hashstring

wtf /ban

Hows your workout going?

No, I clearly see the difference.

Yes, saying there’s a big bug increases exposure, but also makes people prepared to patch. So it’s a trade-off.

No, when there’s no info provided regarding what the bug is, then it doesn’t make finding the bug more likely for any independent researcher.

Yes, increased exposure does increase the overall likelihood. Duh.

However, all this was not the case, the point here is: someone broke the embargo, and that messed the disclosure up, and that caused this mess.

Go find another straw man to practice mental gymnastics on. I’m not your guy.

I guess that according to you, in today’s age, just the rumours of a passenger being able to do a 3G pull up in a 737 should be enough for people to do it. No?

Let me tell you this: - I never said VR & ED was impossible. I never said that a passenger flying a 747 was impossible either. - I said, a rumour of something so generic as “a bug exists somewhere”, does absolutely nothing for the ability to pull something off. Not before, and not now.

However, that is exactly what you wrote. Then, in your previous comment, you are changing what you said and now you’re fighting a straw man.

Goodbye dude, I’m not spending more cycles on this. Go find some bugs lol.

Except you didn’t say that. You said:

> “[…] even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently.”

I never said it’s impossible for LLMs to assist or drive VR and exploit development. It’s just utter nonsense that “knowing that a bug exists” does anything meaningful for finding it independently, unless that bug contains signal.

Which it only does if an embargo is broken, which was the case here.

Haha, and he’s not the one that found it.

> Exercise for the reader. Well, if you are so confident, go do it. Share your results. I bet you won’t find a thing.

That’s also a take based on nothing.

I can say with high confidence that Nginx, Apache and IIS have a critical security vulnerability hidden somewhere in their codebase right now.

Please provide the prompt that uncovers it. Apparently knowing about the existence of bugs is enough nowadays right?

I’ll wait.

This is BS, lol, “embargoes are stupid in 2026”, no they are not, they are more needed than ever and should be respected.

Chainguard was definitely not in the right here.

Finance follows money.

Turns out that money never was a good proxy for the public good, or even the ‘good’ of paying users. The goal has never been maximizing UX, the goal always was squeezing profits.

End-users not voting with their feet is misrepresenting the issue, it’s a symptom of end-users being actively lied to during campaigns (I think the euphemism for that is “lobby groups”).

Why? Because politicians care about being re-elected and their approval rates, and finance has proved to be an unnaturally large factor in that equation.

> The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. OpenAI independently reported the same root cause on the same day

How does this work? Calif works with OAI on Patch the Planet program. Calif reports the finding to PHP. OAI ‘independently’ reports it too, on the same day. I suppose Calif did communicate with OAI about said findings, or is this not how Patch the Planet operates? It seems extremely coincidental.

Well, I believe the answer is in POSSE. Publish (on your) own site, syndicate elsewhere.

Reach the people, but make clear that there is an authoritative source that is ~not~ less rented.

You definitely can, and should.

Letting bigots and racists continue to express these views is extremely problematic.

Tesla death throes, looks cool but they’re done.

yolo in dev can still lead to high bills