have any links to a working PoC that appeared before the details were released? I'm seeing a lot of conflicting info, and I'm not really sure what to think. People saying they were seeing people trying to exploit this hours ahead of the patch release on their servers, yet no one who seemingly actually got pwned by it (were people just misreading their logs?)

doesn't fix the issue

I think the reason artists wouldn't like hobbyists doing it either is just that they've been soured on it by corporations. Artists didn't reject AI in its infancy, or things like deepdream. But AI as it stands very clearly is exploitative, and what's more, it's flooded spaces formerly for human art with low quality generic garbage. Having those experiences bleeds over into your feelings about things that don't match the exact definition of the reason you're upset to begin with.

well, lepton doesn't have browser support. I'm not married to jxl specifically, I just want something in the browser with those features, and jxl fills that niche

biggest advantage for me is file size and lossless conversion of existing jpg images. In a network scenario that can meaningfully impact load times. Others will care about e.g. bit depth

I run a non source code service and I also get these, also getting hit by literally millions of residential IPs being cycled after 1 - 2 hits. Ingesting thousands of copies of near identical pages. The bots seem to be programmed in an extremely simple manner, using non-obfuscated javascript to write the href attribute seems to stop them from seeing links, where previously they would endlessly crawl generated links. Unfortunately it also means noscript users get shafted.

and in latex too, not just monospace

I don't even really expect them to save to webp necessarily, but they should at least be able to open it. No matter what tool you use, opening an image you copied from the internet has got to be a common use case.

I guess even with the physical buttons you had to just learn that triangle means play and twin towers means pause

I've seen an SD card icon used for a save icon before. I think conveniently the shape is similar enough to a floppy that you find it while scanning for it as well

two thirds of graphics software doesn't even support webp yet. it doesn't look good